PURPOSE AND SCOPE

This document may be used by any organisation that develops EFB applications (e.g., airlines, OEMs, EFB manufacturers and EFB application suppliers).

It provides MOPS for the design, development, evaluation and validation of EFB applications and their functions. The MOPS include requirements, recommended practices and guidelines. The MOPS are proportionate to the safety risk of the intended use of the EFB functions in flight operations.

An Electronic Flight Bag (EFB) is an electronic information system, comprised of equipment and applications for flight crew, which allows for the storing, updating, displaying and processing of EFB functions to support flight operations or duties.

EFBs were initially introduced in the flight decks to supplement and/or replace conventional paper products traditionally carried in the pilot’s flight bag, such as airport and navigation charts, aircraft performance and mass and balance charts or flight operational manuals.

The usage of EFBs also includes functions intended to increase the flight operational effectiveness and enhance the pilot situation awareness. Examples of those functions include electronic airport and en-route moving maps, in-flight weather function.

This continuous trend makes it more difficult for national aviation authorities to evaluate whether these new functions and applications, which are typically hosted on commercial-off-the-shelf (COTS) hardware and operating system, can be safely used in flight operations. This evaluation proved to be particularly complex for EFB functions similar to functions hosted in the aircraft certified avionics (e.g. presentation of the aircraft position on a moving map) and that generate a safety risk if not properly used by the flight crew. National aviation authorities may not have the resources and the expertise needed for this assessment, which create delays and hurdles for the introduction of these innovative functions in flight operations of operators.

To address this challenge, EUROCAE created Working Group WG-106 to develop an industry standard specifically applicable to EFB applications, which may be used as a basis for the approval of EFB application software (and its associated installation and operating data) by an authority.

The scope of the work given to WG-106 was to develop a standard adapted for EFB applications that unambiguously define the perimeter of EFB functions without preventing future innovation in that domain. The standard should also not contradict existing guidance such as that contained in the European regulation or in the ICAO EFB Manual Doc 10020 but could implement objectives to achieve completeness. WG-106 verified also consistency of its work with other EFB policies such as the FAA AC 120-76.

WG-106 was composed of EFB application suppliers, aircraft manufacturers, equipment suppliers, operators, regulators, authorities and association representatives. This panel of participants covered a large spectrum of the stakeholders involved in the EFB ecosystem and ensured that the standard is adapted to the needs.

This industry standard addresses the following general EFB aspects:

Determination of whether functions are eligible as EFB functions:

The standard provides a clear and systematic process for determining whether a given function is authorised on an EFB or not. This process is consistent with the definitions and principles of the EFB regulatory materials and relies on the conclusive completion of a safety risk assessment. This process is simple and streamlined for the EFB functions already authorised by the EFB regulatory materials at the time of writing this standard. This process could be applied onto any kind of functions proposed to be hosted on an EFB.

Safety Risk Assessment:

The standard provides a safety risk assessment process developed on the model of the “bowtie” method. This process addresses an issue that has been existing since the onset of the EFB regulations.

By the current regulatory definition, EFB includes functions with failure effect no greater than minor after considerations of the operational/procedural mitigation means (typically pilot procedures and training).

Though, it is recognised that some EFB functions, such as the take-off and landing performance calculations, may have a failure effect greater than minor, for instance in case of a misleading calculation error that is not detected by the flight crew by the operational/procedural mitigations. To resolve this issue, the process uses the concept of residual risk and defines it as the risk associated to a hazard, which may contribute, after application of the operational/procedural mitigation, to a severity effect more than minor.

The existence of residual risk or not for a given function has been considered throughout the standard in order to ensure for the proportionality of the requirements to the criticality of the function. Application hosting function(s) without residual risk have to comply with the minimum set of requirements. Application hosting function(s) with residual risk have to apply additional requirements in order to provide assurance that the contributors to the hazard are prevented to an acceptable level.

Human Machine Interface:

The standard provides considerations for the design of the Human Machine Interface (HMI) of EFB applications. These considerations have been developed using the HMI provisions of the EFB regulatory materials as well as additional best industry practices. A human factors assessment of the HMI is required when HMI aspects are identified as a contributor to a residual risk. The standard specifies the characteristics of the protocol of a human factors assessment.

Development Assurance:

The standard provides development assurance considerations for the development of the EFB software application. As suggested in the Term of References of WG-106, these development assurance considerations have been derived and adapted from ED-215() for use in the context of EFB application software development. These considerations are now self-sufficient and are applicable to the various software development methods (e.g. classic waterfall method, agile method).

The applicant has to apply the adequate assurance level proportionate to the risk associated with the use of its EFB application. The terminology “Function Qualification Level” (FQL) is used to define the selected level of assurance. Two Function Qualification Levels are defined: Low and High. The FQL Low development process objectives are applied for all EFB applications. The additional FQL High development process objectives are applied when EFB software application errors are identified as contributor to a residual risk by the safety risk assessment.

Databases:

The standard provides considerations for addressing databases used by EFB applications and stored on the EFB host platform. The standard proposes two levels of considerations, depending on whether the databases contribute to a residual risk or not. The standard also provides two levels of considerations, adapted to whether the database is considered as part or not of the EFB application for the compliance demonstration with this standard. The decision to consider the database(s) with the application or not with respect to the compliance demonstration with this standard will be under the applicant’s decision.

Security:

The standard provides considerations for addressing security threats. A minimum set of security measures has been developed based on existing best industry practices. This minimum set is applicable to all EFB applications. In case mitigation means are based on assets subject to security threats, they have to be evaluated from a security perspective. A comprehensive security assessment process specifically defined for EFB applications is also provided and must be applied in case a residual risk is identified for a given EFB function.

Operational and installation instructions:

The standard defines the operational and installation instructions to be provided by the applicant to the operators for the integration of the application into their operations. The objective is to ensure that the applicant provides the minimum set of data for ensuring the proper installation, administration, use, and maintenance of the application by the operators.

The data includes in particular important assumptions such as any validation activity (e.g. validation of mitigation or prevention means) that the operators are assumed to perform to ensure the validity of the safety risk assessment.

Specific considerations:

The standard provides also additional considerations applicable to specific existing EFB functions. These additional considerations complement the general considerations. The EFB functions specifically addressed in this document are the aircraft performance and mass and balance calculation functions, the airport moving map display (AMMD) function, the weather function, the functions displaying the aircraft position on maps or charts, the electronic checklist function and the electronic signature function. The other existing EFB functions are considered as not deserving specific considerations, i.e. the general considerations are deemed sufficient.

Additional specific considerations may be needed for new, emerging functions that were not in-service at the time of the development of this standard. If this is the case, these additional specific considerations would be identified and discussed during the development, evaluation or approval of these new, emerging functions.