U.S. Department

of Transportation **Federal Aviation Administration**  

# Advisory

**Circular**
**Subject :**  Chemical O xygen Generator Security Standards **Date: DRAFT Initiated by**  : ANM
- 100 **AC No.** 25
. 795
- X
**1**
. **P urpose**  **.** This a dvisory c ircular (AC) provides guidance for an acceptable means of showing compliance with the requirements of Title 14, Code of Federal Regulations (14 CFR), part 25, § 25.795 ( d), Chemical o xygen generators . Section 25.795(d) requir es each chemical oxygen generator (COG) or its installation to be designed so it meets one of several criteria. The means of compliance described in this document provides guidance to supplement the engineering and operational judgment that must form the basis of an y compliance findings relative to a COG installed on an airplane. **2. A**  **pplicability .**  **a.** This AC provides guidance directed to design approval holders such as airplane manufacturers and modifiers, civil aviation authorities, and Federal Aviatio n Administration (FAA) airplane type certification engineers, their designees, and inspectors. **b.** This material is neither mandatory nor regulatory in nature and does not constitute a regulation. It describes an acceptable means, but not the only me ans, for demonstrating compliance with the applicable regulations. The FAA will consider other me ans of demonstrating compliance that an applicant may elect to present. While these guidelines are not mandatory , they

are derived from extensive F AA and ind ustry experience in determining compliance with the pertinent regulations. On the other hand, if we become aware of circumstances that convince us that following this AC would not result in compliance with the applicable regulations, we will not be bound to the terms of this AC and we may require additional substantiation or design changes as a basis for finding compliance. **c.** This material does not change, create an y additional, authorize changes in, or permit deviations from, regulatory requirements. **3. D**  **efinition o**  **f T**  **erms .**  For this AC, the following definitions should be used. **a. Access** 
- The ability to manipulate the COG with the intent of making alterations for a purpose for which the COG was not originall y designed. This includes gaining acc ess to the area surrounding the COG.2

**b .**  **Activation -**  Release of the firing mechanism of the COG for the purpose of initiating the chemical reaction inside. **c .**  **Alteration -**  A change in the configuration of the COG once “access” has been gained for the purpose of using the COG for other than its intended function **. d**  **. COG**  **-** chemical oxygen generator. **e .**  **Immediately Obvious -**  Where an attempt to gain “access” to the COG would be readil y recognized as suspicious (prior to gaining “access”). This would only be in locations with “unrestricted access” that are “observable.” **f .**  **Intervention -**  The actions crewmembers must take to prevent damage to the airplane once an alert is activated indicating that the COG is being tampered with. The time it takes to intervene with someone in the lavatory has not been determined, however, we assume that it will take several minutes to resolve the issue. **g .**  **Observable -**  A crewmember is able to see if a person attempts to gain “access” to a COG installation during the course of the crewmember ’s normal duties. **h .**  **Tamper Evident**  **-** A unique feature that provides an active and obvious contemporaneous alert to crewmember s that someone is trying to gain “access” to the COG and immediate crew “intervention” is necessary
. **i .**  **Tamper Resistance -**  The level of deterrence for gaining “access” to the COG. **j .**  **Unrestricted access -**  An area of the cabin passengers can enter without overcoming locks or other mechanical closure means. **4. Related Documents.**  **a. Regulations** 
. You c an download an electronic copy of 14 CFR from the Internet at http://www. fdsy s.gov . You can order a paper copy by sending a request to the U.S. Superintendent of Documents, U.S. Government Printing Office, Washington, D.C. 20402
- 0001, or by

calling teleph one number (202) 512
- 1800; or by sending a request by

facsimile to (202) 512
- 2250. § 25.1301 Equipment
- Function and installation

§ 25.1309 Equipment, sy stems, and installations § 25.1322 Flightcrew alerting § 25.1450 Chemical o xygen g enerators § 1 21.330 Chemical oxygen generators § 129.30 Chemical oxygen generators3

**b. AC**  **.** You can download an electronic cop y of the lat est version of the following AC from the Internet at http://rgl.faa.gov : AC 25
- 22 Certi fication of Transport Airplane Mechanical Systems **5. Requirements of**  **§ 25.795(d)** 
. **a. Applicability**  **.** Section 25.795 (d) is applicable to part 25 airplanes equipped with COGs
. **b. Requirements of**  **§ 25.795(d)**  **.** The following text is quoted from § 25.79 5(d): Each COG or its installation must be designed so it meets one of the following criteria: **(1)** Resistance to tampering, **(2)** A combination of tamper resistant and active tamper - evident features, **(3)** Installation in a location or manne r so an y attempt to access the COG would be immediately

obvious, or **(4)** A combination of approaches identified in paragraphs (1), (2) or (3) of this section that the Administrator finds provides a secure installation. **c. Requirements of**  **Airworthines s Directive**  **2012 -**  **11 -**  **09**
. AD 2012
- 11
- 09 requires that after September 10, 2015 , no person may operate a transport category airplane in passenger
carryi ng operations
... . unless each lavatory is equipped with a supplemental oxygen suppl y in accordance with §§ 25.1443 and 25.2447. COG installation s must meet the requirements specified in § 25.795(d) in effect on ( the effective date of the COG rule ) , or FAA Policy Statement PS
- ANM
- 25
- 04 , Chemical Oxygen Generator Installations , dated 12/21/2011. **6. Compliance**  **with § 25.795(d)**  **. a.**  **Acceptable Means of Determining if a**  **CO G or its Installation is**  **Designed to be Secure** 
. S everal criteria may be used for determining if a COG installation is secure or ha s a securit y vulnerability . COG installations with a security vulnerability must include de sign features to prevent potential misuse of the COG
. Figure 1, Criteria for Assessing an Installation , includes a ssessment criteria that can be used for determining if a COG installation has a security vulnerability
. Table 1 includes guidance to assist in answering the questions in Figure 1. For installations identified as having securit y vulnerabilities , such as those for which the answer s to the assessment statements in Figure 1 result in the answer to question number 4 being yes, the design should be changed
. Alternativel y, the COG can be replace d with an acceptable oxygen source that is not a security threat.4 Start
1
. Is a COG installed on the airplane ? Section 25
. 795 ( d ) does not apply No
Yes
2
. Is the COG installed where crewmembers can always

see it ?

The airplane complies with § 25
. 795 ( d ) No Yes

3
. Is it immediately obvious if someone is accessing the COG ? Yes
No 4
. Is the COG susceptible to tampering ? No
Yes Change the COG installation design **Figure 1: Criteria for Assessing an Installation** 5 **Table 1: Assessment**  **Stat ement Analysis**  **Question Number**  **Notes and Questions to Assist with Assessment**  **Statement Analysis 1**  **.** Review the instructions for continued airworthiness. Review drawing s ys tem . Inspect the airplane’s configuration
. **2 .**  C rewmembers can observe the COG installation
. Check the area where the COG is installed. I solated areas such as galley s, lav atorie s, crew rests, enclosed occupied compartments, lower lobe lavatory complexes are potential areas of concern and require further evaluation
. Are crewmembers c lose to the COG installation during their normal duties ? Are there ph ys ical barriers between the crewmember and the area being evaluated? Is there significant distance between the crewmember and the area being observed ? How accessible is the COG? Is the CO G installation surrounded b y curtains? Curtained areas are also considered potential areas of concern and may require further evaluation
. **3 .**  Are there locks on doors/access panels? Are there tamper resistance fasteners on panels? Alarms or some other active alerting tamper indication method is part of the installation’s design
. **4 .**  Check if the COG can be compromised in place. Assess the vulnerability

of the adjacent materials to contain the compromised device
. Assess the ability

of the compartment to contain the event. Check if the COG can be removed. **b. Installation of**  **Tamper Resistan t**  **Features .**  Tamper resistant design features can be used , in whole or in part, to make a COG installation secure . There are different types of tamper resist ant design features , and their functionality largel y depend s on the installation
. The principal benefit of tamper resistance is to delay exploit ation of the COG as a weapon. However, it is not likely

that an existing COG installation that can be accessed from within the lavatory could be modified with tamper resistant design features sufficient to prevent a successful attack
. This is because typical measures of tamper resistance , such as “ special ” tools and fasteners , could likely

be overcome given enough time . These measures are normall y used as one of several layers of securit y. Thus the reliance on such measures is onl y one element of the security sy stem.6

**(1)** A tamper resistant installation employ s multiple element s, which may includ e : **(a)** th e COG’s location, **(b)** the method of mounting, **(c)** phy sical protection (through shielding or mechanical isolation of key components ) , and

**(d)** internal design. **(2)** Eliminating access to the COG is the most straightforward way to make the COG tamper resistant. T ypically , this can be done by placing the COG in a location where significant disassembly of the cabin interior would be required to gain access
. For example, the COG for a lavatory could be located so the entire lavatory module would have to be removed to access the COG. **c. Installation of Tamper Eviden**  **t Features**  **. (1)**  For COGs that can be accessed from isolated compartments, such as lavatories, some form of active tamper evidence ( for example, an alarm), would be needed in ad dition to the installation of tamper resistant features . This is necessary so the time to intervene and stop the attack is less than th e time required to carry out the attack. In this case p assive tamper evident features , such as a tamper evident seal, are not effective because they provide an after
- the
- fact notification of tampering. The effectiveness of a tamper evidence s ys tem depends on i ntervention ; it cannot be assumed that the “ alarm ” by itself would inhibit the attack. **(2)** Once an alert is a ctivated indicating the COG is being tampered with, actions by crewmembers and other available authorized responders are necessary to prevent catastrophic damage to the airplane
. Therefore, there is a critical relationship between the tamper evidence sy st em and the training and capabil ity of the crew to respond
. To be most effective, crew training should be accomplished prior to the alarm feature being deplo yed into the fleet. The time needed to successfully respond to the alarm may be several minutes an d depends on several factors . T he time available to respond to a threat and intervention times are functions of not only the design features but also many complex and human factors
- dependent variables that are difficult to define . These variables include , but are not limited to, the individual capabilities and numbers of flight attendants/authorized responders relative to the terrorists/accomplices , as well as the extensiveness of the training received
. **d .**  **System Safety Considerations.** The applicant sh ould consult the current version of AC 25.1309
- 1 for guidance on compliance with § 25.1309. **e .**  **Hazard classification.** F ailure of tamper resistant or tamper - evident features should be considered major.7

**f .**  **System Performance When Installed. (1)**  A t amper evidence sy stem installed for compliance with § 25.795 ( d) is intended to notify crewmember s that some one is trying to gain access to a COG , presumably for the purpose of creating a potentially catastrophic in
- flight fire
. The sy stem should provide a ural and visual warning s to immediately

not ify crewmember s so they can provide direct response in a timely fashion. For example, visual indication should be provided so the crew can identify which COG location is being tampered with while performing their normal duties
. Aural alerts should be distinct from other alerts and clearly audible to the crewmembers expected to respond to the alert. If an alert is provided to the flightcrew, the alert should be presented in accordance with § 25.1322. **(2)** The o xygen sy stem installed to meet § 25.795(d) must comply with other regulations applicable to ox ygen s ys tems . If the ox ygen s ys tem does not comply with any of these other regulations the applicant needs to petition for an exemption in accordance with existi ng processes. There have been developments in oxygen s ys tem technologies to support new airplane programs. Applicants with these new airplane programs have assessed the dosage of oxygen required by § 25.1443 (based on tracheal partial pressure) and propo sed ox ygen s ys tem test methods that measure actual ox ygen saturation levels in the blood. The test methods include human subject testing in an altitude chamber to substantiate the performance of the oxygen sy stem being considered
. T est methods that measure blood ox ygen saturation levels may be used to demonstrate that a new proposed ox ygen system intended to correct a securit y concern as described in this AC provides an equivalent level of safety to § 25.1443. Using this approach can reduce the total quantity of oxygen required, which in turn can reduce the size of the supply source. A smaller supply source may allow room in existing space provisions for installing design features to address the security concern. **7. Areas that are Immediately Obvious .**  For COG installations located where an y attempt at tampering would be “immediately obvious,” additional safet y measures are not required. Immediately

obvious areas include the main passenger cabin and o ther areas where occupants are alway s present . Wh ile some measure of tamper resistance is encouraged for these locations, none is required to meet § 25.795(d). “ Private ” compartments ( such as a lavatory) or visually divided sections of larger cabin areas are assessed independentl y. The “ immediately obv ious ” criteri on applies to the specific location of each COG installation, not simply the general area in which it is located. In addition, the installation must be evaluated under all conditions that may exist during a flight. So, for example, if tampering would be “immediatel y obvious” except when a curtain is pulled to provide privacy , the installation must be evaluated based on the curtain being arranged in a way that most conceals the installation.

[Signature Block]