AMC1 SPA.EFB.100(b)(1) Use of electronic flight bags (EFBs) – Operational approval

RISK ASSESSMENT

(a) General

Prior to the use of any EFB system, the operator should perform a risk assessment for all type B EFB applications and for the related EFB hardware, as part of its hazard identification and risk management process.

If an operator makes use of a risk assessment established by the software developer, the operator should ensure that its specific operational environment is taken into account.

The risk assessment should:

(1) evaluate the risks associated with the use of an EFB;

(2) identify potential losses of function or malfunction (with detected and undetected erroneous outputs) and the associated failure scenarios;

(3) analyse the operational consequences of these failure scenarios;

(4) establish mitigating measures; and

(5) ensure that the EFB system (hardware and software) achieves at least the same level of accessibility, usability, and reliability as the means of presentation it replaces.

In considering the accessibility, usability, and reliability of the EFB system, the operator should ensure that the failure of the complete EFB system, as well as of individual applications, including corruption or loss of data, and erroneously displayed information, has been assessed and that the risks have been mitigated to an acceptable level.

This risk assessment should be defined before the beginning of the trial period and should be amended accordingly, if necessary, at the end of this trial period. The results of the trial should establish the configuration and use of the system. Once the operator has been granted the operational approval for the use of the related EFB applications, it should ensure that the related risk assessment is maintained and kept up to date.

When the EFB system is intended to be introduced alongside a paper-based system, only the failures that would not be mitigated by the use of the paper-based system need to be addressed. In all other cases, and especially when an accelerated introduction with a reduced trial period or a paperless use of a new EFB system is intended, a complete risk assessment should be performed.

(b) Assessing and mitigating the risks

Some parameters of EFB applications may depend on entries that are made by flight crew/dispatchers, whereas others may be default parameters from within the system that are subject to an administration process (e.g. the runway line-up allowance in an aircraft performance application). In the first case, mitigation means would mainly concern training and flight crew procedure aspects, whereas in the second case, mitigation means would more likely focus on the EFB administration and data management aspects.

The analysis should be specific to the operator concerned and should address at least the following points:

(1) The minimisation of undetected erroneous outputs from applications and assessment of the worst credible scenario;

(2) Erroneous outputs from the software application, including:

(i) a description of the corruption scenarios that were analysed; and

(ii) a description of the mitigation means;

(3) Upstream processes including:

(i) the reliability of root data used in applications (e.g. qualified input data, such as databases produced under ED-76/DO-200A, ‘Standards for Processing Aeronautical Data’);

(ii) the software application validation and verification checks according to relevant industry standards, if applicable; and

(iii) the independence between application software components, e.g. robust partitioning between EFB applications and other airworthiness certified software applications;

(4) A description of the mitigation means to be used following the detected failure of an application, or of a detected erroneous output;

(5) The need for access to an alternate power supply in order to ensure the availability of software applications, especially if they are used as a source of required information.

As part of the mitigation means, the operator should consider establishing reliable alternative means to provide the information available on the EFB system.

The mitigation means could be, for example, one of, or a combination of, the following:

(1) the system design (including hardware and software);

(2) a backup EFB device, possibly supplied from a different power source;

(3) EFB applications being hosted on more than one platform;

(4) a paper backup (e.g. quick reference handbook (QRH)); and

(5) procedural means.

EFB system design features such as those assuring data integrity and the accuracy of performance calculations (e.g. a ‘reasonableness’ or ‘range’ check) may be integrated in the risk assessment to be performed by the operator.