AD/ERJ-170/4 Amdt 4 - Flight Guidance Control Unit

Airworthiness directive: a legally enforceable instrument issued by CASA under the Civil Aviation Regulations (likely CAR 1988 or Part 39 of the Civil Aviation Safety Regulations) to mandate corrective action where an unsafe condition exists or is likely to exist in an aircraft type. It overrides any less restrictive maintenance schedule and binds the operator, the registered owner, and any person performing maintenance on the aircraft.

Functional test: defined explicitly in Note 1 of the directive as "a quantitative check to determine if one or more functions of an item perform within specified limits." This definition is narrower than an operational or visual inspection. It requires measurement against defined parameters, not simply a go/no-go check. The test must be accomplished in accordance with Embraer SB 170-22-0003 (original issue dated 9 November 2006, or later revisions approved by ANAC). The directive does not reprint the SB procedures; the operator must obtain the SB and follow its steps.

Latent failure condition: described in the Background. On software loads 17.3 to 17.7, certain caution messages from the FGCS are not displayed. A failure on one FGCS channel during a flight could be latent (undetected) in subsequent flights because the caution message never appears. If a second failure occurs on the other FGCS channel, the autopilot may command a hard-over (sudden uncommanded movement of control surfaces). The condition is a safety-of-flight concern. The repetitive functional test detects the latent failure; the software upgrade eliminates the root cause.

Terminating action: installation of Primus EPIC software load version 19.3 or higher. Once accomplished, the functional test is no longer required. Notes 2 and 3 give examples: version 19.4 can be installed per SB170-31-0026 dated 5 October 2007; version 21.2 can be installed per SB 170-31-0028 Revision 01 dated 14 January 2008. Any other version may be installed per an applicable approved SB. The terminating action must be completed by 30 June 2009; there is no provision for further extensions under this amendment.

Time in service (TIS): the compliance interval for the functional test is measured in hours TIS, not calendar time. TIS typically means hours from the moment the aircraft first moves under its own power for the purpose of flight. This metric can be demanding for high-utilisation aeroplanes; an aircraft flying 10 hours per day must be tested every 60 days. The directive does not permit an alternative compliance interval based on cycles or calendar days, unless an alternative means of compliance is granted by CASA (not mentioned in the directive but generally available under Part 39).

Delegated authority: the directive is signed by James Coyne as Delegate of CASA, and is marked "8/2008 DM". This indicates the instrument was made under a delegation from CASA's CEO, likely under section 20A of the Civil Aviation Act 1988. The signature block implies the delegate determined the directive was necessary for safety.

The primary obligors are the operators of ERJ-170 model aeroplanes registered in Australia that have the specified Primus EPIC software loads. This includes airlines, charter operators, corporate flight departments, and private owners who hold an Australian certificate of registration for the aircraft. The directive also indirectly affects maintenance organisations that hold the appropriate Part 145 (Maintenance) certification, as they will be contracted to perform the functional test and the software installation. The test and software upgrade may be done in-house by an operator with its own maintenance capability, or outsourced to an approved maintenance organisation (AMO). The directive does not name specific organisations; it imposes the compliance obligation on the operator regardless of who performs the work. Importers of second-hand ERJ-170s into Australia are affected: the 300-hour TIS compliance clock for the functional test starts from "the first issue of an Australian Certificate of Airworthiness," not from the aircraft's entry into service in another country. This means an aeroplane that already has many thousands of hours on it may need the functional test within 300 hours of receiving its Australian CofA, even if it has never been tested before in service. The directive also binds lessors and financiers who retain ownership: if the operator fails to comply, the aircraft's airworthiness certificate may be suspended or cancelled, affecting the asset's value and insurability. Passengers and cargo customers are indirectly affected through potential schedule disruptions if an aircraft is grounded for non-compliance. The Australian public is affected through safety outcomes: the directive reduces the risk of autopilot hard-over events. On the regulatory side, CASA is affected as it must monitor compliance and enforce the directive. ANAC (the Brazilian regulator) is affected because the directive adopts their SB approvals and cross-references their AD, creating a harmonised regulatory stance between the two countries. Embraer is affected because their service bulletins become legally mandatory in Australia; they may face pressure from operators to release timely revisions. The directive does not apply to ERJ-170s with software loads outside the listed range (for example, version 19.3 already installed before the directive took effect) except that those aircraft must still meet the software installation requirement by 30 June 2009 if they have a lower version.

Duty to perform the functional test: the operator must conduct a quantitative functional test of FGCS channel engagement in accordance with Embraer SB 170-22-0003 (original issue or later ANAC-approved revision). The test must be done within 300 hours TIS after the Australian CofA is first issued, and every 600 hours TIS thereafter until the software upgrade is accomplished. The duty is ongoing; if the software upgrade is delayed past the 600-hour interval, another test is due. There is no "grace period" beyond the interval stated.

Duty to install corrected software: the operator must install Primus EPIC software load version 19.3 or higher no later than 30 June 2009. The installation must be per an Embraer SB approved by ANAC. The operator must select the appropriate SB revision for the version being installed. If no ANAC-approved SB exists for a desired higher version, the operator cannot use that version without risking non-compliance. Note 2 lists examples but says "other versions may be installed in accordance with an applicable approved SB" - this places a burden on the operator to verify ANAC approval before installation.

Right to rely on previous compliance: functional tests accomplished under earlier amendments (original issue, Amdt 1, Amdt 2, Amdt 3) are accepted as compliance for Requirement 1 of this amendment. The operator does not need to repeat a test that was validly performed under a prior version of the directive.

Right to use alternative software load versions: the directive explicitly permits installation of version 19.4, 21.2, or any other version, provided it is per an applicable SB approved by ANAC. This gives operators flexibility to install later, more mature software loads without needing a separate CASA approval for each version, provided the SB has ANAC approval.

Duty to maintain records: although not explicitly stated in the directive, the general obligation under Civil Aviation Regulations requires the operator to maintain records of all maintenance actions, including functional test results and software installation, in the aircraft's maintenance records. These records must be presented to CASA upon request.

Right to seek alternative means of compliance: the directive does not mention alternative means of compliance (AMOC). However, under the general framework of airworthiness directives in Australia (typically CAR 39 or CASR Part 39), an operator may apply to CASA for approval of an alternative method that provides an equivalent level of safety. The directive's silence does not preclude this, but the operator would need to demonstrate that the alternative addresses the latent failure condition.

No right to derogate for operational reasons: there is no provision for waiving the 30 June 2009 deadline for the software upgrade due to maintenance delays, parts unavailability, or financial hardship. If the operator cannot install the software by that date, the aircraft becomes unairworthy and cannot be operated.

The directive itself does not specify penalty amounts, but non-compliance with an airworthiness directive is a breach of the Civil Aviation Regulations. The applicable penalty regime is set out in the Civil Aviation Act 1988 and the regulations made under it. Under section 23 of the Act, a person who contravenes a regulation (including an AD) is guilty of an offence punishable by a fine of up to 50 penalty units for a natural person and 250 penalty units for a body corporate (as at 2008, one penalty unit was $110, so the maximum fine for a corporation would be $27,500). More severe penalties apply if the contravention causes or is likely to cause a risk to safety: up to 2 years imprisonment under section 23B of the Act. CASA also has administrative powers: it may suspend or cancel the aircraft's certificate of airworthiness, issue a direction to ground the aircraft, or impose a civil penalty (infringement notice) of up to 1,000 penalty units for a body corporate under the Regulatory Powers (Standard Provisions) Act 2014. The enforcement body is CASA, which may conduct surveillance of maintenance records, inspect aircraft, and audit operators. The directive was signed by a CASA delegate, indicating that CASA has determined the condition is safety-critical and likely to enforce strictly. The background states that the undetected failure condition "may affect the safety of the aeroplane," which justifies immediate regulatory action. History of prior amendments suggests that operators who did not complete the terminating action by the earlier deadlines prompted CASA to amend the directive rather than enforce immediately, but Amendment 4 grants a final 12-month extension. Operators who still fail to install the software by 30 June 2009 can expect enforcement action rather than a further amendment. There is no indication in the source of any previous enforcement action taken under this directive. However, the existence of four amendments within 14 months (original effective April 2007 to Amdt 4 effective June 2008) suggests that CASA was responsive to industry feedback and ANAC changes, not that enforcement was lax. The compliance date of 30 June 2009 is likely treated as a hard deadline.

This airworthiness directive is made under the Civil Aviation Regulations (most likely Civil Aviation Regulation 1988 or Civil Aviation Safety Regulation Part 39). It operates as a mandatory continuing airworthiness requirement. It takes priority over any less restrictive maintenance schedules contained in the aircraft maintenance manual, the operator's approved maintenance program, or other CASA-approved documents. For example, if the maintenance program allows a functional test of the FGCS every 1,200 hours, the AD overrides that and requires testing every 600 hours (or more frequently if the 300-hour initial interval applies). The directive also interacts with the certification basis of the ERJ-170. The aircraft was originally certified by the Brazilian CTA (now ANAC) and validated by CASA. The AD addresses a design defect in the Primus EPIC software load; by making the software installation mandatory, it effectively acts as a retrofit to the type design. This engages regulation 21.06 of the Civil Aviation Safety Regulations regarding design approvals and supplementary type certificates. The service bulletins referenced in the AD (SB 170-22-0003 and SB 170-31-0019) must be ANAC-approved; CASA does not independently approve them but accepts ANAC's approval. This cross-border reliance is enabled by bilateral agreements between Australia and Brazil. The directive explicitly cross-references ANAC AD 2006-11-02R3, creating a harmonised compliance framework. However, the Australian AD contains its own compliance times (300 hours TIS, 600 hours interval, 30 June 2009) which may differ from the Brazilian AD. Operators with aircraft that operate internationally must comply with the most restrictive applicable AD. The directive also interacts with the operator's certificate of airworthiness. If the AD is not complied with, the CofA is no longer valid for flight, and operating the aircraft would contravene section 20A of the Civil Aviation Act (operating an unairworthy aircraft). The directive does not interact directly with state or territory laws; it is purely federal aviation law. It does not intersect with workplace health and safety laws except indirectly through safe operation. It does not interact with competition or trade practices laws except to the extent that the compliance costs may affect market entry for small operators. The directive also interacts with insurance policies: insurers typically require compliance with all ADs as a condition of coverage; non-compliance could void hull and liability insurance.

AD/ERJ-170/4 has undergone four amendments in a span of 14 months. The original issue became effective on 4 April 2007. It introduced the requirement for repetitive functional testing of the FGCS and presumably set an early terminating action date (not stated in this source, but likely 30 June 2008 based on the extension in Amdt 4). Amendment 1 effective 19 October 2007 continued the repetitive inspection requirement and added a terminating requirement: installation of software load version 19.3 or higher. It did not change the applicability or the test procedure. Amendment 2 effective 2 November 2007 changed the applicability of the directive to align with a similar change by the Brazilian ANAC. The source does not specify what the change was, but it likely expanded or refined the list of affected software load versions. Amendment 3 effective 5 June 2008 clarified how higher load versions of the Primus EPIC software could be installed. It added Notes 2 and 3 in the Requirement section, giving examples of version 19.4 and 21.2 and stating that installation terminates the repetitive test. Amendment 4 effective 18 June 2008 continues the repetitive inspection requirement but extends the terminating action date by 12 months (from the prior deadline to 30 June 2009). The background states: "This Amendment continues the repetitive inspection requirement but extends the terminating action date by 12 months." The original terminating action date is not explicitly stated in the source, but the fact that Amdt 4 pushes it to 30 June 2009 implies it had been 30 June 2008 or earlier. The amendment also adds Note 4 cross-referencing ANAC AD 2006-11-02R3. The signature block shows James Coyne as Delegate, dated 12 June 2008, with an effective date of 18 June 2008. This rapid amendment cycle indicates that CASA was closely tracking industry progress and ANAC's regulatory response. The need for four amendments suggests either that the initial compliance timeline was too tight, that software availability was delayed, or that the scope of affected aircraft had to be corrected. The pattern is one of iterative tightening and then relaxation: first requiring testing, then requiring a software fix by a deadline, then clarifying the fix options, then extending the deadline. This is a pragmatic approach, but it also imposes uncertainty on operators who must plan maintenance schedules without knowing whether deadlines will shift again.

The source contains no references to any litigation that has arisen from this directive. No part of the instrument has been judicially reviewed, and no operator has challenged the validity of the AD in the Federal Court or the Administrative Appeals Tribunal. Given the technical nature of airworthiness directives and the limited pool of ERJ-170 operators in Australia (likely only one or two airlines), litigation would be improbable unless a dispute arose over the interpretation of the compliance times or the reasonableness of the deadline. The directive does not involve criminal penalties directly; enforcement is through administrative action and civil penalties, which reduces the incentive for operators to litigate. If an operator wished to challenge the directive, they could seek merits review at the Administrative Appeals Tribunal under section 31 of the Civil Aviation Act (if classified as a reviewable decision) or seek judicial review in the Federal Court under the Administrative Decisions (Judicial Review) Act 1977. Grounds for challenge could include that CASA failed to consider the economic impact on operators, that the directive was beyond power, or that the delegate failed to provide reasons. However, courts generally afford CASA a wide margin of appreciation in safety matters. No published decisions on this AD exist. The lack of litigation should not be taken as evidence that the AD is non-controversial; rather, the compliance costs are borne by a small number of operators who may have chosen to comply rather than litigate. The delegation to a CASA officer rather than the board suggests that the directive is routine. If litigation did occur, it would be between the operator and CASA; the source does not provide any case names or citations. For the purposes of this analysis, the litigation history is nil.

Several provisions in this directive can trap an unwary operator or maintenance provider. The definition of functional test as a "quantitative check to determine if one or more functions of an item perform within specified limits" is more rigorous than a typical operational check. An operator who merely observes that the FGCS engages during a ground run without measuring parameters against SB limits has not satisfied the requirement. The test must follow the Embraer SB exactly; any deviation could be grounds for CASA to find non-compliance. The compliance time for the initial test is "within the next 300 hours time in service (TIS), after the first issue of an Australian Certificate of Airworthiness." For a newly registered aircraft that has previously operated under a foreign CofA, the 300-hour clock starts only when the Australian CofA is issued, not when the aircraft entered service in its previous jurisdiction. The test must be done within 300 hours TIS after that issuance. If the aircraft accumulates those hours quickly (e.g., in 30 days of airline operations), the operator must be ready to perform the test promptly. There is no provision for a one-time extension. The repetitive interval is 600 hours TIS; but if the terminating action is not accomplished by 30 June 2009, the aircraft becomes non-compliant even if a test was done within the previous 600 hours. The 30 June 2009 date is an absolute cutoff; no grace period is granted. The directive does not specify what happens if the software installation cannot be completed due to parts unavailability or the operator's financial constraints. The aircraft would be grounded. The examples of alternative software loads (19.4, 21.2) are not exhaustive. An operator installing a different version must ensure that the Embraer SB for that version has ANAC approval. The directive says "higher software load version in accordance with an Embraer SB approved by the ANAC." If ANAC has not yet approved the SB for a particular version, the operator cannot install it and must use a version with an approved SB. This could lock the operator into an older version if the newer version's SB is not yet approved. The directive also says that functional tests accomplished in accordance with earlier issues of this directive are acceptable. But it does not say the same for earlier revisions of the Embraer SB. The SB must be the original issue dated 9 November 2006 or a later ANAC-approved revision. If the operator performed a test to a revision not yet approved by ANAC, that test may not count. The cross-reference to ANAC AD 2006-11-02R3 means that operators must also monitor the Brazilian AD for any future changes, because if ANAC revokes their directive, CASA may still enforce its own AD until amended. The effective date of this amendment is 18 June 2008, but it was signed on 12 June 2008. There is a six-day gap; an operator who accomplished the terminating action between 12 June and 18 June using the old deadline might have complied early but still be on the hook for the repetitive test if the upgrade was not done by the old deadline. The background states that Amendment 3 became effective 5 June 2008, so operators had only 13 days to adjust before Amdt 4. Finally, the directive does not provide for a test of the software installation itself; it assumes that installation per the SB corrects the latent failure condition. The operator must verify the software load version after installation, but no test is required beyond that.

Step 1: Determine applicability. Check the aircraft logbook to identify the Primus EPIC software load version. Obtain the current software load from the aircraft's avionics. If the load is version 17.3, 17.4, 17.5, 17.6, or 17.7, the directive applies. If the load is already 19.3 or higher, the aircraft may still need to comply with the terminating action if it was installed before 30 June 2009; but if installed after the directive effective date, it should have been done per an approved SB. For aircraft with software loads outside the listed range (e.g., version 17.0 or 17.2), the directive does not apply.

Step 2: For aircraft to which the directive applies, determine whether a functional test has already been performed under a previous amendment. Check maintenance records for the test date and method. If a valid test was performed under the original issue, Amdt 1, 2, or 3, it counts toward compliance with Requirement 1 of Amdt 4. If not, schedule the first functional test within 300 hours TIS after the date of issue of the Australian Certificate of Airworthiness. If the aircraft already has an Australian CofA and has accumulated more than 300 hours TIS since it was issued, the test should be done as soon as practicable, preferably before the next flight.

Step 3: Perform the functional test following Embraer Service Bulletin 170-22-0003 (original issue 9 November 2006) or a later ANAC-approved revision. Obtain the SB from Embraer or an approved distributor. Ensure the maintenance person or organisation is authorised under Part 145. Document the test results, including measurements that show each FGCS channel engages within specified parameters. Retain the record in the aircraft's continuing airworthiness record system.

Step 4: Repeat the functional test every 600 hours TIS until the terminating action is accomplished. Calculate TIS accurately; do not rely on calendar days. If the aircraft cycles through 600 hours quickly, prepare for frequent downtime.

Step 5: Plan the software upgrade to Primus EPIC version 19.3 or higher. Select a version with an available ANAC-approved Embraer SB. For version 19.3, use SB 170-31-0019 (original issue 3 May 2007 or later approved revision). For version 19.4, use SB 170-31-0026 dated 5 October 2007. For version 21.2, use SB 170-31-0028 Revision 01 dated 14 January 2008. For any other version, confirm with Embraer or ANAC that the SB is approved. The installation must be completed on or before 30 June 2009. Do not assume an extension will be granted; no further amendments extending the date are mentioned.

Step 6: After installation, verify the software load version in the aircraft. Update the maintenance records accordingly. Note the terminating action date. The repetitive functional test is no longer required from the moment the software upgrade is installed. However, the operator may wish to continue periodic checks as part of the maintenance program for reliability monitoring.

Step 7: If the operator is unable to meet the 30 June 2009 deadline due to parts unavailability, maintenance capacity, or other reasons, apply to CASA for an alternative means of compliance under the relevant regulation (likely Part 39 of CASR). Provide evidence of the hardship and a plan for completing the upgrade by a later date. CASA may grant an approval on conditions. Note that the directive itself does not mention AMOC, but the general regulation allows it. Do not wait until June 2009 to begin this process.

Step 8: Maintain all records of functional tests and software installation for the life of the aircraft. Be prepared to show them during CASA audits. If the aircraft is sold or transferred, pass the compliance history to the new owner.