Pilot Flame Not Proven Trips in Burner Management Systems: 5 Failure Modes and What to Check
By Profire TeamApril 13, 2026
“Pilot Flame Not Proven” trips in industrial fired equipment often signal a reliability issue, not just a random fault. When multiple process burners, like line heaters, reboilers, and combustors, experience these lockouts, it often points to a broader system reliability problem.
“Pilot Flame Not Proven” is an outcome, not a root cause. The burner management system (BMS) / Flame Safeguard logic does its job by shutting down and mitigating safety hazards when it can’t confirm a stable pilot flame. To restore uptime efficiently, treat this alert as a diagnostic signal.
Instead of immediately swapping parts, investigate the most common drivers:
Pilot ignition timing
Flame detection margin
Pilot stability
Safety interlocks and permissives during light-off, including:
fuel pressure,
combustion air, AND
draft
In most cases, incorrect pilot pressure, poor flame sensor positioning, or inconsistent fuel gas quality cause these issues. They’re typically not a controller fault. That’s why it’s important to treat the burner trip as a signal to check the pilot delivery and flame detector sighting first. And work from there to solve the issue.
Here’s what “Pilot Flame Not Proven” means and the repeatable failure modes that accompany it.
What Does “Pilot Flame Not Proven” Mean? (and what it doesn’t)
A “Pilot Flame Not Proven” alert occurs when a BMS can’t verify a stable pilot flame within the startup proving window. In many facilities, the BMS is implemented as part of the site’s broader flame safeguard systems, so “Pilot Flame Not Proven” should be treated as a protective response—not a nuisance alarm.
To confirm ignition, the system needs a consistent signal from its flame detectors as part of the flame detection system—either a flame rod, UV scanner, or IR scanner. If the signal is too weak, intermittent, or disappears during the proving period, the BMS registers a failure.
In other words, a BMS is looking for an acceptable signal from the flame detection system within the proving window, not just “visible flame.”
The trip is based on what the flame monitoring circuit reports, not whether an operator can see the flame. Poor detector positioning is a common cause: the pilot may ignite, but if the detector can’t consistently see the flame root, it won’t send an acceptable proving signal.
You will often see this message during startup, especially during PTFI (Pilot Trial for Ignition) and a follow-on proving step often labeled PFEP (Pilot Flame Establishing/Proving Period). If proving fails, fuel is shut off, and the system either retries or goes to lockout after the configured number of attempts.
These sequences are typically implemented to meet site safety and regulatory requirements and commonly align with standards such as NFPA 86 and NFPA 87.
“Pilot Flame Not Proven” doesn’t automatically mean the scanner is bad, and it doesn’t automatically mean the pilot never lit. Many repeat events come down to weak flame signal, dirty optics, grounding or bonding issues, unstable pilot flame, or sighting and discrimination problems rather than a controller fault.
Before blaming the burner management system, separate the trip into one of three conditions:
Ignition did not occur (ignition system, pilot fuel delivery, or fuel train issue).
Ignition occurred, but detection was inadequate (flame monitoring/signal margin issue).
The pilot was unstable during the proving window (combustion/airflow/draft issue).
If the trip repeats, verify that safety interlocks and permissives tied to pilot gas supply, combustion air, and draft are made and stable before each relight attempt. Focus first on pilot pressure and detector position.
Quick Definitions
PTFI (Pilot Trial for Ignition): the allotted time for the pilot to light and be proven.
PFEP (Pilot Flame Establishing/Proving Period): the period where the system expects the pilot flame to be established and accepted (naming varies).
First-out: the earliest protective input that initiated the shutdown sequence (if captured). When the control system is integrated to the control room, first-out reporting is often the fastest way to avoid guessing.
Standards context (site-dependent): NFPA 85, 86, and 87 are commonly referenced for combustion safety and BMS practices, and IEC 60730-2-5 may be relevant where safety-related control functions are implemented to meet regulatory requirements. Depending on the application, some sites also map flame safeguard functions to a target Safety Integrity Level (SIL) as part of their safety lifecycle.
What are the repeatable failure modes behind “Pilot Flame Not Proven”?
“Pilot Flame Not Proven” is one alarm label, but it usually maps to a small set of repeatable failure modes. These modes are:
no ignition,
late ignition,
flame is present but not detected,
unstable pilot/dropout during proving, AND
discrimination/viewing problems.
Classifying the trip early helps focus your troubleshooting and reduce unnecessary resets and parts swapping.
Failure mode 1 — No ignition (pilot never lights)
The pilot burner doesn’t establish flame during the trial window. Typical drivers include:
Pilot fuel supply problems (pressure, valve action, restrictions, intermittent supply), including issues upstream at the fuel supply regulators and permissives like fuel pressure switches. Confirm the pilot’s safety shut-off valves are stroking reliably, and that upstream permissives (including pressure) aren’t chattering during light-off.
Insufficient ignition energy (weak spark, degraded components, poor electrode position) within the ignition system. This often comes down to worn ignition electrodes, degraded leads, or weak ignition transformers that can’t deliver repeatable spark energy.
Common ignition-hardware signatures: no spark at all, or arcing through/within the electrode porcelain instead of a clean spark at the tip.
Pilot gas delivery issues (plugged pilot orifice, fouled pilot assembly, poor fuel gas quality) and, where present in the fuel train design, related issues around protection devices such as flame arrestors.
Poor air/fuel mixing at the pilot (blocked air, incorrect aeration, misalignment), including startup airflow problems tied to air blowers and setpoints in the combustion control strategy.
Failure mode 2 — Late ignition (lights too slowly to prove)
The pilot lights, but not fast enough to meet the proving window. Common contributors include:
A weak or inconsistent ignition source (spark quality, positioning, intermittency).
Marginal pilot gas delivery (low pressure, partial restriction, slow valve response), sometimes reflected in borderline readings at fuel pressure permissives.
Excess pilot tubing length downstream of the pilot solenoid can add delay (line fill time). A common field guideline is keeping that run short (on the order of ≤15 ft after the pilot solenoid) to reduce ignition lag.
Draft conditions that delay light-off (wind effects, stack draft swings, local turbulence).
Unstable pilot mixing at startup (too lean/rich, inconsistent aeration), influenced by air-gas fuel ratios and how the combustion control system sequences purge and light-off.
A practical early warning sign is time-to-prove creeping upward before lockouts become frequent.
Failure mode 3 — Flame is present but not detected (signal problem)
A pilot flame may be present, but the controller doesn’t receive a strong, stable proving signal. Treat this as a flame monitoring performance problem first: confirm what the detector actually sees (flame root vs background), then confirm signal margin versus the trip threshold.
Typical causes include:
A weak signal strength relative to the acceptance threshold (a margin issue).
Poor sighting or misalignment (scanner not viewing the flame root; rod not properly immersed).
Poor sensor/scanner position is a top repeat offender here: the pilot may be lit, but the detector isn’t viewing the flame root consistently enough to meet the proving threshold.
Grounding/bonding issues (especially with flame rod/rectification).
Dirty optics, fouled sight ports, or an obstructed view (UV/IR optical flame scanners).
Common contamination sources include dust, sand, snow, and moisture. A continuously flowing purge-air line to the scanner can materially improve lens cleanliness and signal stability.
Wiring, terminations, or connection issues that degrade signal integrity in the detector circuit and sensor inputs.
Failure mode 4 — Unstable pilot/dropout during proving
The pilot ignites and may be detected briefly, but it can’t remain stable through the proving window. A common pattern is excessive draft or poor pilot-to-main burner positioning, where airflow pulls the pilot flame away from the sensor’s field of view.
Common drivers include:
Draft swings or local turbulence that lift the flame off the pilot tip.
On natural-draft equipment, draft problems often show up as poor initial main burner lightoff (oxygen-starved conditions). In severe cases, operators may notice abnormal heating around pilot/flame-arrestor housings that can damage nearby wiring.
Excess air conditions that thin the pilot flame or cause detachment.
Pilot hardware conditions that promote dropout (orifice wear, mixing instability, poor flame anchoring).
Field variability (wind gusts, inlet air changes, heater leakage), plus permissive interactions (for example, trips tied to high-temperature limit switches or airflow permissives that reset the sequence mid-prove).
Where facilities use combustion tuning tools like flue gas analyzers. Tip: Use them to support stability improvements after you’ve resolved the immediate proving issue (don’t treat flue gas numbers as proof of a healthy pilot signal).
Failure mode 5 — Discrimination/viewing problems (scanner sees the wrong thing or can’t see the right thing)
In this failure mode, the detector is operating, but the signal doesn’t represent the pilot flame in a way the logic can accept. The result may be inconsistent proving or sensitivity to background conditions.
Typical contributors include:
Scanner alignment issues (aim off the flame root; partial obstruction).
For UV sighting, aim at the flame anchoring point (near the burner nozzle/pilot flame root). A frequent error is aiming too far away from the nozzle, which increases dropout risk.
Background hot refractory or hot surfaces affecting IR discrimination. Tip: the scanner shouldn’t have line-of-sight to glowing refractory or hot surfaces; verify the sightline is flame-only.
Adjacent flames, reflections, or line-of-sight contamination.
Signal characteristics issues, such as an unexpected flame flicker pattern relative to what the scanner and logic expect.
On newer platforms, detectors and subsystems may be networked and visible to the control room, sometimes with device-level identifiers (including an IP address). That visibility helps trending and burner diagnostics, but it doesn’t eliminate the need to confirm sighting, cleanliness, and discrimination at the burner.
What are some common misdiagnosis patterns to avoid?
Two patterns show up repeatedly:
“Replace the scanner.” Swapping the detector before checking signal margin, sighting, grounding or bonding, optics condition, and pilot stability often leads to the same shutdown returning.
“Blame the controller.” Assuming a control failure before verifying whether ignition occurred and whether the detection path provided a stable signal usually sends troubleshooting in the wrong direction.
A proving trip is usually solved faster when you treat it as an ignition, detection, or stability problem first.
Note: Do not bypass safety interlocks, except under authorized site procedures and documented emergency troubleshooting controls. Bypassing safety interlocks is restricted to authorized senior personnel for emergency troubleshooting and requires documentation. This protects compliance with NFPA 86 expectations and site regulatory requirements for controlled management of protective functions.
Close the loop: classify the trip, then go deeper
“Pilot Flame Not Proven” is an outcome of the safety logic, not a diagnosis. When you sort the event into the right failure mode early, whether no ignition, late ignition, signal not detected, unstable pilot, or discrimination/viewing, you reduce guesswork and unnecessary churn.
From there, troubleshooting can stay targeted. Match your checks to the flame detection method, whether rectification, UV, or IR, and use a post-trip workflow that captures first-out context, flame signal margin, and time-to-prove before anything resets.
If you need to escalate the issue, gather the key details first:
Alarm history,
Photos of the pilot, scanner, and rod sighting,
Pilot pressure readings during lightoff, AND
Recent combustion or tuning reports.
Having these details ready will help a service technician diagnose the problem faster and get your system back up and running.
Pilot Proving by Flame Detection Method: Rectification (µA) vs UV vs IR (Coming Soon)
Post-Trip Workflow for “Pilot Not Proven” Shutdowns: First-Out, Signal Margin, and Prevention (Coming Soon)
Frequently Asked Questions About Pilot Proving Issues
What does “Pilot Flame Not Proven” mean?
“Pilot Not Proven” means the burner management system didn’t receive an acceptable pilot flame signal within the proving window for that startup step.
What causes pilot proving failure most often in oil and gas fired equipment?
Pilot proving failures in oil and gas fired equipment are often repeat events caused by margin and field conditions: weak or unstable signal, dirty optics, grounding/bonding issues, unstable pilot flame, sighting/discrimination problems, pilot pressure issues, and poor sensor/scanner positioning.
Can draft/wind cause nuisance “Pilot Flame Not Proven” trips?
Yes, draft/wind can cause nuisance “Pilot Not Proven” trips. Draft swings can delay light-off, destabilize the pilot, or reduce signal margin enough to fall below acceptance.
What is PTFI, and is there a “normal” trial time?
PTFI is the Pilot Trial for Ignition. Trial times are configuration- and site-dependent, so trending time-to-prove on a given asset is more useful than comparing to a generic value.
What’s a practical maintenance interval to prevent pilot proving issues?
A practical maintenance interval is every 3–6 months: pull the pilot assembly, inspect/clean it, and check the detector sighting/cleanliness. This also surfaces early signs of draft or ignition problems before they become repeat lockouts.
