WO1994029781A1

WO1994029781A1 - Water heater control

Info

Publication number: WO1994029781A1
Application number: PCT/GB1994/001272
Authority: WO
Inventors: Donald Albert Breakspear; Stephen Paul Aydon
Original assignee: Donald Albert Breakspear; Stephen Paul Aydon
Priority date: 1993-06-11
Filing date: 1994-06-13
Publication date: 1994-12-22
Also published as: AU6933194A; ZA944085B

Abstract

A water heater control system wherein the water temperature is sensed by at least two sensors (14A, 14B) and compared to predetermined upper and lower temperature limits to control the operation of an element. The system detects an increase in temperature if the element is off and initiates a failsafe routine. It is also possible to vary the temperature limits in dependence on the ambient temperature or to disenable and enable the element in accordance with a timing schedule.

Description

WATER HEATER CONTROL

This invention relates generally to the control of water heaters or geysers.

It is known to fit a safety valve to a water heater to protect the heater against possible malfunction of a thermostat which permits the water temperature to be raised above boiling point. This type of safety valve

combines over-pressure and temperature features and, with existing geysers, is essential. The valve however is not only expensive but it fails to cure the cause of a problem and only reacts to the symptom of a problem. Thus it is not uncommon to encounter a geyser with water which is maintained substantially at boiling point and with steam and water streaming out of the safety valve outlet.

Electronic thermostats have also been proposed for controlling the function of a water heater. This type of thermostat simplifies the problem of providing an over-temperature switch at a safe temperature of the order of 90°C and can offer advantages in the form of variable hysteresis and set points, and simple remote control, which can marginally cut operating costs, but it is difficult to make these devices failsafe in an acceptable size, even with the use of integrated circuits. The invention provides a method of controlling the operation of a water

heater which includes heating means, responsive to a power supply, for

heating the water and switch means for controlling the connection of the power supply to the heating means, the method including the steps of:

(a) turning the switch means on thereby to turn the heating means on to heat the water,

(b) comparing the temperature of the water to a predetermined upper limit,

(c) turning the switch means off when the water temperature exceeds the predetermined upper limit,

(d) comparing the temperature of the water to a predetermined lower limit,

(e) returning to step (a) when the water temperature is lower than the predetermined lower limit, and

(f) carrying out at least one of the following;

(f)(1) monitoring the temperature of the water when the switch means is off and, if the water temperature increases, initiating a failsafe routine to prevent the water temperature from continuing to increase; (f)(2) monitoring the ambient temperature and, in a controlled manner, varying at least one of the predetermined upper limit, the predetermined lower limit, and the difference between the predetermined upper and lower limits; and

(f)(3) utilizing programmable timing means to enable or dis-enable the switch means in accordance with a timing schedule.

The failsafe routine may include the step of interrupting the power supply to the heater means. This may be achieved in any suitable way. For example the power supply may be short circuited thereby to cause the actuation of an overload device such as in-line fuse, a circuit breaker or

a similar mechanism, or a normally closed, in-line switch can be opened.

The timing schedule may be dependent on the time and date. In this sense 'date' may include the day of the week and the month.

The programmable timing means may also or alternatively, in dependence on the time and the date, be utilized to vary at least one of the following: the predetermined upper and lower limits, and the difference between these limits.

The invention may further include the steps of monitoring the aforementioned method of control and, if the sequence of method steps varies from a predetermined sequence, of restarting the predetermined

sequence.

The predetermined sequence of steps may be embodied in a computer program and the predetermined sequence may be restarted by restarting the program.

The method may also include the steps of allowing a controlled external signal of predetermined format to enable or dis-enable the switch means and, when the switch means is dis-enabled, of carrying out at least step

(f)(1)-

As is apparent from the comments made hereinbefore the method is preferably implemented using one or more programmable computing devices.

The invention also extends to apparatus for controlling the operation of a water heater which includes heating means, responsive to a power supply, for heating the water and switch means for controlling the connection of the heating means to the power supply, the apparatus including means for sensing the temperature of the water, means responsive to the water temperature sensing means for controlling the operation of the switch means thereby to maintain the water temperature between predetermined upper and lower limits, and at least one of the following:

(a) means for comparing the temperature of the water to a predetermined lower limit, means for turning the heating means on when the water temperature is lower than the predetermined lower limit, means for detecting when the switch means is off, means for detecting when the water temperature increases, and means for

initiating a failsafe routine when the switch means is off and the

water temperature increases;

(b) means for sensing an ambient temperature and means responsive to the ambient temperature sensing means for varying at least one of the following: the predetermined upper limit, the predetermined lower limit and the difference between the predetermined upper and lower limits; and

(c) timing means for enabling and dis-enabling the switch means in accordance with a predetermined timing schedule.

The failsafe routine may be implemented in any appropriate way.

Preferably this is done by means of a switching device which causes the power supply to the heater means to be interrupted. The switching device may however be adapted to cause an overload condition in the power supply which in turn results in the actuation of an

overload device such as a circuit breaker or, preferably, an in-line fuse or switch.

The timing means may, in dependence on the time and the date, be used to enable and dis-enabie the switch means, or to vary at least one of the following: the predetermined upper limit, the predetermined lower limit, and the difference between the predetermined upper and lower limits.

The invention is further described by way of example with reference to the accompanying drawings in which:

Figure 1 is a block diagram of apparatus for controlling the operation of a water heater in accordance with the principles of the invention, and

Figure 2 illustrates a temperature probe with two sensors.

Software An explanation of the software used in the invention follows this specification.

Figure 1 of the accompanying drawings illustrates apparatus according to the invention for controlling the operation of a water heater. The apparatus includes a microcontroller 10, a power supply 12, first and second temperature sensors 14 and 16, a brown-out detection unit 18, a switching device 20 which in this example is a silicon controlled rectifier, a filter 22, a programmable or settable clock/calendar unit 24, and a switching circuit 26 which includes a relay 28, transistors 30 and 32, and a light emitting diode 34.

The microcontroller includes a micro processor with an integral watchdog

timer 36, RAM 38, EPROM 40, an analogue to digital converter 42, and a power-on reset unit 44.

The microcontroller has digital output terminals 46, two of which are respectively connected to the filter 22 and the clock/calendar 24, and digital output terminals 48. The microcontroller also includes a non- masked input 50.

As indicated the apparatus is intended to be used to control the operation of a water heater, not shown. The water heater includes a standard electrical heating element 52 which is connected to terminals of the power supply 12. Live and neutral power supply lines 54 and 56 respectively are connected to the power supply.

The power supply 12 provides a stabilized power supply for the operation of the microcontroller and the electronic circuitry associated therewith. The brown-out detection unit 18 monitors the output voltage of the power supply 12 which ideally is maintained at 5 volts. If the voltage drops below

a predetermined level, typically of the order of 4,5 volts, the voltage drop is detected and a reset pulse is generated by the unit 18 to reset the microcontroller. This prevents corruption of the data held in the RAM 38.

The reset signal remains for as long as the voltage is below the indicated lower threshold.

It is to be noted that any corruption of data in the ram 38 can cause the program held therein to go into an endless loop or perform an unexpected operation. Also the microcontroller, although internally protected by means of diodes and other circuitry, may be susceptible to voltage spikes on the input lines 54 and 56 and can malfunction. The brown-out detection unit 18 which is connected to the reset line of the microcontroller helps to reduce problems of this type. Further protective features result by limiting long cable connections to inputs of the microcontroller and by protecting these inputs using metal oxide thyristors or other suitable protection devices.

The DC power supply 12 can also include a temperature stable zener diode which provides an extra reference voltage which is monitored by the analogue to digital converter 42 to verify that the DC power supply, and the analogue to digital converter, are functioning correctly. The first temperature sensor 14 is installed utilizing a suitable brass adaptor, at any appropriate location in or on the water heater, to sense the temperature of the water in the water heater. It provides a voltage signal the value of which is dependent on the water temperature.

The second temperature sensor 16 is exposed to the air surrounding the water heater so that it monitors the ambient air temperature. Although the ambient air temperature may be influenced to some extent by the

temperature of the water in the water heater the sensor 16 will, if it is correctly installed, nonetheless provide a signal which fairly accurately reflects the ambient temperature.

The positioning of the sensors 14 and 16 will depend on the physical parameters of the water heater installation, but, bearing in mind the aforementioned guidelines, will readily be accomplished by a technician.

The relay 28 has contacts 58 between the mains supply and the element 52. The transistor 30, in line with the relay, is normally held off by means of a resistor 60. However if the corresponding digital output terminal 48A connected to the base of the transistor goes high the transistor is turned on and the relay is energized. This arrangement means that if the microcontroller 10 should fail the relay will automatically be turned off.

The LED 34, in parallel with the relay, is turned on by means of the transistor 32 when the relay is off. This arrangement ensures that the current consumption of the switching circuit 26 is held more or less

constant at all times.

The filter 22 detects the voltage on the open side of the relay contacts 58. This is done via a very high impedance and the voltage signal is rectified to provide a 5 volt signal, which is applied to a corresponding digital input terminal 46 of the microcontroller, when power is applied to the element 52.

The switching means 20, in this embodiment, is a silicon controlled rectifier (SCR). However a triac or any other appropriate device can be employed in its place. The SCR has its gate connected to a corresponding digital output terminal 48 of the microcontroller. As stated, the filter 22 effectively monitors the closure of the contacts 58 of the relay. The voltage on the output terminal 48A indicates whether the relay is energized or not. The program in the microcontroller, utilizing this information, can thus detect when the water is being heated even though the relay 28 is de-energized. This would indicate for example that the relay contacts 58 have shorted together. Under these circumstances the SCR

20 is turned on to short the power supply. This causes an overload condition and an in-line fuse 64 in the live lead 54 is then blown by the resulting high current. This failsafe feature causes power to be disconnected from the element 52. Instead of the SCR, a triac, relay or other switch could be used to short the power supply. Another possibility is to make use of an in-line power switch, with normally closed contacts 70, which is then activated to isolate the element from the power supply.

The clock/calendar 24 provides accurate time, day and date information allowing for time based decisions to be made by the microcontroller in respect of enabling or dis-enabling the relay 28.

In general terms the temperature sensor 14 provides a voltage signal which is converted into digital form by means of the integral analogue to digital converter 42. The actual temperature of the water, as indicated by means of the signal, is compared by means of the program held in the RAM 38 to a selected predetermined upper temperature limit and when this limit is reached the relay 28 is turned off. The element 52 is consequently also turned off. As the water temperature decreases its temperature is constantly monitored by means of the sensor 14 and when a selected predetermined lower temperature limit is reached, this is detected by means of the program, and at this stage the relay 28 is again energized to cause the power supply to be reconnected to the element.

The temperature of the water is therefore held between the predetermined upper and lower limits.

The temperature limits are stored in the program and hence are variable by accessing the software. It is possible though to provide input devices e.g. DIP switches or the like, to provide a means for the user to vary the temperature limits.

The ambient temperature is, as has been indicated, monitored by means of the sensor 16. The program in the microcontroller can be partly dependent on the ambient temperature so that the predetermined upper temperature limit, or the predetermined lower temperature limit, can be varied in dependence on the ambient temperature. For example at an ambient temperature of lower than 10°C the upper temperature limit may be 70°C while with an ambient temperature in the range from 10°C to 25°C the upper temperature limit may be lowered to 65°C. Thus by monitoring the ambient temperature it is possible to set the minimum allowable water temperature. This can reduce power consumption particularly during the day and in the summer.

The cost of operating a water heater increases substantially exponentially as the upper temperature limit increases. The effect of the lower temperature limit is more complex and depends inter alia on the thermostat position, the action of water baffles in the heater, and so on.

Through judicious testing however optimum seasonal and time related upper and lower temperature limits can be determined, and thereafter are readily incorporated into the controlling software. Temperature control may be implemented in conjunction with the data provided by the clock/calendar 24. For example the temperature difference or hysteresis between the predetermined upper and lower temperature limits may be varied according to the time of day or the time of year by means of a suitable routine, in the program, which takes into account practical factors. Thus the water may be allowed to cool substantially between 11 p.m. and 4 a.m. and normal operation of the microcontroller may be restored for the hours between 4 a.m. and 11 p.m.

Again this approach can lead to a reduction in power consumption.

Reference has already been made to the use of the filter 22 to detect whether power is applied to the element 52 even though the relay 28 is not energized. It is recognized that the input signal to the filter may be affected by noise on the power lines. Thus when a possible malfunction of this type is indicated a delay period is allowed to elapse and thereafter the situation is checked a number of times. If the outcome of each check indicates that a malfunction has in fact occurred then the SCR 20 is turned on to implement the described failsafe routine. A rapid response to this type of malfunction is not essential for if the water heater has reached a predetermined upper temperature limit of, say, 65°C it will require to be heated for at least two hours more before a dangerous condition is reached.

The 'clock/calendar 24' provides time information in seconds, minutes and hours, date information, the day of the week, the month, and the year. This time information can be configured to meet particular requirements,

for example of an electrical supply authority, and used by the program in the microcontroller automatically to enable or disenable the normal control function of the microcontroller. Thus load shedding routines can be implemented to minimize peak current consumption at various times during the day or the year, according to requirement.

The input 50 is provided to allow the microcontroller to accept an external command to inhibit control. For example load control in an installation may be implemented according to localized factors to allow maximum use to be made of an electrical supply line without causing overload conditions.

Figure 1 illustrates a single sensor 14 which is used to sense the temperature of the water.

Although the sensor output is compared with working limits and short or open circuits can easily be detected a partial short or a slightly damaged sensor may not be detected by the software. By adding a second sensor to the physical probe, this possibility is completely removed.

This arrangement is depicted in Figure 2 which shows a probe 80 with two negative temperature coefficient (NTC) sensors 14A and 14B which are used to sense the water temperature independently, and to provide separate signals. The software constantly compares these signals, but allows for a slight difference between them due, for example, to component tolerances. A greater difference between the signals indicates a fault and a failsafe routine, similar to that already described, may be initiated, or the software may otherwise simply prevent the contact 58 from being closed, to signal the fault condition.

Software Operation

The program used in the microcontrollers includes a number of modules which include the normal temperature control function, the interaction of the ambient temperature with the control function, the load shedding routine which is dependent on the information held in the clock/calendar 24, the relay off routine which acts as a failsafe routine when the element is energized and the relay 28 is not energized, a routine which allows options to be selected via a link to the line 50, and the program restart which inter alia functions in conjunction with the brown-out detection unit 18. In this respect it is to be noted that the power on reset unit 44 functions in a similar manner to detect over-voltages.

Diagnostic procedures and self-testing routines may readily be incorporated in the microcontroller. /29781 .-j g. PCT/GB94/01272

In the program reset routine provision is made for the ambient and options routines to be incorporated. An over-temperature value is set at 75°C and if this temperature is exceeded the RELAY OFF routine is executed.

It is possible to initiate load shedding. This would be normally in conjunction with information supplied by the clock/calendar 24.

The use of an onboard load shedding feature, made possible by the clock/calendar 24, means that conventional ripple control techniques which are implemented from a central point are not required. This in turn results in substantial savings.

The main program makes use of subroutines designated SUB1 to SUB11 respectively, which perform the following functions:

N.B. In the following descriptions, when options are encountered "YES/NO", the next line will be the alternative, unless otherwise stated.

SUB1:ADC - The main program will define which channel to use.

1) Change to channel selected by main program, change from high impedance to analogue input.

2) Pause to give all stray capacitance time to change. 3) Start ADC conversion.

4) Either loop until complete or interrupt on completion.

5) Copy result into RAM.

6) Perform 3 & 4 again.

7) Put selected channel back to high impedance. 8) Compare result, if within +/- 2 counts continue, else start subroutine over. 9) Return from subroutine. REMARK: Alternative method is average result of ADC over several samples. Different microcontrollers have different methods of routing a selected channel to the ADC.

SUB2: VALID - The object here is to compare the ADC result for a specific temperature sensor with pre-programmed temperature limits.

1) Is VALUE greater than bottom limit? - Yes - set ADC value to 255 and go to FAIL - else go to 2.

2) Is VALUE less than upper limit? - Yes - set ADC value to 255 and go to FAIL - else go to 3.

3) Return from subroutine.

Each selected sensor would have preprogrammed limits represented by a few lines of program. This routine would route the sequence to the appropriate lines based on the channel selected. SUB3: AMBIENT - Object is to determine ambient air temperature by (NTC) sensor and compare with preprogrammed values to determine what the best water SETPOINT ought to be. The preprogrammed values would have been found in lab testing of the geyser type. 1) Multiplex ambient I/O line.

2) Call ADC routine.

3) Call VALID routine.

4) Compare result with successive values to determine SETPOINT. e.g. Is RESULT greater than 0°C? - Yes then next, else set SETPOINT = to value representative of 68°C.

Is RESULT greater than 5°C? - Yes then next, else set SETPOINT = to value representative of 67°C.

5) When the corresponding window is found, the SETPOINT variable will be allocated a value.

6) Return from subroutine.

SUB4: DELAY - A complete main program loop time of a minute or more would be quite acceptable. The microcontroller can perform this task in a few milliseconds. Placing delays in the program slows the loop time down. The program can select multiple time durations by placing a value in RAM before calling the DELAY routine.

1) Load timer register with delay value.

2) Loop until time has elapsed. 3) Return from subroutine.

SUB5: CLOCK DAY - This routine reads the day of the week (0- 7 = Monday-Sunday) from the battery backed up clock module. This self contained module is started at the factory and the time set. It can only be read thereafter unless an additional routine is run to enable it to be programmed.

1) Loop as many time as necessary.

2) Set data I/O line or reset it as determined by the preprogrammed word for 'day register'. 3) Loop as many time as necessary.

4) Read data I/O storing each bit from each loop. REMARK: Value is most likely back to front and in BCD format, arrange bits in order and convert to binary value.

5) Set RAM representative of DAY with value. 6) Return from subroutine.

SUB6: CLOCK HOUR - This routine does exactly what DAY did but reads hours. SUB7: CLOCK MIN - This routine does exactly what _DAY did but reads minutes. SUB8: CLOCK SEC - This routine does exactly what _DAY did but reads seconds.

SUB9: DIAGNOSTICS - This routine checks one specific I/O line to determine whether any external signal is present. Depending on the signal it would for example set all I/O lines to high impedance to permit external programming of the clock.

Alternatively it might detect a value signalling the need to fix the SETPOINT for testing purposes, during manufacture.

REMARK: This line can be digital or analogue, in which case it can signal multiple conditions. These routines have little influence on the main function of the thermostat and thus are not further described.

SUB10: LED - This routine is used to signal the status of the thermostat via the LED or LEDs. This is achieved by flashing the LED a certain number of times, the value of which is determined by the main program. 1) Set LED I/O line.

2) Set delay value call DELAY.

3) Reset I/O line.

4) Set delay value call DELAY.

5) Decrement count, if not zero go to 1. 6) Return from subroutine.

SUB11: FAIL - This subroutine is called whenever the program detects an out of tolerance value or the water temperature has risen above 75°C (this value may be changed for various applications). Its first task is to see whether the water temperature is rising when it should not and take appropriate action. A 1) Multiplex water sensor I/O line.

2) Call ADC.

3) Is water above 75°C, no then reset program - yes then increment FAIL FLAG if less than 5 then clear interrupts and go to start of main program.

4) Reset relay I/O line.

5) Set I/O line corresponding to alternative power switch. This is to isolate the element by breaking additional in line contact or triggering an SCR (or other switch) to short out the incoming mains supply and blow onboard fuse.

6) If CLOCK MODULE is present then store value in clock RAM for factory diagnosis. The contents of this RAM can be read even if the rest of the thermostat has failed. 7) Loop continuously - no further action. B REMARK: In the case of the ambient air sensor going out of limit, the program can continue. This is achieved by setting some value for the SETPOINT at this point in the program. It will then be signalled by the LED subroutine. This action will reduce the efficiency of the water heater but in no way affect the safety of the unit.

The operation of the software is as follows: REMARK: At power up, the microcontroller's peripheral modules need to be defined, RAM allocated for storage of variables, internal registers etc. and the Watch Dog Timer needs to be reset.

1) Define Data Registers: - Specify specific locations in RAM allocated to microcontroller internal registers.

2) Reset Watchdog Timer: - This counts down and if zero is reached it will reset the entire process. Needed to prevent the program from locking into an unplanned loop as a result of corrupt data. While not stated in rest of chart, this register needs to be reset at regular intervals just prior to count reaching zero.

3) Define other RAM data: - Specify which RAM locations represent which variables.

4) Set Peripheral Status: Define all I/O lines [Set Impedance]

[Enable interrupts] Set ADC status [on/off] Set Timer status [on/off] [mode] [interrupt status]

REMARK: Only at this stage is the microcontroller ready to start performing the functions of the program.

5) Main Programme:

Test I/O lines for external signal. Yes - call Diagnostic

Routines. Set I/O line for external Zener Diode.

Call ADC.

Call VALID.

Call CLOCK_SEC.

Call DELAY wait a second then. Call CLOCK_SEC.

If clock has incremented set Clock flag; this determines whether clock is present. REMARK: Accuracy of the ADC has been verified as well as the functioning of the multiplexing circuits. Clock as an option has been tested. It is possible to make the Clock trigger a fault if not present. This may be necessary to show that a load shedding function is not functioning.

PROGRAM

START Set LLLOOP = 30 (See TRIGGER routine for significance.) «*■ Reset hysteresis flag Call AMBIENT

Set LOOP REGISTER =XX (XX represents the number of times to loop for 2 minute period) Call CLOCK DAY - Is day Saturday or Sunday then NEXT Call CLOCK HOURS - Does hour fall in load shedding period ' yes - then go to RELAY OFF

Is hysteresis flag set - yes - then reduce SETPOINT by larger amount.

REMARK: If this flag is set, then rate of cooling is very slow and the hysteresis can be increased, thus avoiding unnecessary cutting in and out of the thermostat.

NEXT Set I/O line for water temperature. →

Call ADC Call VAUD

Is water over 75°C? — yes call FAIL Is water above SETPOINT? — no Turn LED Off

Turn Relay On Call DELAY then go to RELAY OFF

Decrement LOOP if zero then go to start • else go to

RELAY OFF Set LOOP register = XX (where XX represents number •* 3- of loops = 2 minute period.) Call AMBIENT OFF1 Reset I/O line to relay (relay Off) ^

REMARK:

TRIGGER Decrement LLLOOP. If zero then set hysteresis flag. REMARK: An hour has passed since element was last on, now possible to open hysteresis up to prevent unnecessary cycling - allow heater to cool extra few degrees.

Go to RELAY OFF

Claims

1. A method of controlling the operation of a water heater which includes heating means (52), responsive to a power supply (54,56), for heating the water and switch means (58) for controlling the connection of the power supply to the heating means, the method including the steps

of:

(a) turning the switch means (58) on thereby to turn the heating means (52) on to heat the water,

(b) comparing the temperature of the water to a predetermined upper limit (14),

(c) turning the switch means (58) off when the water temperature exceeds the predetermined upper limit,

(d) comparing the temperature of the water to a predetermined lower limit (14), and

(e) returning to step (a) when the water temperature is lower than the predetermined lower limit, the method being characterized in that it includes at least one of the following steps: (1 ) monitoring the temperature of the water (14) when the switch means (58) is off and, if the water temperature increases, initiating a failsafe routine (20;64;70) to prevent the water temperature from continuing to increase; (2) monitoring the ambient temperature (16) and, in a controlled manner, varying at least one of the predetermined upper limit, the predetermined lower limit, and the difference between the predetermined upper and lower limits; and

(3) utilizing programmable timing means (24) to enable or dis- enable the switch means in accordance with a timing schedule.

2. A method according to claim 1 which is characterized in that it includes the steps of allowing a controlled external signal (50) of predetermined format to enable or dis-enable the switch means (58) and, when the switch means is dis-enabled, of carrying out at least step (1).

3. Apparatus for controlling the operation of a water heater which includes heating means (52), responsive to a power supply (54,56), for heating the water and switch means (58) for controlling the connection of the heating means to the power supply, the apparatus including means (14) for sensing the temperature of the water, and means (10) responsive to the water temperature sensing means for controlling the operation of the switch means (58) thereby to maintain the water temperature between predetermined upper and lower limits, and which is characterized in that it includes at least one of the following:

(a) means (10;14) for comparing the temperature of the water to a predetermined lower limit, means (10,28) for turning the heating means on when the water temperature is lower than the predetermined lower limit, means (10) for detecting when the switch means is off, means (10,14) for detecting when the water

temperature increases, and means (20;64;70) for initiating a failsafe routine when the switch means (58) is off and the water temperature increases;

(b) means (16) for sensing an ambient temperature and means (10) responsive to the ambient temperature sensing means for varying at least one of the following: the predetermined upper limit, the predetermined lower limit and the difference between the predetermined upper and lower limits; and

(c) timing means (24) for enabling and dis-enabling the switch means in accordance with a predetermined timing schedule.

4. Apparatus according to claim 4 characterized in that the water temperature sensing means (14) includes a probe (80) with at least two

sensors (14A,14B) which independently sense the temperature of the

water.

5. Apparatus according to claim 3 or 4 characterized in that the means for initiating the failsafe routine includes a switching device (20;70) which causes the power supply to the heater means to be interrupted.

6. Apparatus for controlling the operation of a water heater which includes heating means (52), responsive to a power supply (54,56), for heating the water and switch means (58) for controlling the connection of the heating means to the power supply, the apparatus including means (14) for sensing the temperature of the water, and means (10) responsive to the water temperature sensing means for controlling the operation of the switch means thereby to maintain the water temperature between predetermined upper and lower limits, characterized in that the water temperature sensing means (14) includes a probe (80) with at least two sensors (14A,14B) which independently sense the temperature of the water and which provide control signals to the means (10) for controlling the switch means.