AD/CF6/58 Amdt 1 - Electronic Control Unit Software

The central concept is the airworthiness directive itself, a mandatory regulatory instrument under the Civil Aviation Act 1988 and the Civil Aviation Safety Regulations 1998 (CASR). An AD is a legally enforceable notice that requires inspection, modification, or other action on an aircraft or component to correct an unsafe condition. This particular directive concerns the electronic control unit (ECU), a component that governs engine parameters such as fuel flow, compressor bleed, and thrust settings. The ECU runs software versions that control these functions, and changes to the software can alter engine behaviour. The directive identifies ten specific software versions (E.1.D through E.1.N) as prohibited, and maps them to their corresponding ECU part numbers in Table 1. Many of these part numbers are unique to each software version, but some versions (E.1.I through E.1.N) each map to multiple part numbers. For example, version E.1.I corresponds to four different part numbers (1799M99P06, 1799M99P07, 1851M74P01, 1851M80P01), reflecting different hardware configurations that run the same software. A second concept is the transition period for software replacement. The directive permits a limited substitution: until 31 January 2008, an ECU that already has a non-prohibited software version can be swapped for an ECU with a prohibited version. This appears designed to allow operators to keep aircraft flying while awaiting the new FAA-approved software, but only using existing inventory of older components. After that date, all use of prohibited software versions is banned. A third concept is non-reversion: once a new FAA-approved software version is installed, it is prohibited to revert to any older version listed in Table 1. This creates a one-way upgrade path. The directive references FAA AD 2007-17-01 Amdt 39-15159 as the originating US airworthiness directive, illustrating bilateral harmonisation between CASA and the FAA. Under bilateral aviation safety agreements, Australia typically adopts FAA ADs for US-manufactured engines, often with identical or near-identical requirements. The source also notes that this directive is complementary to AD/A330/57 Amdt 2, which likely addresses other aspects of the same unsafe condition on the airframe side. The background states that the new software provides increased margin to flameout, meaning the engine is less likely to suffer a combustor flameout under adverse conditions. This is a safety metric derived from engine certification testing and analysis.

The directive directly applies to operators and owners of aircraft equipped with General Electric CF6-80E1A1, CF6-80E1A2, CF6-80E1A3, CF6-80E1A4 and CF6-80E1A4/B turbofan engines. In practice, this means operators of Airbus A330 series aeroplanes, as noted in the applicability note, though the directive is not limited to that airframe. Any Australian-registered aircraft with these engines, or foreign-registered aircraft operating in Australian airspace under a foreign air operator certificate accepted by CASA, would need to comply. The directive also affects maintenance, repair and overhaul (MRO) organisations that service these engines. They must have the capability to load the new FAA-approved software onto ECUs, verify software versions, and document compliance. Engine lessors and financiers have an indirect interest: if an engine is subject to an AD that prohibits certain software versions, the value and leaseability of that engine may be affected until the modification is completed. General Electric as the engine manufacturer is relevant because the directive requires installation of FAA-approved software, which GE supplies through service bulletins (specifically GE Service Bulletin CF6-80E1 S/B 73-0091, Revision 1, dated 26 June 2007). CASA is the enforcing regulator. The FAA is the originating regulator; this directive adopts their finding and actions. The directive also affects third-party operators such as charter airlines, freight operators, and leasing companies that may have these engines in their fleet. The compliance burden falls on operators, who must schedule downtime for software updates, manage inventory of ECUs, and track compliance dates. For a typical operator with a fleet of A330s, this means coordinating with maintenance schedules to avoid grounding aircraft. The cost of compliance includes the labour for software loading and verification, potential grounding costs if software updates are not available before the deadline, and the cost of the service bulletin itself (if GE charges for it). Smaller operators with fewer engines may face proportionally higher per-engine compliance costs because they lack the scale to amortise overhead. Insurers may also be affected: failure to comply with mandatory ADs could void hull and liability insurance, and compliance is typically required for coverage to remain in force. Passengers and the public are indirectly affected through improved safety margins, though that benefit is difficult to quantify.

The directive imposes several distinct duties. The primary duty is to remove the ten prohibited software versions (E.1.D through E.1.N) from the ECU of each affected engine. This removal must be completed before 31 January 2008. The operator must ensure that the ECU is loaded with a new FAA-approved software version, as referenced in the GE service bulletin. A secondary duty concerns the transition period: from the effective date (25 October 2007) until 31 January 2008, an operator may replace an ECU that has a non-prohibited software version with an ECU that has a prohibited version. This is a permission, not an obligation, but it imposes a duty to comply with the time limit. After 31 January 2008, any ECU that still contains a prohibited software version must not be installed on an engine, and an operator must not operate an engine with such an ECU. A further duty prohibits reversion: once a new FAA-approved software version is installed on a particular ECU, that ECU must not be loaded with any of the older software versions listed in Table 1. This applies from the effective date and continues indefinitely. The operator also has a duty to document compliance in the aircraft's maintenance records, typically by completing a logbook entry referencing the AD, the service bulletin, and the software version installed. The rights under the directive are limited. Operators have the right to use the temporary replacement allowance until 31 January 2008, which gives them flexibility to keep aircraft operating if a compliant ECU is not immediately available. They also have the right to rely on the FAA-approved software as meeting the requirement; no additional Australian approval is needed once the FAA has approved the new software. There is no right to appeal or seek alternative means of compliance within the text, though under CASR Part 39, an operator could apply for an alternative means of compliance (AMOC) from CASA. No such AMOC is referenced in this directive. The directive does not create any new private rights of action; it is a public law requirement enforceable by CASA. Operators who comply are protected from enforcement action. Those who do not comply face the penalties discussed in the next section. The directive also implies a duty to verify the software version on any spare or replacement ECU before installation, as the software versions map to multiple part numbers and it is not sufficient merely to check the part number.

Non-compliance with an airworthiness directive is a serious regulatory offence under Australian aviation law. The Civil Aviation Act 1988 and the Civil Aviation Safety Regulations 1998 (CASR) provide the enforcement framework. Operating an aircraft that does not comply with an applicable AD is generally an offence under regulation 42ZC of the Civil Aviation Regulations 1988 (CAR 1988) or the equivalent provision under CASR. The maximum penalty for an individual operator can be up to 50 penalty units (as at 2007, one penalty unit was AUD 110, so AUD 5,500) or imprisonment for up to two years, or both. For a body corporate, the penalty can be up to 250 penalty units (AUD 27,500). More significantly, CASA can issue a direction to ground the aircraft or the engine, effectively preventing it from flying until compliance is achieved. This grounding power is exercised under section 20BA of the Civil Aviation Act, which allows CASA to direct an aircraft not to fly if it believes an unsafe condition exists. A grounded aircraft imposes costs far exceeding the statutory fine: lost revenue, storage fees, passenger disruption, and reputational damage. CASA may also suspend or cancel the air operator's certificate (AOC) or the certificate of airworthiness for the aircraft, which would ground the entire fleet until the issue is resolved. In practice, for a safety-critical AD such as this one, CASA's primary enforcement tool is the grounding power, not fines. An operator who continues to use an engine with prohibited ECU software after 31 January 2008 is operating contrary to the AD and would be subject to immediate grounding. The directive also creates potential liability for maintenance organisations if they install or work on ECUs with prohibited software after the deadline. They could be found to have contributed to a breach of the regulations. The enforcement approach is generally risk-based: CASA will typically issue a written direction first, then escalate if not complied with. However, because this AD addresses a known safety risk (engine flameout), the regulator is likely to be less tolerant of non-compliance. The directive does not itself specify penalties; it is the enabling legislation that provides them. The amendment history does not show any enforcement actions related to this specific directive, but the background references actual flameout events, which gives the AD significant operational force.

This directive interacts with multiple layers of regulation. At the international level, it adopts FAA AD 2007-17-01 Amdt 39-15159, which was the originating US airworthiness directive. Under the bilateral aviation safety agreement between Australia and the United States, CASA typically validates FAA ADs for US-manufactured engines with little or no change, unless Australian conditions warrant variation. This directive is a direct adoption of the FAA AD. At the national level, it is issued under the Civil Aviation Act 1988 and the Civil Aviation Safety Regulations 1998 (CASR). Specifically, Part 39 of CASR governs airworthiness directives, including issuance, amendment, and compliance obligations. The directive also interacts with AD/A330/57 Amdt 2, which deals with the same underlying unsafe condition (ice-related flameout) but on the airframe side. Both directives must be complied with for the aircraft to be airworthy. The Civil Aviation Regulations 1988 (CAR 1988) still apply to the extent that they contain the offence provisions for non-compliance with ADs. The directive does not interact with state or territory legislation; aviation safety is a Commonwealth matter. It does not appear to interact with work health and safety laws directly, but an employer's duty to provide a safe workplace could be relevant if an engine flameout causes an incident. The directive does not interact with contract law, but it affects contractual rights indirectly: a lease or sale of an engine or aircraft typically requires compliance with all applicable airworthiness directives, so this AD becomes a contractual term by reference. Non-compliance could constitute a breach of contract or void a warranty. The directive does not interact with competition or consumer law in any obvious way. It does not create any interaction with privacy or data protection laws. There is no interaction with environmental law, though a flameout could increase fuel burn or emissions during relight. The directive references GE Service Bulletin CF6-80E1 S/B 73-0091, Revision 1, which is not itself law but is the approved means of compliance. Following the service bulletin is not mandatory if an AMOC is approved, but it is the standard method. The directive does not interact with any international treaties beyond the bilateral safety agreement. It does not create any interaction with immigration or customs laws. The interaction with foreign air operator certificates is important: a foreign operator of an A330 with these engines flying into Australia must comply with this directive if the aircraft is to be operated in Australian airspace. CASA can enforce ADs against foreign operators under the Civil Aviation Act.

This instrument is Amendment 1 to AD/CF6/58, as indicated by its title. The original directive, AD/CF6/58, became effective on 4 August 2005. The background states that the original issue required removal of ECU software version E.1.M or earlier. This amendment expands the requirement to remove software version E.1.N or earlier. The original directive's scope was narrower: it prohibited software versions E.1.D through E.1.M. This amendment adds version E.1.N to the prohibition list. The original also did not include the temporary replacement allowance or the reversion prohibition in the same form; those appear to have been added or refined in this amendment. The compliance dates differ: the original had a different deadline, which is now superseded. This amendment is dated 7 September 2007 and becomes effective on 25 October 2007. It replaces the original directive in its entirety, as noted in the background: 'This Amendment ... replaces the original issue of this Directive.' This means the original AD/CF6/58 is no longer in effect; only this amended version applies. The amendment history is not more detailed in the source, but the pattern suggests ongoing refinement as investigations into the flameout incidents progressed. The amendment also adds explicit mapping of software versions to ECU part numbers in Table 1, which may have been less detailed in the original. The reference to the FAA AD is updated to 2007-17-01, whereas the original likely referenced an earlier FAA AD. The service bulletin reference may also be updated; the original may have referenced an earlier revision. The amendment also introduces the 31 January 2008 deadline, which replaces whatever deadline existed in the original. There is no indication that any further amendments to AD/CF6/58 were issued after this one, based on the source provided. The instrument also notes it is complementary to AD/A330/57 Amdt 2, which suggests that airframe-side requirements were also amended around the same time to address the same unsafe condition. The amendment history is important for compliance because anyone relying on the original directive alone would be non-compliant with the expanded requirements.

The source for AD/CF6/58 Amdt 1 does not itself contain any reference to litigation. There is no challenge to the directive's validity mentioned, no appeal of its terms, and no court or tribunal decision referenced. This is consistent with the nature of airworthiness directives: they are administrative safety instruments, not legislative instruments that are typically challenged in court. The Civil Aviation Act provides for limited merits review of certain CASA decisions, but an AD is usually a legislative instrument that is not subject to individual appeal. A person affected by an AD could seek judicial review under the Administrative Decisions (Judicial Review) Act 1977 (Cth) on grounds such as procedural error or unreasonableness, but such challenges are extremely rare for ADs because the safety justification is usually well-documented. There is no evidence in this source of any such challenge to AD/CF6/58 or its amendment. The background references FAA investigations into engine flameout events, but those investigations are regulatory, not litigious. No class actions, product liability suits, or insurance disputes are mentioned. However, it is plausible that the underlying flameout events may have led to litigation in other jurisdictions, such as actions by operators against General Electric or by passengers against airlines, but that is outside the scope of this source. In Australia, an operator affected by this directive could potentially seek a variation or alternate means of compliance, but there is no record of that resulting in litigation. The absence of litigation history for this specific AD is typical. Airworthiness directives are generally accepted by operators as necessary safety requirements, and compliance costs are treated as normal operational expenses. The litigation risk usually arises only if an operator suffers a loss due to a grounding that they believe was unwarranted, or if there is a dispute about liability between an operator and a maintenance organisation. No such disputes are documented in the source. The directive's interaction with the FAA AD means that any US litigation involving the original FAA AD could have indirect effects, but the source does not reference any such litigation.

Several features of this directive are likely to catch operators off guard. First, the temporary replacement allowance in Requirement 2 appears to permit unrestricted swapping of older ECUs until 31 January 2008, but it is actually narrower than it seems. It allows an ECU with a non-prohibited software version to be replaced with an ECU containing a prohibited version from Table 1. This means an operator can use up existing stock of older ECUs, but only until the deadline. The 'gotcha' is that once that older ECU is installed, the operator cannot later reinstall a compliant ECU and then revert again. The reversion prohibition in Requirement 3 is permanent once the new FAA-approved software is installed on a particular ECU. Second, the deadline for removal (31 January 2008) is strict. There is no extension mentioned. An operator who has not completed the software update by that date cannot operate the engine at all, even if they have an older ECU installed that was previously compliant. Third, the prohibition on reversion is absolute. An operator who installs new FAA-approved software on an ECU cannot under any circumstances go back to an older version even if that older version is not listed in Table 1. The prohibition only applies to the specific versions listed, but those are the only ones that were in common use. Fourth, the directive applies to all engines on the aircraft, not just one. An operator must ensure every engine on an A330 has compliant software. If one engine has prohibited software, the aircraft is unairworthy even if the other engine is compliant. Fifth, the ECU part number mapping is not straightforward. Some software versions (E.1.I through E.1.N) correspond to multiple part numbers. An operator cannot simply check the part number to determine compliance; they must verify the actual software version loaded. A maintenance engineer might mistakenly assume a part number not listed is compliant, but the software version could still be prohibited. Sixth, the directive references FAA-approved software but does not specify the exact version of that new software. Operators must rely on the GE service bulletin to determine which version is approved. If GE releases a later revision of the service bulletin, the operator must ensure they use the correct one. Seventh, the effective date (25 October 2007) creates immediate obligations for Requirements 2 and 3. That means from that date, an operator cannot install a prohibited software version on an ECU that has already been upgraded, and they cannot revert to an older version. This applies even before the removal deadline. Eighth, the directive does not address shelf inventory. An operator may have spare ECUs on the shelf that contain prohibited software. After 31 January 2008, those spares cannot be used unless the software is updated. The cost of updating spares is additional. Ninth, the background notes that the root cause investigation is not complete. This means a further amendment could be issued if the investigation reveals a different cause or if the software fix proves inadequate. Operators face uncertainty about whether this is the final fix or merely a temporary measure requiring further action later. Tenth, the directive is complementary to AD/A330/57 Amdt 2. If an operator focuses only on this engine directive and neglects the airframe directive, they are still non-compliant. The two must be read together.

Compliance with AD/CF6/58 Amdt 1 requires a systematic approach. The first step is to identify which engines are affected. The directive applies to engine models CF6-80E1A1, CF6-80E1A2, CF6-80E1A3, CF6-80E1A4 and CF6-80E1A4/B. The operator must check the engine type certificate data plate or maintenance records to confirm the model. Second, determine which ECU software versions are installed on each engine. This requires connecting diagnostic equipment to the ECU to read the software version identifier. The operator must compare the installed version against Table 1. If the software version is E.1.D, E.1.F, E.1.G, E.1.H, E.1.I, E.1.J, E.1.K, E.1.L, E.1.M or E.1.N, the ECU is non-compliant. Third, obtain the new FAA-approved software. The directive refers to GE Service Bulletin CF6-80E1 S/B 73-0091, Revision 1, dated 26 June 2007. The operator must obtain this service bulletin from GE and procure the software load. This may involve a purchase cost or a service fee from an authorised GE service centre. Fourth, schedule the software update before 31 January 2008. The update must be performed by a licensed aircraft maintenance engineer (LAME) or an appropriately rated maintenance organisation. The process typically involves connecting a laptop or data loader to the ECU, erasing the existing software, and loading the new version. The operator must verify the installation by checking the software version after loading. Fifth, document the compliance in the engine's maintenance log. The entry should reference the AD number (AD/CF6/58 Amdt 1), the service bulletin, the new software version, the ECU part number, the date, and the signature and licence number of the engineer. This documentation is evidence of compliance for CASA inspections and for future maintenance. Sixth, manage spare ECUs. Any spare ECU that contains a prohibited software version must either be updated before 31 January 2008 or be quarantined and not used. The operator should establish a tracking system for spare ECUs to ensure that only compliant units are installed. Seventh, comply with the temporary replacement allowance if needed. From 25 October 2007 until 31 January 2008, an operator may replace an ECU that has a non-prohibited software with an ECU containing a prohibited version, but only if that ECU was already in inventory. Such replacements must be documented. After 31 January 2008, even this temporary allowance ends, and only compliant software is permitted. Eighth, prevent reversion. Once a particular ECU has been upgraded to FAA-approved software, the operator must ensure that it is never reloaded with any of the Table 1 software versions. This may require physical or procedural controls, such as locking the data loader or marking the ECU as upgraded. Ninth, coordinate with AD/A330/57 Amdt 2. The operator must ensure that both the engine directive and the airframe directive are complied with. It may be efficient to perform both modifications during the same maintenance downtime. Tenth, maintain ongoing compliance. Even after the software is updated, the operator should verify compliance during each annual inspection or whenever an ECU is replaced. The directive does not expire; the prohibition on reversion and the requirement to use only compliant software remains in effect indefinitely. Finally, if the operator cannot comply by the deadline for any reason, they should contact CASA to discuss an alternative means of compliance (AMOC) under CASR Part 39. However, there is no guarantee an AMOC will be granted. The operator must also notify their maintenance organisation and any lessor or financing entity of the AD requirement to ensure contractual compliance.