Safely sequencing a burner through each state of the burner cycle is the primary function of a burner management system (BMS) or flame safeguard. To do this the BMS utilizes various limits circuits to monitor the status of the burner through each step of the burner sequence. Each of these are “series limits circuits”, meaning that power is sourced on one end and sensed by the BMS on the other end with all of the limit switches wired in series in between. If any one of the switches in the circuit opens, the BMS will sense a loss of power on the circuit.

Proof-of-Closure Circuit

The first of these is the Proof-of Closure (POC) circuit. The purpose of this circuit is to monitor the status of all fuel safety shutoff valves (SSOVs). The SSOVs are responsible for shutting off the supply of fuel to the burner when the burner is not running. SSOVs are two-state valves either fully open or fully closed depending on the command from the BMS, and are typically slow-opening and fast-closing to ensure that the fuel is shut off immediately when there is an unsafe condition or if the burner is otherwise shut down. There are two SSOVs per fuel, and each of these must mechanically show that the valve is closed by making the contact of a Proof-of-Closure switch.

The BMS is monitoring this circuit at all times and will lockout the burner if any of the SSOVs are detected to be open (or more precisely, “not closed”) at an unexpected time. The Proof-of Closure circuit is a series limit circuit, which means that power is being sourced on one end of the circuit and will pass through each switch in series before returning to the BMS. If any switch opens, the circuit breaks and the BMS no longer sees power at the end of the circuit. The BMS sees this loss of power as an indication the one of the SSOVs is not closed, and then determines if this is permissible. The only time that the SSOVs are allowed to open is during the Main Flame Trial for Ignition (MTFI) and during the Released to Modulate state. At all other times, the opening of the Proof-of-Closure circuit will result in a burner lockout.

Operating Limits

The second limits circuit that the BMS monitors is the Operating Limits circuit, also referred to as the Recycling Limits circuit, so called because the loss of power to this circuit does not cause a lockout that has to be manually reset. This circuit typically contains two types of switches: 1) Call For Heat (CFH), and 2) Safety Limits that are allowed to be automatically reset. This limits circuit is responsible for determining if there is a call to start or stop the burner.

CFH switches can come in many forms, most commonly as a simple burner ON/OFF switch at the burner control panel. Some other forms include a remote start command usually in the form of a dry contact on a plant master controller or as an interposing relay contact energized by the Building Automation System (BAS).

Certain safety limit switches can also be wired into the Operating Limits circuit as Recycling Limits. Most commonly, this will be where the High Steam Pressure or High Water Temperature switch will be wired to for steam and hot water boilers respectively. These must not be confused with the High-High (or Critical High) Steam Pressure or Water Temperature switches which must be wired into the Running Interlock non-Recycling Limits circuit. The High Steam Pressure and High Water Temperature switches often include a built-in deadband which acts as the boilers start and stop pressure/temperature. For example, a High Steam Pressure switch can be given a setpoint of 10 psi and a deadband of 6 psi. In this case the burner will Stop when the pressure rises to 10 psi, and will not Start until the pressure drops below 4 psi (setpoint minus deadband).

High Fire (Purge) Proving Switches

Unless otherwise locked out, once the BMS senses power on the Operating Limits circuit, it will begin the burner cycle and attempt to send the burner into purge. Before the purge timer can begin counting down, the BMS must verify that there is sufficient air flow through the boiler via the Purge Air Flow switch, and that all air-related actuator/servo outputs are at the opened position. This most commonly includes the forced draft damper and induced draft damper, but can also include the flue gas recirculation damper if the burner manufacturer specifies that this must be in the open position for purge. Each of these control actuators has either an internal or auxiliary end switch that acts as the Proof-of-Open switch. A few common styles are the whisker type, plunger type, or rotary cam switch. The BMS must wait until all of these switches are made and there is power at the end of the High Fire Proving circuit before it can start the purge countdown timer. These switches must stay made through the entirety of purge, else the countdown is paused.

Low Fire (Ignition) Proving Switches

In a similar fashion to the High Fire Proving circuit, the Low Fire Proving circuit is used by the BMS to verify that all Fuel & Air control outputs are at their commissioned low fire positions before it can proceed to either PTFI or MTFI (depending on if the burner is a pilot or direct spark ignition). This is to done to protect against potentially igniting the burner with an overly fuel-rich condition do to a stuck valve or having a sudden burst of pressure due to igniting the burner at a higher firing rate. Unlike the High Fire Proving circuit, the fuel control valve is included here in addition to the air control outputs.

Running Interlocks

At all times starting from the Pre-Purge state and continuing into the Modulate state, the burner management is monitoring the Running Interlocks circuit. All safety-related limit switches are wired in series in this circuit, with the exception of the primary low water and high steam pressure switches which can be wired into the recycling limits. If any of these switches open while the burner is firing, this is considered an unsafe condition and the burner management performs a safety shutdown to the lockout state. The Running Interlocks are also referred to as the Non-Recycling Limits because the lockout must be manually acknowledged and reset by the operator before the BMS will attempt to start the burner again. When a lockout occurs, the burner management must immediately shut all fuel valves and perform a post-purge. Often the power that feeds the main fuel valves runs through this circuit which ensures that the valves are de-energized when a limit switch opens. Once the lockout is acknowledged and cleared, the burner goes to the standby state and resumes it’s normal sequence.