# Burner Management Systems: Purge, Ignition, and Flame Supervision > A burner management system (BMS) sequences purge, ignition, and flame supervision and shuts fuel off on trips, independently of the combustion control loop. - Canonical URL: https://wiki.aspotomasyon.com/article/burner-management-systems-nfpa-85-86 - Publisher: ASP OTOMASYON A.Ş. (ASP OTOMASYON Wiki) - Category: Process Industries Solutions - Published: 2026-10-11 · Updated: 2026-10-11 - Reading time: 9 min · Language: English A burner management system (BMS) sequences purge, ignition, and flame supervision and shuts fuel off on trips, independently of the combustion control loop. ![Burner Management Systems: Purge, Ignition, and Flame Supervision — Read the sequence → Check independence → Verify trips → Prove and manage change.](https://wiki.aspotomasyon.com/assets/diagrams/burner-management-systems-nfpa-85-86.svg) *Burner Management Systems: Purge, Ignition, and Flame Supervision — Read the sequence → Check independence → Verify trips → Prove and manage change.* Burners in boilers, furnaces, and ovens release chemical energy quickly. If fuel reaches an unlit or inadequately purged chamber, the result can be a fire or an explosion. A burner management system (BMS) is the safety-related control that governs how a burner starts, how it proves its flame, how it runs, and how it stops when a condition is unsafe. It is separate from the combustion control that sets firing rate and air-fuel ratio. This article describes the concepts a plant engineer, operator, or maintenance lead needs to read a BMS specification, a trip history, or a test record. It gives no design rules, setpoints, or bypass methods, and it does not replace the codes. The governing requirements are in NFPA 85 for boilers and combustion systems and NFPA 86 for ovens and furnaces, read with IEC 61511 for safety instrumented systems. Design, validation, and any bypass decision belong with qualified functional-safety and combustion-safety engineers working to the applicable code. For the wider framework, see [safety instrumented systems and IEC 61511](https://wiki.aspotomasyon.com/article/safety-instrumented-systems-iec-61511). ## What the BMS does and what it does not The BMS runs the safety sequence of a burner. It checks permissives before starting, purges the combustion space, proves an ignition source, establishes and supervises the main flame, and closes safety shutoff valves on a trip. Each step is a state, and the sequence moves forward only when defined conditions are proven. Combustion control is a different job. It modulates fuel and air to hold temperature or pressure. A fault in the control loop should not be able to defeat the safety shutdown, and the BMS should not depend on the control loop to shut fuel off. That separation is a core principle, and many installations use a dedicated burner controller or a certified safety PLC for the BMS logic. Boiler plants also depend on the wider [utilities automation for boilers and chillers](https://wiki.aspotomasyon.com/article/utilities-automation-boilers-chillers). A BMS protects the burner and its immediate fuel train. Other hazards, such as boiler water level, are separate safety functions that need their own analysis. The architecture of safety logic in general is covered in [safety PLCs and functional safety](https://wiki.aspotomasyon.com/article/safety-plcs-functional-safety). ## The start-up sequence and flame supervision The sequence below describes concepts common to most burner safety systems. The exact steps, timings, and proofs come from the equipment manufacturer's logic and the applicable code, and they are not reproduced here. Flame supervision uses a flame sensor and treats a lost or weak signal as a trip condition. 1. Permissives. The start is blocked until required conditions are proven, such as airflow, fuel pressure, and the absence of active trips. 2. Purge. The combustion space is ventilated for a defined period so that any accumulated fuel is cleared before ignition. 3. Ignition. An ignition source is established and proven within a limited time. 4. Main flame. Main fuel is admitted only after the ignition source is proven, and the flame signal is supervised. 5. Run. The flame signal is monitored continuously, and loss of flame leads to a trip. 6. Trip and lockout. Safety shutoff valves close. Restart needs the cause cleared and the full sequence repeated, including purge. ## Trip conditions, lockout, and cause-and-effect A trip is a safe shutdown triggered by a defined condition, such as loss of flame, low fuel pressure, loss of combustion air, or a high-high limit. The trip closes the safety shutoff valves. Lockout prevents automatic restart until someone identifies and clears the cause and resets the system deliberately. A cause-and-effect matrix lists each trip, its input, and the action taken. Each entry should trace back to the hazard analysis. The matrix is a design and safety document, not a troubleshooting aid, and any change to it follows management of change. Nuisance trips are trips without a real hazard. Common causes include contaminated or misaligned flame sensors, a weak flame signal late in a sensor's life, drifting pressure switches, loose wiring or poor grounding, fuel pressure swings, and unstable combustion. A nuisance trip is a fault to investigate, never a reason to bypass. | Condition | BMS action | Typical cause to investigate | Review path | | --- | --- | --- | --- | | Loss of flame during run | Trip and close safety shutoff valves | Flame sensor contamination or misalignment; unstable mixing | Combustion and controls engineers | | Flame not proven at light-off | Abort the sequence and lock out | Ignition source fault or fuel pressure outside the permissive | Operations, then engineering review | | Low fuel pressure | Trip on a defined input | Regulator or pressure switch drift | Instrumentation and safety engineering | | Airflow lost or purge not completed | Hold or abort before ignition | Fan proving switch fault or damper position | Maintenance with engineering sign-off | ## Standards, safety integrity, and testing NFPA 85 is the Boiler and Combustion Systems Hazards Code. NFPA 86 is the Standard for Ovens and Furnaces. Both address fire and explosion hazards in their equipment, and both are revised over time. Apply the edition that the authority having jurisdiction and the insurer accept, and confirm scope for each burner, because the two codes cover different equipment. IEC 61511-1 gives the framework, definitions, and system, hardware, and application programming requirements for safety instrumented systems in the process industry sector. When a BMS performs a safety function, its functional safety assessment and any safety integrity target belong to qualified functional-safety engineers who apply IEC 61511 and the codes that govern the installation. Proof testing checks, at defined intervals, that a safety function still works, including sensors, logic, and final elements such as shutoff valves. Test records, not memory, show that a BMS works. The procedure and interval should be approved by the functional-safety owner. In US facilities, OSHA's process safety management standard (29 CFR 1910.119) requires, for the processes it covers, process hazard analysis, management of change, pre-startup safety review, and mechanical integrity. Those elements apply to BMS changes and tests. For how burner safety sits inside a larger plant, see [power plant automation](https://wiki.aspotomasyon.com/article/power-plant-automation). ## Change management and nuisance-trip investigation Most BMS problems in service come from uncontrolled changes or from trips treated as nuisances without analysis. The procedure below applies to a single trip or a pattern of trips, and it should be run by people authorized to work on the safety system. 1. Record the trip: time, sequence step, status signals, alarms, and operator actions. 2. Compare the record with the cause-and-effect matrix to confirm that the trip matches the intended design. 3. Check sensor and wiring evidence before changing anything, and keep the as-found state for the investigation. 4. Classify the cause as a real hazard, a field device fault, or a design issue. 5. Make any change only through management of change, with the safety owner's approval, followed by a documented test. ## Warning signs of a drifting system - Trips are reset routinely without a recorded cause. - Logic or setpoints in the installed controller differ from the approved drawings. - Forced inputs or temporary jumpers remain in place after maintenance work. - Proof tests are scheduled, but their results are not reviewed by anyone. ## Worked example: reading a trip history A trip count alone does not separate nuisance trips from real hazards. The sequence and timing of events do. **Illustrative example** Assumptions, not measured results. Over one month, a gas-fired oven records 14 trips: nine show flame loss during the run phase and five show a flame not proven at light-off. Seven of the nine run-phase trips fall in the first minutes of a shift handover. The record shows an operator operating a fuel valve during handover, a step the procedure does not describe. Engineering reviews the trips against the cause-and-effect matrix, updates the procedure, labels the valve, and runs a documented proof test. The lesson: the timing of events pointed to the cause, while the trip count alone did not. ## Apply this to your project - The cause-and-effect matrix is approved and matches the installed logic, wiring, and drawings. - Each trip and lockout has a documented root-cause analysis before the unit is restarted. - Proof tests follow a written procedure at defined intervals, and results are recorded and reviewed. - Every change to logic, setpoints, sensors, or the fuel train has a management of change record and a post-change test. - Operators can see the trip reason and sequence step on the HMI or in the event log. - Nuisance trip counts are reviewed by engineering and maintenance together, with actions tracked. [Follow an ASP project guide](https://wiki.aspotomasyon.com/guides) to connect the fundamentals with implementation and acceptance. ## Frequently asked questions ### Can the combustion control PLC also run the burner management system? The BMS and combustion control are separate functions, and BMS logic is normally kept independent of the control loop so that a control fault cannot defeat a safety shutdown. Whether a particular installation uses a dedicated burner controller, a certified safety PLC, or another architecture is a design decision for qualified functional-safety engineers. Ask for the architecture and its safety assessment before accepting any combined arrangement. ### What is the difference between NFPA 85 and NFPA 86? NFPA 85 is the Boiler and Combustion Systems Hazards Code. NFPA 86 is the Standard for Ovens and Furnaces, which addresses fire and explosion hazards in ovens and furnaces used for commercial and industrial processing of materials. Many plants have equipment under both, and the applicable edition and scope depend on the equipment and on the authority having jurisdiction. ### Why does my burner keep tripping on flame loss? Repeated flame-loss trips often come from the flame sensing path, fuel and air mixing, or a supply condition that drifts outside its intended window. Start with the event record: check whether the loss happens at light-off, during run, or at a load change, then inspect the sensor and its view of the flame. Do not bypass the trip. Treat repeated trips as evidence that the system is operating outside its design envelope. ### What is proof testing in a burner management system? Proof testing is a scheduled test that confirms a safety function still works as designed, including sensors, logic, and final elements such as shutoff valves. It follows a written procedure, runs at defined intervals, and produces recorded results. The interval and scope come from the functional-safety assessment and the applicable standard, not from the maintenance schedule alone. ## Continue the engineering work - [Safety Instrumented Systems (SIS) and IEC 61511](https://wiki.aspotomasyon.com/article/safety-instrumented-systems-iec-61511) - [Utilities Automation: Boiler and Chiller Control](https://wiki.aspotomasyon.com/article/utilities-automation-boilers-chillers) - [Steam System Efficiency and Condensate Recovery](https://wiki.aspotomasyon.com/article/steam-system-efficiency) - [Safety PLCs and Functional Safety in Machine Automation](https://wiki.aspotomasyon.com/article/safety-plcs-functional-safety) - [Power Plant Automation: DCS and Balance of Plant Control](https://wiki.aspotomasyon.com/article/power-plant-automation) Browse the [related technical library](https://wiki.aspotomasyon.com/category/process-industries-solutions) or follow an [ASP project guide](https://wiki.aspotomasyon.com/guides) to plan the implementation sequence. ![A conceptual process-control feedback chain. Independent protection functions are outside this simplified diagram and must be assessed separately.](https://wiki.aspotomasyon.com/assets/diagrams/process-industries-solutions-context.svg) *A conceptual process-control feedback chain. Independent protection functions are outside this simplified diagram and must be assessed separately.* ## Primary references and further reading Use the original specifications and product documentation for implementation details. Examples in this guide are illustrative engineering scenarios, not published project results. - [NFPA — NFPA 85 Boiler and Combustion Systems Hazards Code](https://www.nfpa.org/codes-and-standards/nfpa-85-standard-development/85) - [NFPA — NFPA 86 Standard for Ovens and Furnaces](https://www.nfpa.org/codes-and-standards/nfpa-86-standard-development/86) - [IEC — IEC 61511-1:2016 Functional safety, safety instrumented systems for the process industry sector](https://webstore.iec.ch/en/publication/24241) - [OSHA — 29 CFR 1910.119 Process safety management of highly hazardous chemicals](https://www.osha.gov/laws-regs/regulations/standardnumber/1910/1910.119) --- Cite the canonical article: https://wiki.aspotomasyon.com/article/burner-management-systems-nfpa-85-86 (Burner Management Systems: Purge, Ignition, and Flame Supervision, ASP OTOMASYON, updated 2026-10-11).