U.S. Department

of Transportation

Federal Aviation

Administration

Advisory

Circular

Subject: Chemical Oxygen Generator 

Security Standards 

Date: DRAFT

Initiated by: ANM-100

AC No. 25.795-X

1. Purpose. This advisory circular (AC) provides guidance for an acceptable means of 

showing compliance with the requirements of Title 14, Code of Federal Regulations (14 CFR), 

part 25, § 25.795(d), Chemical oxygen generators. Section 25.795(d) requires each chemical 

oxygen generator (COG) or its installation to be designed so it meets one of several criteria. The 

means of compliance described in this document provides guidance to supplement the 

engineering and operational judgment that must form the basis of any compliance findings 

relative to a COG installed on an airplane.

2. Applicability. 

a. This AC provides guidance directed to design approval holders such as airplane 

manufacturers and modifiers, civil aviation authorities, and Federal Aviation Administration 

(FAA) airplane type certification engineers, their designees, and inspectors. 

b. This material is neither mandatory nor regulatory in nature and does not constitute a 

regulation. It describes an acceptable means, but not the only means, for demonstrating 

compliance with the applicable regulations. The FAA will consider other means of 

demonstrating compliance that an applicant may elect to present. While these guidelines are not 

mandatory, they are derived from extensive FAA and industry experience in determining 

compliance with the pertinent regulations. On the other hand, if we become aware of 

circumstances that convince us that following this AC would not result in compliance with the 

applicable regulations, we will not be bound to the terms of this AC and we may require 

additional substantiation or design changes as a basis for finding compliance. 

c. This material does not change, create any additional, authorize changes in, or permit 

deviations from, regulatory requirements.

3. Definition of Terms. For this AC, the following definitions should be used. 

a. Access - The ability to manipulate the COG with the intent of making alterations for a 

purpose for which the COG was not originally designed. This includes gaining access to the area 

surrounding the COG.
2

b. Activation - Release of the firing mechanism of the COG for the purpose of initiating 

the chemical reaction inside. 

c. Alteration - A change in the configuration of the COG once “access” has been gained 

for the purpose of using the COG for other than its intended function.

d. COG - chemical oxygen generator.

e. Immediately Obvious - Where an attempt to gain “access” to the COG would be 

readily recognized as suspicious (prior to gaining “access”). This would only be in locations 

with “unrestricted access” that are “observable.”

f. Intervention - The actions crewmembers must take to prevent damage to the airplane 

once an alert is activated indicating that the COG is being tampered with. The time it takes to 

intervene with someone in the lavatory has not been determined, however, we assume that it will 

take several minutes to resolve the issue.

g. Observable - A crewmember is able to see if a person attempts to gain “access” to a 

COG installation during the course of the crewmember’s normal duties.

h. Tamper Evident - A unique feature that provides an active and obvious 

contemporaneous alert to crewmembers that someone is trying to gain “access” to the COG and 

immediate crew “intervention” is necessary. 

i. Tamper Resistance - The level of deterrence for gaining “access” to the COG.

j. Unrestricted access - An area of the cabin passengers can enter without overcoming 

locks or other mechanical closure means.

4. Related Documents.

a. Regulations. You can download an electronic copy of 14 CFR from the Internet at 

http://www.fdsys.gov. You can order a paper copy by sending a request to the U.S. 

Superintendent of Documents, U.S. Government Printing Office, Washington, D.C. 20402-

0001, or by calling telephone number (202) 512-1800; or by sending a request by facsimile to 

(202) 512-2250. 

§ 25.1301 Equipment - Function and installation

§ 25.1309 Equipment, systems, and installations

§ 25.1322 Flightcrew alerting

§ 25.1450 Chemical oxygen generators

§ 121.330 Chemical oxygen generators

§ 129.30 Chemical oxygen generators
3

b. AC. You can download an electronic copy of the latest version of the following AC

from the Internet at http://rgl.faa.gov:

AC 25-22 Certification of Transport Airplane Mechanical Systems

5. Requirements of § 25.795(d).

a. Applicability. Section 25.795(d) is applicable to part 25 airplanes equipped with 

COGs.

b. Requirements of § 25.795(d). The following text is quoted from § 25.795(d):

Each COG or its installation must be designed so it meets one of the following criteria:

(1) Resistance to tampering,

(2) A combination of tamper resistant and active tamper-evident features, 

(3) Installation in a location or manner so any attempt to access the COG would be 

immediately obvious, or

(4) A combination of approaches identified in paragraphs (1), (2) or (3) of this section 

that the Administrator finds provides a secure installation.

c. Requirements of Airworthiness Directive 2012-11-09. AD 2012-11-09 requires that 

after September 10, 2015, no person may operate a transport category airplane in passengercarrying operations .... unless each lavatory is equipped with a supplemental oxygen supply in 

accordance with §§ 25.1443 and 25.2447. COG installations must meet the requirements 

specified in § 25.795(d) in effect on (the effective date of the COG rule), or FAA Policy

Statement PS-ANM-25-04, Chemical Oxygen Generator Installations, dated 12/21/2011.

6. Compliance with § 25.795(d).

a. Acceptable Means of Determining if a COG or its Installation is Designed to be 

Secure. Several criteria may be used for determining if a COG installation is secure or has a 

security vulnerability. COG installations with a security vulnerability must include design 

features to prevent potential misuse of the COG. Figure 1, Criteria for Assessing an Installation, 

includes assessment criteria that can be used for determining if a COG installation has a security

vulnerability. Table 1 includes guidance to assist in answering the questions in Figure 1. For 

installations identified as having security vulnerabilities, such as those for which the answers to 

the assessment statements in Figure 1 result in the answer to question number 4 being yes, the 

design should be changed. Alternatively, the COG can be replaced with an acceptable oxygen

source that is not a security threat. 
4

Start

1. Is a 

COG installed on the 

airplane?

Section 25.795(d) 

does not apply No

Yes

2. Is the 

COG installed where 

crewmembers can always 

see it? 

The airplane 

complies with 

§25.795(d) 

No

Yes

3. Is 

it immediately 

obvious if someone is 

accessing the 

COG?

Yes

No

4. Is the 

COG susceptible to 

tampering?

No

Yes

Change the COG 

installation design

Figure 1: Criteria for Assessing an Installation
5

Table 1: Assessment Statement Analysis

Question 

Number

Notes and Questions to Assist with Assessment Statement Analysis

1. Review the instructions for continued airworthiness.

Review drawing system.

Inspect the airplane’s configuration.

2. Crewmembers can observe the COG installation.

Check the area where the COG is installed. Isolated areas such as galleys, 

lavatories, crew rests, enclosed occupied compartments, lower lobe lavatory

complexes are potential areas of concern and require further evaluation.

Are crewmembers close to the COG installation during their normal duties?

Are there physical barriers between the crewmember and the area being evaluated?

Is there significant distance between the crewmember and the area being observed?

How accessible is the COG?

Is the COG installation surrounded by curtains? Curtained areas are also considered 

potential areas of concern and may require further evaluation. 

3. Are there locks on doors/access panels?

Are there tamper resistance fasteners on panels?

Alarms or some other active alerting tamper indication method is part of the 

installation’s design.

4. Check if the COG can be compromised in place.

Assess the vulnerability of the adjacent materials to contain the compromised 

device.

Assess the ability of the compartment to contain the event.

Check if the COG can be removed. 

b. Installation of Tamper Resistant Features. Tamper resistant design features can be 

used, in whole or in part, to make a COG installation secure. There are different types of tamper 

resistant design features, and their functionality largely depends on the installation. The 

principal benefit of tamper resistance is to delay exploitation of the COG as a weapon. However, 

it is not likely that an existing COG installation that can be accessed from within the lavatory

could be modified with tamper resistant design features sufficient to prevent a successful attack. 

This is because typical measures of tamper resistance, such as “special” tools and fasteners, 

could likely be overcome given enough time. These measures are normally used as one of 

several layers of security. Thus the reliance on such measures is only one element of the security 

system.
6

(1) A tamper resistant installation employs multiple elements, which may include:

(a) the COG’s location,

(b) the method of mounting, 

(c) physical protection (through shielding or mechanical isolation of key

components), and

(d) internal design.

(2) Eliminating access to the COG is the most straightforward way to make the COG

tamper resistant. Typically, this can be done by placing the COG in a location where significant 

disassembly of the cabin interior would be required to gain access. For example, the COG for a 

lavatory could be located so the entire lavatory module would have to be removed to access the 

COG. 

c. Installation of Tamper Evident Features. 

(1) For COGs that can be accessed from isolated compartments, such as lavatories, 

some form of active tamper evidence (for example, an alarm), would be needed in addition to the 

installation of tamper resistant features. This is necessary so the time to intervene and stop the 

attack is less than the time required to carry out the attack. In this case passive tamper evident

features, such as a tamper evident seal, are not effective because they provide an after-the-fact 

notification of tampering. The effectiveness of a tamper evidence system depends on 

intervention; it cannot be assumed that the “alarm” by itself would inhibit the attack. 

(2) Once an alert is activated indicating the COG is being tampered with, actions by

crewmembers and other available authorized responders are necessary to prevent catastrophic 

damage to the airplane. Therefore, there is a critical relationship between the tamper evidence 

system and the training and capability of the crew to respond. To be most effective, crew 

training should be accomplished prior to the alarm feature being deployed into the fleet. The 

time needed to successfully respond to the alarm may be several minutes and depends on several 

factors. The time available to respond to a threat and intervention times are functions of not only

the design features but also many complex and human factors-dependent variables that are 

difficult to define. These variables include, but are not limited to, the individual capabilities and 

numbers of flight attendants/authorized responders relative to the terrorists/accomplices, as well 

as the extensiveness of the training received.

d. System Safety Considerations. The applicant should consult the current version of 

AC 25.1309-1 for guidance on compliance with § 25.1309. 

e. Hazard classification. Failure of tamper resistant or tamper-evident features should be 

considered major.
7

f. System Performance When Installed. 

(1) A tamper evidence system installed for compliance with § 25.795(d) is intended to 

notify crewmembers that someone is trying to gain access to a COG, presumably for the purpose 

of creating a potentially catastrophic in-flight fire. The system should provide aural and visual 

warnings to immediately notify crewmembers so they can provide direct response in a timely

fashion. For example, visual indication should be provided so the crew can identify which COG

location is being tampered with while performing their normal duties. Aural alerts should be 

distinct from other alerts and clearly audible to the crewmembers expected to respond to the 

alert. If an alert is provided to the flightcrew, the alert should be presented in accordance with 

§ 25.1322.

(2) The oxygen system installed to meet § 25.795(d) must comply with other regulations 

applicable to oxygen systems. If the oxygen system does not comply with any of these other 

regulations the applicant needs to petition for an exemption in accordance with existing 

processes. There have been developments in oxygen system technologies to support new 

airplane programs. Applicants with these new airplane programs have assessed the dosage of 

oxygen required by § 25.1443 (based on tracheal partial pressure) and proposed oxygen system 

test methods that measure actual oxygen saturation levels in the blood. The test methods include 

human subject testing in an altitude chamber to substantiate the performance of the oxygen 

system being considered. Test methods that measure blood oxygen saturation levels may be 

used to demonstrate that a new proposed oxygen system intended to correct a security concern as 

described in this AC provides an equivalent level of safety to § 25.1443. Using this approach 

can reduce the total quantity of oxygen required, which in turn can reduce the size of the supply

source. A smaller supply source may allow room in existing space provisions for installing

design features to address the security concern. 

7. Areas that are Immediately Obvious. For COG installations located where any attempt at 

tampering would be “immediately obvious,” additional safety measures are not required. 

Immediately obvious areas include the main passenger cabin and other areas where occupants 

are always present. While some measure of tamper resistance is encouraged for these locations, 

none is required to meet § 25.795(d). “Private” compartments (such as a lavatory) or visually

divided sections of larger cabin areas are assessed independently. The “immediately obvious”

criterion applies to the specific location of each COG installation, not simply the general area in 

which it is located. In addition, the installation must be evaluated under all conditions that may

exist during a flight. So, for example, if tampering would be “immediately obvious” except 

when a curtain is pulled to provide privacy, the installation must be evaluated based on the 

curtain being arranged in a way that most conceals the installation. 

[Signature Block]