Burner Management System: Why No Light-Off Permissive?

Purge counts down. Purge complete. Then nothing. The pilot solenoid stays dark, the panel sits on "Light-Off Permissive Not Met," and everybody starts guessing. Start at the first-out annunciator, not at the burner.

Skip These Four Fixes First

Every one of these gets tried on first fire. Every one of them costs you a shift.

• Jumpering the interlock "just to see if it lights." The burner management system is a safety instrumented system, not a convenience interlock. Forcing an input defeats the layer of protection you are there to commission, and it destroys your diagnosis: the logic solver latches a first-out, and once you force it you no longer know which device actually opened. If the plant runs on it afterward, you have an undocumented bypass in a certified system.
• Swapping the flame scanner. Before trial-for-ignition there is no fuel at the tip. No scanner change fixes a missing permissive. The one scanner fault that does block light-off is the opposite case: a false-flame (flame-on-with-no-fuel) check at the end of purge, caused by hot refractory glowing into an IR head or an adjacent burner in the scanner's field of view. Read the scanner's own signal strength before you touch the mounting.
• Winding up the pilot gas regulator. Over-pressuring the pilot blows the flame off the tip and drives you into repeated trial-for-ignition timeouts. It also pushes you past the high fuel gas pressure switch, which is itself a permissive. Set pilot pressure to the burner data sheet value measured at the pilot tap, with light-off air flowing.
• Editing the purge timer. Purge duration is derived from heater volume and the air changes your governing code demands. Extending it in software does not create airflow, and on a certified logic solver the constant is usually write-protected. If purge is not proving, the problem is the airflow measurement or the damper position proof, not the number.

Rebooting the logic solver is also not the fault. Do not do it before you have read the first-out.

Understand What the BMS Is Actually Guarding

A burner management system is the dedicated safety logic that prevents an explosive fuel-air mixture from accumulating in a fired enclosure and ignites fuel only in a proven sequence. It is not the combustion control loop. Combustion control (air/fuel ratio, draft, coil outlet temperature) belongs in the DCS.

The sequence it enforces is fixed, and every step is a gate:

1. Start permissives — process fluid flowing through the coils, fuel isolated, no standing trip.
2. Purge — dampers driven to the purge position and proven there, airflow proven above the purge minimum, timer runs.
3. Light-off position — dampers and registers driven back to low fire, position proven.
4. Trial for ignition — igniter energized, pilot safety shutoff valves open, fixed TFI timer running.
5. Pilot proven — scanner signal above threshold within the TFI window, or fuel is shut and the sequence aborts to purge.
6. Main fuel — main double-block-and-bleed valves open, main flame proven, release to modulate.

The fuel train is the physical half of that logic: manual isolation, strainer, regulator, low and high pressure switches, two safety shutoff valves in series with a vent between them, proof-of-closure limit switches, and a separate pilot take-off upstream of the main train. If a proof-of-closure switch does not confirm both main valves seated, the BMS will refuse to purge — and it is right to.

Work the Permissive Chain in This Order

Read the first-out, then go to the field device that first-out names. Field device, then wiring, then logic — in that order. The logic is the last suspect on a system that has already passed factory acceptance testing.

Where the Mechanical Engineer Owns the Design

Most BMS commissioning failures are mechanical, and they were designed in months earlier. The mechanical scope on a fired heater package covers:

• Purge volume. Calculate the swept volume of firebox, convection section, breeching, ducting, and stack, then size the FD/ID fans and the purge airflow so the required air changes complete in an acceptable time. Get this wrong and the purge either never proves or takes twenty minutes.
• Fuel train layout. Valve sizing and Cv, double block and bleed arrangement, vent line routing to a safe location, straight runs for the flow element, strainer and regulator selection, and accessible test taps ahead of every pressure switch. If there is no test connection, nobody can functionally test that switch.
• Air path and damper hardware. Register design, wind box distribution, damper hard stops at purge and light-off positions, and mechanical linkage that will not go out of calibration when the drive strokes it a thousand times.
• Scanner and pilot geometry. Sightline angles, guide pipe length and purge air to the scanner head, and enough discrimination between pilot flame, main flame, and the burner next door.
• Refractory and heat-up. The dryout curve comes from the refractory supplier and it constrains the whole commissioning schedule — you cannot fire hard before it is complete.
• Draft and stack. Natural draft profile, leakage sealing, peep doors, explosion doors, and snuffing steam connections.

The mechanical engineer also brings the burner supplier's sequence and the fuel train P&ID into the HAZOP and the SIL allocation, so the instrumented functions match the hardware that was actually bought.

Commission the Heater in Sequence

1. Complete refractory dryout to the supplier's curve, on temporary burners or the installed burners under manual supervision, before any automatic sequence testing.
2. Pressure test and leak test the fuel train. Seat-leak test each safety shutoff valve individually and record the result — this is the number the proof test interval is built on.
3. Loop check every BMS input and output point to point. Stroke each valve and record travel time to the closed position with a stopwatch or the limit switch.
4. Functionally test each interlock by real process action: drop pressure through the test tap, stop the fan, drive the damper off position. Not by forcing the input.
5. Prove the purge with dampers at position and airflow above minimum, with fuel double-isolated and the vent open.
6. Light the pilot. Record scanner signal strength on pilot alone, then main alone, then both.
7. Bring in main fuel at low fire. Check flame pattern against the burner drawing — impingement or flame lift here is a burner tip or air register problem, not a BMS problem.
8. Set the draft profile and excess O2 across the firing range, burner by burner.
9. Re-run every trip from a live fire condition and record the response times. Close out on the pre-startup safety review.

Verify It, Then Stop Touching It

Verification is a written record, not a feeling. For each safety function you should be able to show: the initiating device tested by real process action, the measured time from initiation to fuel valve closed, the proof-of-closure state confirmed, and the first-out message the operator will actually see. Repeat the full functional test after any logic change, under management of change — a single edited constant invalidates the previous test.

Two pitfalls recur. First, position switches that make on the way in but not on the way out, so purge proves and light-off position never does; set both switch cams with the damper driven mechanically, not by hand. Second, scanners that pass on a cold box and fail once refractory is hot; qualify the sightline at operating temperature, not on day one.

Confirm which code governs before you sign anything: in Canada that is the CSA B149.1/2/3 series for fuel gas installations, and the authority having jurisdiction will hold you to it. If the logic solver reports an internal diagnostic fault, if a certified safety application needs a firmware or parameter change, or if measured trip times fall outside the values in the safety requirements specification, stop. Bring in the burner OEM and the BMS supplier through their official support channel and get the change documented, re-verified, and accepted by the AHJ before you fire again.

FAQ