9.3 Engine Fire Protection, Detection, and Extinguishing

Fire Protection as a Chain of Events

An engine fire is a combustible-material event (fuel, oil, or hydraulic fluid) in a hot, ventilated nacelle. Protection is therefore a layered system, not a single device. The links are: prevention (firewalls, shrouded fuel/oil lines, drains, and fireproof materials per 14 CFR Part 23/25); detection (sensors that alert the crew); isolation (firewall shutoff valves that cut fuel, hydraulic fluid, and bleed air to the affected engine); extinguishing (discharging agent into the fire zone); and post-event inspection before any return to service.

A fire zone is a region the manufacturer designates as fire-protected, defined by ventilation airflow and the presence of ignition sources and combustibles. On a typical turbofan installation the nacelle is divided into Zone 1 — the fan/accessory area — and Zone 2 — the hot engine core. Extinguishing agent is normally directed into Zone 1; a Zone 2 (core) fire is managed primarily by shutting the engine down, closing the fuel and air, and letting airflow purge it, because flooding the core with agent is far less effective than removing the fuel source.

The fire-protection requirements scale with the aircraft. Small single-engine airplanes may have no installed extinguishing system at all, relying on a firewall, shutoff valve, and a handheld extinguisher; transport-category and most multiengine turbine aircraft must have fixed detection and at least one (often two) discharge bottles per engine. Regardless of size, the firewall is a fundamental barrier: it must be fireproof (withstand 2,000 degrees F flame for 15 minutes per the regulatory standard) and sealed at every penetration so a fire cannot spread from the engine compartment into the cabin or structure.

Detection Methods

Detectors must sense heat reliably without false alarms from normal nacelle temperature or a simple wiring fault.

Continuous-loop (resistance) systems complete the warning circuit when any portion reaches the set temperature, so they behave like a long thermal switch and are not primarily rate-sensitive. A key advantage of a loop wired as a complete circle is that a single break does not disable detection. Systems include a self-test that simulates a fire signal to verify continuity and the control unit — passing the test confirms the circuit, not that a fire exists.

Extinguishing Systems and Troubleshooting

The extinguishing bottle stores agent — historically Halon 1301, now increasingly HFC or other Halon-replacement agents — pressurized with nitrogen. Firing the cockpit switch sends current to an electrically initiated cartridge (squib) that ruptures a frangible disc, releasing agent through distribution tubing into the fire zone.

Two indicator discs on the airframe report bottle status: a red thermal discharge disc blows out if the bottle vented from overheat (overpressure), and a yellow disc blows out if the crew discharged the bottle normally. Bottle charge is verified by a pressure gauge read against an approved temperature-correction chart, because the indicated pressure of a gas changes with ambient temperature — a "low" gauge on a cold morning may be perfectly in limits once corrected.

Sorting a fire warning

• A warning that appears with vibration and clears at shutdown suggests a chafed/intermittent detector wire or loose connection as much as a real localized overheat — inspect the loop routing and clamps, and run the self-test.
• A steady warning that passes self-test but shows no heat or smoke points toward a shorted detector segment or a control-unit fault.
• A discharged bottle (yellow or red disc out, low/zero pressure) must be weighed or pressure-checked, recharged or replaced, the squib renewed, and the cause investigated before return to service.

Overheat warning versus fire warning

Many installations provide a separate overheat warning at a lower temperature than the fire warning, alerting the crew to a hot-air leak (a failed bleed-air duct) or an unusual nacelle temperature before an actual fire develops. The mechanic distinguishes the two circuits during inspection and self-test. False warnings are commonly caused by chafed loop tubing, moisture in connectors, a damaged grommet at a firewall penetration, or kinked loop that creates a hot spot — so detector routing, clamping every few inches, and protection at pass-throughs are airworthiness items, not cosmetic. Detector continuity and insulation resistance are checked with the system de-energized, and the integrity test (self-test) is run with power on to confirm the control unit and warning annunciation. After any real fire, the entire zone is inspected for heat damage, and the agent residue is cleaned because some agents form corrosive by-products when decomposed by fire heat.