Advisory U.S. Department of Transportation Circular Federal Aviation Administration Subject: Chemical Oxygen Generator Date: 03/11/14 AC No. 25.795-9 Security Standards Initiated by: ANM-100
1. Purpose. This advisory circular (AC) provides guidance for an acceptable means of showing compliance with the requirements of Title 14, Code of Federal Regulations (14 CFR)
25.795(d), Chemical oxygen generators. Section 25.795(d) requires each chemical oxygen generator (COG) or its installation to be designed so it meets one of several criteria. The means of compliance described in this document provides guidance to supplement the engineering and operational judgment that must form the basis of any compliance findings relative to a COG installed on an airplane.
2. Applicability.
a. This AC provides guidance directed to design approval holders, such as airplane manufacturers and modifiers, civil aviation authorities, and Federal Aviation Administration (FAA) airplane type certification engineers, their designees, and inspectors.
b. This material is neither mandatory nor regulatory in nature and does not constitute a regulation. It describes an acceptable means, but not the only means, for demonstrating compliance with the applicable regulations. The FAA will consider other means of demonstrating compliance that an applicant may elect to present. While these guidelines are not mandatory, they are derived from extensive FAA and industry experience in determining compliance with the pertinent regulations. On the other hand, if we become aware of circumstances that convince us that following the guidance in this AC would not result in compliance with the applicable regulations, we will not be bound to the terms of this AC and we may require additional substantiation or design changes as a basis for finding compliance.
c. This material does not change, create any additional, authorize changes in, or permit deviations from, regulatory requirements.
3. Definition of Terms. For this AC, the following definitions should be used.
a. Access - The ability to manipulate the COG with the intent of making alterations for a purpose for which the COG was not originally designed. This includes gaining access to the area surrounding the COG.
b. Activation - Release of the firing mechanism of the COG for the purpose of initiating the chemical reaction inside.
c. Alteration - A change in the configuration of the COG once access has been gained for the purpose of using the COG for other than its intended function.
d. Chemical Oxygen Generator (COG) - A device that releases oxygen that is created from a chemical reaction.
e. Immediately Obvious - Where an attempt to gain access to the COG would be readily recognized as suspicious (prior to gaining access). This would only be in locations with unrestricted access that are observable.
f. Intervention - The actions crew members must take to prevent damage to the airplane once an alert is activated indicating that the COG is being tampered with. The time it takes to intervene with someone in the lavatory has not been determined; however, we assume that it will take several minutes to resolve the issue.
g. Observable - A crew member is able to see if a person attempts to gain access to a COG installation during the course of the crew member’s normal duties.
h. Tamper-Evident Feature - A unique feature that provides an active and obvious contemporaneous alert to crew members that someone is trying to gain access to the COG and immediate crew intervention is necessary.
i. Tamper Resistance - The level of deterrence for gaining access to the COG.
j. Unrestricted access - An area of the cabin passengers can enter without overcoming locks or other mechanical closure means.
4. Related Documents.
a. Regulations. You can download an electronic copy of 14 CFR from the Internet at
http://www.fdsys.gov. You can order a paper copy by sending a request to the U.S.
Superintendent of Documents, U.S. Government Printing Office, Washington, D.C. 20402 0001, or by calling telephone number (202) 512-1800; or by sending a request by facsimile to
(202) 512-2250.
(1) § 25.1301, Equipment - Function and installation.
(2) § 25.1309, Equipment, systems, and installations.
(3) § 25.1322, Flightcrew alerting.
(4) § 25.1450, Chemical oxygen generators.
(5) § 25.1443, Minimum mass flow of supplemental oxygen.
b. AC. You can download an electronic copy of the latest version of AC 25-22, Certification of Transport Airplane Mechanical Systems, from the Internet at http://rgl.faa.gov.
5. Requirements of § 25.795(d).
a. Applicability. Section 25.795(d) is applicable to part 25 airplanes equipped with COGs.
b. Requirements of § 25.795(d). The following text is quoted from § 25.795(d): “ Each chemical oxygen generator or its installation must be designed to be secure from deliberate manipulation by one of the following:
(1) “By providing effective resistance to tampering,
(2) “By providing an effective combination of resistance to tampering and active tamper-evident features,
(3) “By installation in a location or manner so any attempt to access the generator would be immediately obvious, or
(4) “By a combination of approaches specified in paragraphs (1), (2), or (3) of this section that the Administrator finds provides a secure installation.”
c. Requirements of Airworthiness Directive (AD) 2012-11-09. AD 2012-11-09 requires that after September 10, 2015, no person may operate a transport category airplane in passengercarrying operations …. unless each lavatory is equipped with a supplemental oxygen supply in accordance with §§ 25.1443 and 25.1447. COG installations must meet the requirements specified in § 25.795(d) in effect on May 12, 2014, or FAA Policy Statement PS-ANM-25-04, Chemical Oxygen Generator Installations, dated 12/21/2011.
6. Compliance with § 25.795(d).
a. Acceptable Means of Determining if a COG or its Installation is Designed to be Secure. Several criteria may be used for determining if a COG installation is secure or has a security vulnerability. COG installations with a security vulnerability must include design features to prevent potential misuse of the COG. Figure 1, Criteria for Assessing an Installation, includes assessment criteria that can be used for determining if a COG installation has a security vulnerability. Table 1 includes guidance to assist in answering the questions in Figure 1. For installations identified as having security vulnerabilities, such as those for which the answers to the assessment statements in Figure 1 result in the answer to question number 4 being yes, the design should be changed. Alternatively, the COG can be replaced with an acceptable oxygen source that is not a security threat.
Start
3. Does the COG contain effective tamper resistance and active tamper-evident features?
1. Is a COG installed on the airplane?
2. Is the COG installed where crewmembers can always see it?
4. Is the COG susceptible to tampering?
Change the COG installation design.
No No Yes Yes No Yes Yes No Section 25.795(d) does not apply.
The airplane complies with § 25.795(d).
Figure 1: Criteria for Assessing an Installation 4
Table 1: Assessment Statement Analysis Question Number Notes and Questions to Assist with Assessment Statement Analysis
1. Review the instructions for continued airworthiness.
Review the drawing system.
Inspect the airplane’s configuration.
2. Can crew members observe the COG installation?
Check the area where the COG is installed. Isolated areas , such as galleys, lavatories, crew rests, enclosed occupied compartments, and lower lobe lavatory complexes are potential areas of concern and require further evaluation.
Are crew members close to the COG installation during their normal duties?
Are there physical barriers between the crew member and the area being evaluated?
Is there significant distance between the crew member and the area being observed?
How accessible is the COG?
Is the COG installation surrounded by curtains? Curtained areas are also considered potential areas of concern and may require further evaluation.
3. Are there locks on doors/access panels to prevent access?
Are there tamper-resistant fasteners on panels?
Are alarms or some other active alerting tamper indication method part of the installation’s design?
4. Check if the COG can be compromised in place.
Assess the vulnerability of the adjacent materials to contain the compromised device.
Assess the ability of the compartment to contain the event.
Check if the COG can be removed.
b. Installation of Tamper-Resistant Features. Tamper-resistant design features can be used, in whole or in part, to make a COG installation secure. There are different types of tamper-resistant design features, and their functionality largely depends on the installation. The principal benefit of tamper resistance is to delay exploitation of the COG as a weapon. However, it is not likely that an existing COG installation that can be accessed from within the lavatory could be modified with tamper-resistant design features sufficient to prevent a successful attack.
This is because typical measures of tamper resistance, such as special tools and fasteners, could likely be overcome given enough time. These measures are normally used as one of several 5
layers of security. Thus, the reliance on such measures is only one element of the security system.
(1) A tamper-resistant installation employs multiple elements, which may include:
(a) the COG’s location,
(b) the method of mounting,
(c) physical protection (through shielding or mechanical isolation of key components), and
(d) internal design.
(2) Eliminating access to the COG is the most straightforward way to make the COG tamper-resistant. Typically, this can be done by placing the COG in a location where significant disassembly of the cabin interior would be required to gain access. For example, the COG for a lavatory could be located so the entire lavatory module would have to be removed to access the COG. However, the installer should also consider the ramifications on maintenance when this approach is used.
c. Installation of Tamper-Evident Features.
(1) For COGs that can be accessed from isolated compartments, such as lavatories, some form of active tamper evidence (for example, an alarm), would be needed in addition to the installation of tamper-resistant features. This is necessary so the time to intervene and stop the attack is less than the time required to carry out the attack. In this case, passive tamper-evident features, such as a tamper-evident seal, are not effective because they provide an after-the-fact notification of tampering. The effectiveness of a tamper-evident system depends on intervention; it cannot be assumed that the alarm by itself would inhibit the attack.
(2) Once an alert is activated indicating the COG is being tampered with, actions by crew members and other available authorized responders are necessary to prevent catastrophic damage to the airplane. Therefore, there is a critical relationship between the tamper-evidence system and the training and capability of the crew to respond. To be most effective, crew training should be accomplished prior to the alarm feature being deployed into the fleet. The time needed to successfully respond to the alarm may be several minutes and depends on several factors. The time available to respond to a threat and intervention times are functions of not only the design features but also many complex and human factors-dependent variables that are difficult to define. These variables include, but are not limited to, the individual capabilities and numbers of flight attendants/authorized responders relative to the terrorists/accomplices, as well as the extensiveness of the training received.
(3) In order to be effective, the alerting system must itself be resistant to tampering.
Otherwise, the entire concept of using the early notification to crew could be nullified and the COG accessed without impediment.
d. System Safety Considerations. The applicant should consult the current version of AC 25.1309-1 for guidance on compliance with § 25.1309.
e. Hazard classification. Failure of tamper-resistant or tamper-evident features should be considered major.
1. System Performance When Installed.
(1) A tamper-evidence system installed for compliance with § 25.795(d) is intended to notify crew members that someone is trying to gain access to a COG. The system should provide aural and visual warnings to immediately notify crew members so they can provide direct response in a timely fashion. For example, visual indication should be provided so the crew can identify which COG location is being tampered with while performing their normal duties. Aural alerts should be distinct from other alerts and clearly audible to the crew members expected to respond to the alert. If an alert is provided to the flightcrew, the alert should be presented in accordance with § 25.1322.
(2) The oxygen system installed to meet § 25.795(d) must comply with other regulatons applicable to oxygen systems. If the oxygen system does not comply with any of these other regulations, the applicant needs to petition for an exemption in accordance with existing processes. There have been developments in oxygen system technologies that measure actual oxygen saturation levels in the blood. Using this approach can reduce the total quantity of oxygen required, which in turn can reduce the size of the supply source. A smaller supply source may allow room in existing space provisions for installing design features to address the security concern. This approach would require an equivalent level of safety finding to § 25.1443(c).
7. Areas that are Immediately Obvious. For COG installations located where any attempt at access would be immediately obvious, additional safety measures are not required. Immediately obvious areas include the main passenger cabin and other areas where occupants are always present. While some measure of tamper resistance is encouraged for these locations, none is required to meet § 25.795(d). Private compartments (such as a lavatory) or visually divided sections of larger cabin areas are assessed independently. The immediately obvious criterion applies to the specific location of each COG installation, not simply the general area in which it is located. In addition, the installation must be evaluated under all conditions that may exist during a flight. So, for example, if tampering would be immediately obvious except when a curtain is pulled to provide privacy, the installation must be evaluated based on the curtain being arranged in a way that most conceals the installation. As with tamper-evident designs, crews should be made aware that tampering with any COG is a safety risk, and any necessary information incorporated into training programs.
Jeffrey E. Duven Manager, Transport Airplane Directorate Aircraft Certification Service 7
Advisory Circular Feedback If you find an error in this AC, have recommendations for improving it, or have suggestions for new items/subjects to be added, you may let us know by (1) emailing this form to 9-AWA-AVS AIR500-Coord@faa.gov or (2) faxing it to the attention of the Aircraft Certification Service Directives Management Officer at (202) 267-3983.
Subject: (insert AC title/number here) Date: Click here to enter text.
Please check all appropriate line items:
☐ An error (procedural or typographical) has been noted in paragraph Click here to enter text.
on page Click here to enter text..
☐ Recommend paragraph Click here to enter text. on page Click here to enter text. be changed as follows:
Click here to enter text.
☐ In a future change to this AC, please cover the following subject:
(Briefly describe what you want added.)
Click here to enter text.
☐ Other comments:
Click here to enter text.
☐ I would like to discuss the above. Please contact me.
Submitted by: Date: