AMC 20-25AAirworthiness considerations for Electronic Flight Bags (EFBs)

1          PURPOSE AND SCOPE

This Acceptable Means of Compliance (AMC) is one, but not the only, means to obtain an airworthiness approval for installed electronic flight bags (EFBs) and for EFB installed resources.Additional guidance material can be found in ICAO Doc 10020 ‘Manual of Electronic Flight Bags’.

Operational considerations for the evaluation and approval of the use of EFB applications can be foundin Commission Regulation (EU) No 965/2012.

2          REFERENCE DOCUMENTS

2.1      Related Certification Specifications

CS 25.561, 25.777, 25.789, 25.1301, 25.1302, 25.1309, 25.1316, 25.1321, 25.1322, 25.1357, 25.1431, 25.1529, 25.1581

CS 23.2270, 23.2500, 23.2505, 23.2510, 23.2600, 23.2605, 23.2620

CS 29.1301, 29.1309, 29.1321, 29.1322, 29.1431, 29.1581

CS 27.1301, 27.1309, 27.1321, 27.1322, 27.1581

Appendix G to CS-23, Appendix H to CS-25, and Appendices A to CS-27 and CS-29: Instructions for Continued Airworthiness

EASA Special Condition: Information Security Protection of Aircraft Systems and Networks

2.2      Related Guidance Material

EASA AMC 25.1581Appendix 1 – Computerised Aeroplane Flight Manual

EASA AMC 25.1309System Design and Analysis

EASA AMC 25-11Electronic Flight Deck Displays

EUROCAE ED-130()Guidance for the Use of Portable Electronic Devices (PEDs) on Board Aircraft

EUROCAE ED-12() Software Considerations in Airborne Systems and Equipment Certification

EUROCAE ED-14D/DO-160D (or later revisions) Environmental Conditions and TestProcedures for Airborne Equipment

EUROCAE ED-76/RTCA DO-200A (or later revisions)Standards for Processing Aeronautical Data

EUROCAE ED-80()Design Assurance Guidance for Airborne Electronic hardware

FAA AC 120-76()Guidelines for the Certification, Airworthiness, and Operational Approval of Electronic Flight Bag Computing Devices

FAA AC 20-173Installation of Electronic Flight Bag Components

EASA ETSO-C165A/FAA TSO-C165AElectronic Map Systems for Graphical Depiction of Aircraft Position / Electronic Map Display Equipment for Graphical Depiction of Aircraft Position (Own-ship)

RTCA DO-178()Software Considerations in Airborne Systems and Equipment Certification

RTCA DO-254()Design Assurance Guidance for Airborne Electronic Hardware

RTCA DO-257()Minimum Operation Performance Standards for the Depiction of Navigational Information on Electronic Maps

RTCA DO-311()Minimum Operational Performance Standards for Rechargeable Lithium Battery Systems

TGM/21/07Electrical Wiring Policy for certification of large Aeroplanes, Engines and Propeller

3          GLOSSARY OF TERMS IN THE CONTEXT OF THIS AMC

3.1      Consumer device

Electronic equipment primarily intended for non-aeronautical use.

3.2      Data connectivity for EFB systems

Data connectivity for EFB system supports either uni- or bi-directional data communication between the EFB and other aircraft systems (e.g. avionics).

Direct interconnectivity between EFBs or direct connectivity between EFBs and ground systems as with a T-PED (e.g. GSM, Bluetooth) are not covered by this definition.

3.3      Electronic Flight Bag (EFB)

An electronic information system, comprised of equipment and applications for flight crew, which allows for the storing, updating, displaying, and processing of EFB functions to support flight operations or duties.

3.4      EFB host platform

When considering an EFB system, the EFB host platform is the equipment (i.e. hardware) in which the computing capabilities and basic software (e.g. operating system, input/output software) reside.

3.5      EFB software application

Software installed on an EFB system that provides specific operational functionality.

3.6      EFB system

An EFB system comprises the hardware (including any battery, connectivity provision, I/O devices) and software (including databases and operating system) that is needed to support the intended EFB application(s).

3.7       EFB system supplier

The company that is responsible for developing, or for having developed the EFB system or part of it. The EFB system supplier is not necessarily a host platform or aircraft manufacturer.

3.8      Mounting device

A mounting device is an aircraft certified part that secures portable or installed EFB, or EFB system components.

3.9      Portable Electronic Device (PED)

PEDs are any kind of electronic device, typically, but not limited to, consumer electronics that is brought on board the aircraft by crew members, passengers, or as part of the cargo, and that is not included in the configuration of the certified aircraft. It includes all equipment that is able to consume electrical energy. The electrical energy can be provided from internal sources such as batteries (chargeable or non-rechargeable), or the devices may also be connected to specific aircraft power sources.

3.10    Software application developer

The company responsible for developing, or for having developed a particular software application.

3.11    Transmitting PED (T-PED)

PEDs that have intended radio frequency (RF) transmission capabilities.

4          SYSTEM DESCRIPTION AND CLASSIFICATION OF EFB SYSTEMS

EFB hardware are classified in two categories: portable and installed.

4.1       Portable EFB

A portable EFB is a portable EFB host platform, that is used on the flight deck, and that is not part of the certified aircraft configuration.

Except for installed components, portable EFBs are outside the scope of this document.

Any EFB component that is either not accessible in the flight crew compartment by the flight crew members or not removable by the flight crew, should be installed as ‘certified equipment’ covered by a type certificate (TC), changed TC or supplemental (S)TC.

4.2      Installed EFB

Definition

Installed EFB, means an EFB host platform that is installed in the aircraft and is considered as an aircraft part, covered, thus, by the aircraft airworthiness approval.

Complementary characteristics

An installed EFB is managed under the aircraft type design configuration.

In addition to hosting EFB applications (refer to point CAT.GEN.MPA.141 for the definitions and characteristics of EFB applications), an installed EFB may host certified applications, provided that the EFB meets the applicable certification specifications for hosting such applications, including assurance that the non-certified software applications do not adversely affect the certified application(s). For example, a robust partitioning mechanism is one possible means to ensure the independence between certified applications and the other types of applications.

5          AIRWORTHINESS CONSIDERATIONS

Airworthiness approval is necessary for installed EFB systems, as well as for EFB installed resources.

5.1      Hardware airworthiness approval

5.1.1   Installed resources

             Installed resources are the input/output components external to the EFB host platform itself, such as an installed remote display, a control device (e.g. a keyboard, pointing device, switches, etc.), or a docking station.

The installed resources should be dedicated to EFB functions only, or in the case of use of resources shared with avionics, this possibility shall be part of the approved type design. It should be demonstrated, using the appropriate level of assessment, that the integration in the aircraft of the EFB and the EFB software applications does not jeopardise the compliance of the aircraft installed systems and equipment (including the shared resources) with the applicable certification specifications such as CS 25.1302 or 25.1309.

Installed resources require an airworthiness approval.

5.1.1.1 Mounting device

The mounting device (or other securing mechanism) attaches or allows the mounting of the EFB system. The EFB system may include more than one mounting device if it consists of separate items (e.g. one docking station for the EFB host platform and one cradle for the remote display).

The mounting device should not be positioned in such a way that it creates a significant obstruction to the flight crew’s view or hinders physical access to aircraft controls and/or displays, flight crew ingress or egress, or external vision. The design of the mounting device should allow the user easy access to any item of the EFB system, even if stowed, and notably to the EFB controls and a clear view of the EFB display while in use. The following design practices should be considered:

(a)       The mounting device and associated mechanisms should not impede the flight crew in the performance of any task (whether normal, abnormal, or emergency) that are associated with operating any aircraft system.

(b)       When the mounting device is used to secure an EFB display (e.g. portable EFB, installed EFB side display), the mount should be able to be locked in position easily. If necessary, the selection of positions should be adjustable enough to accommodate a range of flight crew member preferences. In addition, the range of available movement should accommodate the expected range of users’ physical abilities (i.e. anthropometrics constraints). Locking mechanisms should be of a low-wear type that will minimise slippage after extended periods of normal use.

(c)        Crashworthiness considerations should be taken into account in the design of this device. This includes the appropriate restraint of any device when in use.

(d)       When the mounting device is used to secure an EFB display (e.g. a portable EFB, an installed EFB side display), provision should be made to secure or lock the mounting device in a position out of the way of flight crew operations when it is not in use. When stowed, the device and its securing mechanism should not intrude into the flight crew compartment space to the extent that they cause either visual or physical obstruction of flight controls/displays and/or egress routes.

(e)       Mechanical interference issues of the mounting device, either on the side panel (side stick controller) or on the control yoke, in terms of full and free movement under all operating conditions and non-interference with buckles, etc. For yoke mounted devices, (supplemental)-type-certificate-holder data should be obtained to show that the mass inertia effect on column force has no adverse effect on the aircraft handling qualities.

(f)        Adequate means should be provided (e.g. hardware or software) to shut down the portable EFB when its controls are not accessible by the flight crew when strapped in the normal seated position. This objective can be achieved through a dedicated installed resource certified according to 5.1.1 (e.g. a button accessible from the flight crew seated position).

5.1.1.2 Characteristics and placement of the EFB display

(a)       Placement of the display

The EFB display and any other element of the EFB system should be placed in such a way that they do not unduly impair the flight crew’s external view during any phase of the flight. Equally, they should not impair the view of or access to any flight-crew-compartment control or instrument.

The location of the display unit and the other EFB system elements should be assessed for their impact on egress requirements.

When the EFB is in use (intended to be viewed or controlled), its display should be within 90 degrees on either side of each flight crew member’s line of sight.

Glare and reflection on the EFB display should not interfere with the normal duties of the flight crew or unduly impair the legibility of the EFB data.

The EFB data should be legible under the full range of lighting conditions expected in a flight crew compartment, including direct sunlight.

In addition, consideration should be given to the potential for confusion that could result from the presentation of relative directions when the EFB is positioned in an orientation that is inconsistent with that information. For example, it may be misleading if the aircraft heading indicator points to the top of the display and the display is not aligned with the aircraft longitudinal axis. This does not apply to charts that are presented in a static way (e.g. with no HMI mechanisation such as automatic repositioning), and that can be considered to be similar to paper charts.

(b)       Display characteristics

Consideration should be given to the long-term degradation of a display as a result of abrasion and ageing. AMC 25-11 (paragraph 3.16a) can be used as appropriate guidance material to assess luminance and legibility aspects.

Users should be able to adjust the screen brightness of an EFB independently of the brightness of other displays in the flight crew compartment. In addition, when incorporating an automatic brightness adjustment, it should operate independently for each EFB in the flight crew compartment. Brightness adjustment using software means may be acceptable providing that this operation does not affect adversely the crew workload.

Buttons and labels should have adequate illumination for night use. ‘Buttons and labels’ refers to hardware controls located on the display itself.

The 90-degree viewing angle on either side of each flight crew member’s line of sight may be unacceptable for certain EFB applications if aspects of the display quality are degraded at large viewing angles (e.g. the display colours wash out or the displayed colour contrast is not discernible at the installation viewing angle).

(c)       Applicable specifications

In addition to the specifications of this section, each EFB system should be evaluated against CS 23.1321, CS 25.1321, CS 27.1321, or CS 29.1321, as applicable.

If the display is an installed resource, it should be assessed against CS 25.1302 or in accordance with the applicable certification basis.

5.1.1.3 EFB data connectivity

             Portable EFBs that have data connectivity to aircraft systems, either wired or wireless, may receive or transmit data to and from aircraft systems, provided the connection (hardware and software for data connection provisions) and adequate interface protection devices are incorporated into the aircraft type design.

Connectivity provisions for a portable EFB may allow the EFB to receive any data from aircraft systems, but data transmission from EFBs to aircraft systems is limited to:

(a)       systems whose failures have no safety effect or a minor safety effect at the aircraft level (e.g. printers);

(b)       aircraft systems that have been certified with the purpose of providing connectivity to non-certified devices such as PEDs or EFBs in accordance with the limitations established in the AFM; and

(c)        EFB system installed resources according to Section 5.1.1.

EFB data connectivity should be validated and verified to ensure non-interference with and isolation from certified aircraft systems during data transmission and reception.

The safety assessment of the EFB data connectivity installation should include an analysis of vulnerabilities to new threats that may be introduced by the connection of the EFB to the aircraft systems (malware and unauthorised access) and their effect on safety. This assessment should be independent and should not take any credit from the operational assessment of EFB system security, which is intended to protect EFB systems themselves.

For aircraft systems certified for the purpose of receiving data from PEDs or EFBs (case (b) above), their connectivity with PEDs/EFBs should be taken into account in their demonstration of compliance with requirements such as CS 25.1302 and 25.1309. The applicant should in particular, conduct a safety assessment demonstrating that the failure conditions associated with the reception of erroneous PED/EFB data have criticalities that are not higher than minor. Adequate design measures such as preliminary flight crew review and acceptance of the imported parameters that mitigate the risk for using erroneous data should be implemented if needed.

Any consequent airworthiness limitations should be included in the AFM (please refer to 5.2.1).

5.1.1.4Connecting cables

             When cabling is installed to mate aircraft systems with an EFB,

(a)       if the cable is not run inside the mount, the cable should not hang loosely in such a way that compromises task performance and safety. Flight crew should be able to easily secure the cables out of the way during operations (e.g., by using cable tether straps);

(b)       cables that are external to the mounting device should be of sufficient length so that they do not obstruct the use of any movable device on the flight crew compartment; and

(c)       installed cables are considered electrical wiring interconnection systems and, therefore, need to comply with CS-25 Subpart H (FAA Part-25, Transport Category Airplanes) or TGM/21/07 (FAA Part-29, Transport Category Rotorcraft).

5.1.2               Installed EFB

An installed EFB is considered to be a part of the aircraft, and, therefore, requires a full airworthiness approval. This host platform includes the operating system (OS).

The assessment of compliance with the airworthiness requirements would typically include two specific areas:

(a)       the safety assessment addressing failure conditions of the EFB system hardware of any certified application installed on the EFB, and the partition provided for uncertified applications and miscellaneous software applications; and

(b)       hardware and operating system software qualification conducted in accordance with the necessary development assurance level (DAL) for the system and its interfaces.

5.2       Certification documentation

5.2.1   Aircraft flight manual

             For installed EFBs and certified installed resources, the AFM section or an aircraft flight manual supplement (AFMS) should contain:

(a)       a statement of the limited scope of the airworthiness approval of EFB provisions (e.g. these EFB provisions are only intended for EFB applications. The airworthiness approval does not replace the operational assessment for the use of the EFB system).

(b)       the identification of the installed equipment, which may include a very brief description of the installed system or resources; and

(c)        appropriate amendments or supplements to cover any limitations concerning:

(1)       the use of the EFB host platform for the installed EFB system; and

(2)       the use of the installed EFB provisions/resources for the portable EFB system.

For this purpose, the AFM(S) should refer to any guidelines (relevant to the airworthiness approval), intended primarily for EFB software application developers or EFB system suppliers.

5.2.2 Guidelines for EFB software application developers (installed EFB and certified installed resources)

TC/STC holders for EFB installed resources or installed EFBs should compile and maintain guidelines to provide a set of limitations, considerations, and guidance to design, develop, and integrate software applications into the installed EFB or with certified resources for portable EFB. The guidelines should address, at least, the following:

(a)       a description of the architecture of the EFB installed components;

(b)       the development assurance level (DAL) of the EFB component and any assumptions, limitations, or risk mitigation means that are necessary to support this;

(c)        information necessary to ensure the development of a software application that is consistent with the avionics interface and the human machine interface that is also accurate, reliable, secure, testable, and maintainable;

(d)       integration procedures between any new software application and those already approved; and

(e)       guidelines on how to integrate any new software application into the installed platform or installed resources.

The guideline document should be available at least to the aircraft operator, its competent authority, and EASA.

5.2.3 Guidelines for EFB system suppliers (installed resources for portable EFBs)

TC/STC holders for installed resources of portable EFBs should provide a set of requirements and guidelines to integrate the portable EFB into the installed resources, and to design and develop EFB software applications.

Guidelines that are intended primarily for use by the EFB system supplier should address, at least, the following:

(a)       A description of the EFB installed resources and associated limitations, if any. For example, the:

(1)       intended function, limitations of use, etc.;

(2)       characteristics of the mounting devices, display units, control and pointing devices, printer, etc.;

(3)       maximum authorised characteristics (dimensions, weight, etc.) of the portable parts of the EFB system that is supported by the mounting devices;

(4)       architectural description of the EFB provisions, including normal/abnormal/manual/automatic reconfigurations; and

(5)       normal/abnormal/emergency/maintenance procedures including the allowed phases of the flight.

(b)       Characteristics and limitations, including safety and security considerations concerning:

(1)       the power supply;

(2)       the laptop battery; and

(3)       data connectivity.

The guidelines should be available at least to the operator, its competent authority, and EASA.

[Amdt 20/12]

[Amdt 20/16]