Appendix D to TAA Advisory 2012-01

Electronic Flight Bag Evaluation Process

1.   Introduction

1.1.    This Appendix gives details of the evaluation process required prior to the use of new EFB hardware and/or software on an aircraft. It should be noted that the associated evaluations specified in Appendix E, Appendix F, and Appendix G should be completed for each application to be installed in the EFB. The evaluation should consider the aspects below.

2.   Hardware

2.1.  Hardware Approval

2.1.1.   Hardware approval for PEDs to be used as Class 1 or Class 2 EFB devices shall be completed using the OAA-approved process in Regulatory Reference 3.2.1.c, para 314. If TAA approval of a Class 1 or Class 2 EFB installation is required, then it shall be limited to the additional Design Change approval required to incorporate the aircraft mounting device, stowage, power and data connections only.

2.2.   Stowage

2.2.1.   Stowage generally need only be considered for Class 1 units, as Class 2 and 3 devices are by definition mounted to the aircraft. If it is contemplated that Class 2 units may be removed from their mounting during flight operations then stowage considerations would also apply in this case.

2.2.2.   A stowage area with a securing mechanism for these EFBs is recommended for storage of portable units when they are not in use. Stowage provisions should be readily accessible by the crew in flight and should not cause any obstruction or hazard during foreseeable aircraft operations. EFB systems that are not secured in a mounting device during use should be designed and used in a manner that prevents the device from jamming flight controls, damaging flight deck equipment, or injuring flight crew members should the device move about as a result of turbulence, manoeuvring, or other action.

2.3.   Cabling

2.3.1.    Certification is required for any cabling associated with Class 2 or 3 devices. The cabling should not hang loosely in a way that compromises task performance or safety. Flight crew members should be able to easily secure cables out of the way during aircraft operations. Cables should be of sufficient length to perform the intended function. Cables too long or too short could present an operational or safety hazard.

2.4.   Power and Data Connections

2.4.1.   Class 1 EFB:
  1. Class 1 EFB systems may connect to aircraft power through a certified power source. An electrical load analysis should be conducted to replicate a typical Class 1 or 2 EFB system to ensure that powering or charging the EFB will not adversely affect other aircraft systems, and that power requirements remain within power-load budgets. A means (other than a circuit breaker) for the flight crew member to de-power the EFB power source or system charger should be provided.
  2. Class 1 EFB systems may have read only data connectivity to other aircraft systems. The design of the connection should ensure that there is no possibility of the EFB affecting the aircraft systems from which data is being acquired.
2.4.2.   Class 2 EFB:
  1. Class 2 EFB power connections and data connections both require Aircraft Certification approval. An electrical load analysis should be conducted to replicate a typical Class 1 or 2 EFB system to ensure that powering or charging the EFB will not adversely affect other aircraft systems, and that power requirements remain within power-load budgets. A means (other than a circuit breaker) for the flight crew member to de-power the EFB power source or system charger should be provided.
  2. Class 2 EFB data connections require Aircraft Certification approval to ensure non-interference and isolation from aircraft systems during transmission and reception. The EFB data connection may receive information from any aircraft system, as well as receive or transmit information for AAC purposes.
  3. When connected to other aircraft data buses and/or communication systems, EFB failures should not adversely affect other installed aircraft systems.
  4. Class 2 EFB power and data connectivity provisions that are installed by Supplemental Type Certificates (STC) may require an Aircraft Flight Manual Supplement (AFMS) update.

2.4.3.     Class 3 EFB must be approved by TAA Aircraft Certification and meet all applicable certification requirements.

2.5.     Mounting Provisions

2.5.1      This paragraph applies to Class 2 EFBs only as, by definition, Class 1 systems are not mounted to the aircraft and Class 3 systems are permanently installed. Mounting provisions must be approved by the TAA and must meet all applicable certification requirements.

2.5.2      The mounting device (or other securing mechanism) that attaches or allows mounting of the EFB system should ensure that the EFB is positioned in a way that does not obstruct visual or physical access to aircraft controls and/or displays, flight crew member ingress or egress, or external vision. The design of the mount should allow the user easy access to the EFB controls and a clear view of the EFB display while in use. The following design practices should be considered:

  1. The mount and associated mechanism should not impede the flight crew member in the performance of any task (normal, abnormal, or emergency) associated with operating any aircraft system.
  2. Mounting devices should be able to lock in position easily. Selection of positions should be adjustable enough to accommodate a range of flight crew member preferences. In addition, the range of available movement should accommodate the expected range of users' physical abilities (i.e., anthropometric constraints). Locking mechanisms should be of the low-wear type that will minimize slippage after extended periods of normal use. Crashworthiness considerations will need to be considered in the design of this device. This includes the appropriate restraint of any device, when in use.
  3. A provision should be provided to secure, lock, or stow the mount in a position out of the way of flight crew member operations when not in use.
  4. An unsafe condition must not be created when attaching any EFB control yoke attachment/mechanism or mounting device. For example, the weight of the EFB and mounting bracket combination may affect flight control system dynamics, even though the mount alone may be light enough to be insignificant. The equipment, when mounted and/or installed, should not present a safety-related risk or associated hazard to any flight crew member. A means to store or secure the device when not in use should be provided. Additionally, the unit (or its mounting structure) should not present a physical hazard in the event of a hard landing, crash landing, or water ditching. EFBs and their power cords should not impede emergency egress.

2.6.    Position

2.6.1     If it has a stowed position, the EFB should be easily accessible when stowed. When the EFB is in use and is intended to be viewed or controlled, it should be within 90 degrees on either side of each pilot's line of sight.

2.6.2.     If an EFB is being used to display flight critical information such as for navigation, terrain and obstacle warnings that require immediate action, take-off and landing V-speeds, or for functions other than situational awareness, then such information needs to be in the pilot's primary field of view. This requirement does not apply if the information is not being directly monitored from the EFB during flight. For example, an EFB may generate take-off and landing V-speeds, but these speeds are used to set speed bugs or are entered into the AFMS, and the airspeed indicator is the sole reference for the V-speeds. In this case, the EFB need not be located in the pilot's primary field-of-view. A 90-degree viewing angle may be unacceptable for certain EFB applications if aspects of the display quality are degraded at large viewing angles (e.g., the display colors wash out or the displayed color contrast is not discernible at the installation viewing angle). In addition, consideration should be given to the potential for confusion that could result from presentation of relative directions (e.g., positions of other aircraft on traffic displays) when the EFB is positioned in an orientation inconsistent with that information. For example, it may be misleading if own aircraft heading is pointed to the top of the display and the display is not aligned with the aircraft longitudinal axis. Each EFB should be evaluated with regard to these requirements.

2.7.     Reflection

2.7.1.     In the position in which it is intended to be used, the EFB should not produce objectionable glare or reflections that could adversely affect the pilot's visual environment.

2.8.     Lighting

2.8.1.     Users should be able to adjust the screen brightness of an EFB independently of the brightness of other displays on the flight deck. In addition, when automatic brightness adjustment is incorporated, it should operate independently for each EFB in the flight deck. Buttons and labels should be adequately illuminated for night use. Consideration should be given to the long-term display degradation as a result of abrasion and aging.

2.9.     Readability

2.9.1.     Text displayed on the EFB should be legible to the typical user at the intended viewing distance(s) and under the full range of lighting conditions expected on a flight deck, including use in direct sunlight.

2.10.   Controls

2.10.1.    All controls should be properly labelled for their intended function.

2.10.2.    All controls should be within reach of the appropriate crewmember seated normally on the fight deck.

2.10.3.    In choosing and designing input devices, such as keyboards or cursor-control devices, applicants should consider the type of entry to be made and flight deck environmental factors, such as turbulence, that could affect the usability of that input device. Typically, the performance parameters of cursor control devices should be tailored for the intended application function, as well as for the flight deck environment.

2.11.    Disabling of installed EFBs

2.11.1.     For installed EFBs, there should be a means other than a circuit breaker to disable the EFB in the event of unwanted operation, such as continuous flashing. Circuit breakers may not be used as switches.

2.12.    Interference with Other Aircraft Systems

2.12.1.     Class 1 and Class 2 EFB systems should demonstrate that they meet appropriate industry-adopted environmental qualification standards for radiated emissions for equipment operating in an airborne environment. Any Class 1 or Class 2 EFB used in aircraft flight operations should be demonstrated to have no adverse impact on other aircraft systems (non-interference). The manufacturer, installer, or operator may accomplish the testing and validation to ensure proper operation and non-interference with other installed systems. Possible interference when portable EFB systems are moved about in the cockpit should be addressed. Guidance for conducting interference testing of Transmitting Portable Electronic Devices may be found in RTCA DO-294C—Guidance on Allowing Transmitting Portable Electronic Devices (T-PEDs) on Aircraft. This assessment would be carried out as part of the PED hardware clearance process defined in the OAM, Paragraph 314.

2.13.    Rapid Depressurization Testing

2.13.1.     Testing for rapid depressurization should be performed on Class 1 and Class 2 devices intended to be used with Type B software applications during flight in pressurized aircraft. Since many Class 1 and Class 2 EFBs were originally commercial off-the-shelf (COTS) electronic systems adopted for aviation use, testing done on a specific EFB model configuration may be applied to other aircraft installations and these generic environmental tests need not be duplicated. It is the responsibility of the operator seeking approval to provide documentation that these tests have been accomplished. This assessment would be carried out as part of the PED hardware clearance process defined in the OAM, Para 314.

3.      Technical approval of installed software

3.1.     Responsiveness of Application

3.1.1.     The system should provide feedback to the user when user input is accepted.

3.1.2.     If the system is busy with internal tasks that preclude immediate processing of user input (e.g., calculations, self-test, or data refresh), the EFB should display a system busy indicator (e.g., clock icon) to inform the user that the system is occupied and cannot process inputs immediately. The timeliness of system response to user input should be consistent with an application‘s intended function. The feedback and system response times should be predictable to avoid flight crew distractions and/or uncertainty.

3.2.     Readability

3.2.1.     Text size and font for each application should ensure readability at the intended viewing distance, and page layout should ensure clarity and prevent any ambiguity.

3.2.2.     If the document segment is not visible in its entirety in the available display area, such as during zoom or pan operations, the existence of off-screen content should be clearly indicated in a consistent way. For some intended functions it may be unacceptable if certain portions of documents are not visible. This should be evaluated based on the application and intended operational function. If there is a cursor, it should be visible on the screen at all times while in use.

3.2.3.     If the electronic document application supports multiple open documents, or the system allows multiple open applications, indication of which application and/or document is active should be continuously provided. The active document is the one that is currently displayed and responds to user actions. Under non-emergency, normal operations, the user should be able to select which of the open applications or documents is currently active. In addition, the user should be able to find which flight deck applications are running and switch to any one of these applications easily. When the user returns to an application that was running in the background, it should appear in the same state as when the user left that application—other than differences associated with the progress or completion of processing performed in the background.

3.3.     Colours

3.3.1.     For any EFB system, EFB messages and reminders should meet requirements appropriate for the intended aircraft (e.g., sections 523.1322 or 525.1322 of the TCCA Canadian Aviation Regulation (CARs)). While the regulations refer to lights, the intent should be generalized to extend to the use of colors on displays and controls. That is, the color RED should be used only to indicate a warning level condition. AMBER should be used to indicate a caution level condition. Any other color may be used for items other than warnings or cautions, providing that the colors used differ sufficiently from the colors prescribed to avoid possible confusion.

3.4.     Messages

3.4.1.     EFB messages and reminders should be integrated with (or compatible with) presentation of other flight deck system alerts. EFB messages, both visual and auditory, should be inhibited during critical phases of flight. Flashing text or symbols should be avoided in any EFB application. Messages should be prioritized and the message prioritization scheme evaluated and documented. Additionally, during critical phases of flight, required flight information should be continuously presented without un-commanded overlays, pop-ups, or pre-emptive messages, except those indicating the failure or degradation of the current EFB application. However, if there is a regulatory or Technical Standard Order (TSO) requirement that conflicts with the recommendation above, those requirements supersede this guidance.

3.5.     Interface

3.5.1.     The EFB user interface should provide a consistent and intuitive user interface within and across various EFB applications. The interface design, including, but not limited to, data entry methods, color-coding philosophies, and symbology, should be consistent across the EFB and various hosted applications. These applications should also be compatible with other flight deck systems.

3.6.     Data Entry

3.6.1.     If user-entered data is not of the correct format or type needed by the application, the EFB should not accept the data. An error message should be provided that communicates which entry is suspect and specifies what type of data is expected. The EFB system and application software should incorporate input error checking that detects input errors at the earliest possible point during entry, rather than on completion of a possibly lengthy invalid entry.

3.7.     Possibility for Error/Confusion

3.7.1.     The system should be designed to minimize the occurrence and effects of flight crew error and maximize the identification and resolution of errors. For example, terms for specific types of data or the format in which latitude/longitude is entered should be the same across systems. Data entry methods, color-coding philosophies, and symbology should be as consistent as possible across the various hosted EFB applications. These applications should also be compatible with other flight deck systems. Entered data should be displayed with the associated results of each calculation.

3.8.     Workload

3.8.1.     EFB software should be designed to minimize flight crew workload and head-down time. Please see sections 523.1523, 525.1523, 527.1523, 529.1523 of the CARs, and the most current version of associated FAA AC 25.1523-1—Minimum Flight Crew for guidance. Much of the information in this AC is general and may prove useful for other aircraft categories as well. The positioning, use, and stowage of the EFB should not result in unacceptable flight crew workload. Complex, multi-step data entry tasks should be avoided during take-off, landing, and other critical phases of flight. An evaluation of EFB intended functions should include a qualitative assessment of incremental pilot workload, as well as pilot system interfaces and their safety implications. If an EFB is to be used during critical phases of flight, such as during take-off and landing or during abnormal and emergency operations, its use should be evaluated during simulated or actual aircraft operations under those conditions.