Boeing Engine fire QRH /NNC delaying second extinguisher for > two minutes
 

Several years ago a change was made to the airborne Engine fire QRH / NNC for all Boeing aircraft. The second shot was moved from a memory item to a subsequent action (following clean up). With some operators / situations this will result in a delay of over two minutes before the second shot is fired. I can’t find anything from Boeing or the engine manufacturers making it clear that this is what they are actually expecting (product liability concerns?).
This is what is suggested by various experts.

“While it may take longer to reach the step in the non-normal checklist (NNC), the most critical actions—cutting fuel, hydraulics, and electricity, and firing the first bottle—remain memory items to stop the fire's source immediately”

Personally, if I have a failed engine on fire that hasn’t gone out after 30 seconds I’m not waiting for my MTOW underpowered 787 to stagger up to acceleration altitude, crawl up to min clean THEN fire shot two. Any hard information from Boeing (or company policy on this)?

Our QRH has 30s fire the other one. Timer started and/or brought up on the ECL.

Bear in mind that Boeing say they have no recorded instance of an engine shutdown using the correct procedure needing a second bottle. Some airlines say clean, some say after 30s - our checklists reference time rather than flap position. YMMV.

I'm not sure about the Boeing docs - I remember the change, but I don't recall the rationale. The guidance from our training department is pretty open: fly the plane and if you can, wait until clean up to action any checklist, but that the ultimate decision to get things started is left to the crew in the moment. If we feel 500' AGL is the right time to start throwing switches and blowing bottles, then we're free to do so.

The delay between the first shot and second shot is pretty standard across the types I've flown. I had to bring up my instructor notes, but this was the guidance given on the Q400 when I was teaching:

It's entirely possible that Boeing has identified something similar.

I believe the change was data driven/modernisation in combination with an attempt to minimise memory items. A memo at the time; "in-service experience shows that the fuel control switch has the greatest impact (because it prevents fuel flowing to the fire) and the first bottle has the impact of removing oxygen and cooling the hot section. If the first bottle hasn't worked, it's unlikely the second bottle will have any impact eg. UA328"

From Boeing FOTB,it may be the REASON.

“Extinguishing a Fire
If an engine fire is in the engine core compartment fire zone, the action of placing the fuel control switch to cutoff removes the fuel from the fire. This shuts off fuel at the engine and spar valves. Boeing has determined that cutting off the fuel is the most important step in extinguishing the fire.

Discharge of a fire bottle augments this action by introducing a cooling effect and temporarily displaces some oxygen. If the fire remains confined to the fire zone, the probability of the fire and fire warning persisting after these two actions is low. Therefore, the probability of needing to discharge a second fire bottle is equally low.

The design premise of the second fire bottle is for use if there is a re-ignition or a second fire.”

I had this discussion during my last simulator session.

I (and the instructor) believe it’s probably a good idea to wait until the flaps are up and the NNC can be actioned “calmly” rather than rush through two bottles at 400 ft with the memory items.

If the first bottle didn’t stop the fire, it’s unlikely the second one will.
Plus it might make sense to space the bottle discharges in time so that the first bottle has had time to cool down the fire detection loop. Or save it for later in case the fire reignites for whatever reason.

The Boeing QRH non normal checklist instructions for all Boeing types I have operated had the line “The pilot flying may also direct reference procedures to be done by memory if no hazard is created by such action, or if the situation does not allow reference to the
checklist.” Or similar. I’d say that would cover you if you and your colleague were able to quickly agree on the next step of the checklist…

Boeing changed procedures because people absolutely wanted to do things leading to rushed situations in which decisions are taken that make the situation worse.

As a simple real life simulator example: while you are wondering why your 787 is not climbing, your engine on fire was actually still providing thrust. But you decided to shut it down in an eagerness to shoot bottles. That is not what Boeing asks you to do.

* Memory items: flight path under control, gear retracted, and safe altitude attained (400ft AGL) > memory items.
* Reference items: as soon as practical

Debriefing a situation in which an engine fire, with the engine providing thrust, resulting in a shutdown engine and an overboosting engine is pretty interesting. Especially when the aircraft didn't climb... because the crew forgot to raise the landing gear.

You might laugh or think it is absurd, but reality is that these situations happen very often in an eagerness to follow those procedures. The bottle is considered the absolute "life saver". It is far from that. But all that other switcheridoo you rushed into because you think about "2 minutes" leads to catastrophy quicker than you might think.

PS even on the ground that philosophy exists: the FOTB explains they found the idea of shooting 2 bottles just delays evacuation...

PS2: the same happened with the go-around procedure: people focused on flap setting because that's what the call-out said and OPT calculations required. Some focus so hard that in all that eagerness to follow the callout, they forget to "set correct thrust" which is much more important than actual flap setting.

Aren't you ? It's a bit of a sticky wicket to invent your own procedures that go against the aircraft manufacturer's SOPs

Just looked at the QRH and it still says 30 seconds for the second bottle. On the previous Boeing forgetting that second shot was a fail if the fire warning was still active. Of course other operators may have a different philosophy.

Crews rushing to take action after an engine problem - then taking the exact wrong action - has resulted in catastrophic outcomes more than once. Just off the top of my head, I can think of three fatal crashes that occurred because a crew shut down the wrong engine after an engine failure. Take your time and get it right - your life as well as the lives of all those people in the back depend on it.
While an engine fire justifies more prompt action that most engine issues, there is still no reason to rush. The engine installations are certified to withstand a serious fire for five minutes before any crew action is taken - with firewalls and fire proof materials used to mitigate the effects of an engine fire for that five-minute period.
Now I'm not suggesting anyone actually test that five-minute fire protection by waiting that long before taking action, those protections are designed to give the crew time to work the problem in a rational, thoughtful, organized process.

Thanks tdracer, I love learning little snippets like that. Can I assume that certification rules like that are FAA rules and that European rules mirror them?
Cheers,
​​​​​​​Framer

That would be a good assumption. Starting in the late 1990's, we (Boeing) started doing 'joint' FAA/EASA certifications (the JAA before EASA was formed a few years later). In most cases the regulations mirror each other, although there are some exceptions. Since we used the FAA regulations as our baseline, there would be some meetings with EASA to agree to a list of 'significant differences' between the FAR's and the EASA CAR's. That list of differences then became the basis for the EASA certification - for everything not on that list, EASA agreed to accept the FAA cert as being adequate.
I'm reasonably sure there are not meaningful differences between the FAA and EASA rules for engine fire safety.

Much appreciated, thanks for the info.

Don't reinvent the wheel.
 

:ok:

Propulsion System Malfunction Plus Inappropriate Crew Response (PSM + ICR)

https://skybrary.aero/sites/default/...shelf/1623.pdf

" Although the vast majority of propulsion system malfunctions are recognized and handled appropriately, there is sufficient evidence to suggest that many pilots have difficulty identifying certain propulsion system malfunctions and reacting appropriately.

While current training programs concentrate appropriately on pilot handling of engine failure (single engine loss of thrust and resulting thrust asymmetry) at the most critical point in flight, they do not address the malfunction characteristics (auditory and vibratory cues) most likely to result in inappropriate response.

The changing pilot population, coupled with reduced exposure to in-service events from increased propulsion system reliability, is resulting in large numbers of flight crews who have little or no prior experience with actual propulsion system failures "

Since the report was published, many of the technical and certification aspects have improved - safety improvement. However, there has been little change in human behaviour; we still encounter error, make mistakes (thinking); thus the safety focus on HF should be maintained:-

• Understand the situation; avoid fast thinking 'I know what this is'
• Identify the relevant procedure; avoid 'I know better'
• Read and act according to the procedure; avoid 'external advice, hearsay, unsubstantiated opinion'

Between each item think 'ma'; pause - seek 'the wisdom of space in-between' (Japanese) 間

Beware negative influence (negative training in the report). Nowadays this can be seen in the influx of web-based graphic diagrams and videos providing 'explanation', often mistaken or only generic (more the authors tech prowess than factual advice). Mainly for enthusiasts not professionals.

Manufacturers' design and certification have deep design knowledge and situational consideration of failures in their aircraft; much more than we might think otherwise.

Don't reinvent the wheel.

You would fail because you forgot. You would still fail if you skip the step (when reading)

It all depends on your mindset (I guess). Some pilots would prefer to fire the second bottle after 15 seconds if you didn't specify the 30 seconds. I doubt you would have failed if you shot the second bottle after 45 seconds... In reality many times this ends up in "!!!!, forgot the timer".

For the record, I'm not here to say you have to waste time, it is still a fire. I disagree on the 2 minutes time limit "to get things done". There are other priorities. In the FCTM Boeing makes explicitly a subtle difference between engine failure and fire: engine failure (no memory items) > NNC is normally done after the flaps have been retracted and conditions permit. Engine fire > NNC reference items should be done by the PM _as soon as practical_. There is slight difference, up to your operator to decide on how they view this.

For that reason we changed from
"PF - GO AROUND FLAPS 20" as one call-out to
"PF - GO AROUND" "PM - [READ FMA]" "PF - FLAPS 20" "PM - SPEED CHECKED-FLAPS 20, THRUST SET, POSITIVE RATE" etc.

Not always black & white
 

TD Tracer, Brace Brace & uplinker (please choose whichever response is appropriate).

In our company accel alt is 1,000’agl…..memory items at 400’ so all actions correctly taken at 400’ is not rushing anything.OP was when to fire shot two NOT carrying out memory items @ 150’

Correctly completing the memory items at the correct point means you have one extinguisher selected …illuminated in red….there is no more chance of you firing the wrong side shot 30 secs after memory items complete than there would be after clean up.

Also said FAILED engine on fire (this being the reason why it takes over two mins to get to min clean). One of you referred to an engine on fire is producing thrust (this would take much less time to get to the subsequent actions and was specifically not the situation in my OP).

I am aware of the certification requirements of engine fire containment ( I was heavily involved in this before starting flying for a living). This is no guarantee of fire protection. Uncontained failures (Man 737, Quantas A380 etc mean fire can spread in seconds not minutes. Engines are also certified to withstand medium weight bird strikes (Hudson).

The QRH still explicitly states
If you believe setting the Eng to max cont thrust (in a non perf critical climb out) is more important than missing the above shot two timing by a factor of five that’s your prerogative. But don’t tell me I’m inventing procedures, Captains authority allows exactly that anyway.

I have have had enough time in the industry to have witnessed the (long) overdue rationalisation of checklists, procedures and training to take into account human factors and the ultimate goal which is to make things as safe as possible within the constraints you are working with.

When I first started virtually everything was assessed on how fast you did it, not particularly on how much thought and diagnosis was involved: see light, pull lever. Today it is much more about reasonable outcomes and the methods used to get to those reasonable outcomes - the soft skills as they are called. Which is more important and should be prioritised in an EFATO, even with a fire indication; doing a rapid shutdown or ensuring the flightpath of the aircraft is assured, e.g. an ET? The engine may or may not be on fire after 30s but the terrain will stay in the same place. I have in my Company library a 50-page document purely about engine failure and diagnosis, which is itself a distillation of a huge amount of source material including failures that we have had.

All that said, if a checklist directs you towards a certain course of action and there is no obvious reason why this is a bad idea, then conventional wisdom is to carry it out in the way intended, not to try and invent new ways of doing it (what the manufacturers call troubleshooting, which is a last resort when the outcome of Normal and/or Non-Normal Procedures is deemed unacceptable). The current trend is to move as much as possible from recall into read-and-do with crew cooperation, where appropriate. Boeing have recently removed all recall items from an un-annunicated engine fire on the ground, for instance.

Going back to the original question, if you have done the initial items of the FIRE ENG checklist correctly, then a) the engine fuel valves should be closed and all other services disconnected and b) the inside of the cowling should have had a good dose of extinguishant, just in case. As the fire detection systems are activated by temperature not by flames/smoke/combustion, it may take a while for the indication to cease even though the problem has been rectified, e.g. a high-stage bleed leak that has heated stuff up that has thermal inertia. Hence the 30s. I side with others in that if the initial actions have been unsuccessful, the second shot is unlikely to do that much as you’re now dealing with something that is uncontained/uncertified but as that’s what the drill is, we action it anyway as why not?

Sorry RMC, but your original post is worthy of some pushback. Do you currently fly the 777/787? Has your operator told you that you can’t fire the second bottle until clean? That’s not we do. We do the memory items above 400ft which includes firing the first bottle. Once these are complete we bring the checklist up with the timer - once it reaches 30secs we can fire the second bottle as a reference item. We then wait until clean to do the rest of the checklist. It’s a minor change of procedure, not worth getting upset about.

And as Captain we do have authority to modify procedures - to save life or in situations that are outside the scope of the QRH procedures (ie multiple failures). However, not complying with a procedure because you think you know better than Boeing / the regulator / the training department is not acceptable. If you did this for real after an engine fire then those carrying out the investigation would take a very dim view, and you would also be exposing yourself and your airline to potential legal challenges by the pax, insurance company etc. Boeing, regulators and airlines have done the risk assessment in the cold light of day with all the information available. If you have reservations about it then speak to your training department / technical pilot etc and they can explain the rationale behind it.