AD/B747/391 - Refuel Valve Control Unit

An Airworthiness Directive (AD) is a mandatory regulatory instrument issued under the Civil Aviation Safety Regulations 1998 (CASR) or its predecessor regulations. It addresses an unsafe condition that exists or is likely to exist in civil aeronautical products. AD/B747/391 is product-specific, applying to particular Boeing 747 model series by type certificate. The core engineering concept is the “refuel valve control unit” for reserve fuel tanks. This unit controls the opening and closing of valves used during refuelling of the reserve tanks. The modification required by the Boeing Alert Service Bulletin alters the electrical design to prevent lightning-induced surges from reaching the tank interior. The second key concept is the “approved maintenance program” (AMP), which every operator of a large aircraft must maintain under CASR Part 42 or equivalent. The AD requires insertion of Airworthiness Limitations (AWLs) into the AMP. AWLs are mandatory life limits or inspection tasks that if not performed would render the aircraft unairworthy. The specific AWLs referenced (28-AWL-20 and 28-AWL-25) relate to fuel system lightning protection. Another important concept is “critical design configuration control limitation” (CDCCL). A CDCCL is a design feature that is critical to preventing an unsafe condition; AD/B747/391 prohibits operators from using any CDCCL that differs from the approved baseline unless the alternative is itself approved as an AMOC. This constrains an operator’s ability to substitute parts or implement design changes without specific regulatory blessing. The AD also introduces “terminating action” as a compliance mechanism. If a later AD covers the same maintenance program revision, compliance with the later AD’s equivalent requirement serves as full compliance here, avoiding double counting. The AD relies heavily on manufacturer service information (the Boeing Alert Service Bulletin) and Boeing maintenance planning documents (D6-13747-CMR and D621U400-9). This means the actual technical detail is not in the AD itself but incorporated by reference. Operators must physically possess and follow the Boeing documents. The AD also incorporates by reference the FAA AD for equivalent safety standards, though it is the CASA AD that is directly enforceable in Australia. The concept of an AMOC allows an operator to deviate from the prescribed compliance method if an alternative provides an equivalent level of safety, but the AMOC must be approved by CASA. The compliance date of 17 October 2013 gave operators approximately four and a half years from the AD’s effective date to accomplish the modification, a period that reflected the need for parts availability, engineering lead time, and heavy maintenance scheduling. This is a common feature of product ADs: they set a long-term compliance window to minimise economic disruption while ensuring safety. The AD applies to Australian-registered aircraft wherever they operate, so an operator flying a 747 internationally must still comply with this specific Australian instrument even if the aircraft is also subject to an overlapping FAA AD.

The primary subjects are Australian aircraft operators holding an Air Operator Certificate (AOC) that operate any of the Boeing 747 model series listed in the applicability section: 747-100, 747-100B, 747-100B SUD, 747-200B, 747-200C, 747-200F, 747-300, 747-400, 747-400D, 747-400F, 747SR, and 747SP. In practice, by the time this AD became effective in 2009, the number of Australian operators of older 747 variants was small. Qantas operated the 747-400 and earlier models; other operators included freight carriers and possibly charter operators. The compliance burden falls most heavily on operators that still held 747-100/200/300 series aircraft, which are older, more likely to be in secondary or freighter service, and possibly with less sophisticated maintenance planning departments. For those operators, sourcing modification kits and obtaining the particular revision of the Boeing AWL document (D6-13747-CMR, Revision January 2007) may have required effort, especially if the operator did not have a direct relationship with Boeing. The AD also affects maintenance organisations performing the modification, as they must have the service bulletin and trained personnel. Engineers certifying the work need to ensure the modification is recorded in the aircraft logbook and the AMP is updated. The AD also touches regulatory compliance staff: the operator must submit evidence of compliance to CASA, likely through the continuing airworthiness management organisation (CAMO). Aircraft lessors and financiers should be aware of such ADs because non-compliance can ground the aircraft and affect its value. The AD indirectly affects parts suppliers and Boeing itself, which provides the modification kit. The compliance cost is not quantified in the AD, but typical costs for a modification of this nature (avionics change, wiring, valve control unit) might range from $5,000 to $30,000 per aircraft plus labour and downtime. The maintenance program revision itself entails a paperwork exercise but no direct hardware cost, though the AWL tasks (once inserted) may add inspection or maintenance burdens going forward. The AD also has implications for operators who lease aircraft from foreign lessors: they must ensure the modification is performed and maintained in compliance with Australian law, which may differ from the lessor’s home jurisdiction. The AD applies to all Australian-registered aircraft even if they are predominantly overseas. If an operator uses a 747 under a foreign registration but operates into Australia, this AD does not directly apply; the foreign states’ equivalent AD would apply (typically the FAA AD). However, if the aircraft is leased to an Australian operator and registered in Australia, the CASA AD applies. The AD also creates secondary effects for the Civil Aviation Safety Authority itself, which must process any AMOC applications that operators submit if they wish to use later revisions of the Boeing MPD or alternative CDCCLs. That imposes administrative costs on the regulator. Finally, the AD affects passengers and cargo handlers indirectly through the safety outcome; there is no direct burden on them.

The central duty imposed on operators is to complete the refuel valve control unit modification before 17 October 2013. The modification must be performed exactly as described in the Accomplishment Instructions of Boeing Alert Service Bulletin 747-28A2291 Revision 1. This is a prescriptive obligation; there is no room for local engineering judgement unless an AMOC is approved. The operator must also revise its approved maintenance program concurrently with the modification. That revision is not a standalone task; it must happen at the same time as the physical work. This prevents operators from delaying the maintenance program update. The third duty is negative: after the maintenance program revision is done, the operator must not use any CDCCL other than the one approved in the AD, unless it has been approved as an AMOC separately. This restricts the operator’s freedom to substitute design features that could affect fuel tank lightning protection. The operator also has a duty to ensure that any alternative method of compliance is formally approved before use; an unapproved alternative is a breach. The AD creates a right to apply for an AMOC. The instrument does not set out the procedure, but standard practice under CASR Part 21 or Part 39 allows an operator to submit a request to CASA with supporting data. The AMOC can cover either the modification method or the use of a later revision of the MPD. Specifically, the AD states that accomplishing the maintenance program revision in accordance with a later revision of the MPD is an acceptable method of compliance if that later revision is approved by the Manager of the Seattle ACO of the FAA. This gives operators a conditional right to use updated Boeing data without applying for a separate AMOC, provided the FAA has already blessed it. This reduces the compliance burden by aligning with the FAA’s approval stream. The AD also provides a terminating action right: if the operator has already complied with AD/B747/379 (for older models) or AD/B747/378 (for 747-400 series), the maintenance program revision requirement of this AD is automatically satisfied. This prevents double compliance and is a pragmatic efficiency. The operator also has the right to use an alternative method of compliance with the modification requirement, but only if that alternative is approved as an AMOC. The AD says no alternative CDCCLs may be used unless approved as an AMOC; this is phrased as a prohibition but implies a right to seek approval. Implicitly, the operator has a right to seek an extension of time, though the AD does not mention one. Under CASR, CASA may extend compliance dates on a case-by-case basis. The operator also has a duty to maintain records of compliance (the AD does not spell this out, but the general regulatory framework requires it). Finally, the operator has a duty to remain aware of any superseding ADs that might trigger the terminating action provisions. If a later AD (e.g., AD/B747/379) comes into effect, the operator must ensure they comply with it in a timely manner to gain the terminating benefit; otherwise they may end up complying with both. The rights afforded are procedural, not substantive: they allow flexibility but only within the boundaries of safety equivalence approved by the regulator. The AD does not grant the operator any right to challenge the technical basis; that would be a matter of judicial review under the ADJR Act, but the AD itself is silent on dispute rights.

The AD itself does not set out penalties, but non-compliance with an Airworthiness Directive is a breach of the Civil Aviation Act 1988 and the Civil Aviation Safety Regulations 1998. Under CASR Part 39 (Airworthiness Directives), it is an offence to operate an aircraft that does not comply with an applicable AD unless an exemption or AMOC is in force. Alternatively, the aircraft is not airworthy, and operation is prohibited. The applicable penalty provisions are found in the Act: section 20A makes it an offence to operate an aircraft in a manner that contravenes a prescribed condition of an airworthiness certificate or a direction under the regulations. Practically, CASA can issue a direction grounding the aircraft until compliance is achieved. For an individual, the maximum penalty is likely 50 penalty units (currently $13,750) or imprisonment for up to two years, or both, depending on the specific provision. For a body corporate, the penalty may be up to five times that amount ($68,750) under section 4AB of the Crimes Act 1914 applied by the civil aviation legislation. Courts also have power to order remediation. Enforcement priority for CASA is usually compliance through cooperative means: CASA will first contact the operator, request evidence, and if non-compliance persists, issue a Direction to Ground or a show cause notice. Only repeated or wilful non-compliance would lead to prosecution. In addition to criminal penalties, civil liability also attaches: an operator who operates an aircraft not in compliance with an AD may be liable for damages if an accident occurs and that non-compliance is a contributing factor. That could result in tort claims from passengers, cargo owners, or third parties. The AD is specifically enforceable against the aircraft registration holder; if the aircraft is leased, the operator is typically the lessee, but the registered owner may also be held accountable under the regulations. The enforcement mechanism is backed by CASA’s power to suspend or cancel the airworthiness certificate of the aircraft, the approval of the maintenance program, or the operator’s AOC. This is a powerful lever because it affects the operator’s entire fleet. The AD’s compliance date of 17 October 2013 has now passed, so any aircraft that still has not complied is in breach. However, an operator could potentially apply for a late AMOC or an exemption if the aircraft is otherwise safe, but the default position is non-compliance. CASA may also issue a new AD extending the date or imposing additional requirements. The AD does not create a private right of action for individuals; enforcement is exclusively through CASA and the courts. Nonetheless, an employee whistleblower or a competitor could report suspected non-compliance to CASA. The AD’s cross-reference to the FAA AD means that non-compliance could also have implications under bilateral airworthiness agreements: Australia and the US have a Bilateral Aviation Safety Agreement (BASA), so CASA and the FAA share information. An operator found non-compliant in Australia could also face FAA enforcement if operating into the US. The practical cost of non-compliance includes not just legal penalties but also loss of reputation and potential insurance complications (an insurer may deny coverage or increase premiums if the operator is non-compliant with ADs).

AD/B747/391 sits within a hierarchy of regulatory instruments. The enabling legislation is the Civil Aviation Act 1988, under which the Civil Aviation Safety Regulations 1998 (CASR) are made. Specifically, CASR Part 39 governs airworthiness directives, setting out the procedure for issuance, applicability, and compliance. The AD itself does not cite the specific regulation, but it is issued by a delegate of CASA under that part. The AD also interacts with CASR Part 42, which deals with continuing airworthiness management. Under Part 42, operators must have an approved maintenance program. This AD mandates a change to that program, so it directly amends the operator’s Part 42 obligations. The AD’s requirement to incorporate an AWL means that AWL task becomes a mandatory inspection or life limit under the maintenance program, and failure to perform it is a violation of Part 42. The AD also references FAA AD 2008-18-09. While the FAA AD is not directly enforceable in Australia, the text of the AD makes clear that compliance with the FAA AD does not necessarily satisfy CASA’s AD unless the specific Australian requirements are met. However, the terminating action provisions of AD/B747/391 refer to other CASA ADs (B747/379 and /378). This means the AD is part of a series of related directives; operators must track the entire AD numbering sequence. The AD also interacts with the Bilaterial Aviation Safety Agreement (BASA) between Australia and the United States. Under the BASA, CASA may accept FAA approvals, such as acceptance of later revisions of the MPD if approved by the Seattle ACO. So the AD incorporates FAA administrative decisions as valid alternatives, but only for that specific aspect. The AD’s prohibition on using alternative CDCCLs unless approved as an AMOC interacts with CASR Part 21, which governs design changes and supplemental type certificates. If an operator wants to install a different refuel valve control unit or a different wiring configuration, that would be a design change requiring a supplemental type certificate (STC) or repair design approval. The AD does not directly prohibit STCs, but any design change that alters a CDCCL must also be approved as an AMOC. So the AD adds an extra layer of approval for changes that might already be covered by a Part 21 design approval. The AD also interacts with the aircraft’s type certificate basis. As a mandatory directive, it becomes an additional requirement for continued airworthiness. The AD may also affect the aircraft’s noise or emissions certification, but that is unlikely for this modification. The AD does not directly interact with state or territory laws, except possibly through workplace health and safety laws for maintenance personnel; however, the AD does not create workplace duties beyond the existing ones. Insurance law is indirectly affected: an operator’s insurance policy typically requires compliance with all airworthiness directives; non-compliance may void coverage. The AD also has cross-border implications: if an Australian-registered aircraft is operated outside Australia, the AD still applies. The operator must ensure that any maintenance performed overseas complies with this AD, or that an AMOC is in place. If the maintenance is performed by an FAA-approved repair station, the FAA AD requirements (which are equivalent) likely satisfy the CASA AD, but the operator should confirm. Finally, the AD interacts with CASA’s Enforcement Manual: CASA’s enforcement policy regarding AD compliance is part of the administrative law framework. While the AD is a legislative instrument under the Legislation Act 2003, it is not subject to disallowance, but it is registered on the Federal Register of Legislation.

The source text provides no explicit amendment history for AD/B747/391. The instrument is dated 26 March 2009 and became effective on 7 May 2009. It bears the AD number AD/B747/391 and the unique CASA reference 5/2009. The source does not indicate whether this AD was subsequently amended, replaced, or superseded. However, the AD itself contains references to other ADs (B747/379 and /378) which suggests it is part of an ongoing series. Whether those later ADs have amended or superseded the requirements of AD/B747/391 cannot be determined from the source alone. In typical CASA practice, if an AD is superseded, a new AD number is issued and the original is cancelled. The AD is a single-issue directive; it does not appear to be a revision of an earlier directive. The Boeing Alert Service Bulletin it references is Revision 1, implying there was an original issue, but the AD specifically requires Revision 1. It is possible that a later revision of the service bulletin occurred, but the AD would still require the version referred to unless a later revision is accepted under the AMOC provision or by a new AD. The MPD revision referenced (Revision 24, June 2006) is specifically stated; the AD allows use of a later revision if approved by the Seattle ACO. That suggests that the AD builder was aware that the MPD would be revised over time and built in flexibility. The AD’s terminating action provisions referencing AD/B747/379 and /378 imply that those ADs were issued after or concurrently with AD/B747/391. They may have expanded or refined the requirements. Without the full text of those ADs, one cannot determine if AD/B747/391 remains current. To ascertain the current status, an operator would need to check the CASA website or its Airworthiness Directive database. The AD does not contain a sunset clause. Under the Legislation Act 2003, legislative instruments are automatically repealed if not tabled or if a sunsetting period applies, but airworthiness directives are generally not affected by sunsetting because they are disallowable instruments but often continue indefinitely until superseded. The AD’s effective date is clearly stated, but no subsequent amendments are recorded in the source. For the purpose of this deep dive, we note that as of the sourcing date, AD/B747/391 is the instrument as originally issued, with no recorded amendment history in the provided text. Users should verify current status independently, as CASA may have issued a subsequent AD that modifies these requirements, particularly given the age of the directive (nearly 16 years old at the time of this writing).

The provided source text contains no reference to any legal proceedings involving AD/B747/391. Airworthiness directives are generally not fertile ground for litigation because they are technical safety instruments, and non-compliance is rarely challenged on the merits. Operators typically comply because the cost of grounding is high and the safety case is strong. However, it is possible that an operator sought judicial review of the AD under the Administrative Decisions (Judicial Review) Act 1977 (ADJR Act) on grounds such as unreasonableness or procedural error. Without source evidence, we cannot assert any specific case. A search of Australian legal databases (e.g., AustLII, Westlaw) for “AD/B747/391” or “Boeing 747 refuel valve control unit” would be required. In general, litigation against CASA ADs is rare. The most common challenge is to the underlying airworthiness directive’s basis, but courts afford the regulator wide discretion in safety determinations. The case of Civil Aviation Safety Authority v Airservices Australia does not relate to ADs. The case of Bateman v CASA [2004] FCAFC 61 deals with enforcement but not ADs. The AD does not create a cause of action for private parties; therefore, tort claims are unlikely unless an accident occurs. No accident directly attributed to the refuel valve control unit condition described in the AD has occurred in Australia that resulted in litigation, to the best of public knowledge. The AD’s background references fuel system reviews; those reviews may have been influenced by the TWA Flight 800 and other fuel tank explosion investigations, but those events did not produce litigation in Australia. The AD is essentially an administrative action, and any challenge would need to be brought within the 28-day statutory period for judicial review. If no challenge occurred, the AD stands. It is also possible that an operator prosecuted for non-compliance might raise a defence that the AD was invalid or irrational. That would be a rare defence. In the United States, FAA ADs are frequently challenged, but Australian litigation history is sparse. For the purposes of this deep dive, we must state that the source text reveals no litigation history, and no known cases are directly on point. Therefore, the litigation history is nil. The practical inference is that the AD has been accepted and complied with by the industry without controversy. However, the absence of litigation does not mean the AD was cost-free; it means the cost of compliance was less than the cost of challenging it, and the safety case was accepted.

Several features of this AD can trip up even experienced compliance professionals. The first is the concurrent compliance requirement: Requirement 2 (maintenance program revision) must be done at the same time as Requirement 1 (the modification). Operators who complete the modification early but delay the maintenance program revision until the next scheduled maintenance check are in breach. The AD states “Concurrently with accomplishing the modification.” That means the program revision must be incorporated at the moment the modification is recorded; it cannot be deferred. A second gotcha is the specificity of the Boeing documents referenced. The AD requires the use of Boeing Alert Service Bulletin 747-28A2291 Revision 1, not earlier or later revisions. If an operator uses the original issue or Revision 2 without an AMOC, they are not compliant. The words “Revision 1, dated 12 March 2009” are prescriptive. Similarly, for the 747-400 series, the maintenance program revision must incorporate AWL No. 28-AWL-25 from Revision 24 of the MPD, or a later revision only if approved by the Seattle ACO. An operator who uses Revision 25 without checking whether the Seattle ACO officially blessed it is non-compliant. That approval from the FAA is not automatic; it must be explicitly conferred. A third gotcha is the terminating action trap. The AD says that complying with AD/B747/379 Requirement 1(a) terminates Requirement 2(a) of this AD. But careful reading: it does not terminate Requirement 1 (the modification). So an operator who thinks they are fully done after AD/B747/379 may still need to perform the modification of the refuel valve control unit under Requirement 1 of this AD. The terminating action only covers the maintenance program revision. A fourth gotcha is the CDCCL restriction. The AD says “No alternative CDCCLs may be used unless the CDCCLs are approved as an AMOC.” This applies after the maintenance program revision is completed. An operator who continues to use a previously installed alternative CDCCL (perhaps installed before the AD) must now ensure that alternative is covered by an AMOC. If not, the aircraft may be non-compliant even if the modification and maintenance program are done. This could catch operators who have older STCs or repair modifications that affect the fuel tank lightning protection design. A fifth gotcha relates to record-keeping: the AD does not explicitly require the operator to keep a copy of the Boeing service bulletin or the FAA approval letter for later MPD revisions. However, as a matter of evidence, the operator needs to demonstrate compliance. If CASA inspects and the operator cannot produce the specific revision of the service bulletin showing the modification instructions, or evidence of FAA approval for a later MPD, the operator may be deemed non-compliant. A sixth gotcha is the effective date: the AD became effective on 7 May 2009. If an operator had already accomplished the modification before that date, they still must have used the correct service bulletin revision. If they used an earlier version, the AD may not be satisfied unless the alternative is accepted. A seventh gotcha is the aircraft model applicability: the AD includes both passenger and freighter variants, and even the 747SR (short range) and 747SP. Operators of those models may not realise the AD applies if they are not flying passenger services. The eighth gotcha is the interpretation of “unless previously accomplished” in the compliance section. This phrase relates to Requirement 1. It means if the modification was already done before the compliance date (17 October 2013), the operator is excused from doing it again. But the operator must still confirm that the previously accomplished modification was done exactly as per Boeing Service Bulletin 747-28A2291 Revision 1. If it was done per an earlier revision, it may not count. Finally, there is a potential trap for operators of foreign-registered aircraft who later register in Australia: they need to check historical compliance against this specific AD, not just the equivalent FAA AD. The requirements may differ, for example, in the maintenance program revision element (the AWL number) which could be different from the FAA’s equivalent. The AD is specifically targeted at Australian operators; cross-border leasing requires careful mapping.

Compliance with this AD requires a coordinated effort between engineering, maintenance, and continuing airworthiness management. The process can be broken down into seven steps:

1. Identify affected aircraft. Locate the exact model line and type certificate data. The applicability list is broad; confirm that the aircraft is indeed a Boeing 747-100 through 747SP. Cross-check the current fleet register. If the aircraft is not on the Australian register, the AD does not apply.

2. Obtain required documentation. Purchase Boeing Alert Service Bulletin 747-28A2291 Revision 1 dated 12 March 2009. Obtain the correct AWL document depending on model: for 747-100/200/300 series, obtain D6-13747-CMR Revision January 2007; for 747-400 series, obtain D621U400-9 Section 9 Revision 24 dated June 2006. These documents may be available through Boeing’s MyBoeingFleet portal or through a distributor. Ensure you have the exact revision as specified.

3. Plan the modification. The modification changes the refuel valve control unit for the reserve fuel tanks. Source the kit from Boeing or an approved parts distributor. Schedule the modification before 17 October 2013 (historical; now late, but for future reference). The modification can be performed at any time, but it must be done before operating the aircraft after that date. Coordinate with the maintenance organisation (CAMO-approved) to perform the work during a suitable maintenance base check. The modification is likely an engineering change that requires a logbook entry and a Form 1 release.

4. Perform the modification concurrently with the AMP revision. Ensure that the maintenance program revision is not done weeks later. The amendment to the approved maintenance program must be incorporated at the same time. This means having the revised AMP document ready and the compliance schedule updated to include the new AWL tasks. For older models, insert AWL No. 28-AWL-20; for 747-400 series, insert AWL No. 28-AWL-25. The AMP should show the AWL task description, interval, and a cross-reference to the Boeing document. The AMP revision must be approved by CASA or by the operator’s Part 42-approved CAMO organisation under the operator’s approved procedures. Usually, the operator’s CAMO has authority to incorporate AWLs without prior CASA approval because they are mandatory. However, the operator must submit the revised AMP to CASA for record-keeping.

5. Address the CDCCL restriction. After the modification and AMP revision are done, review the aircraft’s configuration for any CDCCL that deviates from the approved baseline. If the aircraft has an alternate CDCCL (e.g., a different valve part number not covered by the service bulletin), obtain an AMOC from CASA. The request should include a safety analysis showing the alternative provides an equivalent level of protection. Alternatively, restore the design to the approved configuration.

6. Document compliance. Maintain a file containing a copy of the AD, a work order showing the modification, a copy of the Boeing service bulletin used, the revised AMP pages, and evidence that the modification was performed before 17 October 2013. For the AMP revision, retain a copy of the revised document. If using a later MPD revision, keep the FAA Seattle ACO approval letter. Complete an AD compliance record in the aircraft logbook and the operator’s continuing airworthiness record system.

7. Monitor for terminating action and supersedure. If CASA issues AD/B747/379 or /378, evaluate whether complying with those ADs can terminate this AD’s maintenance program revision requirement. This can save effort. However, do not assume that termination occurs automatically; confirm that the specific requirement numbers match. Also monitor for any new AD that may supersede AD/B747/391 entirely. A superseding AD would cancel this AD, but until that happens, this AD remains in force.

Operators should also consider applying for an AMOC if they wish to use a different modification method or a later revision of the Boeing service bulletin. The AMOC application should be made to CASA’s Airworthiness Engineering Branch, providing technical data. The AD’s cross-reference to FAA-approved later MPD revisions provides a shortcut: if the FAA Seattle ACO has already approved a later MPD revision, the operator can use it without a separate Australian AMOC. But the operator still needs to obtain proof of that FAA approval.

For operators who have already complied, the steps are mainly verification and record-keeping. A compliance audit should check that the documentation is complete and that the AWL tasks have been scheduled in the maintenance tracking system. If the aircraft has undergone major modifications since the AD, re-check the CDCCL compliance.

Finally, if the aircraft is sold or returned to lessor, the AD compliance information must be transferred. The new operator will rely on the records. Therefore, ensure the records are clear and comprehensive. Failure to pass on accurate AD status could result in liability.