Engine Fire Detection — Loops, Sensing Elements and the FDU

The engine nacelle is the most fire-prone volume on the aircraft: hot, and full of fuel, hydraulic fluid and hot-air ducts. Engine fire detection is the nacelle's smoke alarm — except it measures temperature, not smoke. This article takes the "heat loop → FDU" leg from the overview apart completely: what is inside the loop, how one tube senses two kinds of fire, why the four zones trip at different temperatures, and the pair of time constants (20 s and 5 s) that separate a fault from a fire.

1. An electro-pneumatic dual loop — AND that degrades to OR

The FCOM gives the crew view:

"The engines and the APU each have a fire and overheat detection system consisting of : - Two identical gas detection loops (A and B) mounted in parallel. - A Fire Detection Unit (FDU)."

The AMM states the type and the degrade behaviour — the first thing worth committing to memory:

"The fire detection system is of the electro-pneumatic type. On each engine, there are two continuous loops for the fire detection. The loops are connected in parallel to a Fire Detection Unit (FDU). The connection is made through an AND logic to avoid spurious FIRE warnings. In case of failure of one loop, the AND logic becomes an OR logic. The aircraft can be released in this configuration."

Three points sit inside that paragraph. Electro-pneumatic — the sensing is pneumatic (gas pressure), the processing is electronic. AND avoids spurious warnings — both loops must agree before a fire is declared. One loop failed → OR, dispatchable — the system automatically demotes AND to OR, trading anti-spurious margin for retained detection, which is the legal basis for dispatch with a single-loop fault. The FCOM restates the same fact in crew language:

"A fault in one loop (break or loss of electrical supply) does not affect the warning system. The unaffected loop still protects the aircraft."

[!warning]- The logic changes with the system's own health Healthy, the pair is AND (strict, anti-spurious); once one loop fails, it becomes OR (sensitive, detection-preserving). The logic switches automatically — the fail-conservative theme of the whole article. It is a mistake to remember "a fire always needs both loops": healthy needs two witnesses, degraded accepts one.

Each loop carries five detectors:

"For one engine, each loop: - comprises five fire detectors connected in parallel... - is connected through the related channel, to four of the eight lamps in a red warning light common to the two loops."

The FCOM's crew-facing count is by location:

"Five sensing elements for each engine, located in the pylon nacelle, in the engine core, compressor and fan sections."

So there are five detection positions per engine — pylon, zone 1 (left), zone 1 (right), zone 2, zone 3 — with one detector of each loop at every position, paired A/B for dual coverage. The red warning light has eight bulbs in two groups of four; each loop drives four, so burning out one loop's circuit still lights half the light — the same redundancy as the battery-only "half-light" in the overview.

2. The sensing element — a pressure tube obeying the gas law

"A sensing element is a tube 0.063 in. (1.6 mm) in outer diameter and 0.018 in. (0.46 mm) in thickness. It contains a hydrogen-charged titanium core with a spiral wound around it. This spiral is made of an inert material which has a special property: it can give off and absorb a gas. The gap between the sensing-element outer-tube wall and the core is filled with helium. The initial pressure of the helium is related to the pre-set temperature threshold selected for each sensing element. The sensing element reacts according to the ideal gas law."

Read against the ideal gas law, this is a two-gas tube. The helium in the annular gap senses an overall average temperature: heat the whole tube and the helium rises in pressure per PV = nRT. The hydrogen locked in the titanium core (released and reabsorbed by the inert spiral) senses a localised discrete temperature: let one short section be licked by flame and that section's spiral releases hydrogen, spiking the local pressure. Cool the tube and the average pressure falls while the core reabsorbs the hydrogen — reversible and self-resetting.

One tube therefore has two sensing functions, matched to the responder's two switches:

"The responder assembly consists of a stainless steel body. It contains a chamber connected to two pressure switches: an ALARM switch and a MONITOR switch. ... The fire detector has two sensing functions. It responds: - to an overall average temperature threshold or, - to a highly localized discrete temperature caused by impinging flame or hot gas. ... Each of the two detections has for result to close the ALARM switch."

[!warning]- One tube, two switches, one self-check philosophy Helium senses the "whole-tube bake", hydrogen the "single-point burn"; a pressure rise closes the ALARM switch = fire. The MONITOR switch watches something else entirely — whether the tube has lost gas:

"If the detector leaks, the loss of gas pressure will cause the MONITOR switch to open. When the MONITOR switch opens a fault signal is generated. In this condition the result of the system test will be negative."

Pressure up reports fire (ALARM closes); pressure lost reports a fault (MONITOR opens). Detecting the fire and detecting the detector's own failure are done with the same pressure tube — that is the entire meaning of the "pneumatic" in electro-pneumatic.

3. Four zones, four thresholds — set by how hot the zone normally runs

The four monitored zones trip at different, non-adjustable temperatures:

The thresholds track the zone's normal working temperature: zones 1 and 2 run relatively cool, so 260 °C average already means trouble; the turbine section and the pylon are hot by design, so their thresholds are raised to 400–425 °C average / 675–676 °C discrete to avoid nuisance trips.

[!warning]- Discrete thresholds are far higher than average thresholds A single spot licked by flame should only count at a much higher temperature, whereas "the whole tube is at 260/425 °C" means large-area overheat. The two thresholds map to two fires: average = smoulder / general overheat, discrete = torching flame / local fire. The pylon protection against combustion-chamber torching flames named in the overview is exactly the 675 °C discrete threshold at work.

4. The FDU — a three-comparator bridge that sorts fire from dirt from break

The detectors turn "pressure up/down" into switch states; the FDU turns those into a verdict.

"The Fire Detection Unit (FDU) processes the signals generated by the responder of the detectors. There are three functional modules: - two independent channels (1 for each detection loop) - one monitoring circuitry (for maintenance purpose only)."

Each channel is a bridge with three comparators:

"Three comparators are used for this analysis: - the FIRE comparator, - the CONTAMINATION comparator, - the INTEGRITY comparator."

Each detector is 7.50 kΩ; five in parallel give a loop equivalent of 1.5 kΩ. As the loop resistance shifts, the bridge voltage moves, and three thresholds sort the state:

[!warning]- Break and contamination move the voltage in opposite directions An open detector raises equivalent resistance → voltage falls → INTEGRITY declares INOP. Contamination lowers resistance → voltage rises (but not to the fire threshold) → CONTAMINATION declares a fault. Three thresholds let the FDU tell fire / dirt / break apart — which is why a dirty detector is never misread as a fire.

5. Fire and fault logic — 20 s sets a fault, 5 s sets the flame effect

The FCOM gives the crew criteria:

"A fire warning appears if: - Both loop A and B send a fire signal, or - One loop sends a fire signal and the other one is failed, or - Breaks occur in both loops within 5 s of each other (flame effect), or - A test is performed on the associated FIRE panel. A loop-fault caution appears if: - One loop is failed, or - Both loops are failed, or - The FDU fails."

The AMM supplies the two time constants:

"the detection by a single fire detection loop for a time of more than 20 sec while the other loop is in normal condition" → LOOP A(B) FAULT.

"When loop A (B) fault is present and if a loop B (A) fault occurs after more than 5 seconds... EWD: ENG 1 (2) DET FAULT... NOTE: If the two faults (loop A and loop B faults) occur in less than 5 seconds, a FIRE warning signal is generated."

The logic behind each constant:

• 20 s — only one loop reports fire while the other stays silent. It could be a real fire (why is the other loop quiet?) or that loop misbehaving. The system waits 20 seconds: if the other loop joins, it is a fire; if not, that loop is faulted. The window gives a lone report time to confirm or disprove itself.
• 5 s (flame effect) — a real fire burns through the tubes. If both loops break almost together (< 5 s apart), that is not coincidence — flame severed both, so a **fire** is declared. If the breaks are > 5 s apart, that is more like two independent mechanical failures → DET FAULT. "Broke together" is fire; "broke one after the other" is a fault.

[!warning]- "Both loops broke" can be a fire or a fault — the 5 s decides The most elegant logic in the chapter: the system does not ask whether the loops broke, it asks how — a fierce fire severs both in an instant, ageing hardware fails one at a time. A single 5-second window separates "burned through" from "wore out."

6. What the crew sees, and the dispatch link

The distinction between a LOOP FAULT (one leg down, still walks on OR logic) and a DET FAULT (both legs down, that engine's fire alarm is blind) is what the MEL article turns into dispatch verdicts. Note also that this system is fire and overheat detection — the average thresholds are overheat thresholds; there is no separate low-level engine-overheat caution on this aircraft, so an overheat to threshold is handled as a fire, red in one step.

Self-test

[!note]- Q1. What do hydrogen and helium each sense? When do the ALARM and MONITOR switches act? Helium (annular gap) senses overall average temperature; hydrogen (titanium core) senses localised discrete temperature. Pressure up closes ALARM (fire); pressure lost opens MONITOR (fault) — both via the same tube.

[!note]- Q2. Why do the four zones trip at different temperatures, and why is discrete higher than average? Thresholds track normal running temperature — cool zones (1/2) trip at 260 °C average, hot zones (3/pylon) at 400–425 °C. Discrete is higher because a single flame-licked spot should only count at a much higher temperature.

[!note]- Q3. Healthy logic vs degraded logic, and how does that support single-loop dispatch? AND when healthy, OR when one loop fails. OR still detects fire on the surviving loop, so a single-loop fault is dispatchable; losing both (DET FAULT) is not.

[!note]- Q4. What do 20 s and 5 s each decide? When are "both loops broken" a fire vs a DET FAULT? 20 s: a lone fire report either confirms (other loop joins) or is faulted. 5 s: both loops breaking < 5 s apart = fire (flame effect); > 5 s apart = DET FAULT.

[!note]- Q5. How does the FDU tell fire from dirt from break? Three comparators on a bridge: break raises resistance (voltage falls → INTEGRITY/INOP); contamination lowers it (voltage rises to mid-band → CONTAMINATION); fire closes ALARM (voltage above FIRE threshold).

Key takeaways

References

• FCOM DSC-26-20-10 — dual loop + FDU, five sensing elements, fire/loop-fault criteria.
• AMM 26-12-00 — electro-pneumatic type, AND→OR and dispatch, sensing-element construction (hydrogen/helium, ALARM/MONITOR), four-zone thresholds, FDU three comparators, 20 s / 5 s logic, DET FAULT.

Independent study material, not an Airbus publication and not endorsed by the manufacturer. Always defer to the current operator FCOM, FCTM, and QRH for operational use.