US senators sharply questioned regulatory officials Wednesday about the Federal Aviation Administration's reliance on Boeing's engineers to certify the safety of the new 737 MAX 8 aircraft, which was involved in two fatal crashes in the last five months.

The self-certification procedure, called Organization Designation Authorization, was scrutinized in Washington at a hearing of the Senate Commerce Committee's subcommittee on aviation and space. It featured testimony by Daniel Elwell, the acting FAA administrator; Robert Sumwalt, chairman of the National Transportation Safety Board; and Calvin Scovel, Transportation Department inspector general.

For decades, the FAA has delegated some authority for certifying new aircraft to the manufacturers themselves, reducing government costs and, defenders say, speeding the rollout of new models.

Following the crashes of Lion Air in Indonesia last October and Ethiopian Airlines earlier this month that killed a total of 346 passengers and crew, the self-certification process has been seized by critics as evidence of an overly cozy relationship between the FAA and the industry.

In his opening statement, Elwell said the FAA was "fully involved" in the certification of the Boeing 737 MAX 8, including "133 of the 297 flight tests".

Elwell defended the agency's reliance on experts from aircraft manufacturers and said the current system had produced an unprecedented safety record in the US.

Senator Richard Blumenthal questioned the FAA's oversight of the Boeing 737 MAX jet, arguing that reliance on the aircraft manufacturer during certification of the aircraft's safety put "the fox in charge of the henhouse".

Blumenthal said Boeing rushed to get the 737 MAX into the air to compete with Europe's Airbus and disregarded critical safety features.

"There needs to be rigorous reform so the FAA is put back in charge of safety," the Connecticut Democrat said. "The fact is that the FAA decided to do safety on the cheap, which is neither safe nor cheap," he said.

Blumenthal vowed to introduce legislation to change the way aircraft are certified safe to fly.

Senator Jerry Moran, a Kansas Republican, asked what it would take for the FAA on its own to certify aircraft.

Elwelll said: "10,000 additional FAA employees and $1.8 billion' each year.

He said the European equivalent of the federal regulatory agency delegates more authority to a manufacturer's employees when certifying the safety of Airbus. Elwell said the FAA conducts strict oversight of manufacturers. "It's part of the fabric of what we've used to become as safe as we are today," he said.

Senator Ed Markey, a Democrat from Massachusetts, demanded a "yes" or "no" answer from Elwell on whether two safety options that airlines could decline to buy should have been mandatory on the MAX aircrft.

Elwell declined to answer the question with a single word and reiterated what he had said several times during the hearing: "Safety is central to the agency's existence."

Airlines configure aircraft to meet their operational needs and budgets. Some airlines chose to purchase the "angle of attack" system display for readings of two sensors and a "disagree light" to be activated if the sensors produce conflicting readings while others did not. The add-on safety devices are a minor cost in an aircraft that sells for $120 million.

Ethiopian Airlines and Lion Air reportedly declined to buy the two add-on safety devices.

Calvin Scovel III, inspector general of the Transportation Department, said his office plans to revise its oversight of aircraft development by July. But he did not say federal regulators plan to abandon the collaborative approach with manufacturers.

"While revamping FAA's oversight process will be an important step, continued management attention will be key to ensure the agency identifies and monitors the highest-risk areas of aircraft certification," Scovel told the committee.

"Over the years, FAA has increasingly shifted toward working with industry to meet shared safety goals,' he said. "For example, FAA now delegates more of its aircraft certification to approved manufacturers through its congressionally authorized Organization Designation Authorization program or ODA. However, my office has identified weaknesses with FAA oversight of ODA. For example, in 2015, we reported that its oversight was not based on risk.'

Senators questioned the safety of Boeing's anti-stall system, called the Maneuvering Characteristics Augmentation System (MACS). The system was installed because MAX jets have bigger engines mounted closer to the nose of the plane than older Boeing 737s, changing the plane's aerodynamics.

If the nose of the plane rises, threatening a stall, the MACS system automatically points the nose of the plane down to gain speed. The system can be shut off by flipping a switch on the throttle console.

The system may have played a part in the crash of the Lion Air crash and the March 10 crash of the Ethiopian Airlines plane.

The "angle of attack" sensor built into the MAX aircraft measures the amount of lift generated by the wings. The device warns pilots when there is too little lift, potentially stalling the plane, then points the nose of the plane down to gain speed.

Information contained on flight recorders for the Indonesia and Ethiopian planes has not been released, but analysts say the pilots may not have known how to turn off the anti-stall device after it pointed the nose of the plane down, and that may have been a factor in the crashes.

On Wednesday, Secretary of Transportation Elaine Chao testified before the Senate Appropriations subcommittee on her department's 2020 fiscal year budget. When asked by Senator Susan Collins, a Republican from Maine, about the relationship between the FAA and Boeing on safety certification, Chao said that while the relationship is necessary, she was "concerned about any allegations of coziness".

"The FAA is the one that certifies," Chao said. "The FAA does not build planes. They certify. But this method of having the manufacturer also be involved in looking at these standards is really necessary because once again the FAA cannot do it on their own."

At a news conference Wednesday at a Boeing plant in Renton, Washington, Mike Sinnett, the company's vice-president, said he doesn't see the need to overhaul its development of aircraft following the two crashes.

He described changes to the MAX jets' flight-control system and called the new software "more robust" than the initial version. However, he said the upgrade does not mean the original design was inadequate.

The upgraded MCAS will be activated by input from two sensors rather than one. The power of the system will be limited so the pilot can pull back on the control column to override the automated system if the plane's nose is pointed down.

Sinnett said a new training system for pilots on upgrades to the MCAS has been "provisionally approved" and will provide about 30 minutes of computer-based training.