littleferrhis nearly every safety system in aircraft today are due to fatal incidents in the past. But that can be said about almost any safety system anywhere. Car airbags weren't just an idea developed out of nowhere to help save lives.

Dropping the landing gear again? It is retracted when up and in the bay heating up the debris / space and possibly causing a fire. Leaving it down would allow the gear to cool.

This happens quite a bit leaving Vegas during the summer. The plane is heavy with tourist and needless to say it's hot

+Austin Ford Thanks for the info Austin!

That's interesting information. Doesn't the C-17 also have an additional thing they do with the air they use to increase lift that other aircraft do not do? I think the engines blow air thru ducts over the or under the wings so they can do super short takeoffs. I'd be interested if maybe there is extra fire detection loops in the C-17 due to that, or if there is just a different design.

jim stephens You may be referring to the flaps. When the flaps extend, it'll get in the way of the thrust that the engines produce. When the thrust hits the flaps, it is deflected downward. That downward force is basically contributing to keeping the aircraft in the air. This is one of the reasons why the C-17 is able to perform STOL ops.

Austin Ford​ absolutely right.

Also used on bombardier airframes as well.

You make a good point. To explain why two is sufficient you have to look at the possible failure modes of these thermistors: A short circuit or low impedance fault between the live and ground wire - This would look like a false positive (fire detected with no fire present) The most likely result of senor failure, a breakdown of the insulator properties, mishandling of the cable, voltage surge on the live wire. etc etc could all cause a fault with the same effect as a fire would. An increased resistance between the live and ground wire - This would prevent the thermistor from working as originally intended and could prevent the detection circuit activating when a fire is detected. Fortunately, due to the mechanical and electronic properties of the detection mechanism, the chance of this kind of fault is orders of magnitude lower than the low impedance/short circuit fault. If there was an increased resistance this would appear to be a decrease in temperature. The system could check if this temperature reading was valid by cross-checking against other temperature measurements (I'm not certain it does this). A disconnected temperature sensor (infinite resistance between the live and ground) - This fault would be detectable as during normal operation (no fire, no sensor fault) some current flow would be present. If there is no current flow then there would be a "TEMP SENSOR FAULT" reported. For this particular system, dual redundancy is sufficient as only one failure mode is undetectable and likely to occur. There are examples of airline systems where dual redundancy is not considered sufficient (eg hydraulic system). The most important thing when designing safety critical systems such as these is to sufficiently isolate the two devices such that a single fault, could not cause the same failure in both systems at the same time. This isolation and redundancy are one of the key reasons why aviation systems are so expensive.