5.3 Flame Safeguard, Pilot Proving & Burner Interlocks

5.3 Flame Safeguard, Pilot Proving & Burner Interlocks

Quick Answer: Item 16 — 100% flame safeguard — shuts the main fuel burner valve and the pilot on pilot failure and prevents the main burner from turning on until a safe pilot is established. Scanners (UV/IR) prove flame; prepurge/postpurge clear combustibles; air flow switch proves primary air; interlocks and the programmer enforce sequence. Never light off without correct water level and a completed safe cycle.

Why Flame Safeguards Exist

A furnace full of unburned fuel is a bomb waiting for a spark. Delayed ignition can produce flareback — flames discharging from access doors or ports — or a full furnace explosion when fuel or combustible gas builds up in the fire side. Arkansas competency 2 requires that you can light off the boiler in a safe manner. Item 16 and the associated glossary terms (scanner, purge, interlock, programmer, air flow switch) are the automatic half of that skill; your procedure discipline is the other half.

Official Definition — Control List Item 16

100% FLAME SAFEGUARD: The pilot safety device to shut off the main fuel burner valve and the pilot burner in the event of a pilot failure and to prevent the main burner from turning on until a safe pilot is established.

Unpack the two duties:

“100%” in classic flame-safeguard language means the system supervises the pilot (and typically the main flame) so fuel valves cannot stay open into a dark furnace. If the pilot goes out, fuel must close. If the pilot never proves, main gas/oil must never open.

Flame Scanner, UV, and IR

On light-off, the programmer opens the pilot fuel and ignition path, then looks for a scanner signal within a trial-for-ignition period. No prove → no main fuel. After main flame is established, many systems continue to supervise main flame; loss of flame signal causes a flame-failure shutdown of fuel valves.

Dirty scanner lenses, misaligned sight pipes, and wrong scanner type for the fuel/flame are common field problems. For the exam, know what the scanner does (proves flame) more than every manufacturer model number.

Prepurge, Postpurge, and Purge Period

Unburned gas or oil vapor left in the furnace is the classic setup for a furnace explosion. Arkansas glossary terms:

Prepurge uses the fan(s) and open dampers (per program) to sweep the furnace, passes, and often breeching path with air before any pilot or main fuel is introduced. Postpurge clears residual combustibles after the run. Skipping purge, jumpering purge timers, or lighting into a “maybe empty” furnace is an exam-level and real-world violation of safe light-off practice.

Air Flow Switch and Combustion Air Proof

Without proven airflow, fuel must not be released. The air flow switch (or equivalent pressure/flow prove) is an interlock input to the programmer: fans proven → purge allowed → ignition sequence allowed. Forced- and induced-draft arrangements differ by plant, but the principle is constant — no proven air, no fuel.

Programmer, Firing Cycle, and Interlocks

A typical safe sequence (plant-specific; manufacturer instructions always rule):

1. Start permitted only if limit and safety interlocks are satisfied (water level, fuel pressure, air proves, temperature/pressure limits, etc.).
2. Prepurge with proven airflow for the required time.
3. Pilot trial — ignition and pilot fuel; scanner proves pilot.
4. Main fuel released only after pilot prove; main flame supervised.
5. Release to modulation / operating control once main flame is proven (low fire hold as designed).
6. On normal shutdown: fuel off, postpurge, idle ready for next call.
7. On flame failure or limit trip: fuel valves close immediately; often alarm + manual reset required; investigate before restart.

Interlocks ensure proper sequence. Jumpering an interlock to “get steam up” is exactly the defective/unsafe operation pattern that can cost a license under Arkansas’s “knowing it to be defective” / unsafe-operation rules.

Flame Failure Response

When flame fails in service:

• Main (and pilot, as designed) fuel valves close — that is the flame-safeguard job.
• The programmer goes to a lockout or recycle path per design; many commercial systems lock out and require reset.
• The operator verifies why flame was lost (fuel supply, draft, scanner, linkage, LWCO trip, hi-limit, etc.) before another light-off attempt.
• Repeated failed light-offs without purge discipline increase furnace-explosion risk — stop, purge, troubleshoot.

Related glossary hazards:

• Flareback — flames out doors/ports from delayed ignition or pressure buildup.
• Furnace explosion — fuel/combustible gas buildup in the fire side ignites violently.

Water Level Ties to Light-Off (Operations Link)

Arkansas sample question 45: regardless of fuel type, before lighting a boiler during a cold start-up, the operator must first check for the correct water level. That is not a separate “nice to have” — it is an interlock philosophy you share with the automatic systems:

Flame safeguard will not cure a dry boiler. LWCO will not cure lighting into an unpurged furnace. All of the Chapter 5 controls work as one stack: water, pressure, and flame.

How Item 16 Fits the Arkansas Control List

Recall the automatic-safety slice of the required valves/controls/fittings list:

Together with the mechanical safety valve and proper attendance, these devices are why Arkansas still insists that automatic appliances are helpers, not replacements for a licensed operator who understands them.

Exam Traps

If you can recite item 16, name scanner / purge / air-flow switch / interlock / programmer in one firing-cycle story, and refuse any shortcut that skips pilot prove or water-level check, you are ready for the flame-safeguard portion of the Arkansas Boiler Operator exam.