At the 2025 Emerson Exchange Conference, Emerson’s Steven Kormann and Ross Turner presented Not Your Grandfather’s Burner Control: Modern BMS Hardware for Modern NFPA Compliance. Here is their presentation abstract.
Everyone has a burner system somewhere – whether it’s a boiler to supply steam, a process burner to heat products, or an emissions system to incinerate byproducts. These systems have been run with all variety of control hardware for as long as process control has been around. In the past, these systems have often been complicated, using basic, common control hardware requiring any number of external monitoring and 3rd party communication methods to meet NFPA requirements. Why hold onto this overly complicated architecture, when years of innovation have brought us modern, built-for-purpose control hardware that can meet and exceed NFPA without extra engineering? We’ll explore how the use of SIL-capable, built-for-purpose equipment can bring our burner management solutions into the modern era.
Steven opened by describing the common hardware requirements for NFPA burner management systems. These include logic system selection, independence, hardwired operator-initiated shutdowns, diagnostics & fault monitoring, and field device selection and fault monitoring.
Traditional NFPA BMS compliance typically included a general-purpose programmable logic controller (PLC) or, occasionally, a hardwired system. For simple applications, built-for-purpose controllers have been used. The DCS and BMS have been independent of one another with separate, dedicated controllers, separate logic, and separate user access.
A Master Fuel Trip (MFT) pushbutton is required to provide hardwired operator shutdown, typically located in both the control room and the field. Some regulations require a hardwired MFT relay circuit to shut down fuel sources independent of the burner management system (BMS) to ensure safety and prevent potential hazards.
Process fault monitoring with watchdog timers is typically used to meet diagnostic and fault requirements. I/O card fault monitoring is also necessary for compliance, as it enables critical I/O checking. For NFPA 86, a high-temperature interlock is needed, with older code revisions requiring separate high-temperature interlock controllers with a hardwired trip.
From a field device input standpoint, inputs may be hardwired altogether in a common trip and rely solely on wiring best practices to ensure that wiring faults are detected via open-loop monitoring of wiring damage. Shorted connections are undetectable. Traditionally, these discrete switches are wired for 120VAC.
For field device outputs, loop power fed from the BMS ensures that wiring faults de-energize valves and igniters. Valves are selected with the appropriate fail-open and fail-close capabilities to provide a safe shutdown in the event of an actuating power loss. These also operated at 120VAC.
This traditional approach to NFPA BMS compliance paints a complicated picture.
Steven and Ross next presented a simplified approach. For the logic system selection, NFPA provides more options and tighter restrictions with the newer code revisions. NFPA 86 and 87 require either a listed device or a SIL 2-capable logic system. NFPA 85 still allows broad logic system selection; however, specific clauses require strong diagnostics and independence that is natively met by a SIL2/3 capable system.
Some modern systems, such as the DeltaV DCS and DeltaV SIS, can meet independence requirements without requiring separate operator and engineering stations. Cross-communication with DCS and BMS can be accomplished using native network gateways, eliminating the need for additional I/O or Modbus/serial communication configuration and wiring.
From a diagnostic and fault monitoring perspective, the processor features fault monitoring with internal watchdog timers and redundant processors, eliminating the need for an external timer. The high-temperature interlock is no longer required to be a separate device. The BMS controller can handle it.
Where discrete I/O is used, line fault detection can be implemented to detect open and short circuit faults for both inputs and outputs. At 24VDC, the I/O is finger-safe, and the SIS provides a first-out indication of the source of the trip condition.
HART analog input devices can be used in place of discrete devices for greater diagnostic capabilities and first-out indications. Output devices can use 24VDC when power requirements permit. Line fault monitoring can be added for improved diagnostic coverage. The traditional fail-safe architecture is still valid.
For NFPA 86 and 87 only, a hardwired MFT Circuit is not required. A hardwired pushbutton is needed but can be directly wired to a SIL2-capable BMS. The pushbutton must be a physical button. It cannot be replaced with a graphic button.
According to the 2023 revision of NFPA 86, if combustion airflow is a discrete input, it must be compared to the fan run check and interlock on state mismatch. This requirement does not apply to analog input-based airflow, as it is integrated with diagnostics. The code for MFT pushbutton implementation was lowered in this revision from SIL3 to SIL2.
Here is a simplified BMS design using the DeltaV DCS and DeltaV SIS that meets these requirements.
Visit the links above for more information on reducing risk with modern safety instrumented systems technologies and practices.
