Annex C: Portable Electronic Flight Bag Evaluation Process

1. Introduction

1.1. This annex provides details of the evaluation process required prior to the use of EFB hardware and/or software on an aircraft. The associated checklists are provided in advisory Annex D and Annex E, respectively. If multiple software applications are being assessed, an Annex E checklist needs to be completed for each one.

2. Hardware

2.1 Stowage

2.1.1 The EFB shall be stowed during critical phases of flight, unless used with an approved mounting device or acceptable viewable stowage device.

2.1.2 Stowage requires an inherent means to prevent unwanted EFB movement. EFB stowage is required for all EFBs not secured in or on a mounting device. If an EFB mounting device is not provided (via viewable stowage or permanently installed mounts), then a verification must be performed to ensure that a suitable area has been designated to securely stow the EFB. This area must prevent the device from jamming flight controls, damaging flight deck equipment, or injuring flight crew members, in the event that the device moves about because of turbulence, maneuvering, or other action. The stowage area should not obstruct visual or physical access to controls and/or displays, flight crew ingress or egress, or external vision. For example, acceptable stowage locations for an EFB with no mount include the inside compartments of the pilot’s stowed flight bag.

2.2 Viewable Stowage Devices and Components

2.2.1 Viewable Stowage Devices and Components include items used to secure EFB hardware, which is viewable to the pilot (e.g., kneeboards, suction cups, removable trays, etc.). Viewable stowage devices and components must not interfere with flight control movement; obstruct visual or physical access to controls and/or displays, or flight crew ingress or egress. Viewable stowage should minimize blockage of the windshields to allow the pilots to maintain a clear view of critical outside references (e.g., during ground operations, taxiing, takeoff, approach and landing). Training and procedures should address specific and acceptable placement of viewable stowage devices.

2.2.2 With respect to the use of suction cups, training on the following best practices and procedures is recommended:

1. The suction cups and surfaces to which they will be attached should be properly cleaned with isopropyl alcohol or aircraft window cleaner prior to attachment of the suction cups;
2. Attachment surfaces should be substantially smooth and flat;
3. Periodic cleaning and reattachment should be performed, as appropriate, for the conditions of the environment in which they are used (e.g., dusty);
4. Suction cups should not be left attached to the aircraft windscreens for long periods of time; and
5. Suction cups should be replaced every six months, at a minimum, and more often, in extreme environments.

2.3 Cabling

2.3.1 Certification is required for any cabling that interfaces with the aircraft. The cabling should not hang loosely in a way that compromises task performance or safety. Flight crew members should be able to easily secure cables out of the way during aircraft operations. Cables should be of sufficient length to perform the intended function. Cables that are too long or too short could present an operational or safety hazard.

2.4 Data Connections

2.4.1 EFB systems may have data connectivity (wired or wireless) to other aircraft systems. The design of the interface should ensure that there is no possibility of the EFB adversely affecting the aircraft systems from which data is being acquired.

2.4.2 When connected to other aircraft data buses and/or communication systems, EFB operation and/or system failures should not adversely affect other installed aircraft systems.

2.4.3 When an EFB is connected (Wired/Wireless) to aircraft systems, aircraft systems and network security should be assessed in accordance with reference 3.2.h.

2.5. Mounting Provisions

2.5.1 Permanent mounting provisions and viewable stowage devices must meet all applicable certification requirements.

2.5.2 When utilizing permanent mounting provisions and/or viewable stowage devices, a verification should be performed to ensure that the EFB is positioned in a way that does not obstruct visual or physical access to aircraft controls and/or displays, flight crew member ingress or egress, or external vision. The design should allow the user easy access to the EFB controls and a clear view of the EFB display while in use. The following design practices should be considered:

1. The mount and associated mechanism should not impede the flight crew member in the performance of any task (normal, abnormal or emergency) associated with operating any aircraft system.
2. Mounts should be able to lock in position easily. Selection of positions should be adjustable enough to accommodate a range of flight crew member preferences. In addition, the range of available movement should accommodate the expected range of the user’s physical abilities (i.e., anthropometric constraints). Locking mechanisms should be of the low-wear type that will minimize slippage after extended periods of normal use. This includes the appropriate restraint of any device, when in use and under any foreseeable operating conditions.
3. A provision should be provided to secure, lock or stow the mount in a position out of the way of flight crew member operations, when not in use.
4. An unsafe condition must not be created when attaching any EFB control yoke attachment/mechanism or mounting device. For example, the weight of the EFB and mounting bracket combination may affect flight control system dynamics, even though the mount alone may be light enough to be insignificant. The equipment, when mounted and/or installed, should not present a safety-related risk or associated hazard to any flight crew member. A means to store or secure the device when not in use should be provided. Additionally, the unit (or its mounting structure) should not present a physical hazard in the event of a hard landing, crash landing or water ditching. EFBs and their power cords should not impede emergency egress (this may require a quick disconnect capability from power and data sources).

2.6 Position

2.6.1 If it has a stowed position, the EFB should be easily accessible when stowed. When the EFB is in use and is intended to be viewed or controlled, it should be within 90 degrees on either side of each pilot’s line of sight.

2.6.2 The evaluation needs to consider the potential for confusion that could result from the presentation of relative directions, when the EFB is positioned in an orientation inconsistent with that information. For example, when displaying own-ship position, it may be misleading if the aircraft track is pointed to the top of the display and the display is not aligned with the aircraft longitudinal axis.

2.7 Reflection

2.7.1 In the position in which it is intended to be used, the EFB should not produce objectionable glare or reflections that could adversely affect the pilot’s visual environment.

2.8 Lighting

2.8.1 Users should be able to adjust the screen brightness of an EFB independently of the brightness of other displays on the flight deck. In addition, when automatic brightness adjustment is incorporated, it should operate independently for each EFB in the flight deck. Buttons and labels should be adequately illuminated for night use. Consideration should be given to the long-term display degradation as a result of abrasion and aging.

2.9 Readability

2.9.1 Text displayed on the EFB should be legible to the typical user at the intended viewing distance(s) and under the full range of lighting conditions expected on a flight deck, including use in direct sunlight.

2.10 Controls

2.10.1 All controls should be properly labelled for their intended function.

2.10.2 All controls should be within reach of the appropriate crew member seated normally on the fight deck.

2.10.3 In choosing and designing input devices, such as keyboards or cursor-control devices, applicants should consider the type of entry to be made and flight deck environmental factors, such as turbulence, that could affect the usability of that input device. Typically, the performance parameters of cursor control devices should be tailored for the intended application function, as well as for the flight deck environment.

2.11 Electrical Power Source

2.11.1 EFB implementation should consider the source of electrical power, the independence of the power sources for multiple EFBs, and the potential need for an independent battery source. Battery-powered EFBs having aircraft power available for recharging the EFB battery are considered to have a suitable backup power source. A procedure to ensure the safe recharge of the battery should be established. EFBs not having a battery power source are required to have the EFB connected to an aircraft power source.

2.11.2. Battery-Powered EFBs. Useful battery life should be established and documented for battery-powered EFBs. Each battery-powered EFB providing Type B EFB applications should have at least one of the following before departure:

1. an established procedure to recharge the battery from aircraft power during flight operations;
2. a battery or batteries with a combined useful battery life to ensure operational availability during taxi and flight operations, to include diversions and reasonable delays considering duration of flight; or
3. an acceptable mitigation strategy providing availability of aeronautical information for the entire duration of flight.

2.11.3 Battery Replacement. Battery replacement intervals should meet or exceed Original Equipment Manufacturer (OEM) recommendations. If the EFB manufacturer has not specified a battery replacement interval, then the original battery (or cell) manufacturer’s specified replacement interval should be adhered to.

2.11.4 Lithium Batteries. Rechargeable lithium-type batteries are becoming more common as a source of principal power or standby/backup power in EFBs. Lithium-ion or lithium polymer (lithium-ion polymer) batteries are two types of rechargeable lithium batteries commonly used to power EFBs. The word “battery” used in this TAA-OAA Advisory refers to the battery pack, its cells, Battery Management System (BMS) and its circuitry. The guidance that follows in the sub-sections assumes the EFB will:

1. only use batteries recommended by the manufacturer;
2. be recharged only by devices expressly designed for recharge of the specific battery and will be continuously monitored while being charged;
3. contain no more than four cells in series (less than or equal to 18-Volt output) (reference 3.2.k); and
4. use batteries rated for no more than 100 Watt-hours (Wh), as listed in the manufacturer’s specification, or calculated by multiplying the capacity in Ah by the maximum working (nominal performance) voltage.

Note: Contact DTAES 6-2 where planned usage of batteries between 101 to 160 Wh is anticipated (additional requirements will apply).

2.11.4.1 Safety Concerns

1. In general, batteries that are not physically or electrically abused, and operated within their environmental design limitations, provide a stable and safe power source. Quality control issues of commercially produced batteries also represent a failure risk. Mitigation of the safety concerns should be addressed by validating the presence of mitigating battery safety systems and procedures, as detailed in the Institute of Electrical and Electronic Engineers (IEEE) 1625-2008, IEEE Standard for Rechargeable Batteries for Multi-Cell Computing Devices (available internally, within DND, under AEPM RDIMS #1739431).
2. Abused batteries can be induced into thermal runaway by several means, including: over charging, shorting, rapid discharge, physical damage, crushing, puncturing and heating. Overheating may result in thermal runaway, which can cause the release of either molten lithium or a flammable electrolyte. Once one cell in a battery pack goes into thermal runaway, it produces enough heat to cause adjacent cells to also go into thermal runaway. The resulting fire can flare repeatedly as each cell ruptures and releases its contents.
3. For additional information on fighting fires caused by lithium-type batteries in portable electronic devices, refer to:
   1. IATA Lithium Batteries Risk Mitigation for Operators (available internally, within DND, under AEPM RDIMS #1739499); and
   2. FAA Safety Alerts for Operators (SAFO), Fighting Fires Caused by Lithium Type Batteries in Portable Electronic Devices (available internally, within DND, under AEPM RDIMS #1739492) and expanded information bulletin (available internally, within DND, under AEPM RDIMS #1739494).

2.11.4.2 Lithium Battery Safety and Testing Standards. Because of their proximity to the flight crew and potential hazard to the safe operation of the aircraft, the use of rechargeable lithium-type batteries in EFBs located in the aircraft flight deck must comply with certain international standards. Evidence that the batteries comply with the standards specified in subparagraph 2.11.4.2.a. and either: 2.11.4.2.b., 2.11.4.2.c., or 2.11.4.2.d. must be provided.

1. United Nations (UN) Transportation Regulations. UN ST/SG/AC.10/11/Rev.5, Recommendations on the Transport of Dangerous Goods, Manual of Tests and Criteria (Para 38.3) (available internally, within DND, under AEPM RDIMS #2065517);
2. Underwriters Laboratory (UL). UL 1642, Standard for Lithium Batteries (available internally, within DND, under AEPM RDIMS #2067839); UL 2054 (available internally, within DND, under AEPM RDIMS #1543757), Standard for Household and Commercial Batteries; and UL 60950-1, Information Technology Equipment – Safety;

Note:  Compliance with UL 2054 indicates compliance with UL 1642.

3. International Electrotechnical Commission (IEC). International Standard IEC 62133-2 (available internally, within DND, under AEPM RDIMS #206784), Secondary cells and batteries containing alkaline or other non-acid electrolytes – Safety requirements for portable sealed secondary cells and for batteries made from them, for use in portable applications.
4. RTCA/DO-311, Minimum Operational Performance Standards for Rechargeable Lithium Battery Systems. An appropriate airworthiness testing standard, such as the latest version of RTCA/DO-311, can be used to address concerns regarding overcharging, over-discharging, and the flammability of cell components. RTCA/DO-311 is intended to test permanently installed equipment; however, these tests are applicable and sufficient to test EFB rechargeable lithium-type batteries. If RTCA/DO-311 is used, then RTCA/DO-311, Table 4-1, and Appendix C, Additional Resources, should be used for guidance on applicable testing.

2.11.4.3 Showing Compliance. Proof of compliance to the requirements in 2.11.4.2, should be sought and retained, from credible sources (e.g., EFB manufacturer, battery OEM, etc.).

2.11.4.4 Rechargeable Lithium-Type Battery Maintenance, Spares, Storage, and Functional Check. Documented maintenance procedures for selected rechargeable lithium-type batteries should be available. These procedures should meet or exceed the OEM’s recommendations. These procedures should address battery life, proper storage and handling, and safety. There should be methods to ensure the rechargeable lithium-type batteries are sufficiently charged at proper intervals and have periodic functional checks to ensure they do not experience degraded charge retention capability or other damage due to prolonged storage. These procedures should include precautions to prevent mishandling of the battery, which could cause a short circuit, damage, or other unintentional exposure or possibly resulting in personal injury or property damage. All replacements for rechargeable lithium batteries and chargers should be sourced from the OEM and repairs cannot be made.

2.11.5 Use of Aircraft Electrical Power Sources

2.11.5.1 EFBs may connect directly to aircraft power through a certified power source. Appropriate labels should identify the electrical characteristics (e.g., 28 VDC, 1,500 mA, 60 or 400 Hz) of electrical outlets for EFB electrical connections.

2.11.5.2 The electrical load analysis (ELA) may need to be updated when new power sources are being added that are not currently included in the existing ELA.

2.11.5.3 A means (other than a circuit breaker) for the flight crew member to de-power the EFB power source or system charger should be provided.

2.12 Interference with Other Aircraft Systems

2.12.1 EFBs must demonstrate that they meet appropriate environmental qualification standards for radiated emissions for equipment operating in an airborne environment. Any EFB used in aircraft flight operations should be demonstrated to have no adverse impact on other aircraft systems (non-interference). The WSM Staff may accomplish the testing and validation to ensure proper operation and non-interference with other installed systems.

2.12.2 EFB Electromagnetic Compatibility (EMC) Demonstration. The WSM must demonstrate that all EFB components, including cords/cables for data or power, are electromagnetically compatible with aircraft navigation and communication systems in all phases of flight. This is accomplished via one of the methods described in paragraphs 2.12.3 or 2.12.4.

2.12.3 PED-Tolerant Aircraft (Method 1). Aircraft demonstrated as PED-tolerant for both transmitting and non-transmitting PEDs do not require specific aircraft EMC ground or flight tests. Aircraft PED tolerance may be demonstrated using guidance provided in TAA Advisory 2015-02 – Demonstrating Aircraft E3 Tolerance to Electronic Devices (Reference 3.2.g).

2.12.4 Aircraft EMC Tests (Method 2). This method should be used if the aircraft are not determined to be PED-tolerant in paragraph 2.12.3.

2.12.4.1 Radio Frequency (RF) Emissions. The WSM should obtain the RF emissions characteristics of the PED through RTCA/DO-160, Environmental Conditions and Test Procedures for Airborne Equipment, Section 21, Emission of Radio Frequency Energy; RF emissions tests; or an equivalent RF emissions test standard. If this data is not readily available, the PED can be sent to AETE for evaluation. DTAES 6-2 has a data base of previously qualified PEDs, and should be consulted prior to engaging AETE. Experience has shown successful qualification provides high assurance that the equipment will not interfere with aircraft radios or other aircraft electrical or electronic equipment or systems.

2.12.4.2 Charging Tests. If it is intended to allow charging of EFBs during flight, then the test setup should include testing under charging conditions. If it is intended to allow EFBs to charge in-flight and RF emissions test data is not available, then either a retest of the PED under the charging conditions or the performance of EMC ground tests according to paragraph 2.12.4.3 is recommended.

2.12.4.3 EMC Ground Tests. Perform aircraft EMC ground tests, if the PED’s RF emissions test data reveals potential for interference, or if complete RF emissions data during all intended operating conditions is lacking. Configure the aircraft as prepared for taxi with doors and access panels closed, and ground-based electrical power disconnected. Power for the aircraft electrical and electronic systems should be from the aircraft generator(s) during testing. A PED EMC Test Plan is available in Annex B of the document referenced in 3.2.f.

Note: The aircraft EMC ground tests should demonstrate the EFB’s electromagnetic compatibility with aircraft navigation and communication systems for each aircraft make, model and series (M/M/S) in which the EFB will operate. The specific EFB equipment should be operated on the aircraft to show no interference occurs with aircraft equipment. The aircraft EMC tests should demonstrate RF emissions from the equipment do not interfere with safety-related aircraft systems, particularly aircraft radio receivers and aircraft systems required by regulations, such as flight data recorders (FDR). These EMC tests are based on a source-victim matrix, where the EFB is the potential source of interference and the safety-related aircraft systems and aircraft systems required by regulations are the potential victim systems. The operating modes for the EFB and the potential interference victim systems are defined in the source-victim matrix. Special test equipment might be required to simulate in-flight operating conditions.

1. If RF emissions tests have been performed using RTCA/DO-160, Section 21, the aircraft radio receiver channels should be selected based on inspection of the emissions test results in the aircraft radio receiver frequency bands.
2. Certain radio receivers with no direct indication of receiver performance, such as transponders and Global Navigation Satellite Systems (GNSS), might require specific procedures or instrumentation to determine acceptable performance.
3. If the EFB includes a transmitter, such as a WiFi, cellular, or Bluetooth transmitter, it must be demonstrated that the EFB transmitter will not adversely affect other aircraft systems during the aircraft EMC ground tests. The EFB transmitters must be configured for such tests.
4. If the EFB will connect to the aircraft for power or battery charging, then the EMC ground tests should be performed with the EFB connected to the aircraft power source.

2.12.5 Aircraft EMC Flight Tests. If EMC ground tests conducted under paragraph 2.12.4 cannot adequately simulate the in-flight environment, or when the systems being evaluated for susceptibility cannot be operated on the ground, then additional EMC flight-testing should be conducted.

Note: EMC flight-testing, if necessary, should be conducted during visual meteorological conditions (VMC).

2.13 Environmental Aspects other than E3

2.13.1 EFBs should perform their intended functions when used within their defined concept of operations (CONOPS). Given that the EFBs are typically off-the-shelf equipment, the OEM specification will describe the EFB environmental envelope. Since portable EFBs are not installed equipment and do not form part of the type certified aircraft, there is no requirement to perform a complete suite of RTCA DO-160 testing. The only exception is the requirement to conduct rapid decompression testing as detailed in 2.13.3.

2.13.2 The OEM environmental specifications are accepted without further testing. However, the fleet will need to ensure and satisfy the OAA that:

1. the OEM environmental specifications will satisfy the intended CONOPS; and
2. where appropriate, the Operational Risk Analysis, required in Annex F, considers the impact of utilizing EFBs outside of the OEM specification due to probable aircraft system failure conditions (e.g., loss of all cabin heating) and addresses associated restrictions, limitation or mitigating strategies.

2.13.3 Worldwide aviation authorities have agreed that, for pressurized aircraft, the effects of a rapid decompression need to be assessed. Therefore:

1. Testing for rapid decompression must be accomplished to confirm that:
   1. given the close proximity of the EFB to the flight crew, it does not pose safety hazards to the flight crew during a rapid decompression; and
   2. for EFBs that host applications that are required by the CONOPS to be used during flight following a rapid decompression in pressurized aircraft, those functionalities remain available for operational use.
2. Rapid decompression testing should be conducted in accordance with Mil-Spec 810F, Defence Standard 00-35, or RTCA/DO-160, Section 4, up to the maximum operating altitude of the aircraft in which the EFB is to be used. It is the responsibility of the Fleet and/or Fleet WSM seeking approval to obtain and retain documentation that these tests have been successfully accomplished (a finding of compliance is not required).

3. Software Application Evaluation

3.1. Responsiveness of Application

3.1.1 The system should provide feedback to the user, when user input is accepted.

3.1.2 If the system is busy with internal tasks that preclude immediate processing of user input (e.g., calculations, self-test, or data refresh), the EFB should display a system busy indicator (e.g., clock icon) to inform the user that the system is occupied and cannot process inputs immediately. The timeliness of system response to user input should be consistent with an application’s intended function. The feedback and system response times should be predictable to avoid flight crew distractions and/or uncertainty.

3.2 Readability

3.2.1 Text size and font for each application should ensure readability at the intended viewing distance, and page layout should ensure clarity and prevent any ambiguity.

3.2.2 If the document segment is not visible in its entirety in the available display area, such as during zoom or pan operations, the existence of off-screen content should be clearly indicated in a consistent way. For some intended functions it may be unacceptable if certain portions of documents are not visible. This should be evaluated based on the application and intended operational function. If there is a cursor, it should be visible on the screen at all times while in use.

3.2.3 If the electronic document application supports multiple open documents, or the system allows multiple open applications, indication of which application and/or document is active should be continuously provided. The active document is the one that is currently displayed and responds to user actions. Under non-emergency, normal operations, the user should be able to select which of the open applications or documents is currently active. In addition, the user should be able to find which flight deck applications are running and switch to any one of these applications easily. When the user returns to an application that was running in the background, it should appear in the same state as when the user left that application – other than differences associated with the progress or completion of processing performed in the background.

3.3 Colours

3.3.1 EFBs are not certified to provide airworthiness warnings and cautions, however, they do provide important situational/contextual information. As such, the color RED should be used only to indicate a warning level condition, and the color AMBER should be used to indicate a caution level condition. Any other color may be used for items other than warning or caution conditions, providing that the colors used differ sufficiently from the colors prescribed to avoid possible confusion.

3.4 Messages

3.4.1 EFB messages and reminders should be clear and unambiguous. Messages should present minimum distraction to the flight crew. Messages should be prioritized and the message prioritization scheme evaluated and documented.

3.5 User Interface

3.5.1 The EFB user interface should provide a consistent and intuitive user interface within and across various EFB applications. The interface design, including, but not limited to, data entry methods, color-coding philosophies and symbology, should be consistent across the EFB and various hosted applications. These applications should also be compatible with other flight deck systems.

3.6 Data Entry

3.6.1 If user-entered data is not of the correct format or type needed by the application, the EFB should not accept the data. An error message should be provided that communicates which entry is suspect and specifies what type of data is expected. The EFB system and application software should incorporate input error checking that detects input errors at the earliest possible point during entry, rather than on completion of a possibly lengthy invalid entry.

3.7 Possibility for Error/Confusion

3.7.1 The system should be designed to minimize the occurrence and effects of flight crew error and maximize the identification and resolution of errors. For example, terms for specific types of data or the format in which latitude/longitude is entered should be the same across systems. Data entry methods, color-coding philosophies and symbology should be as consistent as possible across the various hosted EFB applications. These applications should also be compatible with other flight deck systems. Entered data should be displayed with the associated results of each calculation.

3.8 Workload

3.8.1 EFB software should be designed to minimize flight crew workload and head-down time. Complex, multi-step data entry tasks should be avoided during take-off, landing and other critical phases of flight. An evaluation of EFB-intended functions should include a qualitative assessment of incremental pilot workload, as well as pilot system interfaces and their safety implications. If an EFB is to be used during critical phases of flight, such as during take-off and landing, or during abnormal and emergency operations, its use should be evaluated during simulated or actual aircraft operations under those conditions.

Top of page

Back to TAA Advisory 2012-01