Two controlling devices, namely a combustion controlling device controlling the combustion of a combustion furnace, and a safety controlling device checking the operation of the devices wherein the operations are controlled by the combustion controlling device. This enables safer control of combustion because if there is a fault in either the combustion controlling device or the safety controlling device, a process can be performed by the other device to stop the combustion. Additionally, because the controlling device for controlling the structural elements that control the combustion in the boiler system and the controlling device for operational checks of the outputs from those structural elements are separate, if there is a failure in any of the structural elements or controlling devices, that failure can be detected reliably, enabling safer control of the combustion.