Boiler Safety Controls: A 5-Test Field Checklist

Early August, basement boiler room of an office building in Saint-Laurent. Two hot water boilers, down since late May. The technician closes the disconnect and the sequence runs clean: purge, ignition, flame proven, modulation. Everything looks healthy. Except that none of the devices meant to stop those burners in a fault has been called on for fourteen months. Testing boiler safety controls is not watching the unit fire — it is forcing each shutdown condition, one at a time, and writing down what happens.

Boiler safety controls: what exactly gets tested?

A commercial boiler carries two families of devices that routinely get mixed up. Operating controls run normal service: they light, modulate, stop. Safety controls act once — the day something goes wrong. They can sit idle for years, which is precisely why they deserve suspicion.

A test is not a visual inspection. It means creating the fault condition and confirming the device cuts fuel within the expected time. What each test proves — and what it leaves unproven — is the whole point:

That right-hand column is why a test is always logged with a value, never a checkmark.

Before the first test: energy control, tools, log sheet

Tools needed — boiler and flame safeguard manuals, multimeter, stopwatch, differential manometer for air and gas, locks and tags, plus the last test record for the unit.

⚠ Safety — a safety test deliberately drives the equipment into an abnormal condition. Quebec’s occupational health and safety regulation governs hazardous-energy control methods before any work on equipment, and the building’s written procedure applies in full, including for a five-minute test. Never leave a jumper in place “to save time” — that is the single most common origin of the defeated safeties found two years later.

Prepare the log sheet before you go downstairs. Three columns: expected setpoint, measured value, action taken. Without it, the test becomes a memory.

Test 1 — Low water cutoff: blowdown first, slow drain second

On a steam boiler this is the safety whose failure costs the most. Two different tests, constantly confused.

The blowdown happens under normal operating conditions: open the control’s blowdown valve, the level drops fast, the burner must stop. For a cutoff mounted externally on a water column, ASME CSD-1 recommends this test daily. It proves the float moves and the switch works — nothing more.

The slow drain test, recommended twice a year by the same standard, is the only one that reveals the real cutoff point: let the level fall slowly and record the exact height at which the burner stops. The National Board warns that this test calls for caution and generally two technicians, because a secondary cutoff’s trip point can sit below the lowest visible part of the gauge glass — you never see the limit coming.

Test 2 — High limit: aquastat and pressure switch

On a hot water boiler the high limit is a manual-reset aquastat; on a low-pressure steam boiler, a limit pressure switch. The method is the same either way: lower the device setpoint progressively below the actual measured value until the contact opens, record the shutdown value, then restore the original setting.

Two things get logged. First, the gap between the dial setting and the real shutdown value — an aquastat that opens 8 °C above its graduation is no longer a limit, it is trim. Second, the reset mode: a high limit that resets itself hides a recurring problem instead of reporting it.

Test 3 — Safety relief valve: what the try lever actually shows

The relief valve is the last line of defence and the most abused device in the room. The test starts with the eyes: discharge piping clear and unreduced, no weeping, nameplate legible and consistent with the boiler’s maximum allowable working pressure.

Then comes the lever — and the conditions matter. The National Board’s pressure relief device inspection guide is explicit: valves built to ASME Code Section IV, the low-pressure heating boiler valves found across the Greater Montreal commercial stock, can have their test lever lifted with no pressure on the boiler. Every other valve requires at least 75% of set pressure under the disc first. And if the valve is found stuck closed, the same guide requires the equipment to be removed from service immediately until it is repaired or replaced.

Test 4 — Flame proving: time it, don’t just watch it

With the burner firing, interrupt the flame signal — block the scanner or disconnect the flame lead, whichever the manufacturer prescribes — and start the stopwatch. Fuel must be shut off within the flame failure response time printed on the amplifier, not on the relay module. On Honeywell’s 7800 Series, for instance, amplifiers are rated at 0.8 to 3.0 seconds depending on the model.

While you are there, read the flame signal strength at low fire as well. A strong signal at high fire but a marginal one at minimum is an advance warning of recurring safety lockouts once the January thaws arrive, load collapses and the burner spends its days at the bottom of its range.

Test 5 — Gas pressure switches, air proving and lockout

Three devices, one logic: each must not only cut, but lock the control out and demand a manual reset.

• Low gas pressure switch — close the manual upstream valve slowly until it trips, reading the manometer as you go. The trip point has to make sense against the supply pressure under maximum fire, not at rest.
• High gas pressure switch — simulate overpressure by the manufacturer’s method; it protects the valve train against a regulator failure.
• Combustion air proving switch — partially block the inlet or disconnect the pressure tap: the burner must lock out before ignition, never after.

CSA B149.1, adopted in Quebec, governs installation and work on these gas-fired appliances. Any device replaced during testing must be equivalent to the original — never “what was on the truck.”

Why run these tests in August instead of at the first cold snap?

Because in August a boiler can sit down for three hours with no consequence. In January, that same outage in a rental building generates tenant calls and pressure to “get it running,” which is exactly what pushes crews to bypass the thing they came to verify.

There is a mechanical reason too. What a test uncovers — a fouled float, a stuck valve seat, a clouded scanner — are slow failures that built up over the previous season. Finding them now leaves time to order a part; finding them during the first cold wave means a temporary rental. These records also feed the log required from the operator of pressure equipment in Quebec: the pressure equipment regulation demands traceability that only a planned campaign delivers without improvising.

Field case: the float that cut out too low

Residential building in Rosemont, low-pressure steam boiler, basement boiler room. The daily blowdown had been performed and logged for years: burner off every time, spotless file. The slow drain test had never been done.

Run as part of season prep, it showed the burner only stopping once the level had dropped below the bottom of the sight glass. Cause: sludge in the control body slowing the float’s descent. The fast blowdown, by creating an abrupt drop, dragged the float down despite the fouling and returned a reassuring result. The control body was cleaned, the water treatment program corrected, the test repeated: cutoff at the intended point. Without the slow test, that safety would have held right up to a genuine gradual water loss — the one day it mattered.

Book two hours before the heating season

Pull the manual for your lead boiler and find the last slow drain test date on file. If it is older than six months, or if there is none, schedule the campaign now: two hours per unit, log sheet filled in, measured values rather than checkmarks. That sheet is the only document worth anything in front of an inspector — and in front of an insurance claim.

For a property manager, those records read as a risk statement: they say which of your boilers are genuinely protected and which are protected only on paper. That is the reading the Montréal Combustion team files after every boiler commissioning and maintenance campaign, because a safety that has never been tested is not a safety — it is an assumption.