Overheat Protection: How High-Temperature Cut-Off Prevents Fires in Gas and Electric Appliances

The Devices That Provide Overheat Protection

How Overheat Arises

Why the Safety Must Be Independent

The normal thermostat and the overheat protection must not be the same function, and they should not share the same sensing element. If the thermostat is the only temperature control and it fails closed, or its sensor drifts low, nothing limits the temperature; a cut-out that uses the same sensor cannot catch that failure. Sound designs therefore use layers: regulation by the thermostat, first protection by a resettable thermal cut-out, and final protection by a one-shot thermal fuse at a higher temperature. Each layer catches a failure of the one before it. The thermal fuse should be chosen to operate at a temperature that protects the appliance but is not so close to normal operation that it trips during legitimate use, and the margin between the layers must be based on measured temperatures rather than on the nameplate.

Fail-Safe Behaviour

An overheat protector must fail into the safe state. If a wire breaks, a sensor opens or the supply is lost, the protected circuit should be de-energised rather than left enabled; a cut-out that silently allows heating when it is faulty provides no protection. On a gas appliance, the same principle means an overheat or dry-fire condition must interrupt the gas supply, and the fault should not be cleared by a simple restart where the standard requires a manual reset. A manual-reset cut-out is often used where an unattended automatic restart could repeat the hazard, such as a dry-fire in a water heater.

Testing Overheat Protection

1. Measure the temperature at which the cut-out operates and the time from fault onset to operation, using the part’s rated temperature;
2. Induce the actual fault — block ventilation, stop the fan or remove the water — rather than only testing the switch in isolation;
3. Confirm the cut-out removes power or gas, and that a one-shot fuse does not reset;
4. For auto-reset types, verify the reset temperature and that normal operation cannot restart into the fault;
5. Repeat after thermal cycling to detect drift, and log the result.

The general electrical safety requirements in IEC 60335-1 (E8) set out abnormal-operation and single-fault testing, and the protector should be verified in that context. A gas cooker test bench can combine the overheat test with the flame, valve and combustion checks, interlocking with the FFD, the gas valve and the CO checks in F5. As with the sensor comparison in F7, the protective device must be located where it actually measures the hazard, not a convenient cooler spot.

Selecting and Controlling the Protective Device

The part must be chosen on measured temperature and current rather than on a nominal catalogue value. The cut-out should be rated for the voltage and current of the circuit it interrupts, and a part that is marginal on current can weld or fail to open at the moment it is needed. A thermal fuse that is not rated for the actual fault current, or that is placed in a part of the circuit it cannot effectively disconnect, gives the appearance of protection without the function. The operating temperature and electrical rating therefore belong on the component specification and should be confirmed by the appliance test rather than assumed from the supplier’s generic label.

Incoming inspection of these parts is small but valuable. A cut-out can be checked for its operating temperature and continuity on a sample basis, and a thermal fuse for its link and rating, which separates a defective batch before it reaches production. Because the safety part is often inexpensive and fitted in volume, a bad batch can otherwise appear across many appliances and is only discovered at the final test or in the field. The part, batch and supplier should be recorded, and the installation position should be controlled as a fixture dimension: a sensor that is fitted even a short distance from the hot spot can read low and operate late, much as a flame electrode placed out of position fails the ignition test.

Thermal cycling also matters. A reusable cut-out that is cycled many times can drift or fatigue, and the housing around the protector can change after ageing, so it is prudent to verify the operating temperature after a representative cycling or ageing run rather than only on a new unit. A one-shot fuse should not be operated during ordinary production, since it cannot be reset; it is verified on development or sample units and then fitted as a controlled part.

Common Mistakes

• Using the thermostat as the overheat protection, or sharing its sensor;
• Testing only the switch in isolation, without inducing the real fault;
• Choosing a cut-out temperature without measuring the real enclosure temperature;
• Assuming the protector fails safe without testing an open sensor or broken wire;
• Allowing automatic restart into a dry-fire or fan-fault condition;
• Mounting the sensor away from the point that overheats.