Burner Management Systems


 The following paragraphs outline a general method for implementing a typical boiler Burner Management System (BMS).  Several general guidelines to implement operation strategies for such a system are also provided.

 This document is intended for use by the control systems designer as a guide for basic design.  Final and detailed BMS design is required per the applicable design specifications. The control systems designer is responsible for compliance with this standard, and all other applicable federal, state and local standards and regulations.


 The Burner Management System must be designed to ensure a safe, orderly operating sequence in the start-up and shutdown of fuel firing equipment and to reduce possible errors by following the operating procedure.

 The system is intended to protect against malfunction of fuel firing equipment and associated systems.  The safety features of the system shall be designed to provide protection in most common emergency situations; however, the system cannot replace an intelligent operator’s reasonable judgment in all situations.

In some phases of operation, the BMS shall provide permissive interlocks only to insure safe startup of equipment. Once the equipment is in service, the operator must follow acceptable safe operating practices.

 It is essential that all parts of the BMS are in good working order and in service whenever the burner is in service if the system is to provide the protection for which it is designed. Regular maintenance and inspection of the system and its associated hardware is essential for its continued safe operation.

 This narrative gives a description of a typical BMS as it relates to the various operating phases and the operation of the fuel firing equipment and associated systems.

 BMS Functions

            The BMS shall be designed to perform the following functions:


  1.      Prevent firing unless a satisfactory furnace purge has first been completed.

  2.      Prohibit start-up of the equipment unless certain permissive interlocks have first been completed.

  3.      Monitor and control the correct component sequencing during start-up and shut-down of the equipment.

  4.      Conditionally allow the continued operation of the equipment only while certain safety interlocks remaining satisfied.

   5.      Provide component condition feedback to the operator and, if so equipped, to the plant control systems and/or data loggers.

            6.      Provide automatic supervision when the equipment is in service and provide means to make a Master Fuel Trip (MFT) should certain unacceptable firing conditions occur.

            7.      Execute a MFT upon certain adverse unit operating conditions.


 Common cause of furnace explosions is “Fuel leakage into an idle furnace and the ignition of the accumulation by a spark or other source of ignition”.  Proper attention to the design of the interlocks and trip system to provide a safe light up of the boiler furnace is required.

 Furnace Purge

            Before any fuel firing is permitted, either initially or after a boiler trip, a satisfactory furnace purge cycle must be completed. Prior to starting a furnace purge cycle, the operator must ensure that the following purge requirements are satisfies


  1.      Drum level within operating range (not high, not low)

  2.      Instrument air header pressure within operating range

  3.      Fan is in service

  4.      Purge airflow capable of a minimum of 70% of the full load airflow established through the unit

  5.      All flame scanners reading "No Flame"

  6.      Natural gas block valves are proven closed

  7.      Fuel oil block valves are proven closed

  8.      Air dampers are in the fully open position

  9.      Natural gas, or fuel oil, header pressure upstream of block valve is satisfactory

  10.    Pilot gas header pressure is satisfactory

  11.    Burner Control System is energized

  12.    A "No Master Fuel Trip condition" condition is established


            As each of the above conditions is reached, their respective indicator lights, shall illuminate as "PURGE PERMISSIVES" on the operator control console.

            Once all of the above conditions are satisfied, the "PURGE AVAILABLE" light shall illuminate indicating  that the START PURGE switch is enabled by the system logic. Activating the START PURGE control, when the "PURGE AVAILABLE" light is illuminated, will begin a timed furnace purge cycle as indicated by a "PURGE IN PROGRESS" light illuminating.  As the purge shall be “...sufficient for at least eight air changes” of the furnace.

 If the operator is starting the boiler from the cold condition, or restarting after a Master Fuel Trip event, the procedure outlined in the following paragraphs is required.  If the boiler is recycling or otherwise starting from a warm condition, the MFT circuit will reset automatically and the procedure will skip directly to the main flame light off sequence.

 At the end of the purge cycle, and providing that the purge requirements remained satisfied, the damper control shall position the inlet damper for light-off, approximately 10% to 35% airflow, depending on burner design,  required turn-down, etc.  The "PURGE COMPLETE" light will illuminate and the boiler trip circuit shall be ready for reset, and so indicated by a "MFT RESET" light.

            Provided the start-up permissive remain satisfied, the system shall initiate a burner startup period timer set for no more than 10 minutes.  If the operator does not initiate a start-up within this time, the boiler control system will exit the “PURGE COMPLETE” condition and the operator must begin again with the pre-purge cycle.  If the MFT has been reset, the boiler control system will trip the MFT when leaving the “PURGE COMPLETE” condition.

            Upon completing a satisfactory purge, the operator must press the “RESET MFT” pushbutton.  The boiler control system will indicate that the MFT has been reset with a steady on “MFT RESET” light.  At this point, the boiler control system is ready to allow the main flame start-up sequence.

 Main Flame Start-Up Sequence

 The main flame start-up sequence, from the lighting the of the pilot flame through main flame light-off, is an automated sequence.  Once the start-up sequence has begun, only the “BOILER STOP” switch and the “EMERGENCY STOP” will interrupt the start-up sequence.  Any interruption of the start-up sequence requires a post-fire purge prior to attempting to start the boiler again.  To initiate the start-up sequence, the operator activates the “START BOILER” switch.

 Pilot Flame Light-Off

  Before the burner can be started, satisfactory light-off conditions for the pilot and main burners must be met.  This is accomplished when the following conditions are satisfied:

 For the pilot igniter:

1.    MFT relay reset

2.    Pilot gas header pressure normal

 For natural gas:

1.    All of the above mentioned for the pilot igniter

2.    Natural gas pressure normal

3.    Natural gas control valve is in light-off position

 For fuel oil:

1.    All of the above mentioned for the pilot igniter

2.    Oil gun is in place in the burner

3.    Oil pressure is normal

4.    Fuel oil atomizing interlocks are satisfied

5.    Fuel oil atomizing medium is provided to the burner

6.    Oil control valve is in light-off position

 Other Conditions:

 1.    No MFT condition after purge

 2.    All flame scanners report no flame

 3.    All natural gas, or all fuel oil, block valves shown closed

 4.    All air dampers are in light-off position


Failure to meet any of these conditions shall prevent the burner light-off operation.                   


 To light the pilot flame, the pilot header vent valve, and, for natural gas fuel, the natural gas vent valve shall be closed by the boiler control system.  Then, sequentially, the igniter transformer is energized, the pilot gas block valves are open and a 10 second pilot ignition timer starts counting down.  When ignition timer cycle is completed, the igniter transformer is de-energized and the pilot flame scanner is checked by the control system.  If the pilot flame is present, the main flame light-off sequence continues. If the pilot flame fails, the boiler control system initiates a pilot flame failure shutdown.  Additional attempts of pilot light-off are permissible provided a successful pilot light-off are made within 10 minutes after the furnace purge.

 Note that if the pilot flame continues to fail after several attempts, the boiler should be inspected to determine the fault and the condition corrected.

 Main Flame Light-Off

Once the pilot flame is made, the boiler control system opens the header block valves for the selected fuel.  A main flame light-off timer begins a 15 second countdown for natural gas, or 20 seconds for fuel oil, to establish and stabilize the main flame.  At 5 seconds before time out, the boiler control system closes the pilot block valves and opens the pilot vent valve.  The remaining 5 seconds are used to detect the main flame. For the typical dual flame scanner design, a main flame failure shutdown is initiated if both flame scanners return a “no flame” signal to the burner control system.  This will generate a boiler trip, and another furnace purge will be required.  Once the burner is lit, the system is in the NORMAL RUN CONDITION and combustion controls should be released to modulation control.


 “The normal shutdown cycle for the boiler shall accomplish the following in the order listed:

   (a) Shut off fuel supply to the main burner.

    (b) Interrupt spark and shut off fuel supply to igniter, if in operation.

    (c) For oil:

      1.  Where used, open the recalculating valve.

       2.  Shut off atomizing medium, if desired.

            (d) For gas, vent piping between safety shutoff valves to atmosphere.

            (e) Perform a post purge of the boiler furnace enclosure.

            (f) Shut down fan, if desired.”

  For a safety shutdown, a manual reset is also required.

 Normal Boiler Shutdown Process

 A normal shutdown is initiated by operating BOILER SHUTDOWN switch.  This will initiate the shut down sequence listed above.

 Boiler Master Fuel Trip

 Any of the following conditions shall cause a boiler trip to occur.   This results in the shutdown of all fuel and requires another furnace purge cycle before any attempt at re-lighting.


For fuel oil:

 1.   Excessive steam pressure.  2.   Low water level. 3.   Low fuel pressure . 4.   Low oil temperature. 5.   Loss of combustion air supply. 6.   Loss of flame. 7.   Loss of control system power.  8.   Loss of atomizing medium, if used.  


For natural gas:

1.   Excessive steam pressure or water temperature. 2.   Low water level. 3.   High or low gas pressure. 4.   Loss of combustion air supply. 5.   Loss of flame. 6.   Loss of control system power. 


In the event of an MFT, the control system shall initiate the following:

1.    Execute a shut down as listed above.

2.    Illuminate the appropriate indicator lights and alarms.

3.    Return the system to the pre-purge state

 Boiler restart will be inhibited until all pre-purge requirements are satisfied.

 Types of Alarms

 The following is a list of recommended alarm conditions:

1.    Any boiler or burner trip signal

 2.    High or low water level

 3.    High furnace pressure

 4.    Partial Loss of flame (For the typical two scanner system, one indicates “no flame”)

 5.    Main fuel shutoff valves closed

 6.    Loss of control system power

  7.    Unsuccessful burner shutdown

 Interface with the Combustion Control System (CCS)

 The following list, at a minimum, of signals should be sent to the Combustion Control System:

 1.    Controls to purge position

2.    Controls to light-off position

3.    Normal run condition: release controls to modulation

4.    Main natural gas block valve open: permissive to place gas control valve in automatic.

5.    Master fuel trip: run boiler load to zero and place combustion controls in manual.

6.    Oil recirculation signal


 Under the provisions of NFPA 8501, section 6-5.2.3, for a single burner boiler, the BMS and CCS may reside in the same processor.  This option can to reduce the integration complexity and increase  the BMS to CCS interface reliability.

 Operator Interface

 The above describes a traditional operator interface using discrete switches and indicator lights.  The control designer is encouraged to incorporate a graphical user interface or similar options in order to enhance the ease of use and readability of the boiler control system operator interface.


A.Pre purge permissive condition checks and furnace purge are to be initiated by the operator from the local BMS panel

 B. The total furnace airflow shall not be reduced below the purge rate airflow (75% of the maximum continuous airflow capacity). Reducing airflow below these limits will lead to a MFT, and a new furnace purge will be required.

 C. Suggested color design:

Purge Permissive indicating lights:


Purge Available indicating light:


Purge in progress indicating light:


Purge complete indicating light:


MFT reset indicating light: