Redundant Flame Safety
What do aerospace and industrial heating vessels have in common? Backups for essential systems. In this Technical Tuesday installment, Bruce Yates, president of Protection Controls Inc., explores how NFPA 86 Standard for Oven and Furnaces addresses redundant flame safety, compares common sensing approaches, and highlights recent advances in UV scanner technology that improve reliability and reduce maintenance risks.
This informative piece was first released in Heat Treat Today’s February 2026 Air & Atmosphere Heat Treating print edition.
Introduction
Boeing Aircraft lost billions of dollars before realizing that the 737 MAX’s MCAS (Maneuvering Characteristics Augmentation System) needed a redundant angle-of-attack vane to prevent erroneous MCAS-induced drive commands. Lockheed Martin uses dual-redundant MIL-STD-1553 data bus (that is, a shared communication pathway for exchanging data between electronic systems) on its Apache Guardian attack helicopter for target acquisition and cueing for the helicopter’s fire-control radar system. Spacecraft internal Active Thermal Control Systems (ATCSs) can either be a fully redundant thermal-control loop or a single loop system that is equipped with a redundant accumulator to be activated if needed. The accumulator represents a single point of failure that can result in a loss of crew.
Aerospace is not the only industry where redundancy is an important aspect of safety. It is critical in the industrial heating industry. NFPA 86 Standard for Ovens and Furnaces has for many years required redundant pilot gas valves and redundant main gas valves.
Let’s discuss redundant flame safety.
Redundancy in Industrial Heating
There are two types of flame sensors generally used on industrial burners: flame rods and ultraviolet scanners. Flame rods are simply stainless steel rods that intersect the burner flame. A voltage potential from the combustion safeguard is applied to the flame rod. When a flame is present, an electrical current (measured in millionths of an amp) flows from the flame rod through the ionized gases of the flame to the burner, which is grounded. This current is amplified in the combustion safeguard and energizes a relay output to power the fuel valves (see Main Image).
Redundancy can be achieved by using a two-burner control with one flame rod. The flame signal from the flame rod goes to the sensor input of both positions of the two-burner control (Figure 1).
We will devote the rest of this article to UV scanners (Figure 3).
Redundant Flame Safety with UV Scanners
The tube of a UV scanner responds only to radiation in the spectrum of 1,900 to 2,300 Å (Figure 2). Peak response is at 2,100 Å (210 nm). Solar UV starts at about 2,800 Å, as shown in Figure 2, and is therefore not detectable by the device. Solar radiation, of course, extends into the visible spectrum (4,000 Å) and extends into the infra-red spectrum. A UV tube consists of a fused silica or UV glass envelope, two electrodes, and a gas contained in this envelope. This is called a cold-cathode gas-discharge tube.
This tube conducts or ignites when it is irradiated with ultraviolet light and when sufficient voltage potential exists across the two electrodes. The electrodes can be made of tungsten, molybdenum, or nickel. When a photon of sufficient energy is absorbed into the cathode electrode, electrons are emitted and are drawn to the anode. A larger cathode allows more electrons to avalanche, causing higher current flow and thus higher sensitivity to UV. There are high sensitivity UV scanners designed for special burners that will produce low UV, such as one designed by Protection Controls, Inc.
The gas in the tube is usually a helium-hydrogen ionizable mix. Electrons released by the cathode release electrons in the ionized gas, becoming a self-sustaining discharge much greater than that of the originally generated electrons and producing a very high current gain or avalanche effect. The sensitivity of a tube will very slowly decrease over a period of time. Replacement should be made after 8,000 hours of operation. The current produced by the photoelectrons is measured in millionths of an ampere, so this current is amplified in the combustion safeguard to energize a relay that can then energize the fuel valves.
Critical Maintenance to Avoid Tube Gas Contamination
While UV scanners are very reliable, tube gas contamination may occur with large temperature shock (ΔTEMP/ΔTime) or large physical shock (a 2-inch drop may cause 100G shock), causing the electrode to UV glass envelope seal integrity to be compromised. Because of this, it is possible for a UV tube to conduct current when no UV is incident upon it. This would normally be detected during the flame safeguard safe start check. When an indicated flame on condition exists prior to purge or ignition, the safe start check relay prevents ignition and gas valve energization.
In addition to safe start check before every heating cycle, a monthly preventative maintenance schedule should be in place if the burner is used daily. This consists of closing a manual gas valve. The electrically powered gas valves should close in two to four seconds as the UV scanner and combustion safeguard respond to loss of flame.
If a burner is in continuous service, we recommend that this maintenance schedule be performed weekly. An alternative to this is to use a self-checking ultraviolet scanner and control. In the past, this type of scanner involved an electrically operated shutter, which alternately would block and allow UV to the tube. However, having a mechanical device operating close to the burner heat and vibration is a recipe for frequent and premature failures; it is typically rated for only 140°F to 175°F maximum and is quite expensive.
Going Shutterless
Newer designs are available that completely avoid using a mechanical operating device to moderate the UV, increasing reliability and durability. For example, the Dual/Redundant Self Check UltraViolet Flame Sensor and Combustion Safeguard Control from Protection Controls includes two UV tubes in one ultraviolet sensor to monitor one burner flame. UV tubes respond to welding sparks, ignition sparks, lightning, bright incandescent or fluorescent light, solar radiation, gamma rays, and x-rays.
Since UV tubes produce UV rays when they conduct, two UV tubes in one sensor would not normally be suitable for sensing a burner flame, as one UV tube could be responding to the other tube and not the flame. But in the case of this safety control, two voltage supplies to the UV tubes are out of phase with each other. When one UV tube is powered and may respond to UV rays, the other UV tube is off. Additionally, the two UV tubes are powered through two rectifier circuits from two transformers that are out of phase with each other. The two UV tubes are powered and sense UV from the flame on alternating half cycles (Figure 3).
Each UV tube and rectifier circuit provides input to its amplifier. Each amplifier provides input to its own flame relay (Figure 4). Upon burner startup, before burner ignition, if either UV tube is in conduction, the safe start check circuit does not permit powering the fuel valve.
During the burner run cycle, if either UV tube fails in the conduction state, the cycle will safely continue with the other UV tube sensing the burner flame. See Figure 5.
Regardless of which sensor option you choose, accounting for flame redundancy and ensuring your maintenance plan is proactive enough for the method chosen is key to a safe manufacturing environment.
About The Author:
President
Protection Controls, Inc.
Bruce Yates is the president of Protection Controls and is involved with management, sales, and engineering responsibilities. He graduated from the University of Illinois with a Bachelor of Science in Electrical Engineering in 1968. He works with his brother Douglas in the family-owned flame safeguard control manufacturing company, started by his father, James, and uncle, Robert, in 1953.
For more information: Contact Bruce Yates at email@protectioncontrolsinc.com.
Redundant Flame Safety Read More »
