AD/ERJ-170/22 - FADEC Software

The AD rests on a small set of interlocking concepts expressed in the document text. First, applicability is model‑based: the AD applies to Model ERJ 170-100 STD, ERJ 170-100 LR, ERJ 170-100 SU, ERJ 170-100 SE, ERJ 170-200 STD, ERJ 170-200 LR and ERJ 170-200 SU aeroplanes. That list delimits who must comply. Second, the operative requirement is a software change to the FADEC system: "Replace the current engines full authority digital engine control (FADEC) software version by the new version V5.41 or any further FADEC software version approved by the Brazilian Agência Nacional de Aviação Civil (ANAC)." The AD thus prescribes software configuration management as the corrective action.

Third, the AD anchors compliance and procedure to an aircraft manufacturer document: "The detailed instructions and procedures to accomplish this AD are described in the Embraer Service Bulletin 170-73-0006 original issue, or further revisions approved by the ANAC." That links the technical method to a Service Bulletin and to ANAC approval of any revisions. Fourth, there is a time-in-service compliance metric rather than a calendar deadline: "Within the next 1,200 hours time in service after the effective date of this Directive." The AD became effective on a fixed date: 7 May 2009. Fifth, the AD explicitly supersedes and cancels a prior AD (AD/ERJ-170/16 Amdt 1), so it is presented as replacing earlier regulatory instructions for the same equipment.

The background section sketches a chain of technical causation relevant to the regulatory choice: ANAC initially reported loss of thrust control events rooted in fuel metering valve (FMV) position feedback signal problems; that led to an earlier AD (AD/ERJ-170/16) to upgrade to V5.40. After V5.40 was in use, ANAC reported commanded in-flight shutdowns linked to a logic error in V5.40, with IFSD events occurring at a higher rate than the prior loss-of-thrust-control events. That situation prompted AD/ERJ-170/16 Amdt 1 requiring a reversion to V5.30. The AD now requires V5.41, which "corrects the foregoing anomalies."

Finally, the governance relationships in the instrument are apparent: CASA (via its delegate) issues the AD for Australian-regulated aircraft; ANAC approves the software versions and Service Bulletin revisions. The directive references ANAC ADs as antecedent regulatory actions.

Together these concepts frame the AD as a narrowly focused, corrective regulatory instrument: it sets a defined hardware‑software configuration state (FADEC V5.41 or later ANAC‑approved) for a defined set of ERJ-170 models, anchored to a manufacturer procedure document and a quantifiable compliance window.

The directive identifies a clear, bounded population of affected parties by model series: Model ERJ 170-100 STD, ERJ 170-100 LR, ERJ 170-100 SU, ERJ 170-100 SE, ERJ 170-200 STD, ERJ 170-200 LR and ERJ 170-200 SU aeroplanes. Those aircraft, wherever they are registered or operated under Australian oversight, fall within the directive's applicability clause. The text does not explicitly name operators, owners, repair stations, lessees or lessors, but by convention and regulatory practice the primary operational responsibility for mandatory AD compliance rests with the aircraft operator or the aircraft operator’s nominated maintenance organisation. The AD itself uses operationally relevant measures: "Within the next 1,200 hours time in service after the effective date," meaning the clock runs against each aircraft's accumulated time in service.

The instrument also implicates other parties by reference. Embraer is implicated as the provider of the Service Bulletin that contains the detailed instructions; the AD requires conformance to Embraer Service Bulletin 170-73-0006 original issue or further revisions approved by ANAC. ANAC is a decision‑maker in two respects: (a) it approves FADEC software versions (the AD permits "V5.41 or any further FADEC software version approved by the Brazilian Agência Nacional de Aviação Civil (ANAC)"), and (b) it approves any further revisions to the Embraer Service Bulletin. CASA is the issuing authority for the AD in Australia, signing through a named delegate, James Coyne. The directive also refers to ANAC AD 2008-03-01R2, indicating regulatory interaction and prior action by ANAC that informs the Australian AD.

Maintenance organisations and engineering shops that undertake FADEC software installation under the Embraer Service Bulletin will be operationally affected: they must use the specified procedures and any ANAC-approved revisions. Engineers responsible for continued airworthiness must ensure that the correct FADEC software version is installed and that the installation is completed within the 1,200 hours TIS window. Aircraft technical records custodians should note that the AD supersedes a previous AD (AD/ERJ-170/16 Amdt 1), which affects record-keeping for prior compliance actions and the mandatory baseline for inspections or audits.

Finally, there is a derivative effect on flight operations planners: scheduling must account for the work required under the Service Bulletin within the specified TIS window. The AD does not allocate costs, nor does it state explicitly who pays; the obligation to comply, grounded in the AD's applicability and compliance clause, creates an operational cost and scheduling requirement that will be borne in practice by the operator or the party responsible for maintenance and airworthiness of the listed aircraft.

Key duties set out in the document are direct and narrowly specified. The primary duty is to replace the current FADEC software with version V5.41 or with any subsequent FADEC software version approved by ANAC. The AD prescribes that the detailed instructions and procedures to accomplish the software change are those described in Embraer Service Bulletin 170-73-0006 (original issue), or any further revisions of that Service Bulletin that have been approved by ANAC. Operators must complete the required change "Within the next 1,200 hours time in service after the effective date of this Directive." The effective date is explicitly stated: the directive "becomes effective on 7 May 2009."

The document does not set out an exhaustive compliance regime, record-keeping obligations, or an administrative reporting process beyond the instruction to use the Service Bulletin and the compliance timeframe. It does, however, establish a baseline for mandatory action and the technical norm (V5.41 or ANAC‑approved later versions). The AD supersedes the prior AD (AD/ERJ-170/16 Amdt 1), which implies that duties arising from the superseded AD are replaced by the duties in this AD; in particular, prior instructions to revert to V5.30 or to use V5.40 are superseded by the present requirement to use V5.41 or later ANAC‑approved versions.

Rights under the document are implicit rather than explicit. The AD permits flexibility in that it authorises "any further FADEC software version approved by the Brazilian Agência Nacional de Aviação Civil (ANAC)" as an acceptable alternative to V5.41, thereby allowing aircraft operators or maintainers to install a later ANAC‑approved software release without seeking additional Australian regulatory permission. The AD similarly allows the use of "further revisions [of the Embraer Service Bulletin] approved by the ANAC," which recognises ANAC's approval as sufficient to validate changes in the procedural document. Thus, the AD delegates substantive technical approval authority to ANAC for subsequent software versions and Service Bulletin revisions.

The AD prescribes who decides what versions and procedural revisions are acceptable: ANAC. The issuing Australian authority (CASA) mandates compliance with those ANAC‑approved outcomes. The AD itself does not stipulate remedial or enforcement steps in the event of non‑compliance, nor does it specify a process for seeking exemptions, alternative methods of compliance (AMOCs), or extensions. Those items are absent from the text and therefore not conveyed as duties or rights within this document.

In brief, the AD creates a clear duty to achieve a software state (V5.41 or later ANAC‑approved) within a stated TIS window, anchors the implementation to a specified Service Bulletin or its ANAC‑approved revisions, and delegates continued technical approval of future software versions and Service Bulletin changes to ANAC.

The AD itself sets out the mandatory corrective action and compliance timeframe but does not include any express penalty provisions, civil sanction schedule, or enforcement procedures in its text. The document records the effective date (7 May 2009), the compliance timeframe (1,200 hours TIS from that date), and the procedural reference (Embraer Service Bulletin 170-73-0006, original or ANAC‑approved revisions). It does not, in the supplied text, specify which enforcement mechanisms CASA will deploy should an operator fail to comply, nor does it set out administrative fines, legal consequences, or specific post‑compliance certification steps.

Because the AD is issued by CASA and signed by its delegate, it functions as an instrument within the CASA airworthiness regulatory framework. In practice, mandatory ADs become part of the continuing airworthiness requirements that operators are expected to follow; where an AD is not complied with, CASA has regulatory tools and administrative powers by statute and regulation to intervene. However, the current document does not state those powers or the applicable enforcement pathways. The directive does reference ANAC AD 2008-03-01R2 and the superseded AD/ERJ-170/16 Amdt 1, but it does not convert those references into enforcement terms.

Because the AD requires conformance to a Service Bulletin and a specific software configuration, the primary enforcement lever practical for the regulator is the aircraft’s airworthiness status: the aircraft will not meet the AD‑mandated configuration unless the change is carried out and recorded. The AD therefore creates a compliance obligation that affects an aircraft’s continuing airworthiness certificate or regulatory acceptability for operation. The document does not, however, describe the paperwork or approval process by which compliance is to be recorded, nor does it specify whether an operator must notify CASA upon completion.

Absent explicit penalty language in the AD text, any discussion of fines, sanctions, or enforcement proceedings would be outside the supplied source. The manifest enforcement content in the AD is limited to the requirement, the technical standard, the procedural reference, and the compliance timeframe. Any enforcement actions or penalties administered by CASA in practice would derive from wider regulatory instruments and statutory powers not included in the supplied text.

The directive explicitly interacts with at least two other regulatory instruments by reference. First, it refers to ANAC , the Brazilian civil aviation authority , for two distinct functions: approval of FADEC software versions (it accepts "V5.41 or any further FADEC software version approved by the Brazilian Agência Nacional de Aviação Civil (ANAC)"); and approval of any further revisions to Embraer Service Bulletin 170-73-0006, which it specifically authorises for use in complying with the AD. Second, the AD notes that "ANAC AD 2008-03-01R2 refers," thereby acknowledging a prior ANAC directive as part of the regulatory context. The AD also supersedes an earlier Australian AD (AD/ERJ-170/16 Amdt 1), directly replacing the earlier Australian regulatory instruction for the same aircraft and subject matter.

The practical effect is to create a regulatory chain where an Australian AD requires compliance with a specific technical solution but recognises ANAC's ongoing technical approvals as acceptable for subsequent changes. That places ANAC’s approval process in the role of the definitive technical gatekeeper for later software releases and service bulletin revisions, with CASA enforcing the Australian compliance requirement anchored to ANAC’s determinations.

Beyond the explicit references to ANAC and to the superseded AD, the supplied text does not mention other domestic laws, regulations, or international agreements. It does not reference Australian aviation statutory provisions, such as the Civil Aviation Act or specific Civil Aviation Safety Regulations, nor does it set out interactions with contractual regimes (leases, warranties), import/export law, or product liability frameworks. The AD is therefore a focused operational directive: it modifies an airworthiness requirement for specified aircraft and cross‑references ANAC documents as the source of acceptability for alternative technical actions.

Because the AD cancels the prior AD/ERJ-170/16 Amdt 1, operators must treat the earlier AD as superseded; staffing, maintenance planning, and records must reflect the present AD as the operative regulation. The AD’s delegation of approval for further software versions and Service Bulletin revisions to ANAC creates an inter‑jurisdictional administrative relationship: CASA enforces the AD while ANAC controls the technical approvals that satisfy it.

Any interactions with other laws, such as those governing enforcement, record-keeping, maintenance certification, or operator obligations, are not spelled out in the document and so are not described here. The supplied text confines its cross‑referencing to ANAC approvals and to the superseded Australian AD.

The document contains limited but specific amendment history embedded in its background and supersession statements. The present directive, AD/ERJ-170/22 (FADEC Software, 5/2009), supersedes AD/ERJ-170/16 Amdt 1; the supersession is explicit: "This Directive supersedes AD/ERJ-170/16 Amdt 1 which will be cancelled." The effective date of the present directive is 7 May 2009, and the document is signed and dated 26 March 2009 by James Coyne, Delegate of the Civil Aviation Safety Authority.

The background provides a concise narrative of the technical and regulatory sequencing that produced the current amendment. Initially, ANAC had reported instances of loss of thrust control due to Fuel Metering Valve (FMV) position feedback signal problems; because those problems affected flight safety, AD/ERJ-170/16 (the earlier AD) required an upgrade to FADEC software version V5.40. After AD/ERJ-170/16 was issued, ANAC received reports of several instances of commanded in-flight shutdown (IFSD) during use of FADEC V5.40. Investigation identified these IFSD events as being linked to a logic error in V5.40. The IFSD events had a higher occurrence rate than the initial loss-of-thrust-control events that led to AD/ERJ-170/16; consequentially, AD/ERJ-170/16 Amdt 1 was issued to require the FADEC software to be returned to version V5.30. Subsequently, FADEC software version V5.41 was issued, and it "corrects the foregoing anomalies." The present AD therefore requires installation of V5.41.

The document also notes a related ANAC AD reference: "Note: ANAC AD 2008-03-01R2 refers." That reference is part of the amendment record insofar as it situates the AD within ANAC’s own directive sequence.

No other amendments, revisions, or later supersessions are recorded within the supplied text. The AD authorises the use of future ANAC‑approved FADEC versions and ANAC‑approved service bulletin revisions, which anticipates further technical changes but does not itself constitute an amendment history. The document therefore supplies a brief but clear trail: original AD leading to V5.40, subsequent reversion to V5.30 by amendment because of IFSDs, and the current AD mandating V5.41, with cancellation of the previous amendment.

The supplied AD contains no litigation history. It does not refer to any court decisions, administrative appeals, challenges to the AD, or adjudicated disputes arising from its issuance. No judicial or tribunal proceedings are recorded in the text provided. The document is administrative in nature: signed by a CASA delegate, dated, and effective as of a stated date; it is silent on any legal challenges or case law.

Given the absence of litigation references, the AD stands as a regulatory instrument without documented contestation in the supplied materials. Any litigation, appeals, or enforcement actions that may have arisen in practice fall outside the text of this instrument and consequently are not referred to or summarised here.

Where users need to know whether this AD has been the subject of administrative appeals, judicial review, or contested enforcement, they must consult the administrative records, case law databases, or regulatory archives beyond the supplied document. The AD itself provides neither a record of such proceedings nor a reference to where any such records might be found.

The AD contains several specific points that can create operational or compliance pitfalls if overlooked.

1. Narrow model applicability: The AD applies only to explicitly enumerated ERJ-170 variants: ERJ 170-100 STD, LR, SU, SE, and ERJ 170-200 STD, LR, SU. Aircraft not on this list are outside the AD’s applicability as written. Operators must confirm model designations carefully, because a misclassification could lead to either unnecessary action or failure to comply where required.

2. Software version flexibility tied to ANAC: The AD mandates V5.41 or "any further FADEC software version approved by the Brazilian Agência Nacional de Aviação Civil (ANAC)." This creates an asymmetry of approval authority: Australian compliance accepts ANAC approvals for later versions. Operators must therefore track ANAC approvals rather than relying solely on Embraer releases or CASA confirmations. Failure to ensure that a later software release has ANAC approval could render the installed version non‑compliant despite being a later numbered release.

3. Service Bulletin approval requirement: The AD ties the procedural instructions to Embraer Service Bulletin 170-73-0006 "original issue, or further revisions approved by the ANAC." That means that even if Embraer issues a revised Service Bulletin, its use for compliance depends on ANAC approval. Implementing a revised service bulletin not approved by ANAC would not, on the face of this AD, meet the directive’s requirement.

4. Compliance measured in hours time in service: The compliance window is "within the next 1,200 hours time in service after the effective date of this Directive." This is not a calendar deadline. Operators must count aircraft TIS accurately from the effective date (7 May 2009) to determine the final compliance threshold for each aircraft. Miscounting flight hours or misunderstanding whether TIS relates to engine hours versus aircraft hours could cause non‑compliance.

5. Supersession of prior ADs: The AD expressly cancels AD/ERJ-170/16 Amdt 1. Operators that previously complied with the earlier AD by reverting to V5.30 must now update to V5.41 (or later ANAC-approved) within the stated TIS. Failure to consider the supersession may create confusion about which software baseline is current.

6. Background technical trade-offs: The technical background discloses that V5.40 addressed loss of thrust control related to FMV feedback signals but introduced a logic error resulting in IFSDs at a higher occurrence rate, prompting a regulatory backstep to V5.30. V5.41 is described as correcting those anomalies. Operators should be alert that software releases have previously had adverse effects and therefore should verify that the software and Service Bulletin used match the AD’s acceptability criteria.

7. No enforcement or reporting detail in the AD: The AD does not provide post‑compliance reporting steps or specify how compliance should be documented and notified to CASA. Operators should not assume the existence of automatic reporting channels from this AD alone; the AD’s silence on reporting could create administrative uncertainty unless operators consult CASA guidance or standard maintenance record practices.

8. Temporal mismatch between issue and effective dates: The AD is signed on 26 March 2009 but "becomes effective on 7 May 2009." Operators should note that the compliance clock begins on the effective date, not the signing date.

9. Jurisdictional coordination: Because ANAC plays a decisive role in approving acceptable software and procedural revisions, operators must coordinate across jurisdictions (Embraer, ANAC, CASA) to confirm that the FADEC software release and Service Bulletin revision intended for use satisfy the AD’s cross‑referenced approvals.

These points are stated or implied by the text and represent concrete operational or administrative areas where failure to attend to the AD’s precise phrasing could lead to non‑compliance or practical confusion.

The AD prescribes a concise compliance pathway; operators should translate those items into an action plan consistent with the document text.

1. Confirm applicability. Check each aircraft’s model designation against the list in the AD: Model ERJ 170-100 STD, ERJ 170-100 LR, ERJ 170-100 SU, ERJ 170-100 SE, ERJ 170-200 STD, ERJ 170-200 LR, ERJ 170-200 SU. Only aircraft of these types are covered by the AD as written.

2. Identify current FADEC software. Determine what FADEC software version is currently installed on each affected aircraft. The AD requires replacing "the current engines full authority digital engine control (FADEC) software version" with V5.41 or a later ANAC‑approved FADEC software version.

3. Obtain the approved procedural document. Obtain Embraer Service Bulletin 170-73-0006 original issue, or any further revision that has been approved by ANAC. The AD requires following the detailed instructions and procedures contained in that Service Bulletin or its ANAC‑approved revisions.

4. Verify ANAC approvals for software and Service Bulletin revisions. If you plan to install a FADEC release later than V5.41, confirm that the later version has been approved by ANAC. Similarly, if using a revision of Embraer Service Bulletin 170-73-0006, verify ANAC approval of that revision. The AD expressly conditions compliance on ANAC approval for later software versions and Service Bulletin revisions.

5. Schedule the installation within the TIS window. The AD requires compliance "Within the next 1,200 hours time in service after the effective date of this Directive." The effective date is 7 May 2009. Count each aircraft’s time in service from that date and schedule the FADEC software replacement to occur before each aircraft reaches 1,200 hours TIS after 7 May 2009. Ensure the maintenance schedule allows for any procedures or test flights the Service Bulletin prescribes.

6. Execute the work per the Service Bulletin. Perform the FADEC software replacement and any associated procedures strictly according to Embraer Service Bulletin 170-73-0006 (original or ANAC‑approved revision). Use qualified maintenance personnel and comply with any installation checks or validation steps the Service Bulletin requires.

7. Record compliance. While the AD does not specify reporting formalities, maintain airworthiness records documenting the FADEC software version installed, the Service Bulletin revision used, the ANAC approval status (if applicable), the date of work, the aircraft TIS at work completion, and signatures of authorised maintenance personnel. These records will demonstrate that the AD requirement has been met for each affected aeroplane.

8. Update continuing airworthiness baselines. Since the AD supersedes AD/ERJ-170/16 Amdt 1, ensure that the aircraft’s continuing airworthiness status, inspection baselines, and maintenance plans reflect the FADEC V5.41 (or later ANAC‑approved) requirement as the current mandatory status.

9. Coordinate with regulatory and manufacturer contacts as necessary. Given that ANAC approvals are central to the AD’s permissive options, maintain clear communication channels with Embraer and ANAC to verify that the software or Service Bulletin revisions intended are approved. Also maintain CASA points of contact to resolve any doubts about compliance evidence or potential need for relief.

10. Consider operational timing and spare capacity. Although the AD does not specify the duration of the software installation, schedule the work to minimise operational disruption within the 1,200 hours TIS window, accounting for required downtime and any post‑installation validation flights or checks recommended by the Service Bulletin.

Following these steps aligns with the mandatory elements in the AD: ensure applicability, obtain and follow the named Service Bulletin or an ANAC‑approved revision, install FADEC V5.41 or an ANAC‑approved later version, and complete the work within 1,200 hours TIS after the effective date of 7 May 2009. The AD contains no explicit alternative methods of compliance or approval process within its text; if operators require relief, they should seek guidance from CASA and note ANAC’s role in approving later software versions and Service Bulletin revisions.