Page 12 Par 11
(5) Showing Compliance. The operator provides the principal inspector (PI) with records of compliance to these battery standards during the authorization to use the EFB. These records may be available from the battery’s Original Equipment Manufacturer (OEM).
(6) Rechargeable Lithium-Type Battery Maintenance, Storage, and Functional Check. Operators should have documented maintenance procedures for their rechargeable lithium-type batteries. These procedures should meet or exceed the OEM’s recommendations.
These procedures should address battery life, proper storage and handling, and safety. There should be methods to ensure that the rechargeable lithium-type batteries are sufficiently charged at proper intervals and have periodic functional checks to ensure that they do not experience degraded charge retention capability or other damage due to prolonged storage. These procedures should include precautions to prevent mishandling of the battery, which could cause a short circuit or other unintentional exposure or damage that could result in personal injury or property damage. All replacements for rechargeable lithium batteries must be sourced from the OEM and repairs must not be made.
(7) Use of Aircraft Electrical Power Sources. Appropriate labels should identify the electrical characteristics (e.g., 28VDC, 1500mA, 60 or 400Hz) of electrical outlets for Class 2 portable EFB electrical connections. Conduct an electrical load analysis to replicate a typical EFB to ensure that powering or charging the EFB will not adversely affect other aircraft systems and that power requirements remain within power load budgets. Additional actions and application of airworthiness regulations are not applicable to the internal elements of Class 1 and Class 2 EFBs unless specified in this AC. For guidance on the use of aircraft electrical power sources, refer to AC 20-173.
f. Environmental Hazards Identification and Qualification Testing. Certain environmental hazards must be evaluated for Class 1 and Class 2 EFBs to ensure their safe use in anticipated operating environments. Evaluate Class 1 and Class 2 EFB system RF emissions data needs in accordance with AC 91.21-1 and this AC. Class 1 and Class 2 EFBs should demonstrate that they meet appropriate industry-adopted environmental qualification standards for radiated emissions for equipment operating in an airborne environment (RTCA/DO-160, Environmental Conditions and Test Procedures for Airborne Equipment, or its equivalent). It is necessary to demonstrate that any Class 1 or Class 2 EFB used in aircraft flight operations will have no adverse impact on other aircraft systems (non-interference). The manufacturer, installer, or operator may accomplish the testing and validation to ensure proper operation and non-interference with other installed systems. Test for possible interference while moving a portable EFB about in the cockpit. Additionally, rapid decompression testing may need to be accomplished to demonstrate Class 1 or Class 2 EFB operation for use in pressurized aircraft.
(1) Non-EFB Non-Interference Testing. It is the user’s/operator’s responsibility to determine that the operation of a PED will not interfere in any way with the operation of aircraft equipment. AC 91.21-1 addresses non-interference testing for non-critical phases of flight only and is not adequate when an EFB is to remain powered (including being in standby mode) during critical phases of flight. Class 1 and Class 2 EFBs require the additional guidance for non-interference testing contained in subparagraph 11f(2), in addition to the guidance in AC 91.21-1.
Par 11 Page 13
(2) EFB PED Non-Interference Compliance Test Method. In order to operate a PED during all phases of flight, the user/operator is responsible for ensuring that the PED will not interfere in any way with the operation of aircraft equipment. The following methods are applicable to Class 1 and Class 2 EFBs that are to remain powered (including being in standby mode) during critical phases of flight. The user/operator may use either Method 1 or Method 2 for non-interference testing.
(a) The two following steps complete Method 1 for compliance with PED non-interference testing for all phases of flight.
1. Step 1 is to conduct an electromagnetic interference (EMI) test in accordance with RTCA/DO-160, section 21, category M. An EFB vendor or other source can conduct this Step 1 test for an EFB user/operator. An evaluation of the results of the RTCA/DO-160 EMI test can be used to determine if an adequate margin exists between the EMI emitted by the PED and the interference susceptibility threshold of aircraft equipment. If Step 1 testing determines that adequate margins exist for all interference (both front door and back door susceptibility), then Method 1 is complete. It is necessary to complete Step 2 testing if Step 1 testing identifies inadequate margins for interference, or either front door or back door susceptibility. (Front door emissions couple to aircraft system antennas by means of propagation through aircraft apertures such as doors and windows. Back door emissions couple to aircraft equipment, wires, and cables.)
2. Step 2 testing is specific to each aircraft model in which the PED will be operated. Test the specific PED equipment in operation on the aircraft to show that no interference of aircraft equipment occurs from the operation of the PED. Step 2 testing is conducted in an actual aircraft, and credit may be given to other similarly equipped aircraft of the same make and model as the one tested.
(b) Method 2 for compliance with PED non-interference testing for all phases of flight is a complete test in each aircraft using standard industry practices. This should be to the extent normally considered acceptable for non-interference testing of a PED in an aircraft for all phases of flight. Credit may be given to other aircraft of the same make and model equipped with the same avionics as the one tested.
(3) T-PEDs. In order to operate a T-PED in other than a non-critical phase of flight, the user/operator is responsible to ensure that the T-PED will not interfere with the operation of the aircraft equipment in any way. The following method is applicable to Class 1 and Class 2 EFBs that are to remain powered (including being in standby mode) during critical phases of flight.
Non-interference testing for T-PEDs consists of two separate test requirements.
(a) Test Requirement 1. Each T-PED should have a frequency assessment based on a representative sample of the frequency and power output of the T-PED. This frequency assessment should consider Federal Communications Commission (FCC) frequency standards and be in accordance with applicable processes set forth in RTCA/DO-294, Guidance on Allowing Transmitting Portable Electronic Devices (T-PEDs) on Aircraft. This frequency assessment must confirm that no interference of aircraft equipment will occur as a result of intentional transmissions from these devices.
Page 14 Par 11
(b) Test Requirement 2. Once a frequency assessment determines there will be no interference from the T-PED’s intentional transmissions, test each T-PED while operating using either Method 1 or Method 2 for basic non-interference testing requirements. This basic non-interference testing is applicable to both an EFB-integrated T-PED and a T-PED that is remote to an EFB. When an EFB has an integrated T-PED, complete the basic non-interference testing both with and without the T-PED function being operative. If a T-PED is located remotely from the EFB, the T-PED basic non-interference testing is independent from the EFB non-interference testing. T-PED position is very critical to T-PED non-interference testing.
Clearly define and adhere to the operating/testing locations of a T-PED in T-PED operating procedures.
(4) Rapid Decompression Testing.
(a) Environmental Tests. Other environmental testing, specifically testing for rapid decompression, may be necessary. Testing completed on a specific representative EFB make and model configuration may be applied to other EFBs of the same make and model. It is the responsibility of the operator to provide documentation that these tests have been accomplished on at least one representative sample of each make and model of the EFB. Representative testing is an appropriate level of testing for modern solid-state devices. The testing of operational EFBs should be avoided when possible to preclude the infliction of unknown damage to the unit during testing.
(b) Rapid Decompression Testing. Determining an EFB device’s functional capability requires rapid decompression testing when utilizing Type B software applications in pressurized aircraft, unless alternate procedures or a paper backup is available. When using only Type A applications on the EFB, rapid decompression testing is not required. The information from the rapid decompression test is used to establish the procedural requirements for the use of that EFB device in a pressurized aircraft. Rapid decompression testing must comply with RTCA/DO-160 guidelines for rapid decompression testing up to the maximum operating altitude of the aircraft in which the EFB is to be used. Similarity of a particular EFB to a unit already tested may be used to comply with this requirement. It is the responsibility of the operator to provide the rationale for the similarity.
1. Pressurized Aircraft. It is necessary to conduct rapid decompression testing for Class 1 and/or Class 2 EFB devices when the EFB has Type B applications and/or is used to remove paper-based aeronautical information in a pressurized aircraft in flight. When a Class 1 or Class 2 EFB has successfully completed rapid decompression while turned on, no mitigating procedure needs to be developed beyond dual redundancy. If a Class 1 or Class 2 EFB device demonstrates rapid decompression testing while turned off and is fully functional following rapid decompression, then procedures will need to be developed to ensure that one of the two EFBs onboard the aircraft remains off or configured so that no damage will be incurred should rapid decompression occur in flight above 10,000 feet mean sea level (MSL).
2. Unpressurized Aircraft. Rapid decompression testing is not required for a Class 1 or Class 2 EFB used in an unpressurized aircraft. The EFB must be demonstrated to reliably operate up to the maximum operating altitude of the aircraft. If EFB operation at maximum operating altitude is not attainable, procedures must be established to preclude
Par 11 Page 15 operation of the EFB above the maximum demonstrated EFB operation altitude while still maintaining availability of required aeronautical information.
g. EFB Mounting Devices. For guidance on the design and installation of EFB mounting devices, refer to AC 20-173.
h. Stowage Area for EFB. EFB stowage is required for all EFBs not secured in or on a mounting device. If an EFB mounting device is not provided, designate an area to stow the EFB.
Stowage requires an inherent means to prevent unwanted EFB movement when not in use. Do this in a manner that prevents the device from jamming flight controls, damaging flight deck equipment, or injuring flightcrew members should the device move about as a result of turbulence, maneuvering, or other action. The stowage area should not obstruct visual or physical access to controls and/or displays, flightcrew ingress or egress, or external vision. Acceptable stowage locations for a Class 1 EFB include the inside compartments of the pilot’s stowed flight bag.
i. Data Connectivity with Aircraft Systems (Wired or Wireless). For guidance on the design and installation of any EFB data connectivity with aircraft systems, either wired or wireless, refer to AC 20-173. Hardware and software for data connection provisions and interface protection devices must be incorporated into the aircraft type design per AC 20-173.
12. EFB SYSTEM DESIGN CONSIDERATIONS.
a. EFB System Design and Usability. It is necessary to evaluate the human factors/pilot interface characteristics of the EFB system. Special attention should be paid to new or unique features that may affect pilot performance.
b. Human/Machine Interface. The EFB user interface should be consistent and intuitive within and across various EFB applications. The interface design (including, but not limited to, data entry methods, color-coding philosophies, terminology, and symbology) should be consistent across the EFB and various hosted applications.
c. Legibility of Text. Text displayed on the EFB should be legible to the typical user at the intended viewing distance(s) and under the full range of lighting conditions expected on a flight deck, including use in direct sunlight. Users should be able to adjust the screen brightness of an EFB independently of the brightness of other displays on the flight deck. Brightness should be adjustable in fine increments. In addition, when incorporating an automatic brightness adjustment, it should operate independently for each EFB in the flight deck. Buttons and labels should have adequate illumination for night use. All controls must be properly labeled for their intended function. Consideration should be given to long-term display degradation as a result of abrasion and aging. The EFB should not produce objectionable glare or reflections that could adversely affect the pilot’s visual environment.
d. Electronic Display of Aeronautical Charts.
(1) Electronic aeronautical charts should provide a level of information comparable to paper charts.
Page 16 Par 12
(a) Visual, instrument, and aerodrome charts (refer to International Civil Aviation Organization (ICAO) Annex 4) that are depicted should contain the information necessary, in appropriate form, to conduct the operation at a level of safety that is at least equivalent to that provided by paper charts. The screen size and resolution must be demonstrated to display information in a comparable manner to paper aeronautical charts and the data it is intended to replace. The information should be equally readable to the paper chart it is replacing, in both light and dark conditions.
(b) The screen must display an instrument approach procedure (IAP) chart in an acceptable aeronautical chart format similar to a published paper chart. The screen must be large enough to show the entire standard format one-page IAP chart all at once, with a degree of legibility and clarity equivalent to that of a paper chart. This requirement is not meant to preclude panning and zooming features, but is intended to prevent a workload increase during the approach phase of flight. Alternate representations of IAP charts will need to be evaluated for operational suitability by the FSB process for functionality and human factors.
(c) Aeronautical navigation charts (i.e., visual flight rules (VFR) navigation charts, low and high altitude en route charts, and terminal procedure publications) will need to be evaluated for operational suitability by the FSB process. Panning, scrolling, zooming, rotating, or other active manipulation is permissible for these Type B applications. An EFB display may not be capable of presenting an entire aerodrome chart (airport diagram) if the chart is the expanded detail (fold over) type. In this case, a moving map centering feature (not own-ship position depiction or aircraft symbol) may be desirable. Aerodrome charts must include all information useful for airport operation. Any active manipulation (e.g., zooming, panning, or decluttering) should be easily returned to the default position. For a description of the requirements for AMMD, refer to AC 20-159.
NOTE: Software with an airworthiness approval performing an intended function of aeronautical charting as a replacement for paper could be utilized to support operational requirements without the need for further operational evaluation for use, provided it meets the EFB system design configuration considerations in this paragraph.
(2) The OSR/FSB report should include, but not be limited to, the following:
• Aeronautical information operational suitability;
• Pilot workload in both single-pilot-flown and multicrew-flown aircraft;
• Size, resolution, and legibility of symbols and text;
• Access to desired charts;
• Access to information within a chart;
• Grouping of information;
• General layout;
• Orientation (e.g., track-up, north-up);
• Depiction of scale information; and
• Training, checking, and currency requirement.
Par 12 Page 17
e. Responsiveness of Application. The system should provide feedback to the user when user input is accepted. If the system is busy for an atypical time with internal tasks that preclude immediate processing of user input (e.g., calculations, self-test, or data refresh), the EFB should display a “system busy” indicator (e.g., clock icon) to inform the user that the system is occupied and cannot process inputs immediately. The timeliness of system response to user input should be consistent with an application’s intended function. The feedback and system response times should be predictable to avoid flightcrew distractions and/or uncertainty.
f. Off-Screen Text and Content. If the document segment is not visible in its entirety in the available display area, such as during “zoom” or “pan” operations, the existence of off-screen content should be clearly indicated in a consistent way. For some intended functions it may be unacceptable if certain portions of documents are not visible. The basis of this evaluation should be on the application and intended operational function. If there is a cursor, it should be visible on the screen at all times while in use. The default position should be easily accessible after any active manipulation (e.g., zooming, panning, or decluttering).
g. Active Regions. Active regions are regions to which special user commands apply. The active region can be text, a graphic image, a window, a frame, or another document object. If the display uses active regions, these regions should be clearly indicated.
h. Managing Multiple Open Applications and Documents. The electronic document application should provide continuous indication of which application and/or document is active if the system supports multiple open documents, or if the system allows multiple open applications. The active document is the one that is currently displayed and responds to user actions. Under non-emergency, normal operations, the user should be able to select which of the open applications or documents is currently active. In addition, the user should be able to find which open flight deck applications are running and switch to any one of these open applications easily. When the user returns to an application that was running in the background, it should appear in the same state as when the user left that application, other than differences associated with the progress or completion of processing performed in the background.
i. Input Devices. All controls must be within reach of the appropriate crewmember seated normally on the flight deck. In choosing and designing input devices such as keyboards or cursor-control devices, operators should consider the type of entry to be made and flight deck environmental factors, such as turbulence and other normal vibrations that could affect the usability of that input device. Typically, the performance parameters of cursor-control devices are tailored for the intended application function as well as for the flight deck environment. Input devices should provide feedback to indicate when operational.
j. Flightcrew Workload. The EFB software design should minimize flightcrew workload and head-down time. The positioning, use, and stowage of the EFB should not result in unacceptable flightcrew workload. Avoid complex, multi-step data entry tasks during takeoff, landing, and other critical phases of flight. An evaluation of EFB intended functions should include a qualitative assessment of incremental pilot workload, as well as pilot system interfaces and their safety implications. If the intended function of an EFB includes use during critical phases of flight, such as during takeoff, landing, or abnormal and emergency operations, its use should be evaluated during simulated or actual aircraft operations under those conditions.
Page 18 Par 12
k. System Error Messages. If an application is fully or partially disabled, or is not visible or accessible to the user, it may be desirable to have a positive indication of its status available to the user upon request. Certain nonessential applications such as email connectivity and administrative reports may require an error message when the user actually attempts to access the function, rather than an immediate status annunciation when a failure occurs. EFB status and fault messages should be prioritized and the message prioritization scheme evaluated and documented.
l. Data Entry Screening and Error Messages. If user-entered data is not of the correct format or type needed by the application, the EFB should not accept the data. The EFB should provide an error message that communicates which entry is suspect and specifies what type of data it expects. The EFB system and application software should incorporate input error checking that detects input errors at the earliest possible point during entry, rather than on completion of a possibly lengthy invalid entry.
m. Error and Failure Modes.
(1) Flightcrew Error. The system design should minimize the occurrence and effects of flightcrew error and maximize the identification and resolution of errors. For example, terms for specific types of data or the format for entry of latitude/longitude should be the same across systems. Data entry methods, color-coding philosophies, and symbology should be as consistent as possible across the various hosted EFB applications.
(2) Identifying Failure Modes. The possible effects of undetected errors in each EFB application should be evaluated. The assessment should address the adequacy of the human/machine interface, accessibility of controls, ability to view controls, annunciations, displays and printers, and the effect on flightcrew workload and head-down time. The assessment should also consider the effects of flightcrew (procedural) errors determined by comments from the professional pilot community. The EFB system should be capable of alerting the flightcrew of probable EFB application/system failures.
n. Integrity Considerations. The operator must demonstrate that the EFB performs its intended functions. Additionally, data contained in the data files should be of sufficient integrity to perform the intended functions without producing false or hazardously misleading information. A process for continuous fault or anomaly reporting by the users is essential to an effective EFB program. This is initially accomplished through the evaluation process and the validation period. It is subsequently maintained through data updates and software revision procedures.
13. AUTHORIZATION PROCESS. The introduction and use of EFBs in the cockpit and cabin of parts 121, 125, and 135 operations require authorization from the PI. This requirement includes FAA evaluation of all operating procedures, pertinent training modules, checklists, operations manuals, training manuals, maintenance programs, minimum equipment lists (MEL), other pertinent documents, and reporting procedures.
a. Part 91F Operations. This guidance material also applies to operators of large and turbine-powered multiengine aircraft operating under part 91F where the operating regulations
Par 13 Page 19 require specific functionality and/or equipage. Part 91F operations do not require any specific authorization for EFB operations provided the EFB does not replace any system or equipment required by the regulations. This AC provides guidance for all EFB equipages. In order for a PED to be considered an EFB, its functions must conform to the guidance in this AC.
b. General Process for Approval or Acceptance. FAA Order 8900.1, Volume 3, Chapter 1, The General Process for Approval or Acceptance, and FAA Order 8900.1, Volume 4, Chapter 15, Electronic Flight Bag Authorization for Use, contain instructions for the completion of a five-phase process. The process leads to formal operational authorization and consists of the following five phases:
(1) Phase 1 of the process begins when an operator requests authorization from the FAA.
The FAA and the operator should reach a common understanding of what the operator must do, what role the FAA will have, and what reports and documents will be included as part of the authorization process.
(2) Phase 2 begins when the operator submits a plan to the FAA for formal evaluation.
During this phase, the FAA must ensure that the plan is complete and in an acceptable format before it can conduct a thorough review and analysis. The operator coordinates the plan with the PI or other inspectors, as assigned. The PI or other assigned inspectors will facilitate coordination with the AEG and the Aircraft Certification Office (ACO), as necessary.
(3) Phase 3 begins when the FAA starts its in-depth review and analysis of the operator’s plan for regulatory compliance, safe operating procedures, logical sequence, and other areas
(e.g., flightcrew and dispatcher qualifications, acceptable procedures, and schedules for accomplishment).
(4) Phase 4 is the major phase of the process and involves validation testing. In this phase, the operator conducts specific operations for the purpose of data collection or for FAA observation purposes. Phase 4 concludes when the operator provides sufficient proof to satisfy the FAA’s requirement for meeting all the plan objectives or when the operator is unable to complete them satisfactorily.
(5) Phase 5 begins after the successful completion (or termination) of the validation phase. In this phase, the FAA grants authorization for those elements in the plan that were successfully completed and documented in the FSB report, or sends the operator a letter of disapproval for those elements that were not completed or that were terminated. The PI grants authorization for the operational use of the EFB through the issuance of OpSpec A061, Use of Electronic Flight Bag. Refer to FAA Order 8900.1, Volume 3, Chapter 18, Section 3, Part A Operations Specifications—General.
c. Operator Responsibilities. In addition to close coordination with the local Flight Standards District Office (FSDO), certificate management office (CMO), and certificate management unit (CMU), to obtain authorization for EFB use, the following steps (in chronological order) are suggested:
(1) Make written application in a form and manner acceptable to the FAA.
Page 20 Par 13
(2) Demonstrate a fault and anomaly reporting process to ensure initial and continuing reliability for each EFB.
(3) Demonstrate that the radio magnetic interference/EMI tests have been performed satisfactorily.
(4) Demonstrate that the EFBs can be properly stowed, secured, and/or mounted in the aircraft.
(5) Demonstrate that any electronic receptacles used for connection of the EFB to an aircraft system have been installed using FAA-approved procedures.
(6) Demonstrate that successful rapid decompression testing has been accomplished, if applicable.
(7) Develop policies and procedures that may include, but are not limited to, the following:
• For single-pilot- and multicrew-flown aircraft, appropriate procedures for EFB use during all phases of flight;
• Procedures to follow when one unit fails (where multiple units are carried onboard the aircraft);
• Procedures to follow when all units fail (the procedures should specifically identify alternate means for obtaining data);
• A revision process procedure/method that ensures appropriate database accuracy and currency;
• Courseware to be used while conducting training;
• Procedures that document the knowledge of the user (e.g., training received, evaluation forms, test results);
• A list of the software and data loaded and maintained in each unit; and
• Instructions for continued airworthiness (ICA) in accordance with the manufacturer’s recommendations (also include these instructions in the inspection/maintenance program).
(8) Operators transitioning to a paperless or reduced-paper cockpit should carry paper backups of all the information on the EFB during a validation period. The backup information should be readily available to the crew. During this period the operator should validate that the EFB is as available and reliable as the paper-based system being replaced.
(9) For certificate holders, this validation period should include a 6-month operational test evaluation where the EFB system(s) will be available to the crew with all appropriate backup products. The backup products and the EFB are not used simultaneously during the evaluation period, but the backup products are available if needed. A reduction to the 6-month validation period may be considered if the certificate holder has previous experience with EFBs. A request to reduce the 6-month operational test evaluation requires approval from the Air Transportation Division (AFS-200). The certificate holder must submit a plan with justification to reduce the 6-month operational test evaluation to the FAA PI assigned with oversight responsibility for
Par 13 Page 21 subsequent coordination and review with the applicable AFS Regional Office (RO) and AFS-200.
(10) The operator will issue a final report detailing the training effectiveness, operational effectiveness, and reliability of the EFB.
d. Operational Procedures Development.
(1) EFB Intended Function. The intended function(s) of EFBs may vary depending on the device used and the software applications hosted by the computer. It is extremely important that the operator specifically define the intended EFB functions in a clear and concise manner.
Operational procedures developed to achieve a specific intended function or use should consider the applications listed in the attached appendices.
(2) Operator Responsibilities. Operators will be expected to:
(a) Have procedures that define expectations of how the flightcrew should use each EFB function during ground operations and under all flight conditions;
(b) Provide the procedures to flightcrews;
(c) Provide procedures for normal, abnormal, and emergency use; and
(d) Review and determine whether to modify those existing policies and procedures affected by the introduction of EFBs into line operations.
(3) Procedural Considerations.
(a) Procedures for Using EFBs with Other Flight Deck Systems. Flightcrew procedures will ensure that the flightcrew knows what aircraft system to use for a given purpose, especially when both the aircraft and EFB are providing similar information. Procedures should also be designed to define the actions to be taken when information provided by an EFB does not agree with that from other flight deck sources or when one EFB disagrees with another. If an EFB simultaneously displays information that an existing cockpit automation displays, procedures to identify which information source will be primary and which source will be secondary need to be developed (as well as procedures to identify under what conditions to use the backup source). Whenever possible and without compromising innovation in design and use, EFB/user interfaces should be consistent (but not necessarily identical) with the flight deck design philosophy.
(b) Flightcrew Awareness of EFB Software/Database Revisions. The operator should have a procedure in place to allow flightcrews to confirm the revision numbers and/or dates of EFB flight databases and software installed on their units for each flight. (Databases that do not adversely affect flight operations such as maintenance log forms, a list of airport codes, or a captain’s atlas, for example, do not require the confirmation of revision dates by flightcrews.)
An example of a date-sensitive revision is an aeronautical chart database on a 28-day revision cycle. Procedures should specify what action to take if the applications or databases loaded on an EFB are out-of-date.
Page 22 Par 13
(c) Procedures to Mitigate and/or Control Workload. Procedures that mitigate and/or control additional workloads created by using an EFB will need to be addressed.
(d) Defining Responsibilities for Performance Calculations. The operator should develop procedures that define any new roles that the flightcrew and dispatch may have in creating, reviewing, and using performance calculations supported by EFBs.
(e) Shutdown Procedures. Shutdown procedures for EFBs should:
• Be incorporated into normal flightcrew shutdown checklist procedures.
• Allow the EFB operating system and hosted applications to remain stable after multiple startups and shutdowns.
e. EFB Configuration Control. The operator’s EFB specification documents must list the make and model of the authorized EFB equipment and include at least the following configuration information, which is also required to support OpSpec A061:
(1) Operating system to include version control;
(2) Application program version control;
(3) Approved source for the database updates;
(4) Make and model of EFB hardware (see note); and
(5) Make and model of the EFB hardware, including a tracking process for major internal subcomponents whose replacement/upgrade may necessitate additional non-interference testing.
NOTE: Permanently sealed tablet computing devices that have no interchangeable internal parts are tracked by make and model or part number of the device hardware itself (e.g., Make: Apple/Model: A1396).
f. Mitigation Strategy. During the transition period to a paperless cockpit, an operator will need to establish a reliable backup means of providing the flightcrew with the information required by the regulations. During this period, an EFB must demonstrate that it produces records that are as available and reliable as those provided by the current paper information system. Operators should establish procedural mitigations to provide a reliable means of displaying information that is required by the operating rules to the flightcrew. This will ensure an equivalent level of safety and integrity to that of the current paper-based products. Mitigation may be accomplished by a combination of the following:
(1) System design;
(2) Separate and backup power sources;
(3) Redundant EFB applications hosted on different EFB platforms;
(4) Paper products accessible for use by crewmembers; and/or
Par 13 Page 23
(5) Procedural means.
g. Procedural Mitigations. If one or more onboard EFBs fail, resulting in loss of function or the presentation of false or hazardously misleading information, a contingency plan or process will need to be in place to provide the required information. For example, as a backup to eliminating printed approach charts, an acceptable transition to a paperless cockpit could include the following:
• Carrying paper products for a given time period to validate EFB reliability by quantitative means;
• Using a printing device to print all applicable data required for the flight; or
• Using an aircraft fax machine to uplink equivalent paper documents to the cockpit.
h. Removal of Paper-Based Information. The risk mitigation process must be completed prior to removal of the paper-based information associated with a particular EFB application.
These requirements also apply to an operator who intends to begin operation of any aircraft type without paper-based information.
i. Database Update Process.
(1) The operator needs to establish a method for revising EFB databases. The method of data revision should ensure integrity of the data that the operator loads and not negatively impact the integrity of the EFB operation. Especially when using internet and/or wireless means, procedures must exist to protect the EFB data from corruption. Database revisions do not include application software or operating system changes. Application software and/or operating system program changes must be controlled and tested prior to use in flight. Operators should not perform database and/or application software changes during operations (taxi, takeoff, in-flight, and landing).
(2) Operators also need to establish revision control procedures so that flightcrews and others can ensure that the contents of the database are current and complete. These revision control procedures may be similar to the revision control procedures used for paper or other storage media. For data that is subject to a revision cycle control process, it should be readily evident to the user which revision cycle is currently loaded into the EFB.
j. Software Revision Process.
(1) It is the responsibility of the operator and/or the application software vendor to ensure that its operating system and Type A and Type B application programs meet the intended function. Unauthorized modification of any database or the loading of any new or additional software intended for operational use is not permitted unless that software can be demonstrated to comply with the original intended use. For Type C applications, operators should use FAA-approved Service Bulletins (SB) or the minor change process defined in the current edition of AC 21-40, Guide for Obtaining a Supplemental Type Certificate, or FAA Order 8110.4, Type Certification. In addition to the operator’s responsibilities described above, it is the responsibility of the pilot in command (PIC) to verify that any EFB depiction of an en route, terminal area, approach, airport map, or sectional is current and up-to-date. One means for doing this is to