Boeing Faces Capitol’s Glare as It Presses to Fix the 737 Max

RENTON, Wash. — Boeing on Wednesday made its most overt acknowledgment that new software in its jets could have played a role in two deadly crashes as it tries to convince pilots, airlines and regulators around the world that a coming fix will solve the problem.

Before a meeting with more than 200 pilots and airline executives at its factory in Renton, Wash., Boeing, for the first time, publicly laid out its proposed updates to the software as well other changes to the 737 Max that it hopes will get the plane flying again. The changes would give pilots more control over the system and make it less likely to be set off by faulty data, two issues at the center of the investigations into the crashes.

“The rigor and thoroughness of the design and testing that went into the Max gives us complete confidence that the changes we’re making will address any of these accidents,” Mike Sinnett, Boeing’s vice president for product strategy, said in a press briefing.

The company, which was eager to complete the plane quickly for competitive reasons, also faced new scrutiny in Washington on Wednesday over the development and certification of the jet, a process that regulators heavily delegated to Boeing. Senators, in two congressional hearings with Boeing’s regulators, pressed for more oversight and raised the possibility of overhauling the system.

The acting head of the Federal Aviation Administration, in a hearing of the Senate Commerce Committee’s aviation subcommittee, said that the agency initially scrutinized the new software independently, but ultimately left it to Boeing. The official, Daniel Elwell, also said he did not believe the automated system had been tested with a scenario involving a faulty sensor, which was a concern in a Lion Air crash in Indonesia in October.

“The F.A.A. decided to do safety on the cheap, which is neither cheap nor safe,” said Senator Richard Blumenthal, Democrat of Connecticut. He added that he planned to introduce legislation to reform the system, which he said “is so fatally riddled with flaws.”

The F.A.A. “put the fox in charge of the henhouse,” he said.

Boeing and the F.A.A. are playing defense on two fronts, as prosecutors, regulators and lawmakers investigate their responses to the crashes and their approval of the plane.

During his hearing, Calvin L. Scovel III, the Transportation Department’s inspector general, said he was looking into how the F.A.A. handled the crisis. In the days after an Ethiopian Airlines crash that killed 157 people this month, global regulators grounded the jets, while the United States initially held off doing the same.

“Clearly, confidence in F.A.A. as the gold standard for aviation safety has been shaken,” he said. Mr. Scovel said he wanted to understand why the agency was the last major aviation regulator in the world to “drive risk to zero” by grounding the 737 Max.

Mr. Scovel also said he would investigate why the F.A.A. approved the software system, which is known as MCAS, including the decision not to include it in the operating instructions and not to require additional training for pilots. When the plane was introduced, pilots learned about the 737 Max on an iPad.

Robert L. Sumwalt, the chairman of the National Transportation Safety Board, also said in the hearing that his agency was “examining the U.S. design certification process.”

The F.A.A. has long allowed plane makers to help certify that their new aircraft meet safety standards. In recent years, Boeing was able to choose its own employees to help regulators approve the 737 Max.

In a separate hearing with the Senate Appropriations Committee’s transportation subcommittee, the Transportation secretary, Elaine Chao, called the practice “necessary.”

Ms. Chao stressed that the F.A.A. sets safety standards that manufacturers must meet while developing aircraft. The certification process, she said, “is, of course, subject to oversight and supervision by the F.A.A.”

When asked by the subcommittee’s chairwoman, Senator Susan Collins, Republican of Maine, about concerns that the arrangement “sacrifices potentially the safety of the traveling public,” Ms. Chao said that the possibility was “troubling.”

Mr. Elwell, during his hearing, said that the F.A.A. initially oversaw certification for the software, but delegated more authority over time, “when we had the comfort level” that the Boeing employees were knowledgeable enough about the system.

Mr. Elwell later said that practice was “part of the fabric of what we’ve used to become as safe as we are today” and that without it, the F.A.A. would need 10,000 more employees and $1.8 billion for its certification offices.

Boeing has defended the process, saying the plane adhered to all F.A.A. safety rules.

A Boeing official cautioned against drawing any definite conclusions until more is known. “In general, the process has worked and continues to work, and we see no reason to overhaul the process,” this official said, speaking on the condition of anonymity because of the investigations.

The Boeing official said that in most accidents, many things go wrong. Based on what is known about the crashes in Indonesia and Ethiopia, Boeing said it felt that MCAS was in need of updating.

“We’ve seen two accidents now and we believe it is appropriate to make that link in the chain more robust,” the official said.

The updated software, which Boeing outlined on Wednesday, will rely on data from two so-called angle of attack sensors, so the plane won’t have a single point of failure. It will also make it easier for pilots to override the system, which was originally designed to push down the nose of the plane repeatedly and aggressively.

The company said the new software had been extensively tested and officials from the F.A.A. had taken test flights on updated jets. Pilots from United States airlines have also tried out the updated system in flight simulators.

Dennis A. Muilenburg, Boeing’s chief executive, has avoided the spotlight in recent weeks and was not in Renton on Wednesday for the news briefing or the meeting with pilots and executives.

Boeing also said it would retrofit jets with a safety feature that was previously optional. The feature — known as a disagree light, which is activated if two key sensors on the plane do not produce the same readings — will be standard on new Max planes. The disagree light might have helped the pilots in the Lion Air crash identify the source of the problem.

During a testy exchange, Senator Edward J. Markey, Democrat of Massachusetts, repeatedly pressed the F.A.A. official, Mr. Elwell, on whether all available safety features should be required on planes. Mr. Elwell responded that “safety-critical pieces of equipment on an aircraft are mandatory.” He added, “If there is any manufacturer that sells a safety-critical part a la carte, we will not permit it.”

But Mr. Elwell added that he found it “hard to believe that a safety company like an airline would save a couple thousand dollars on an option that might improve safety.”

Although the fix is apparently ready, Boeing provided no timetable for installing it. The F.A.A. must first approve the new software and the training. Then, Boeing said, each existing 737 Max will need to be manually upgraded, a procedure that takes an hour for each plane. Finally, Max pilots will need to receive an additional 30-minute training program about the software.

Even if the F.A.A. does approve the changes, regulators in Europe, Canada, China, Brazil and elsewhere might move more slowly. “Certification around the world will be at the discretion of those regulators around the world, and so we can’t comment on timing,” Mr. Sinnett said.