US senators sharply questioned regulatory officials on Wednesday about the Federal Aviation Administration's reliance on Boeing Co's engineers to certify the safety of the company's new 737 Max 8 aircraft, which was involved in two fatal crashes in the past five months.

A self-certification procedure called Organization Designation Authorization came under scrutiny at a hearing of the Senate Commerce Committee's aviation subcommittee in Washington. Testifying were Daniel Elwell, acting FAA administrator; Robert Sumwalt, chairman of the National Transportation Safety Board; and Calvin Scovel III, Transportation Department inspector general.

For decades, the FAA has delegated some authority for certifying new aircraft to the manufacturers, reducing government costs.

After the crashes of Lion Air in Indonesia in October and Ethiopian Airlines this month, which killed a total of 346 passengers and crew members, critics have cited the self-certification process as evidence of an overly cozy relationship between the FAA and the industry.

Elwell defended the agency's reliance on experts from manufacturers and said the current system had produced an unprecedented safety record in the US. He said the FAA was "fully involved" in the certification of the Boeing 737 Max 8, including "133 of the 297 flight tests".

Senator Richard Blumenthal questioned the FAA's oversight of the Boeing 737 Max jet, arguing that reliance on the manufacturer put "the fox in charge of the henhouse".

Blumenthal said Boeing rushed to get the 737 Max in the air to compete with Europe's Airbus and disregarded critical safety features.

"There needs to be rigorous reform so the FAA is put back in charge of safety," he said. "The fact is that the FAA decided to do safety on the cheap, which is neither safe nor cheap," he said.

Senator Jerry Moran asked what it would take for the FAA on its own to certify aircraft. Elwell said: "Ten thousand additional FAA employees and $1.8 billion" per year.

He said the European equivalent of the US agency delegates more authority to a manufacturer's employees when certifying the safety of Airbus.

Elwell said the FAA conducts strict oversight of all manufacturers.

Senator Ed Markey demanded a "yes" or "no" answer from Elwell on whether two safety options that airlines could decline to buy should have been mandatory on the Max aircraft. Elwell declined to answer with a single word.

Some airlines chose to purchase the "angle of attack" system display for readings of two sensors and a "disagree light" to be activated if the sensors produce conflicting readings while others did not. Ethiopian Airlines and Lion Air reportedly declined to buy the two add-on safety devices.

Scovel, inspector general of the Transportation Department, said his office plans to revise its oversight of aircraft development by July.

"Over the years, FAA has increasingly shifted toward working with industry to meet shared safety goals," he said. "FAA now delegates more of its aircraft certification to approved manufacturers through its congressionally authorized Organization Designation Authorization program or ODA. However, my office has identified weaknesses with FAA oversight of ODA."

Senators questioned the safety of Boeing's anti-stall system, called the Maneuvering Characteristics Augmentation System.

The system was installed because Max jets have bigger engines mounted closer to the nose of the plane than older Boeing 737s, changing the plane's aerodynamics.

If the nose rises, threatening a stall, the MACS system automatically points the nose of the plane down to gain speed. The system can be shut off by flipping a switch on the throttle console between the pilot and co-pilot.

The "angle of attack" sensor built into the Max aircraft measures the amount of lift generated by the wings. The device warns pilots when there is too little lift, potentially stalling the plane.

Information contained on flight recorders for the Indonesia and Ethiopian planes has not been released, but analysts say the pilots may not have known how to turn off the anti-stall device after it pointed the nose of the plane down, and that may have been a factor in the crashes.

On Wednesday, Mike Sinnett, Boeing's vice-president, said he doesn't see the need to overhaul its development of aircraft. He called the new Max software "more robust" but also said the upgrade does not mean the original design was inadequate.

The upgraded MCAS will be activated by input from two sensors rather than one.

The system's power will be limited so that the pilot can pull back on the control column to override the system if the plane's nose is pointed down.

Sinnett said a new training system for pilots on upgrades to the MCAS has been "provisionally approved".