CAT.GEN.MPA.141 Use of electronic flight bags (EFBs)

DEFINITIONS For the purpose of EFB use, the following definitions apply:

(a)Aircraft administrative communications (AAC): AAC are defined by ICAO as non-safety communications that are used by aeronautical operating agencies and are related to the business aspects of operating their flights and transport services. These communications are used for a variety of purposes, such as flight and ground transportation, bookings, deployment of crew, and aircraft or any other logistical purposes that maintain or enhance the efficiency of overall flight operations. AAC data links receive/transmit information that includes, but is not limited to, the support of EFB applications.

(b)Aeronautical operational control (AOC): AOC communications are defined by ICAO as communications required for the exercise of authority over the initiation, continuation, diversion or termination of flight for safety, regularity, and efficiency reasons.

BACKGROUND INFORMATION Further related information on EFB hardware and EFB applications can be found in the following documents:

(a)EASA AMC 20-25, Airworthiness considerations for EFBs;

(b)EASA CS-25, Book 2, AMC Subpart F, AMC 25.1309, System Design and Analysis;

(c)EUROCAE ED-14D/DO-160D (or later revisions) Environmental Conditions and Test Procedures for Airborne Equipment;

(d)EASA ETSO-C165A, Electronic Map Systems for Graphical Depiction of Aircraft Position;

(e)FAA AC 120-76(C), Authorization for an Electronic Flight Bag Program;

(f)FAA AC 120-78, Electronic Signatures, Electronic Recordkeeping, and Electronic Manuals;

(g)ICAO Doc 10020, Manual of Electronic Flight Bags (EFBs).

HARDWARE Before using a portable EFB, the following considerations should be assessed by the operator:

(a)General A portable EFB is a portable electronic device (PED) and may host type A and/or type B EFB applications. In addition, it may host miscellaneous software applications. Portable EFBs are controlled PEDs (C-PEDs). A portable EFB should be capable of operation autonomously inside and outside the aircraft. The mass, dimensions, shape, and position of the portable EFB should not compromise flight safety. The power supply of a portable EFB may be provided by aircraft sources through an adequate power source. If mounted or stowed, a portable EFB should be easily removable from its mounting device/viewable stowage device or attached to it, without the use of tools by the flight crew. Any locking devices used to prevent theft should be unlocked during flight. A portable EFB may be part of a system that contains EFB-installed resources which are part of the certified aircraft configuration. The intended functions of the EFB-installed components may be to mount the EFB onto the aircraft and/or connect it to other systems. Portable EFBs may be used in all phases of the flight if secured to a certified mount or securely attached to a viewable stowage device in a manner that allows its use. Portable EFBs that do not meet the above characteristics should be stowed during critical phases of the flight. However, this does not preclude a flight crew from using a portable EFB during restricted portions of the critical phases of flight to complete a task related to the safety of the flight on the condition that the device is continuously handheld and used only during a short period of time. When the task is completed, the device should be stowed again. Any EFB component that is either not accessible in the flight crew compartment by the flight crew members or not removable by the flight crew members should be installed as ‘certified equipment’ covered by a type certificate (TC), a change to a TC or a supplemental (S)TC.

(b)Characteristics and placement of the EFB display For a portable EFB, the considerations on the location of the display proposed below should apply to the proposed location of the display when the EFB is in use. The EFB display and any other elements of the EFB system should be placed in such a way that they do not unduly impair the flight crew’s external view during any of the phases of the flight. Equally, they should not impair the view of or access to any flight-crew-compartment control or instrument. The location of the display unit and the other EFB system elements should be assessed for their possible impact on egress requirements. When the EFB is in use (intended to be viewed or controlled), its display should be within 90 degrees on either side of each flight crew member’s line of sight. Glare and reflection on the EFB display should not interfere with the normal duties of the flight crew.

(c)Power source If the aircraft is equipped with electrical power outlet(s) in the flight crew compartment, the operator should ensure that their certified characteristics are compatible with the intended use of the EFB system. The powering or charging of the EFB system should be compatible with the electrical characteristics of the power supplied by the outlets in terms of power consumption, voltage, frequency, etc., not to impair the EFB system or other aircraft systems.

(d)EFB data connectivity Portable EFBs may have data connectivity to aircraft systems, either wired or wireless, provided that the connections (hardware and software for data connection provisions) and adequate interface protection devices are incorporated into the aircraft type design. A portable EFB may receive any data from aircraft systems, but data transmission from EFBs should be limited to aircraft systems that have been certified for this intended purpose (refer to AMC 20-25 for more details).

(e)External connecting cables (to avionics and/or power sources) When external cables are used to connect a portable EFB to the aircraft systems and/or to a power source, the following should apply:

(1)cables should not hang loosely in a way that compromises task performance and safety; flight crew members should be able to easily secure the cables out of the way during operations (e.g. by using cable tether straps); and

(2)cables should be of sufficient length so that they do not obstruct the use of any movable device (e.g. flight controls, switches, seats, windows) in the flight crew compartment.

(f)Electromagnetic interference (EMI) demonstrations See paragraph (b), (c) and (d) of AMC1 CAT.GEN.MPA.140. The EMI demonstration should cover any cable connected to the EFB as well as non-certified power chargers.

(g)Batteries See paragraph (f) of AMC1 CAT.GEN.MPA.140.

(h)Viewable stowage The evaluation of the viewable stowage should be performed for a given location in the flight deck. This location should be documented and this information should be part of the EFB policy. The viewable stowage should not be positioned in such a way that it creates significant obstruction to the flight crew members’ view or hinders physical access to aircraft controls and/or displays and/or aircraft safety equipment, flight crew ingress or egress. The viewable stowage as positioned should allow the flight crew to retain a sufficiently extensive, clear, and undistorted view, to enable them to safely perform any manoeuvres within the operating limitations of the aircraft, including taxiing, take-off, approach, and landing. The design of the viewable stowage should allow the user easy access to any item of the EFB system, even if stowed, and notably to the EFB controls and a clear view of the EFB display while in use. The following design practices should be considered:

(1)The viewable stowage and associated mechanisms should not impede the flight crew members in the performance of any task (whether normal, abnormal, or emergency) associated with operating any aircraft system;

(2)When the viewable stowage is used to secure an EFB display, it should be able to be easily locked in position. If necessary, the selection of positions should be adjustable enough to accommodate a range of flight crew member preferences. In addition, the range of available movement should accommodate the expected range of users’ physical abilities (i.e. anthropometric constraints). Locking mechanisms should be of a low-wear type that will minimise slippage even after extended periods of normal use;

(3)The viewable stowage should be designed and installed so that it will sustain all foreseeable conditions relative to the flight environment (e.g. severe turbulence, hard landings) while retaining its structural integrity and without becoming detached. The use of restraints of the device should be considered where appropriate;

(4)A provision should be available to secure or lock the device in a position out of the way of flight crew operations when not in use. When stowed, the device and its securing mechanism should not intrude into the flight crew compartment space to the extent that they cause either visual or physical obstruction of flight controls/displays and/or ingress/egress routes;

(5)Possible mechanical interference issues of the viewable stowage, either on the side panel (side stick controller), or on the control yoke, in terms of full and free movement under all operating conditions and non-interference with buckles, etc., should be prevented;

(6)Adequate means should be provided (e.g. hardware or software) to shut down the portable EFB when its controls are not accessible by the flight crew members when strapped in the normal seated position; and

(7)The viewable stowage device should be easily removable from the aircraft without the use of tools. Some types of means for securing viewable stowage may have characteristics that degrade noticeably with ageing or due to various environmental factors. In that case, the documentation should include procedures (e.g. crew procedures, checks, or maintenance actions) to ensure that the stowage characteristics remain within acceptable limits for the proposed operations. Securing means based on vacuums (e.g. suction cups) have holding capacities that decrease with pressure. It should be demonstrated that they will still perform their intended function at operating cabin altitudes or in the event of a rapid decompression. In addition, it should be demonstrated that if the EFB moves or is separated from its stowage, or if the viewable stowage is unsecured from the aircraft (as a result of turbulence, manoeuvring, or other action), it will not jam flight controls, damage flight deck equipment, or injure flight crew members. The risks associated with an EFB fire should be minimised by the design and location of the viewable stowage.

VIEWABLE STOWAGE

(a)Viewable stowage devices have been involved in several reported incidents worldwide. The following issues should be considered by the operator when assessing the compliance of a viewable stowage device:

(1)The EFB or EFB stowage interfering with controls (e.g. side sticks, tillers, PTT switches, etc.);

(2)Stowage or EFB cables interfering with the opening of windows;

(3)Stowage or EFB cables interfering with the access to oxygen masks;

(4)The EFB falling during take-off, cruise, or landing, interfering with flight controls, disengaging the autopilot, or hurting the flight crew; and

(5)Suction cups detaching following a loss of pressurisation, adding to the crew’s workload.

(b)Guidance on the safety, reliability and usability of different viewable stowage solutions and on the related operating conditions can be found in a study published by the FAA. With regard to the specific example of suction cups, the following means of mitigation are recommended:

(1)The suction cups and the surface to which they will be attached should be properly cleaned with isopropyl alcohol or aircraft window cleaner prior to attachment of the suction cups;

(2)Attachment surfaces should be substantially smooth and flat;

(3)Periodic cleaning and reattachment should be performed, as appropriate, for the conditions of the environment in which they are used (dusty, etc.);

(4)Suction cups should not be left attached to the aircraft windscreen for long periods of time;

(5)Suction cups should be replaced every 6 months at a minimum, and, more often in extreme environments.

APPLICATION CLASSIFICATION An EFB software application is an application that is not part of the configuration of the certified aircraft and is installed on an EFB system to support flight operations. The classification of the applications, based on their respective safety effects, is intended to provide clear divisions between such applications and, therefore, between the assessment processes applied to each. For the purpose of the following process, ‘malfunction or misuse’ means any failure, malfunction of the application, or design-related human errors that can reasonably be expected in service.

(a)Determination of an application type:

AMC2 CAT.GEN.MPA.141(b) and AMC3 CAT.GEN.MPA.141(b) should be used to justify a classification, provided that the application does not feature design or functional novelties that introduce new forms of crew interaction or unusual procedures. An application may also be recognised as a type A or type B EFB application through an appropriate approval (e.g. ETSO authorisation) granted by EASA. If an application is not listed in AMC2 or AMC3 CAT.GEN.MPA.141(b), presents a high degree of novelty, or is not covered by an EASA approval (e.g. ETSO authorisation), the classification should be established using the definitions and criteria provided hereafter. As a first step, it should be verified that the application does not belong to the following list of applications that are not eligible for classification as either type A or type B EFB applications. Applications that:

(1)display information which is tactically used by the flight crew members to check, control or deduce the aircraft position or trajectory, either to follow the intended navigation route or to avoid adverse weather, obstacles or traffic during the flight;

(2)display information which may be directly used by the flight crew members to assess the real-time status of aircraft critical and essential systems, as a replacement for existing installed avionics, and/or to manage aircraft critical and essential systems following a failure;

(3)send data to air traffic services; are not eligible to be classified as either type A or type B EFB applications. Then, the next steps in this process should be to:

(1)identify any failure conditions resulting from potential losses of function or malfunction (with either detected or undetected erroneous outputs), taking into consideration any relevant factors (e.g. aircraft/system failures, operational or environmental conditions) and any established mitigation (e.g. flight crew procedures, flight crew training) that would intensify or alleviate the effects; and

(2)classify the application as follows, based on the assessment of the safety effect of each failure condition:

(i)if there is no failure condition that may have a safety effect, the application should be classified as a type A EFB application;

(ii)if one or several failure conditions with a safety effect that is limited to minor are identified, the application should be classified as type B;

(iii)if more severe failure conditions are identified, the application should not be eligible for classification as an EFB application. Software applications with failure conditions that are classified as more severe than minor are ineligible as type A or type B EFB applications. Notes: The severity of the failure conditions linked to displaying a function that already exists in the certified type design, or that is already authorised through an ETSO, and used with same concept of operation (considering the intended function but also operational means of mitigation), should be considered in the assessment of the severity of the failure condition of an application and cannot be less than the severity already assessed for this function. The data resulting from this process may be reused by the operators in the context of the EFB risk assessment process.

(b)Miscellaneous software applications Miscellaneous software applications are applications that support function(s) that are not directly related to operations conducted by the flight crew on the aircraft. Miscellaneous software applications are not considered to be EFB applications for the purposes of this AMC. Examples of miscellaneous software applications are web browsers (not used for operational purposes), email clients, picture management applications, or even applications used by ground crews (e.g. for maintenance purposes).

TYPICAL TYPE A EFB APPLICATIONS The following EFB application should be considered type A EFB applications:

(a)browsers that display:

(1)the certificates and other documents which are required to be carried by the applicable operational regulations, including digitally created documents such as:

(i)the certificate of registration;

(ii)the certificate of airworthiness (CofA);

(iii)the noise certificate, and its English translation if applicable;

(iv)the air operator certificate (AOC);

(v)the operations specifications relevant to the aircraft type, issued with the AOC;

(vi)the third-party liability insurance certificate(s); and

(vii)the aircraft continuing airworthiness records, including the technical log (flight crew view thereof);

(2)some manuals and additional information and forms which are required to be carried by the applicable operational regulations such as:

(i)notifications of special categories of passenger (SCPs) and special loads; and

(ii)passenger and cargo manifests, if applicable; and

(3)other information within the operator’s aircraft library such as:

(i)airport diversion policy guidance, including a list of special designated airports and/or approved airports with emergency medical service (EMS) support facilities;

(ii)maintenance manuals;

(iii)emergency response guidance for aircraft incidents involving dangerous goods (see ICAO Doc 9481-AN/928);

(iv)aircraft parts manuals;

(v)service bulletins/published airworthiness directives, etc.;

(vi)current fuel prices at various airports;

(vii)trip scheduling and bid lists;

(viii)passenger information requests;

(ix)examiner and flight instructor records; and

(x)flight crew currency requirements;

(b)interactive applications for crew rest calculations in the framework of flight time limitations;

(c)interactive forms to comply with the reporting requirements of the competent authority and the operator;

(d)applications that make use of aircraft administrative communications (AAC) to collect, process and then disseminate data that has no effect on the safe operation of an aircraft.

TYPICAL TYPE B EFB APPLICATIONS The following EFB applications should be considered type B EFB applications, provided that they do not feature design or functional novelties that introduce new forms of crew interaction or unusual procedures:

(a)Document browsers that display the manuals and additional information and forms required to be carried by regulations and that are necessary for the safe operation of the aircraft, such as:

(1)the operations manual (including the minimum equipment list (MEL) and configuration deviation list (CDL));

(2)the aircraft flight manual, or equivalent document;

(3)the operational flight plan;

(4)meteorological information with graphical interpretation;

(5)air traffic services (ATS) flight plan;

(6)notices to airmen (NOTAMs) and aeronautical information service (AIS) briefing documentation.

(b)Electronic aeronautical chart applications including en-route, area, approach, and airport surface maps.

(c)Airport moving map display (AMMD) applications.

(d)Applications that make use of the aeronautical operational control (AOC) communications to collect, process and then disseminate operational data.

(e)Aircraft performance calculation applications that use algorithmic data or that perform calculations using software algorithms to provide aircraft performance data such as:

(1)take-off, en-route, approach and landing, missed approach and other phases of flight, performance calculations providing limiting masses, distances, times and/or speeds, etc.;

(2)power settings, including reduced take-off thrust settings, etc.

(f)Mass and balance calculation applications used to establish the mass and centre of gravity of the aircraft and to determine that the load and its distribution are such that the mass and balance limits of the aircraft are not exceeded.

(g)Applications providing in-flight weather information.

TACTICAL USE The tactical use of an EFB application is considered to be related to short-term decision-making, while strategic use is related to long-term decision-making support.

HUMAN-MACHINE INTERFACE (HMI) FOR TYPE A EFB APPLICATIONS An HMI assessment is not required for a type A EFB application. However, type A EFB applications should be designed in accordance with the human factor principles in order to minimise their impacts on crew workload.