A burner program controller is often described as the box that starts the burner. That undersells it. The box exists to make a specific ordered sequence of things happen, and its most important output is not a running burner but a refusal to continue when a step does not prove itself.
The sequence is a safety argument
The order of operations in a light-off is not arbitrary. The chamber has to be swept of any combustible mixture before ignition, because igniting a chamber that still contains gas is the accident this arrangement exists to prevent. Air has to be proven before the fuel valve opens, because an ignition spark in a chamber with no air is a spark in a fuel-rich void.
After ignition, the flame has to be proven before the fuel is left on, because a spark that has stopped making sparks is not a flame. Each of these can fail, and the controller's design assumes each one eventually will. The sequence is written so that the failure produces a stop rather than a continuation.
Purge exists because the chamber may not be empty
The pre-purge step clears the chamber and connected ductwork with a fixed volume of air before any fuel is admitted. That volume is calculated from the free space which could contain a combustible mixture, and the time from the air flow actually achieved, which is why the two are not interchangeable numbers.
The failure mode here is subtle. A purge adequate on paper can be inadequate in practice if the air path is restricted, if the chamber was opened for maintenance and not properly closed, or if a damper was left in a position that starves the flow. A pressure switch proving the air side converts that from a hope into a measurement.
Proving is a timing question, not a presence question
Flame proving is not simply detecting a flame. The controller requires a signal above a threshold, held for a minimum duration, within a maximum time from the ignition attempt. A signal flickering above the threshold for a moment is not proof, and a signal arriving after the window has closed is a failure even though a flame is now visible.
This is why detector type and siting matter to the sequence rather than just to the burner. An ionisation detector reading a small flame close to the electrode will give a stronger signal than an ultraviolet detector seeing the same flame from further away, and the threshold in the controller was set against the design case rather than against whatever is installed.
Lockout is information, not an obstacle
When a proof fails, the controller stops and holds the burner there. It records which step failed, and most modern units attempt a limited number of restarts before locking out permanently. That distinction matters: a retry limit suits a transient condition such as a slow flame, while a hard lockout on the first failure suits a condition such as a gas pressure switch that has failed closed.
A lockout should never be a prompt to reset. Each reset discards the evidence, and a burner that resets cleanly every time will sit in a fault indefinitely while the operator gets used to the noise. Reading the recorded fault before resetting is the difference between a diagnosis and a superstition.
Reset and restart are not the same operation
Controllers distinguish between a reset, which clears a lockout and waits for a new start demand, and a restart, which begins the sequence again without clearing the fault history. That distinction lets a burner be cycled by an operator in the ordinary case while an unattended lockout still leaves a record.
Where a burner is started from a remote supervisory system, reset authority is a decision rather than a default. Allowing an automatic reset on a lockout indicating a proven safety failure removes the last indication that something is wrong, at the moment the operator would otherwise have investigated.
Matching the controller to the burner family
These units are not interchangeable across burner families even where the wiring base looks the same. The sequence timings, the proof requirements and the fuel the program was written for are all specific to the burner design, and a controller from another series can complete a start the burner design never intended to permit.
When a spare is being ordered, the burner model and its fuel determine the correct unit. General purpose burner controllers cover a range of programs, and which program is loaded matters as much as the hardware. Quoting from the model plate alone is how the wrong controller ends up on the bench.
Frequently asked questions
What does a burner sequence controller actually do?
It runs a fixed order of safety steps: prove the chamber can be purged, purge it, prove air, ignite, prove the flame, then permit sustained fuel. It also watches the interlocks while running and stops the burner when one fails.
Why does the controller lock out instead of trying again?
Because a failed proof is a statement about the state of the plant, not an inconvenience. Continuing past it means running without a condition that was supposed to be established. Most controllers retry a limited number of times for a plausibly transient condition, then lock out for good.
Can a faulty controller cause lockouts on a healthy burner?
Yes. A controller with failing relays, a degraded display or a corrupted program can misread a proof or lose a step without anything on the burner having changed. If the interlocks all test good and lockouts persist with no physical change, the controller belongs on the list of suspects.
Is it acceptable to jumper an interlock to clear a lockout?
No, and the reason is specific rather than general. The interlock being bypassed is the one that would have detected the fault you are trying to make disappear. A bypass converts a stopped burner into a running burner with the protection removed, and the fault is still there.
How long should a pre-purge take?
Long enough to sweep the calculated free volume of the chamber and its ductwork at the air flow the burner will actually achieve. The figure is not a fixed number, which is why purge time belongs with the chamber volume and measured air flow rather than with a standard.
Can a different controller series be fitted as a replacement?
Only if its program matches the sequence and proof requirements of the burner design. A similar wiring base does not establish that, and a controller that completes a start the burner was never designed to permit is a safety change made by accident.
Request a quote
Send the burner model, the fuel, and the controller part number from its label, and we can confirm whether a direct replacement exists or whether the program has to be set to suit. If the reason for the enquiry is repeated lockouts, add the fault code displayed, since that narrows the question considerably.
Related products
The parts and product families referenced in this guide:
- purge and ignition timing in one unit
- program selection for a given burner family
- walking the light-off by hand first
- the signal the prove window is set against
This guide covers Burner Sequence Controller: The Brain That Lights Safely. For the exact part that fits your duty, send us the model plate photo and we confirm availability, lead time and a matched quotation.