Boeing 787 APU and Fire Protection

The Boeing 787's auxiliary power unit (APU) is unusual for what it does not supply: it gives no bleed air at all. Mounted in the tail cone, like the APUs of traditional airliners, it drives two starter generators that feed the aircraft's electrical system, from which the engines are normally started. Fire protection covers the engines, the APU, the wheel wells, the cargo compartments, the lavatories and the crew rests, with some features shaped by the 787's composite structure.

This article draws on the EASA type-certificate data sheet (TCDS), the FAA Master Minimum Equipment List (MMEL), the FAA Flight Standardization Board (FSB) reports, Boeing's airport planning document and Boeing's 2007 AERO article, written before entry into service. The APU's electrical role is covered in Boeing 787 electrical system, and the A220's arrangement in A220 APU and fire protection.

The APU and its generators

The TCDS lists one no bleed-air APU, the Hamilton Sundstrand APS5000, on all three models, and leaves its limitations and operating procedures to the flight manual. Boeing's 2007 description places it in the tail cone, as on traditional aircraft, but providing only electrical power. With nothing delivered as compressed air, all the components of pneumatic power delivery disappear from the APU, and Boeing expected a simpler and more reliable unit as a result.

The two APU starter generators (ASGs) and the two variable frequency starter generators (VFSGs) on each engine make up the 787's six generators. The APU runs at variable speed, taking advantage of the variable-frequency electrical system: Boeing described the operating speed as set by ambient temperature and kept within a 15 percent range of the nominal speed, for better performance.

For a pilot coming from the 777, the original FSB differences table sums up the APU as no bleed air, no air turbine starter, an electric starter and a starter duty cycle limitation. The current FSB report rates the APU differences at level A, self-instruction.

APU start and operation

The APU starts the way the engines do. Its generators run as starting motors, controlled by start converters, and only one of the two is needed for an APU start. The power can come from the aircraft battery, a ground power source or an engine-driven generator; there is no pneumatic start. For this the MMEL lists a dedicated APU battery with its own charger, and an APU start power unit (SPU), in addition to the main battery.

Fuel reaches the APU through an APU DC fuel pump and an APU fuel shutoff valve. The APU air inlet door has its own actuation system, which the MMEL allows to be deactivated in the in-flight open position, and the MMEL also lists an APU ground control panel. The MMEL lists APU EGT, RPM, oil quantity and oil pressure indications and an APU FAULT light; a no-bleed APU has no bleed pressure to show.

In service the APU is the normal power source for an engine start: Boeing's airport planning document says a normal start uses the APU to provide electrical power, with ground power units on the forward receptacles as the alternative when the APU is unavailable (details in Boeing 787 no-bleed systems architecture).

The MMEL also shows how the APU backs up the engine generators. With one VFSG inoperative, the APU must be started before departure and run for the whole flight, with both APU generators working. With the APU itself inoperative, dispatch requires the left APU generator control unit and all the VFSG systems to work and the flight to remain within 180 minutes of a suitable airport. These are dispatch conditions, not normal procedures.

Engine fire detection

The engine fire detection system is built from detector assemblies, each containing more than one detector element. The MMEL lists 24 elements on aircraft with Rolls-Royce Trent 1000 engines and 20 on those with GE GEnx-1B engines, of which 12 and 10 must work for dispatch, one element in each detector assembly being allowed to be inoperative. The EASA data sheet records, for all three models, an equivalent safety finding titled "RR Turbine Overheat Detection", and the original FSB report states that the fire detector systems comply with 14 CFR 25.1203.

Two other systems watch areas where a fire or a hot-air leak could otherwise go unseen:

• Wheel well fire detection. Twelve temperature detectors, of which eight must work; one per wheel axle may be inoperative if the outboard detectors work. With the whole system inoperative, the MMEL prohibits flaps 20 for take-off and keeps the landing gear extended for 10 minutes after take-off (Boeing 787 landing gear and electric brakes).
• Duct leak overheat detection. Two systems with four channels, of which one channel per engine may be inoperative. With a system inoperative, the associated engine anti-ice switch must stay off, the aircraft must not be flown in known or forecast icing and the flight must remain within 120 minutes of a suitable airport. The hot engine air left on the 787 serves engine anti-ice (Boeing 787 ice and rain protection).

Engine fire extinguishing

The engines are protected by fixed extinguishing bottles: the MMEL lists four fire bottle discharge (BTL DISCH) lights, covering the engine, APU and cargo bottles, and the original FSB report states that the design meets the fire-extinguishing system requirements through 14 CFR 25.1195 and 25.1201. The EASA data sheet records an equivalent safety finding on the design of the fire handle for the 787-8, called the fire switch handle for the 787-9 and 787-10.

Both FSB reports list the APU and cargo fire controls among the differences from the 777, at level A in the current report. The principles are in engine fire protection, fire and overheat detection and fire extinguishing agents and hand extinguishers.

View full schematic

APU fire protection

The APU has two fire detection loops, one of which is required for dispatch, and a fire extinguishing system with an automatic discharge function. The original FSB report describes the APU fire controls and indicators as on the same panel and in the same location as on the 777, with more automation. The MMEL provisos show how the parts depend on each other:

• APU auto discharge inoperative. The APU fire warning indicator must be monitored whenever the APU runs on the ground, so that a person watches for the warning in place of the automatic function.
• APU fire detection inoperative. Either the APU selector stays OFF, or the APU is used on the ground only, monitored continuously by ground personnel, with the APU external control system working and the APU not used during taxi. In both cases the VFSGs must work and the flight must remain within 180 minutes of a suitable airport.
• APU fire extinguishing system inoperative. The APU is not used, the VFSGs must work and the same 180-minute limit applies.

Cargo fire protection

The lower cargo compartments are not accessible to the crew in flight and are not designed to need a crew member to enter them to fight a fire: an integral cargo fire protection system is installed instead. All cargo compartment fire extinguishers are controlled by switches on the cargo fire panel on the flight deck. Smoke detection grows with the length of the holds:

A detector may be inoperative only if the detectors next to it work normally. The agent is held in bottles 2A, 2B and 2C, with bottles 2D and 2E as optional equipment, and is directed to the forward or the aft compartment through separate forward and aft flow valves. The system also includes bottle pressure monitors, two squib control channels and a filter/regulator. With one of bottles 2A to 2C inoperative, it must be deactivated, the aircraft operated pressurised and the total bottle capability must at least equal the maximum time to land at a suitable airport. With a flow valve inoperative, its compartment must stay empty or carry only ballast, empty cargo handling equipment or the fly-away kit, the spares an operator carries on board.

Compared with the 777, the cargo fire controls are on the same panel in the same place, with additional automation for the protection of the composite structure. The composite airframe also shaped the certification basis: EASA's special conditions include in-flight and post-crash fire resistance of composite material and composite wing and fuel tank fire protection, and the 787-10 has an equivalent safety finding on burn-through protection of the composite fuselage. For the 787-9, the certification basis also includes CS 25.795(b)(3), cargo compartment fire suppression, one of the security requirements Boeing elected to comply with. See cargo and lavatory fire protection for the principles.

Lavatory, crew rest and cabin fire protection

Each lavatory has a smoke detection system and a waste compartment fire extinguishing system, and the MMEL lists a smoke-detected function of the lavatory call light. A lavatory with its smoke detection inoperative may be used only by crew members, with its waste receptacle empty and its door locked and placarded.

The overhead crew rests described in Boeing 787 family and flight deck have their own smoke detection: six individual bunk smoke detectors in the overhead flight attendant rest (OFAR) and two in the overhead flight crew rest (OFCR), each rest also having two entrance area smoke detectors. A bunk whose detector has failed is closed off with a barrier strap and placard.

In the cabin and on the flight deck, the original FSB report lists water and Halon portable fire extinguishers, and a crash axe is installed in the flight deck. The forward and aft equipment cooling systems have their own smoke detectors, covered in Boeing 787 air conditioning, pressurisation and oxygen.

Library articles are written for study and exam preparation. They do not replace your aircraft's approved documentation, your operator's procedures or the regulations themselves.