Engine Fire Protection

An engine carries fuel, oil and hydraulic fluid under pressure next to casings hot enough to ignite them. Engine fire protection makes sure that if a leak does catch fire, the fire stays where it started, the engine can be isolated from every supply that feeds it, and an extinguishing agent can be delivered into the right place within seconds.

The protection works in layers. Design contains the fire in a designated fire zone behind fireproof walls. A detection system warns the crew (see fire and overheat detection). The engine fire handle or pushbutton isolates the engine, and a fixed fire extinguishing system floods the zone with agent. The crew's drill, described in engine failure and engine fire, ties these together.

Designated fire zones

A designated fire zone is a region where a fire could start following the failure or leakage of a component. CS 25.1181 and 14 CFR 25.1181 identify them on transport aeroplanes. They include the engine compartments, down to the compressor section of a turbine engine, and the APU compartment. Each must meet the fire protection requirements of CS 25.1185 to 25.1203, so it has fire detection, extinguishing and walls that contain a fire.

An engine is not one zone but several. Fireproof bulkheads divide it into compartments, for example around the fan case and around the core, so that a fire in one cannot spread into the next, and each compartment has its own detection and its own share of the extinguishing agent. On the A320 the detection elements lie in the pylon nacelle, the engine core and the fan section. The zones depend on the engine: on the A320neo, the LEAP-1A has two designated fire zones, the fan area and the core, while for the PW1100G-JM EASA accepted the fan compartment as a zone that is not a designated fire zone, so only the core is protected.

Firewalls and fireproof bulkheads

A firewall separates an engine from the rest of the aircraft; in a light aeroplane it is the wall between the engine and the cabin. It keeps an engine fire away from the cabin and flight deck, and it also contains leaking fluids.

Firewalls and the fireproof bulkheads within the nacelle must be fireproof. ATPL texts quote the standard as withstanding a flame of about 1,100°C (2,000°F) for at least 15 minutes without burning through. That rules out aluminium alloys, which melt at around 660°C. Firewalls are made of stainless steel or titanium; titanium gives the best fire resistance for its weight, stainless steel is heavier.

Engine fire handle

The engine fire handle (a pull handle or switch on Boeing and Embraer types, a guarded pushbutton on Airbus types) isolates the engine in one action. Pulling or pushing it cuts off everything that could feed the fire or spread it:

On the E190-E2 the fire handle closes the fuel, hydraulic and bleed air shutoff valves. On the 737 the switch is mechanically locked down to prevent an inadvertent shutdown and is unlocked by the fire warning or an ENG OVERHEAT light; an override button unlocks it manually.

The handle does not always stop the engine at once. The A320's pushbutton closes only the low-pressure valve at the wing, and an engine at idle would run for about a minute on the fuel left downstream of it. The drill therefore shuts the engine down first with the engine master switch or start lever, and uses the fire control to isolate it.

Fixed extinguisher bottles

The agent is stored in fire extinguisher bottles, pressurised containers connected by fixed pipes to the zones they protect; the E190-E2's engine bottles, for example, are in the rear wing-to-fuselage fairing. They normally hold Halon 1301, which discharges as a vapour that floods an enclosed space (see fire extinguishing agents), kept under pressure; ATPL texts give about 600 psi as a typical charge.

Engine systems are high rate discharge (HRD) systems: the whole charge is released in seconds rather than minutes, flooding the zone with agent. Each bottle is sealed by a bursting disc. An electrically fired cartridge, the squib, is fitted between the bottle outlet and the pipe; when fired it ruptures the disc and the agent rushes into the distribution pipes.

Transport aircraft typically give each engine two shots, but the arrangements differ:

• The A320 has two bottles for each engine, each fired by its own AGENT pushbutton, and each squib has a dual electrical supply. There is no cross-feed between engines.
• The Boeing 737 has two bottles for both engines. Pulling an engine's fire switch arms one squib on each bottle, and either or both bottles can be fired into either engine by rotating the switch one way or the other.
• The E190-E2 has two engine bottles, cross-connected so that either can serve either engine.

On the 737 the engine extinguishing circuits are powered from the hot battery bus, and an EXT TEST switch checks the continuity of each squib circuit before flight.

View full schematic

Bottle discharge and spray rings

From the bottle, the agent travels through fixed pipes to spray rings or nozzles in the fire zones, which spread it around the engine and through each part of the zone. The same principle serves the APU compartment and cargo holds, where some mixed systems combine fixed pipes and nozzles with adapter points for hand extinguishers.

Discharging a bottle takes a deliberate action separate from pulling the handle: on the 737, rotating the fire switch to a stop and holding it for one second; on the A320, a brief push on the AGENT pushbutton. Halon acts by chemically interrupting the combustion and by blanketing the fire, so it works quickly, but it does not cool the hot metal. That is one reason why the fuel is shut off before the agent is used: fresh fuel on a hot engine can reignite once the agent has dispersed.

Discharge indicators

The crew and engineers must be able to see whether a bottle has been used:

• Flight deck lights. The A320's amber DISCH light comes on in the AGENT pushbutton when its bottle has lost pressure; the 737's amber BOTTLE DISCHARGED light comes on a few seconds after the switch is rotated, and also if the pressure is low.
• On the bottle. A pressure gauge that reads zero after discharge and, on some bottles, an indicator pin that moves out when the squib has fired. These may be visible only with a panel removed.
• Thermal discharge indicator. If a bottle is overheated, a thermal relief device vents its contents overboard before it can burst. A red disc on the outside of the fuselage, visible on the walk-round, shows that this has happened; ATPL texts describe it as a green disc being ejected to reveal the red one. On the A320, a red disc outside at the rear of the fuselage signals that agent has been discharged overboard through bottle overpressure.

A discharged bottle, whether fired or vented, is replaced before the next flight, and a thermal discharge is investigated.

Engine fire drills

The generic engine fire drill is carried out in a strict order: silence the warning, isolate the engine from fuel, air, electrics and hydraulics, then discharge the extinguishant. The type's checklist governs the details. The initial actions depend first on whether the aircraft is in the air or on the ground; an engine fire at or after V1 is carried into the air, with no action on the engine until a safe height.

On the Boeing 737 the recall items of Engine Fire, Severe Damage or Separation are: autothrottle disengage; thrust lever of the affected engine close, which also helps confirm which engine it is; start lever to CUTOFF; engine fire switch pull, using the override if it is not unlocked. If the fire switch or ENG OVERHEAT light stays illuminated, the switch is rotated to a stop and held for one second; if after 30 seconds the warning remains, it is rotated to the other stop to fire the remaining bottle. On the A320 the ECAM procedure closes the thrust lever, sets the ENG MASTER switch OFF, pushes the ENG FIRE pushbutton and discharges AGENT 1, then AGENT 2 if the fire is still detected 30 seconds later.

Each irreversible action is confirmed by both pilots. After the drill the aircraft lands at the nearest suitable aerodrome; a warning that persists after both shots makes that landing urgent. On the ground, an engine fire commonly leads to an evacuation.

Uncontained engine failure

An uncontained engine failure is one in which fragments of a failed rotating part escape through the engine casing and nacelle. Fragments that escape can pass through the wing, fuel tanks, systems and cabin. Three accidents show the consequences:

• United Airlines Flight 232 (1989): the fan disc of the DC-10's tail engine failed, and its fragments severed the lines of all three hydraulic systems.
• Qantas Flight 32 (2010): an intermediate pressure turbine disc of a Trent 900 on an A380 burst, damaging the wing, a fuel tank, hydraulics, electrics and flight controls.
• Southwest Airlines Flight 1380 (2018): a fan blade of a 737-700's left engine broke off at a fatigue crack; a fragment of the engine's fan cowl struck the fuselage and a cabin window departed.

Aircraft are designed to limit the damage, with guidance such as FAA AC 20-128A: a rotor burst is analysed as a particular risk, and redundant systems are physically separated so that a single burst is unlikely to disable them all. On the E190 E1, for example, a dry bay beside each engine pylon keeps fuel out of the area most exposed to a rotor burst.

For the crew, severe damage is handled with the fire drill. Boeing combines them in one checklist, Engine Fire, Severe Damage or Separation. A severely damaged engine is never relit, and with structural damage possible, the handling of the aircraft is checked before the approach.

Library articles are written for study and exam preparation. They do not replace your aircraft's approved documentation, your operator's procedures or the regulations themselves.