A Boeing 787's engines drive generators that make the plane's alternating-current (AC) electrical power. The generators are managed by small computers called generator control units (GCUs). Four main GCUs go with the engine-mounted generators.
Boeing told the US Federal Aviation Administration (FAA) about an issue found "during laboratory testing". A software counter inside each GCU "will overflow after 248 days of continuous power, causing that GCU to go into failsafe mode".
The danger was in the timing. If all four main GCUs had been powered up at the same time, they would all reach day 248 at the same time, and "all four GCUs will go into failsafe mode at the same time, resulting in a loss of all AC electrical power regardless of flight phase". The FAA added that losing all AC power "can result in loss of control of the airplane".
The FAA issued airworthiness directive AD 2015-09-07 on 23 April 2015; it was published and took effect on 1 May 2015. It skipped the usual comment period first, finding that "the risk to the flying public" justified it. Its fix was not new software. It was a repetitive maintenance task for electrical power deactivation: power the airplane down, at intervals not to exceed 120 days, well inside the 248-day limit.
The FAA estimated the directive covered 28 US-registered 787s, at 1 work-hour, or $85, per power-down. It called the rule "interim action": Boeing was developing a GCU software upgrade to fix the counter itself.
- 248 days of continuous power until the counter overflowed
- 4 main generator control units that could fail together
- At most 120 days between required power-downs
- 28 US-registered airplanes, at $85 per power-down
Why it matters: Counters and timers that only ever go up will one day hit their limit, and identical parts started together will hit it together. Ask how long your system can run without a restart, and test past that point, not just to it.