Boiler Programming, Flame Supervision and Functional Tests

A sequence controls permission to progress

A boiler programming control coordinates events in a defined order. It differs from a modulating pressure controller: a pressure controller adjusts firing demand during permitted operation, while the burner-management sequence determines whether fuel may be admitted at all. A permissive must be satisfied before a step begins. An interlock can prevent or stop an unsafe condition. A lockout requires the specified investigation and reset process rather than automatic repeated attempts.

The actual approved sequence depends on the boiler, burner, fuel and applicable requirements. Do not memorize one universal purge duration or flame-failure response time for every installation. Purge airflow, volume, time and proof conditions must meet the governing design together. A clock running while airflow is unproved does not establish a completed purge.

Typical sequence functions

Before a start, the control evaluates the required safe condition of water level, pressure/temperature limits, fuel conditions and other permissives. It verifies the required valve and airflow states. A purge stage supplies the specified airflow through the defined furnace and gas path. A damper position switch alone may not prove actual flow; the designed proof devices determine what is checked. Failure of a required permissive prevents progress or causes the defined response.

After a valid purge, the sequence moves to the permitted ignition condition. The igniter and pilot, where fitted, operate for the approved trial. Pilot flame must be proved as required before main fuel admission. Main flame is then proved within its allowed trial. A system using direct ignition has a different arrangement. Requiring a main flame before the first main fuel admission would be an impossible generic logic rule; the timing and type of flame proof matter.

Once running, flame supervision and required process interlocks remain active. Flame failure or another trip closes the required safety shutoff valves through the designed shutdown action. The subsequent fan, damper and post-purge response follows the approved system. Normal pressure-control cycling, controlled shutdown and a safety lockout need not have identical sequences. Record which event actually occurred before diagnosing it.

Flame proving and false signals

A flame rod uses flame rectification and suitable grounding/electrode geometry to produce a proving signal. Optical devices detect selected ultraviolet or infrared flame characteristics. A detector must discriminate the intended flame from an igniter, another burner or hot background where the design requires it. Dirty viewing windows, incorrect aiming, broken wiring and unsuitable replacement detectors can compromise operation. A lit-looking furnace is not proof that the safety system sees the correct flame.

False-flame checks before ignition are important: a signal when there should be no flame may indicate a fault or unwanted combustion. The safe response is the prescribed inhibit or lockout, not bypassing the check to make the boiler start. Likewise, repeated resets after an unsuccessful ignition can admit fuel under unsafe conditions. Investigate the initiating cause and verify the shutdown state before any authorized restart.

Functional testing and maintenance

Testing must use the maker’s instructions, plant procedure and required competent personnel. Establish what the test must demonstrate, the equipment state, hazards, expected indication and safe stopping point. A lamp test shows annunciator function; it does not establish that a low-water sensor trips at the proper level. A simulated input tests part of a chain; it may not prove the process connection or the final valve closure. Identify what remains untested.

Useful test records identify the device, method, conditions, actual response, acceptance criteria, date, responsible person and any defect. Confirm restoration of sensing lines, normal valve positions, wiring, covers and authorized bypasses after testing. A temporary bypass must be controlled and tracked; it is not an ordinary operating fix. Changes to sequence logic, timers or setpoints require the applicable engineering and management-of-change process.

Interpret a startup failure

Suppose the fan starts but the sequence never leaves purge. Check the documented unmet permissive and indications, such as airflow proof or damper-position confirmation, through authorized diagnostics. Do not conclude that a longer timer will solve it. If the main flame drops after admission, preserve trip data and evaluate fuel, air and flame-signal conditions under the approved troubleshooting procedure. The objective is a verified protective sequence, not merely getting a RUN indication.

Read a sequence trace

Suppose the event record shows demand at 10:00:00, fan command at 10:00:02 and airflow proof at 10:00:07. A purge that requires proven airflow cannot be credited from the demand or fan-command time. The distinction is between a request and evidence that the required condition exists. Record time stamps and actual status without forcing the sequence forward. An unexpected missing transition needs competent investigation against the installed sequence document, including sensor and actuator status, rather than a repeated reset that obscures the original failure.

Comparison aid

Source notes

Official scope and technical references checked 2026-10-17: Reference 1; Reference 2. Archived DOE handbooks are used for physical principles, not current Canadian legal requirements.