When it comes to burner management systems, safely sequencing a burner through each state of the firing process is the top priority. This can be broken down into 4 basic functions: 1) Pre-ignition checks verifying that the burner and boiler are in a safe condition to start, 2) Continuous monitoring of all safety limits while the burner is running, 3) Initiating a safety shutdown sequence when an unsafe condition is detected, and 4) Initiating a normal shutdown sequence when the burner’s call for heat is over.

The below diagram shows a typical burner management state machine:

The BMS begins in the Standby state, waiting for a call for heat. When a call for heat is received, the BMS begins its Pre-Start Checks. This is where the controller verifies that the safety limits circuit is not energized which would indicate that the limits are jumped out. This also checks that the minimum air flow switch is not made before the fan is running, which would indicate that it is set to low. While this is happening the controller will run additional internal checks program memory corruption or incorrect settings.

If the Pre-Start Checks are successful, the BMS will move on to the Pre-Purge state. During Pre-Purge the blower motor is energized to run the fan to clear any unburnt combustibles from the furnace, boiler passes, and flue. Pre-Purge must run long enough for 4 full air changes for firetube boilers and 8 full air changes through the furnace for watertube boilers. This timer is not allowed to start until all air-related control outputs are proven to be in the open position and the purge air flow switch is made. Once this is proven and the Purge timer is complete, the BMS moves to the Ignition state or PTFI, depending on the type of burner.

Before PTFI can begin the Fuel/Air control outputs must be proven to be at the low fire position to ensure the burner lights off at the safely commissioned point. Once this is proven, the BMS then energizes the ignition spark and pilot fuel valves. After this point the BMS has a limited period of time in which a flame must be sensed (typically 10 seconds). If the flame is not sensed within this window of time, the BMS will initiate a safety shutdown or lockout and will not proceed to the next state.

If the burner management detects the pilot within the allotted window, it then moves on the main trial for ignition (MTFI) state. This is when the main fuel valves are opened and the controller verifies that there is a stable flame. Any flame failure from this point forward will result in a burner lockout, though some smaller burners can be setup to attempt a retry by going ack to the Pre-Purge state and attempting the lightoff again. If a flame is detected, the burner management will release the burner to modulate with the plant load.

Safely Shutting Down the Burner

At all times starting from the Pre-Purge state and continuing into the Modulate state, the burner management is monitoring two limit circuits: the Start Limits and the Running Interlocks. The start limits are also known as the Recycling Limits, meaning that the burner does not have to be manually reset when this circuit opens. This circuit represents a normal shutdown, typically due to a loss of the burner’s call for heat or the burner ON-OFF switch being set to the OFF position. When this happens, the burner management removes the released to modulate command which drives the fuel/air control to low fire then shuts the main fuel valves and does a Post-Purge before stopping the blower motor. The burner will remain in the standby state until the Start Limit circuit recloses, and the burner cycle starts again.

If the Running Interlocks circuit opens while the burner is firing, this is considered an unsafe condition and the burner management performs a safety shutdown to the lockout state. The Running Interlocks are also referred to as the Non-Recycling Limits because the lockout must be manually acknowledged and reset by the operator before the burner management will attempt to start the burner again. When a lockout occurs, the burner management must immediately shut all fuel valves and perform a post-purge. Once the lockout is acknowledged and cleared, the burner goes to the standby state and resumes it’s normal sequence.