AMC 25.795(d) Security of chemical oxygen generators

ED Decision 2015/019/R

1.       Purpose

CS 25.795(d) requires each Chemical Oxygen Generator (COG) or its installation to be designed so that it meets one of several criteria. The means of compliance described in this AMC provides guidance to supplement the engineering and operational judgment that should form the basis of any compliance findings related to a COG installed on an aeroplane.

2.       Definition of terms

For this AMC, the following definitions apply:

(a)      Access: The ability to manipulate the COG with the intent of making alterations for a purpose for which the COG was not originally designed. This includes gaining access to the area surrounding the COG.

(b)     Activation: Release of the firing mechanism of the COG for the purpose of initiating the chemical reaction inside. 

(c)      Alteration: A change in the configuration of the COG once ‘access’ has been gained for the purpose of using the COG for a function other than the one it is intended for.

(d)     Chemical Oxygen Generator (COG): A device that releases oxygen that is created from a chemical reaction.

(e)      Immediately obvious: Where an attempt to gain ‘access’ to the COG would be readily recognised as suspicious (prior to gaining ‘access’). This would only be in locations with ‘unrestricted access’ that are ‘observable’.

(f)      Intervention: The actions crew members must take to prevent damage to the aeroplane once an alert is activated indicating that the COG is being tampered with. The time it takes to intervene when the lavatory is occupied has not been determined; however, it can be assumed that it will take several minutes to resolve the issue.

(g)      Observable: A crew member is able to see if a person attempts to gain ‘access’ to a COG installation during the course of the crew member’s normal duties.

(h)     Tamper-evident feature: A unique feature that provides an active and obvious contemporaneous alert to crew members that someone is trying to gain ‘access’ to the COG and immediate crew ‘intervention’ is necessary.

(i)       Tamper-resistance: The level of deterrence for gaining ‘access’ to the COG.

(j)      Unrestricted access: An area of the cabin passengers can enter without overcoming locks or other mechanical closure means.

3.       Related Certification Specifications (CSs)

CS 25.795    Security considerations

CS 25.1301  Equipment — Function and installation

CS 25.1309  Equipment, systems, and installations

CS 25.1322  Flight crew alerting

CS 25.1450  Chemical oxygen generators

4.       Compliance with CS 25.795(d)

(a)      Acceptable means of determining if a COG or its installation is designed to be secure

Several criteria may be used for determining if a COG installation is secure or has a security vulnerability. COG installations with a security vulnerability must include design features to prevent potential misuse of the COG. Figure 1, Criteria for Assessing an Installation, includes assessment criteria that can be used for determining if a COG installation has a security vulnerability. Table 1 includes guidance to assist in answering the questions in Figure 1. For installations identified as having security vulnerabilities, such as those for which the answers to the assessment statements in Figure 1 result in the answer to question number 4 being yes, the design should be changed. Alternatively, the COG can be replaced with an acceptable oxygen source that is not a security threat.

Figure 1: Criteria for assessing an installation

Table 1: Assessment statement analysis

(b)      Installation of tamper-resistant features

Tamper-resistant design features can be used, in whole or in part, to make a COG installation secure. There are different types of tamper-resistant design features, and their functionality largely depends on the installation. The principal benefit of tamper-resistance is to delay exploitation of the COG as a weapon. However, it is not likely that an existing COG installation that can be accessed from within the lavatory could be modified with tamper-resistant design features sufficient to prevent a successful attack. This is because typical measures of tamper-resistance, such as special tools and fasteners, could likely be overcome given enough time. These measures are normally used as one of several layers of security. Thus, the reliance on such measures is only one element of the security system.

(1)     A tamper-resistant installation employs multiple elements, which may include:

(i)      the COG’s location;

(ii)      the method of mounting;

(iii)     physical protection (through shielding or mechanical isolation of key components); and

(iv)     internal design.

(2)     Eliminating access to the COG is the most straightforward way to make the COG tamper-resistant. Typically, this can be done by placing the COG in a location where significant disassembly of the cabin interior would be required to gain access. For example, the COG for a lavatory could be located so that the entire lavatory module would have to be removed to access the COG. However, the installer should also consider the ramifications on maintenance when this approach is used.

(c)      Installation of tamper-evident features

(1)     For COGs that can be accessed from isolated compartments, such as lavatories, some form of active tamper-evidence (for example, an alert) would be needed in addition to the installation of tamper-resistant features. This is necessary so that the time to intervene and stop the attack is less than the time required to carry out the attack. In this case, passive tamper-evident features, such as a tamper-evident seal, are not effective because they provide an after-the-fact notification of tampering. The effectiveness of a tamper-evident system depends on intervention; it cannot be assumed that the alarm by itself would inhibit the attack.

(2)     Once an alert is activated indicating that the COG is being tampered with, actions by crew members and other available, authorised responders are necessary to prevent catastrophic damage to the aeroplane. Therefore, there is a critical relationship between the tamper-evidence system and the training and capability of the crew to respond. To be most effective, crew training should be accomplished prior to the alarm feature being deployed into the fleet. The time needed to successfully respond to the alarm may be several minutes and depends on several factors. The time available to respond to a threat and intervention times are functions of not only the design features but also of many complex and human factor-dependent variables that are difficult to define. These variables include but are not limited to the individual capabilities and numbers of flight attendants/authorised responders relative to the terrorists/accomplices, as well as the extensiveness of the training received.

(3)     In order to be effective, the alerting system must itself be resistant to tampering. Otherwise, the entire concept of using the early notification to crew could be nullified and the COG accessed without impediment.

(d)      System safety considerations

The applicant should consult AMC 25.1309 for guidance on compliance with CS 25.1309.

(e)      Hazard classification. Failure of tamper-resistant or tamper-evident features should be considered major.

(f)      System performance when installed

A tamper-evidence system installed for compliance with CS 25.795(d) is intended to notify crew members that someone is trying to gain access to a COG. The system should provide aural and visual warnings to immediately notify crew members so that they can provide direct response in a timely manner. For example, visual indication should be provided so that crew members can identify which COG location is being tampered with while performing their normal duties. Aural alerts should be distinct from other alerts and clearly audible to the crew members expected to respond to the alert. If an alert is provided to the flight crew, the alert should be presented in accordance with CS 25.1322.

5.       Areas that are immediately obvious

For COG installations located where any attempt to access would be immediately obvious, additional safety measures are not required. Immediately obvious areas include the main passenger cabin and other areas where occupants are always present. While some measure of tamper-resistance is encouraged for these locations, none is required to meet CS 25.795(d). Private compartments (such as a lavatory) or visually divided sections of larger cabin areas are assessed independently. The ‘immediately obvious’ criterion applies to the specific location of each COG installation, not simply the general area in which it is located. In addition, the installation should be evaluated under all conditions that may exist during a flight. So, for example, if tampering would be immediately obvious except when a curtain is pulled to provide privacy, the installation should be evaluated based on the curtain being arranged in a way that most conceals the installation. As with tamper-evident designs, crews should be made aware that tampering with any COG is a safety risk, and any necessary information should be incorporated into the training programmes.

[Amdt 25/17]