- Publications and resources
- Rules and regulations
- Safety management
- Licences and certification
- About us
Go to top of page
Cabin Safety Bulletin 19 Cabin electronic flight bags
Date of publication:
11 December 2019
On this page
This bulletin applies to all operators of Australian registered aircraft and should be read in conjunction with Regulation 235 of CAR 1988; Regulation 215 of CAR 1988 and Section 82 of CAOs.
This bulletin provides operator guidance in relation to cabin electronic flight bags, extracts of which have been taken from International Civil Aviation Organisation (ICAO) Doc 10111 Manual on the Implementation and Use of Cabin Electronic Flight Bags First Edition 2019.
This bulletin describes an example of an acceptable means, but not the only means, of demonstrating compliance with regulations and standards. On its own this bulletin does not change, create, amend or permit deviations from regulatory requirements, nor does it establish minimum standards.
A cabin safety bulletin is an advisory document that alerts, educates and makes recommendations about cabin safety matters. Recommendations in this bulletin are not mandatory.
Although Electronic Flight Bags (EFBs) were originally developed for flight crew members to perform flight management tasks, it is possible to implement EFBs for use in cabin operations. An EFB developed for cabin operations is referred to as a cabin electronic flight bag (C-EFB). The function of a C-EFB may include, but not limited to, cabin crew operations manual, checklists, forms, passenger information and real-time reporting.
Operators increasingly are introducing C-EFBs into cabin operations and this bulletin looks to provide guidance on the implementation and use of C-EFBs by cabin crew members.
Cabin EFBs (C-EFBs) perform a variety of functions traditionally accomplished using paper references by electronically storing and retrieving documents required for flight operations such as the Cabin Crew Operations Manual. C-EFBs may be authorised for use in conjunction with or to replace some of the hard copy material that cabin crew typically carry in their document library.
With the technological advancements that facilitated the growth in everyday electronic transactions, the Australian Government introduced legislation that recognised, from a legal perspective, electronic versions of documentation that are required by regulation are acceptable. The media used to store and display the document has become irrelevant.
The Acts Interpretation Act 1901; and Electronic Transactions Act 1999 are the enabling legislation allowing the use of digital media to display the documentation required by the Civil Aviation Act 1988 and any of its subordinate regulations.
Documents that have already been approved in accordance with the relevant regulations do not need additional approval if they have been stored in the C-EFB in essentially the same form as the original document.
C-EFBs can be either portable or installed.
Portable EFBs are not part of the aircraft configuration and are considered as portable electronic devices (PEDs). They generally have self-contained power and may rely on data connectivity to achieve full functionality.
Installed EFBs are integrated into the aircraft, subject to normal airworthiness requirements and under design control. The approval of these EFBs is included in the aircraft's type certificate or in a supplemental type certificate.
Both safety and non-safety related functions are eligible as C-EFB functions. A C-EFB may include, but is not limited to, the following functions:
- operations manuals, including the cabin crew operations manual
- passenger information list
- passenger announcements
- aircraft system interaction, for example, cabin defects
- documents and checklists, including quick reference handbooks
- reporting forms and functions (mandatory and operator-required reporting, safety, security, quality, service, fatigue and flight operations)
- medical service providers
- flight and duty time limitations
- training materials and digital learning access
- operator email or other news communication
- operator portal
- a copy of the C-EFB user manual
- onboard sales process
- layover information, for example, hotel, embassy, medical services.
C-EFB functions to be used for the safe operation of aircraft are considered to be those whose failure, malfunction or misuse would have an adverse effect on the safety of aircraft operations, for example, by increasing cabin crew workload during critical phases of flight. The applications below may be considered examples of software applications providing such functions, depending on their use, associated procedures and failure mitigation means:
- cabin crew operations manual
- special authorisations/approvals
- cabin defect logbook/cabin maintenance discrepancy reporting forms
- electronic checklists, including those for use during normal operations, abnormal and emergency situations
- mandatory occurrence reporting forms
- ICAO emergency response guidance for aircraft incidents involving dangerous goods (Doc 9481).
The C-EFB risk assessment is a process to evaluate the risks associated with the use of each C-EFB function. Operators should use this process to develop appropriate risk mitigation strategies to manage risks to an acceptable level. Operators should perform the risk assessment prior to the entry into operation of any C-EFB system and its results should be reviewed periodically.
The risk assessment should evaluate the risks associated with the use of a C-EFB by addressing the following, as a minimum:
- evaluate the physical characteristics of the C-EFB, including size (eg physical size of the device, screen size, font size), stowage, securing and accessibility (eg a C-EFB that is too small may fall behind or under structures such as class dividers or closets, be obstructed by other items or easily lost)
- identify potential losses of function or malfunction (detected and undetected erroneous output) and associated failure scenarios
- analyse the operational consequences of these failure scenarios
- ensure the C-EFB system (hardware and software) achieves at least the same level of accessibility, usability and reliability as the paper-based system that it is replacing
- ensure the C-EFB will not cause interference with on-board electronic systems and aircraft equipment on which it will be permitted for use (through aircraft PED tolerability testing)
- analyse human factors and ergonomic considerations related to the C-EFB, for example, to minimise human errors
- establish risk mitigation strategies.
When the C-EFB system is intended for introduction alongside a paper-based system, only the failures that would not be mitigated by the use of the paper-based system need to be addressed. In all other cases, a complete risk assessment should be carried out.
Manufacturing defects, product recalls and processes for continued operation should be considered in the risk assessment.
The risk assessment should be defined before the beginning of the trial period and should be amended accordingly, if necessary, at the end of the trial period. The results of the trial should establish the configuration and use of the C-EFB system.
Risk mitigation strategies
Based on the outcome of the C-EFB risk assessment, operators should determine a series of risk mitigation strategies against C-EFB failure.
Operators should consider establishing a reliable alternative means of providing information that is available on the C-EFB system.
The risk mitigation strategies can be one or a combination of the following examples:
- system design (including hardware and software)
- alternative C-EFB possibly supplied from a different power source
- C-EFB applications hosted on more than one platform
- paper backup, for example, cabin crew operations manual
- alternative procedures
- administration support, for example, operators should ensure that cabin crew members have access to necessary information during operations.
In order to address the accessibility, usability and reliability of the C-EFB system, operators should include risk mitigation strategies for failure of the C-EFB system, such as:
- complete system failure
- individual application failures
- corruption or loss of data
- battery testing and recharge
- erroneously displayed information.
An installed C-EFB is a component that is incorporated into the aircraft type design and, as such, is subject to airworthiness authority approval. Installed C-EFBs should be certified either during the airworthiness certification of the aircraft, through operational bulletins by the original equipment manufacturer or through a third-party supplemental type certificate.
Data connectivity to aircraft systems
The capability of connecting an installed C-EFB to certified aircraft systems should be covered by an airworthiness approval. Certified aircraft systems should be protected from the adverse effects of an installed C-EFB system failure by using a certified aircraft interface device (AID). An AID may be implemented as a dedicated device or implemented in non-dedicated devices such as a C-EFB docking station, a network file server or other avionics equipment.
Power to the C-EFB
Installed power provisions should comply with the applicable airworthiness requirements. Connection of the C-EFB to the non-essential or least critical power bus is recommended, so failure or malfunction of the C-EFB or power supply will not affect the safe operation of an aircraft's critical or essential systems. There should be a means other than a circuit breaker to disable installed C-EFBs in the event of unwanted operation, such as continuous flashing. Circuit breakers may not be used as switches.
Consideration should be given to the physical characteristics of the device selected for the C-EFB, for example, a smart phone or tablet. Some devices may prove to be cumbersome for normal use in the cabin. The physical characteristics of the device should be evaluated as part of the C-EFB risk assessment.
Stowage and securing
Stowage and securing require inherent means to prevent unwarranted C-EFB movement. Stowage and securing means are required for portable C-EFBs, as installed C-EFBs are by definition integrated into the aircraft. Stowage and securing should be configured such that the C-EFB can be easily stowed and secured but remains readily accessible. The methods of stowage and securing should not create a hazard during aircraft operations.
The C-EFB data should be legible under the full range of lighting conditions expected in the cabin. Font style, colour, formatting and background should also be legible. The screen background should be considered to ensure readability, for example, colour and wallpaper.
Basic non-interference testing
As portable C-EFBs are considered to be PEDs, operators should ensure that the C-EFB will not interfere in any way with the operation of aircraft systems.
Power supply, connectivity and compatibility
Operators should ensure that power supply to the C-EFB, either by battery and/or externally supplied, is compliant with the applicable standards for use in an aircraft and available to the extent required for the intended operation. The power source needs to be suitable for the device.
Installed power provisions should comply with the applicable airworthiness requirements. C-EFB design should consider the source of electrical power, the independence of the power sources for multiple C-EFBs and the potential need for an independent battery source. Operators should identify designated outlet(s) for use by cabin crew members to charge C-EFBs onboard the aircraft.
Operators may consider providing approved charging stations for use in flight. If so, stations should meet all airworthiness requirements. Charging stations that are dedicated for crew use should not be accessible to or used by passengers.
Operators should ensure that any cabling attached to the C-EFB, whether in the dedicated mounting or handheld, does not present a hazard. Cabin crew members should only use approved, compatible cables.
Rechargeable lithium-type batteries are becoming more common as a source of principal power or standby/back-up power in C-EFBs. Lithium-ion or lithium-polymer (lithium-ion polymer) batteries are two types of rechargeable lithium batteries commonly used to power C-EFBs. Overheating can occur during use or charging of the C-EFB. The placement of the C-EFB should allow sufficient airflow around the unit.
Operators should ensure that the C-EFB can be operable within the anticipated environmental conditions in the cabin, including foreseeable high/low temperatures, and after rapid decompression if the C-EFB is intended for use in such an event.
A mounting device is a device that can be used to secure a portable C-EFB. It may include equipment such as docking stations and suction cups. The mounting device may have aircraft power and data connectivity. It may require quick disconnect for egress. If the mounting device for the C-EFB is permanently attached to the aircraft structure, the installation should be approved in accordance with the appropriate airworthiness requirements.
Some considerations for these devices include:
- The intended C-EFB hardware in its mounting device does not obstruct visual or physical access to aircraft displays, controls or external vision and that its location does not impede ingress, egress and emergency escape paths, nor pose any risk of injury to occupants, for example, in the event of a hard landing.
- There should be no mechanical interference between the C-EFB in its mounting device and any of the cabin display panels.
- The mounting device should be able to lock in position easily. Crashworthiness considerations should be considered in the design of this device, including appropriate restraint of any device when in operation.
- Provisioning to secure, lock or stow the mounting device in a position clear of cabin crew member operations when not in operation.
- The C-EFB hardware should be capable of being easily removed from the mounting device by the cabin crew member without tools or maintenance action, for fire safety reasons.
The C-EFB should provide an intuitive, user-friendly and consistent interface within and across the various software applications that it hosts. This should include, but not be limited to, data entry methods, colour-coding philosophies and symbols. Software developers and operators are encouraged to evaluate the usability of an existing human-machine interface (HMI) before developing a new HMI. The HMI should be evaluated for unforeseeable common human errors after its introduction into operation in the everyday environment to allow for required changes or enhancements of the given design.
Style of presentation
Software considerations include, but are not limited to, the following and should be addressed by operators:
- ease of access to common functions
- consistency of symbols
- terms and abbreviations
- legibility of text
- system responsiveness
- methods of interaction
- use of colour
- display of system status
- error messages
- management of multiple applications and documents
- off-screen text and content
- use of active regions.
Ease of access to common functions
C-EFB software should be designed to minimise cabin crew workload and provide ease of access to common functions. Complex, multi-step data entry tasks should be avoided during critical phases of flight.
An evaluation of C-EFB intended functions should include a qualitative assessment of incremental cabin crew workload, as well as user-system interfaces and their safety implications. If a C-EFB is to be used during critical phases of flight, such as during take-off and landing, or during abnormal and emergency situations, its use should be evaluated during simulated or actual aircraft operations under those conditions.
Consistency of symbols
Symbols used in the C-EFB applications should be consistent with those used on aircraft systems, equipment and paper-based documentation they are intended to replace.
Terms and abbreviations
Terms and abbreviations used in the C-EFB applications should be consistent with those used in the paper-based documentation they are intended to replace.
Legibility of text
Information displayed on the C-EFB should be legible to the intended user at the intended viewing distance(s) and under the full range of lighting conditions expected in the cabin, including daytime use in direct sunlight and night operations. Brightness should be adjustable in fine increments. Consideration should be given to long-term display degradation because of abrasion and ageing of the device.
The system should provide feedback to the user when user input is accepted. If the system is busy with internal tasks that preclude immediate processing of user input for example, self-test or data refresh, the C-EFB should display a 'system busy' indicator to inform the user the system is occupied and cannot process inputs immediately. The timeliness of system response to user input should be consistent with an application's intended function, for example, time-critical information should be prioritised by the system.
Methods of interaction
In choosing and designing input devices, such as keyboards, touch screens or cursor-control devices, operators should consider the type of entry to be made and the cabin environmental factors, such as turbulence and other normal vibrations affecting the usability of the input device. For touch screens, cabin crew members may need physical locations or structures, such as a galley bench, to stabilise their hand to be able to make accurate inputs. Operators should verify that touch screens do not result in unacceptable levels of cabin crew workload and error rates. Input devices should provide feedback to indicate when they are operational. Since touch screens provide little or no tactile feedback or control motion, visual and/or aural or other touch activation feedback is especially important. Other touch screen considerations include selecting the touch technology, for example, resistive or capacitive, controlling screen contaminates which may reduce readability, for example, skin oils or perspiration, and mitigating inadvertent operation.
Use of colour and messages
The colour 'red' should be used only to indicate a warning level condition.
'Amber' should be used to indicate a caution level condition.
Any other colour may be used for items other than warnings or cautions, providing that colours used differ sufficiently from the colours prescribed to avoid possible confusion. The use of colours should take into consideration cabin crew members with vision impairments.
Display of system status
If an application is fully or partially disabled, or is not visible or accessible to the user, it may be desirable to have an indication of its status available to the user upon request. It may also be desirable to prioritise these C-EFB status and fault messages.
C-EFB messages and reminders should be integrated with (or compatible with) other cabin system alerts. The C-EFBs should not cause a distraction through visual or audible notifications. If additional messages are available but not currently displayed, there should be an indication of the additional messages. If user-entered data are not of the correct format or type needed by the application, the C-EFB should not accept the data. An error message should be provided that clearly communicates which entry is suspect and specifies what type of data are expected.
The C-EFB should provide continuous indication of which application and/or document is active if the system supports multiple open documents or allows multiple open applications. The active application/document is the one currently displayed and responding to user actions. During normal operations, the user should be able to select which of the open applications or documents is currently active. In addition, the user should be able to find which open applications are running and switch to any one of them easily. The user should also be able to open a new application quickly and easily. When the user returns to an application running in the background, it should appear in the same state as when the user left the application, other than differences associated with the progress or completion of processing performed in the background.
If a document segment is not visible in its entirety in the available display area, such as during 'zoom' operations, the existence of off-screen content should be clearly indicated in a consistent manner. For some intended functions, it may be unacceptable if off-screen content is not indicated. This should be evaluated based on the application and intended operational function.
Active regions are those to which special user commands apply, for example, hyperlinks or copying. The active region can be text, a graphic image, window, frame or another document object. Active regions are also useful for selecting between frames on a frame-based visual display. The information in the active frame would respond to update commands entered by the user. If the display uses active regions, these should be clearly indicated. If users do not know how to use an active region, they will have trouble applying special commands to the intended object. If users do not know that a particular region is active, they may enter inappropriate commands and become frustrated when these commands are not processed as expected.
A signature to signify acceptance or to confirm the authority may be required. In order to be accepted as equivalent to a handwritten signature, an electronic signature used in C-EFB applications should assure the same degree of accessibility and security as the signature it replaces. Operators should have a process in place for an electronic record keeping system to ensure the integrity of the system.
The C-EFB system should be secure from malicious software, data hijack, unauthorised usage and fraudulent or criminal intent, both on the ground and in the air. Access to the system should be controlled and authenticated. Operators should ensure that adequate security procedures are in place to protect the system software and data. Adequate measures should also be in place for compilation, secure distribution and remote wiping of the data on the C-EFB. Content should be protected on unsecured networks. Additional security procedures to protect hardware should be developed, for example, device distribution, replacement and collection list, loss, theft, possibility of erasing device content remotely and storage when the device is not in use.
Updates to C-EFB
If updates to the C-EFB software are necessary, operators should ensure that the changes are properly tested in a controlled environment prior to upload for use in flight. This includes updates to the operating system and software data.
Operators should have a process to ensure cabin crew members are informed and have received all system applications and data updates, for example, operating systems, tracking systems, notification systems, administrative systems. The C-EFB should have a status page that shows if any updates were performed and what these involved.
Operators should ensure that the software developer has a quality assurance process in place. The software development and verification processes should be included and documented in the quality assurance process.
Operators should have a C-EFB management system in place for their C-EFB program, which includes the following:
- procedures and systems related to the C-EFB
- hardware configuration management
- software configuration management
- C-EFB security
- software update management
- content management.
The C-EFB management system is the key link between an operator and the C-EFB system and software suppliers. It is responsible for hardware and software configuration management and for ensuring, in particular, that no unauthorised software is installed. The C-EFB management system is also responsible for ensuring that only a valid version of the software application and current data packages are installed on the C-EFB system.
The C-EFB management system should ensure that the software applications and any updates supporting functions not directly related to operations conducted by cabin crew members on board aircraft, for example, web browser, email client, picture management, do not adversely impact the operation of the C-EFB. There should be a means for operators to carry out their own check of data content prior to load and/or release for operational use.
The C-EFB management system should establish procedures to ensure that no unauthorised changes take place to C-EFB functions. Procedures should be established for the development, system updates, content downloads, maintenance, security and integrity of the C-EFB. The required level of C-EFB security depends on the complexity of the system and data protection. A C-EFB policy and procedures manual may form part of the operations manual. Procedures should be established for the maintenance of the C-EFB.
Operators should assign at least one person, for example, a dedicated C-EFB manager, who is able to maintain oversight of the complete C-EFB system. This includes the distribution of responsibilities within the operator management structure. Complex C-EFB systems may require additional support.
Operators should ensure that each person involved in the C-EFB management system receives appropriate training in their role and has a good working knowledge of the proposed system hardware, operating system and relevant software applications.
The C-EFB management system should also include dedicated technical support for all users. Procedures should include a situation when cabin crew members may need assistance outside the technical support operating hours. Operators should ensure that cabin crew members have access to necessary information during operations.
Operators should develop a user manual which may contain the following sections, as a minimum:
- table of contents
- general guidelines, for example, security/confidentiality aspects, actions in the event of lost devices, crew member responsibilities, onboard usage
- manual overview
- process for updating and any software prerequisites
- viewing and functionality
- search and navigation
- design features
- care, for example, hardware, cabling, converters, device maintenance, damage prevention
- frequently asked questions
- technical support
- process for incorporating CCOM revisions and updates
- glossary or index.
Operators should develop procedures for using the C-EFB in relation to the following:
- user role and responsibilities
- phases of flight when the usage of the C-EFB is not permitted
- stowage and securing specifications
- battery power management
- revisions and updates
- inclusion of the requisite reporting system and forms, where applicable
- damage prevention
- loss, damage, theft or software failure
- reporting of C-EFB failures or faults.
User role and responsibilities
Operator procedures should address the individual cabin crew member's role and responsibilities regarding C-EFB use. These include, but are not limited to, the following:
- requirements for C-EFB availability and accessibility
- usage of the C-EFB during flight
- use and download of other/external applications
- data protection measures for the device.
Phases of flight when use of the C-EFB is not permitted
Procedures should include specification of the phases of flight during which cabin crew members may not use the C-EFB, for example, during critical phases of flight.
Stowage and securing specifications
Procedures should include specifications for when and how all portable C-EFBs must be stowed and secured. This includes during critical phases of flight and in turbulence to ensure the safety of the cabin occupants. Secured portable C-EFBs should remain accessible to the cabin crew members throughout the flight.
Battery power management
If battery-powered C-EFBs utilise aircraft power for recharging, operators should establish a procedure to ensure safe recharge of the battery, for example, minimum percentage of battery before the flight to be sufficiently charged to support the operation, charging on board or use of power bank. In addition, operators should identify designated outlet(s) for use by cabin crew members to charge C-EFBs onboard the aircraft. Means to operate the power source should be documented per the procedures in the cabin crew operations manual, including connectivity and compatibility.
Note: ICAO Doc 9481 Emergency Response Guidance for Aircraft Incidents Involving Dangerous Goods contains guidelines for cabin crew procedures to respond to PED or stand-alone lithium battery fires.
Revisions and updates
Operators should have a procedure in place to allow cabin crew members to confirm the revision number and/or date of C-EFB software application or databases. Procedures should specific what actions to take if the software applications or databases loaded on the C-EFB are out of date.
Inclusion of the operator reporting system and forms
Where operators include the reporting system and associated report templates as part of the C-EFB applications, procedures regarding their use should be established. This includes mandatory and voluntary reporting as part of the safety management system, including real-time reporting where applicable.
An operator should establish procedures for preventing damage to the C-EFBs and the aircraft. This includes, but is not limited to, guidelines regarding the use of uncertified cabling, crew monitoring of the device while it is charging and exposure to water and temperature.
Loss, damage, theft or software failure
Operators should have procedures to address device loss, damage, theft or software failure, particularly to protect safety and sensitive information contained in the C-EFB. However, this should include, but not be limited to:
- reporting process, for example, when, why and how to report
- device replacement process
- backup procedure for software failure or unavailability of the device, for example, use of paper documents.
Operator procedures should address the individual cabin crew member's actions and responsibilities for replacing or repairing their assigned C-EFB device.
Reporting of C-EFB failures or faults
A reporting system for C-EFB failures should be established. These procedures should be in place to inform maintenance personnel and cabin crew members about a failure or fault of the C-EFB, including actions to isolate it until corrective action is taken.
Workload and cabin crew coordination
In general, using a C-EFB should not increase the crew's workload during critical phases of flight. For other flight phases, cabin crew operating procedures should be designed to mitigate and/or control additional workload created by using a C-EFB. Workload should be distributed between cabin crew members to ensure ease of use and continued monitoring of other cabin crew tasks.
The type of C-EFB training will depend on the nature and complexity of the C-EFB system. Training should address any gaps in the level of proficiency that the user may have with technology and the specific device to be used. Operators may use different delivery methods for C-EFB training including classroom instruction, hands-on exercises and/or computer-based training (digital learning methods).
Initial C-EFB training should include the following, as a minimum:
- user role and responsibilities
- fundamentals on how to use the C-EFB, for example, navigating throughout the C-EFB, turning the device on and off, logging in and out, adjusting screen settings and brightness, charging the device, screen maintenance
- safe practices, for example, cable removal, use of protective cases, converter practices, use of aircraft power outlets, temperature exposure, preservation of long-term battery life, procedure for lithium battery fire
- clear instruction, for example, step-by-step on how and when to update the C-EFB content and software, operating system, applications and security aspects, as well as the importance of keeping the device up-to-date
- operating the C-EFB in normal, abnormal and emergency situations
- the protection of safety and sensitive information, for example, passcode security, passenger information
- how to handle and report the failure of C-EFB component(s).
Operators should provide additional training for users on any new or modified functions of the device and applications. They may offer supplemental training to maintain and reinforce cabin crew knowledge and proficiency of the C-EFB.
Changes to the C-EFB
If any updates of the C-EFB are necessary, appropriate testing of the changes should be performed prior to use in flight. For all other types of modification, for example, to hardware, operators should apply their change management process.
Addiational guidance material for this bulletin includes:
- Civil Aviation Safety Authority Civil Aviation Advisory Publication 233-1(1) Electronic Flight Bags October 2013
- International Civil Aviation Organization (ICAO) Doc 10111 Manual on the Implementation and Use of Cabin Electronic Flight Bags First Edition 2019
- International Civil Aviation Organization (ICAO) Doc 10020 Manual of Electronic Flight Bags (C-EFBs) Second Edition 2018
- Federal Aviation Administration Advisory Circular 9MAY14 (AC 120-76C) Guidelines for the Certification Airworthiness and Operational Use of Electronic Flight Bags
- Federal Aviation Administration Information for Operators 18JAN13 (InFO13002) Information for Operators Subject: Crewmember Manuals
- Transport Canada Advisory Circular 28MAR18 (AC 700-020 Issue 03) Electronic Flight Bags
View the cabin safety pages.
If you have an inquiry, please contact the cabin safety team on 131 757 and ask to speak to a cabin safety inspector or email firstname.lastname@example.org.
Subscribe to our mailing list to receive cabin safety bulletins.