CA3129944A1 - Water heater safety override for legionella control during load shifting and load shedding - Google Patents

Abstract

The present disclosure describes a safety override circuit and related methods that leverage the existing temperature-based automatic shutoff feature of a conventional water heater to permit external control signals to shut off of the water heater only where conditions for Legionella control are met. This may be achieved by allowing external control signals to shut off the water heater only if the water heater has already shut itself off at some point within a predetermined prior time period because the water temperature was sufficient for Legionella control (e.g. 60 C within the past 24 hours pursuant to WHO guidelines).

Description

WATER HEATER SAFETY OVERRIDE FOR LEGIONELLA CONTROL DURING
LOAD SHIFTING AND LOAD SHEDDING
TECHNICAL FIELD
[0001] The present disclosure relates to electric water heaters, and more particularly to control systems for water heaters.
BACKGROUND

[0002] Climate change is widely acknowledged to be a serious threat to human life and health, and a wide range of mitigation strategies have been proposed to reduce the emission of greenhouse gases such as carbon dioxide (for example, but it is not the only such threat). For example, U.S. Patent Publication No. 2012/0109394 describes a home energy management system that allows for appliance scheduling based on electricity cost and CO2 emission intensity of the energy. One example of an electrical appliance that could be scheduled to reduce CO2 emission is a residential water heater, which is a significant consumer of electricity.

[0003] Concurrently, many electrical utilities offer rates that vary with time of use.
Sometimes these are reduced rates offered at times where electricity production has a lower carbon footprint; in other cases it is to distribute electrical demand over time, or it may be a combination (e.g. a more evenly distributed demand may result in a lower carbon footprint).
There is an increasing use of timers, controllers or external demand management load schedulers (collectively referred to as "control devices") in conjunction with electric water heaters. These control devices are designed to shift the electric load to later periods, with the objective of managing load, minimizing carbon intensity in generation, reducing homeowner operating costs to take advantage of variable time of use electricity rates, or other reasons.
These control devices can delay water heating from a few minutes, to over 20 hours per day, depending on their objective and configuration. They operate by denying electrical power supply to the water heater for the specified period, after which electrical power to the water heater is restored and reheating begins.

Date Recue/Date Received 2021-09-03

[0004] Climate change, however, is not the only threat to human life and health. Microbes also pose a threat. One such microbe is Legionella. The World Health Organization (WHO), in its "Guidelines for drinking-water quality", Second Edition, Addendum, "Microbiological agents in drinking water" , specifically addresses Legionella and recommends that "water temperatures inside calorifiers and tanks must reach 60 C throughout, including at the bottom, at least once per day". Assuming that the water heater is allowed to fully reheat before automatically shutting off after reaching its temperature set point, a set point of 60 C
will provide compliance with the WHO guidelines.

[0005] However, the scheduled denial of electrical power may defeat or inhibit the tanks' ability to meet WHO Legionella control guidelines. By periodically interrupting the electrical power supply, they are effectively reducing the water heater's temperature set point, and in some situations, they may not allow sufficient re-heating time in a 24 hour period for the tank to fully reheat and achieve its temperature set point. If a hot water heater is scheduled to shut down until it can use electricity with a lower CO2 emission intensity, even if the temperature of outgoing water is sufficient for comfort, these scheduled shutdowns may inhibit the ability of the hot water to reach the temperature required for Legionella prophylaxis.
Moreover, some homeowners may schedule their hot water tanks to take advantage of lower electricity rates that occur for short periods of time. It is possible that in some cases, depending on the pattern of hot water consumption and the time required to fully reheat a tank (which is longer in winter) these short periods may not be sufficient to reheat the tank completely. For example:
= A water heater may be scheduled to only utilize low intensity carbon generation during off-peak periods, which occurs for 4 to 5 hours per night depending on total electricity demand and weather. Because of a shiftwork schedule, a specific homeowner may have much of their hot water use during this same overnight period, and as result the tank never reaches 60 C (even if that is the temperature set point) before the control device denies electrical power to the water heater. Unknown to the homeowner, the water heater is no longer operating within the WHO guidelines.

Date Recue/Date Received 2021-09-03 = A jurisdiction may have a "super off-peak" electricity rate that is very low for only two to three hours per night, and the homeowner wants to use these low rates to reduce costs. In winter time, the tank of the water heater may not fully re-heat prior to denial of electrical power; if needed, the tank is "topped up" during the day. In this case, the homeowner will not have any issues with continuous hot water supply, but the tank will not ever be fully reheated to its 60 C set point. Unknown to the homeowner, the tank is no longer operating within the WHO guidelines. (A "super off-peak rate" is designed to take advantage of excess capacity and promote electric vehicle (EV) charging and other electrification.)

[0006] In summary, it is possible that with the increasing practice of using control devices that receive external control signals to permit or deny electrical power to water heaters for the purpose of peak load management, energy pricing optimization or minimizing the use of carbon intensive electricity generation, on a given day(s) a water heater may not be provided with electricity for long enough to fully reheat and reach its internally controlled temperature set point, which, assuming that the set point is at 60 C or higher, would meet the WHO
recommended guidelines for controlling Legionella bacteria. Thus, external or homeowner control of the water heater may undermine Legionella prevention.

[0007] Some attempts have been made to balance the reduction of CO2 emissions against the control of Legionella.

[0008] For example, U.S. Patent No. 10,837,674 describes a safety system and method to prevent water within a top portion of a tank of an electric water heater from dropping below a safe temperature during a load shedding period by a power provider to prevent the propagation of harmful bacteria in a top portion the tank. A control device monitors the water temperature in the top portion of the tank by the use of a temperature sensor. If the control device detects a temperature of the water in the top portion of the tank below 140 F, it will by-pass the instructions of the power provider and connect power to one or more of the resistive heating elements of the tank until a predetermined temperature above 140 degrees F
is attained before switching off the resistive heating elements. This system relies on knowledge of the actual temperature, and measures only the upper portion of the tank. As Date Recue/Date Received 2021-09-03 such, even if working perfectly it will not ensure that the entire tank has reached the necessary temperature.

[0009] Canadian Patent Publication No. 3,016,933 describes a system comprising a temperature sensor at the base of a tank of the water heater to be controlled, and a controller which calculates a safety index to Legionella of the water heater. When a load shedding request signal is received by the controller (e.g. from a utility), the controller determines whether or not to cut the power supply to interrupt the operation of the water heater depending on the calculated index. This system requires complex calculations based on the time duration of specific temperatures detected by the sensor.

[0010] Some approaches require adding one or more new external thermistors attached to the wall of the tank of the water heater (between the inner tank and insulation) or to pipes leaving the tank, and then monitoring and acting on the readings. Given a twelve to fifteen year expected life of the tank, it is to be expected that in some cases, these parts will fail to stay secure or to operate as new. In these cases, the homeowner will have no way of learning that their Legionella control system has failed. Additionally, a control device may have a malfunction that does not allow the water heater tank to fully reheat, either due to a control error, a look-up error, or other hardware, software or communications issue.
This malfunction could continue for some months or longer before being noticed if the water mostly reheats (e.g. to 50 C or 55 C), but not to 60 C. The homeowner would be receiving sufficient hot water supply, but the water heater is not operating within WHO guidelines, or would not be able to participate in the cost saving or carbon saving demand management program.

[0011] Thus, there remains a need for a simple, straightforward and reliable mechanism for allowing a water heater to potentially participate in load shifting and load shedding to reduce CO2 emissions without sacrificing control of potentially deadly Legionella.
SUMMARY

[0012] The present disclosure describes a safety override circuit and related method that leverages the existing temperature-based automatic shutoff feature of a conventional water heater, relying on the existing internal parts of the original water heater, to permit external Date Recue/Date Received 2021-09-03 control signals to shut off of the water heater only where conditions for Legionella control are met. This may be achieved by allowing external control signals to shut off the water heater only if the water heater has already shut itself off at some point within a predetermined prior time period because the water temperature was sufficient for Legionella control.

[0013] In one aspect, a safety override circuit for controlling power supply to a water heater is provided. The safety override circuit comprises a current input for monitoring a current drawn by the water heater, a control input for monitoring at least one external control signal supervising supply of electrical power to the water heater, and a timing element adapted for monitoring elapse of a predetermined prior time period. The safety override circuit is connectable in electrical communication with a power supply and with the water heater. The safety override circuit is configured to selectively permit the control signal(s) to deny electrical power to the water heater and to override the at control signal(s) to provide electrical power to the water heater. Where the current drawn by the water heater has fallen to zero within the predetermined prior time period, the safety override circuit denies electrical power to the water heater in response to the control signal(s), otherwise the safety override circuit provides electrical power to the water heater despite the control signal(s).

[0014] In some embodiments, the timing element is a timer forming part of the safety override circuit. The timing element may be, for example, a hardware timer or a software timer. In other embodiments, the timing element is a timing input adapted to receive a timing signal from a timer that is external to the safety override circuit.

[0015] In some embodiments, the safety override circuit comprises a microprocessor and the current input, the control input and the timing element form part of the microprocessor. The microprocessor executes program logic for using the timing element to measure lapse of the predetermined prior time period and using the current input to determine whether the current drawn by the water heater has fallen to zero within the predetermined prior time period. The microprocessor further executes program logic for, where the control signal(s) requests denial of electrical power to the water heater, when the current drawn by the water heater has fallen to zero within the predetermined prior time period, denying electrical power to the water heater in response to the control signal(s), and absent the current drawn by the water heater Date Recue/Date Received 2021-09-03 having fallen to zero within the predetermined prior time period, providing electrical power to the water heater despite the control signal(s).

[0016] In some embodiments, the safety override circuit is connectable in electrical communication with the power supply and with the water heater by a relay circuit configured for coupling the power supply to the water heater. The relay circuit comprises a first switch interposed between a first terminal of the power supply and a first terminal of the water heater and a second switch interposed between a second terminal of the power supply and a second terminal of the water heater, and the switches are controlled by the microprocessor.

[0017] In some embodiments, the first and second switches are single pole double throw relay switches whose coils are coupled to signal voltage through a switch control circuit in which the microprocessor is interposed, and the microprocessor is configured to selectively provide electrical power to the water heater and to selectively deny electrical power to the water heater by selectively grounding the coils to energize the coils and thereby actuate the switches.

[0018] In some embodiments, the current input is coupled to a current transformer interposed between the power supply and the water heater. The current transformer provides a signal representing current drawn by the water heater to the current input.

[0019] In some embodiments, the microprocessor is a Wi-Fi enabled microprocessor including a Wi-Fi module and the control input is adapted to receive the control signal(s) from the Wi-Fi module.

[0020] In another aspect, a safety override circuit for controlling power supply to a water heater is provided. The safety override circuit is connectable in electrical communication with a power supply and with the water heater to selectively provide electrical power to the water heater and deny electrical power to the water heater. The safety override circuit comprises a microprocessor. The microprocessor comprises a current input for monitoring a current drawn by the water heater, a control input, a Wi-Fi module adapted to receive at least one external control signal supervising supply of electrical power to the water heater and direct the control signal to the control input, and a timing element adapted for monitoring Date Recue/Date Received 2021-09-03 elapse of a predetermined prior time period. The safety override circuit further comprises a relay circuit for coupling the power supply to the water heater. The relay circuit comprises a first switch interposed between a first terminal of a power supply and a first terminal of the water heater, and a second switch interposed between a second terminal of the power supply and a second terminal of the water heater. The first and second switches are single pole double throw relay switches whose coils are coupled to signal voltage through a switch control circuit in which the microprocessor is interposed whereby the switches are controlled by the microprocessor. A current transformer is interposed between the power supply and the water heater. The current transformer is coupled to the current input of the microprocessor to provide a signal representing current drawn by the water heater to the current input. The microprocessor is configured to selectively provide electrical power to the water heater and to selectively deny electrical power to the water heater by selectively grounding the coils to energize the coils and thereby actuate the switches. The microprocessor executes program logic for using the timing element to measure lapse of the predetermined prior time period and using the current input to determine whether the current drawn by the water heater has fallen to zero within the predetermined prior time period. The microprocessor further executes program logic for, where the control signal(s) request denial of electrical power to the water heater, when the current drawn by the water heater has fallen to zero within the predetermined prior time period, controlling the switches to deny electrical power to the water heater in response to the control signal, and, absent the current drawn by the water heater having fallen to zero within the predetermined prior time period, controlling the switches to provide electrical power to the water heater despite the control signal(s).

[0021] In another aspect, a safety override circuit for controlling supply of electrical power to a water heater is provided. The safety override circuit comprises a current input for monitoring a current drawn by the water heater, a control input for monitoring at least one external control signal supervising supply of electrical power to the water heater and a timing element adapted for monitoring elapse of a predetermined prior time period.
The safety override circuit is connectable in electrical communication with a power supply and with the water heater and adapted to selectively permit the control signal(s) to deny electrical power to the water heater and to override the control signal(s) to provide electrical power to the water Date Recue/Date Received 2021-09-03 heater. Where the current drawn by the water heater has fallen to zero within the predetermined prior time period, the safety override circuit permits the control signal(s) to deny electrical power to the water heater, and otherwise the safety override circuit overrides the control signal(s) and provides electrical power to the water heater.

[0022] In another aspect, a method of controlling supply of electrical power to a water heater is provided. The method comprises monitoring a current drawn by the water heater, monitoring at least one external control signal supervising supply of electrical power to the water heater, determining whether the current drawn by the water heater has fallen to zero within a predetermined prior time period, and where the control signal(s) request denial of electrical power to the water heater, where the current drawn by the water heater has fallen to zero within the predetermined prior time period, denying electrical power to the water heater in response to the control signal(s), and otherwise providing electrical power to the water heater despite the control signal(s).

[0023] In another aspect, a method of controlling supply of electrical power to a water heater is provided. The method comprises monitoring a current drawn by the water heater, determining whether the current drawn by the water heater has fallen to zero within a predetermined prior time period, responsive to determining that the current drawn by the water heater has fallen to zero within the predetermined prior time period, monitoring at least one external control signal supervising supply of electrical power to the water heater, and responsive to the control signal(s) requesting denial of electrical power to the water heater where the current drawn by the water heater has fallen to zero within the predetermined prior time period, denying electrical power to the water heater in response to the control signal(s), and otherwise providing electrical power to the water heater despite the control signal (s).

[0024] In another aspect, a method of controlling supply of electrical power to a water heater is provided. The method comprises monitoring a current drawn by the water heater, monitoring at least one external control signal supervising supply of electrical power to the water heater, responsive to the control signal(s) requesting denial of electrical power to the water heater, determining whether the current drawn by the water heater has fallen to zero within a predetermined prior time period, and responsive to the control signal(s) requesting Date Recue/Date Received 2021-09-03 denial of electrical power to the water heater where the current drawn by the water heater has fallen to zero within the predetermined prior time period, denying electrical power to the water heater in response to the control signal(s), and otherwise providing electrical power to the water heater despite the control signal(s).

[0025] In another aspect, a method of controlling supply of electrical power to a water heater is provided. The method comprises monitoring a current drawn by the water heater, determining whether the current drawn by the water heater has fallen to zero within a predetermined prior time period, responsive to determining that the current drawn by the water heater has fallen to zero within the predetermined prior time period, monitoring at least one external control signal supervising supply of electrical power to the water heater, and responsive to the control signal(s) requesting denial of electrical power to the water heater where the current drawn by the water heater has fallen to zero within the predetermined prior time period, permitting the control signal(s) to deny electrical power to the water heater in response to the control signal(s), and otherwise overriding the control signal(s) and providing electrical power to the water heater despite the control signal(s).

[0026] In another aspect, a method of controlling supply of electrical power to a water heater is provided. The method comprises monitoring a current drawn by the water heater, monitoring at least one external control signal supervising supply of electrical power to the water heater, responsive to the control signal(s) requesting denial of electrical power to the water heater, determining whether the current drawn by the water heater has fallen to zero within a predetermined prior time period, responsive to the control signal(s) requesting denial of electrical power to the water heater where the current drawn by the water heater has fallen to zero within the predetermined prior time period, permitting the control signal(s) to deny electrical power to the water heater in response to the control signal(s), and otherwise overriding the control signal(s) and providing electrical power to the water heater despite the control signal(s).

[0027] In another aspect, a method of controlling supply of electrical power to a water heater is provided. The method comprises monitoring a current drawn by the water heater, monitoring at least one control signal governing supply of electrical power to the water heater, Date Recue/Date Received 2021-09-03 determining whether the current drawn by the water heater has fallen to zero within a predetermined prior time period, and where the control signal(s) request denial of electrical power to the water heater, where the current drawn by the water heater has fallen to zero within a predetermined prior time period, permitting the control signal(s) to deny electrical power to the water heater, and otherwise overriding the control signal(s) and providing electrical power to the water heater.
BRIEF DESCRIPTION OF THE DRAWINGS

[0028] These and other features will become more apparent from the following description in which reference is made to the appended drawings wherein:
FIGURE 1 is a block diagram showing an illustrative tank-style electric water heater coupled to a safety override circuit according to an aspect of the present disclosure;
FIGURE 2 is a schematic of an illustrative circuit connecting an illustrative microprocessor-based safety override circuit in electrical communication with a power supply and with an electric water heater;
FIGURE 3 is a flow chart showing a first illustrative method of controlling supply of electrical power to a water heater; and FIGURE 4 is a flow chart showing a second illustrative method of controlling supply of electrical power to a water heater.
DETAILED DESCRIPTION

[0029] Reference is now made to Figure 1, which shows an illustrative tank-style electric water heater 100 coupled to a safety override circuit 120 according to an aspect of the present disclosure. The water heater 100 includes a lower heating element 102, a lower thermostatically controlled temperature limit switch 104, an upper heating element 106, an upper thermostatically controlled temperature limit switch 108, and an electrical junction 110.
For clarity, the terms "lower" and "upper" refer to the physical position of the heating elements and temperature limit switches, and not to temperature values. The electrical Date Recue/Date Received 2021-09-03 junction 110 is coupled in electrical communication with an electrical power supply 112, for example 220V AC. Electrical power to the lower heating element 102 and the upper heating element 106 from the junction 110 is governed by the temperature limit switches 104, 108.
The lower temperature limit switch 104 and the upper temperature limit switch 108 are typically robust mechanical thermostats, such as adjustable mechanical "snap-disk"
thermostats that physically open an electrical circuit when a set temperature is reached, although other types of thermostatically controlled temperature limit switches may be used.
Other components of the water heater 100 are known to those of skill in the art, and are omitted for simplicity of illustration.

[0030] In one typical embodiment, when both the lower temperature limit switch 104 and the upper temperature limit switch 108 are open, indicating the temperature has risen above a predetermined level, the open temperature limit switches 104, 108 will interrupt the electrical power to the lower heating element 102 and the upper heating element 106, respectively, to prevent overheating. Where a mixing valve is present to prevent scalding, the predetermined level may be set to 60 C or higher to comply with WHO recommendations for Legionella control. Other types of electric water heater may have a single heating element and a single temperature limit switch. In any case, when all of the temperature limit switch(es) are open, indicating that the temperature has reached the predetermined level, the temperature limit switch(es) will interrupt the electrical power to the heating element(s) and the water heater will cease to draw current. Accordingly, where the predetermined level for the temperature is 60 C or higher, the water heater will only cease to draw current when the temperature has reached a level sufficient to comply with WHO recommendations for Legionella control.

[0031] However, as noted above, there is a risk that external control (e.g. by a homeowner or an electric utility) of the electrical power to the water heater may interrupt the supply of electrical power before the water heater has reached the required temperature, and thereby undermine Legionella prevention. The safety override circuit 120, shown in simplified block diagrammatic form in Figure 1, prevents this from occurring. Broadly speaking, the safety override circuit 120 will only permit interruption of electrical power to the water heater if the current drawn by the water heater has fallen to zero within a predetermined prior time period.

Date Recue/Date Received 2021-09-03 If the water heater 100 is set to shut off when the temperature reaches a predetermined level of 60 C or higher and the predetermined prior time period is 24 hours, this will ensure that the WHO recommendations for Legionella control have been complied with in the previous day before the water heater 100 is subjected to shutdown under external or homeowner control. While it is preferred to use a predetermined temperature of 60 C or higher and a predetermined prior time period of 24 hours for specific compliance with WHO
guidelines, it is to be understood that other combinations of predetermined temperature predetermined prior time period that are effective for suppression of Legionella may also be used.

[0032] Continuing to refer to Figure 1, the safety override circuit 120 comprises a current input 122, a control input 124, and a timing element 126. The current input 122 monitors an electrical current drawn by the water heater 100 and the control input 124 monitors at least one external control signal 118 supervising electrical power to the water heater 100. The external control signal(s) may include, for example, a schedule to provide electrical power to the water heater only at specific times; such a schedule may be programmed by a homeowner (e.g. to take advantage of lower electricity rates at a particular time of day) or by an electrical utility (e.g. for reduced carbon emissions or load balancing). The external control signal(s) 118 may also include, for example, a temperature control signal to cease providing electrical power to the water heater 100 when a certain temperature has been reached;
such a temperature control signal would be based on one or more external temperature sensors that differ from the lower temperature limit switch 104 and the upper temperature limit switch 108 described above. For example, a homeowner may want to deny power to the water heater 100 upon reaching a desired temperature point, which is lower than the predetermined level that triggers the temperature limit switch(es). Programming may be achieved using a direct physical interface (e.g. buttons and a screen, or a touch screen), or via wireless communication, such as a remote control device or a smaiiphone application communicating over a wireless network). An external control signal 118, for example a schedule or temperature control signal may be stored in a storage 116 of the safety override circuit. The external control signal 118 may also be a signal from an electric utility to cease electrical power to the water heater 100 because of conditions affecting the utility, such as dynamic load balancing. The timing element 126 is adapted for monitoring elapse of a predetermined Date Recue/Date Received 2021-09-03 prior time period, for example 24 hours. Depending on the configuration of the safety override circuit 120, the timing element 126 may be a timer forming part of the safety override circuit 120, for example a hardware timer or a software timer, or the timing element 126 may be a timing input adapted to receive a timing signal from a timer that is external to the safety override circuit.

[0033] The safety override circuit 120 is connectable in electrical communication with the power supply 112 and with the water heater 100. As shown in the embodiment illustrated in Figure 1, the safety override circuit is connectable in electrical communication with the power supply and with the water heater by a relay circuit 128 configured for coupling the power supply 112 to the water heater 100; in other embodiments the safety override circuit may be electrically interposed between the power supply and the water heater.

[0034] The safety override circuit 120 is configured to selectively permit the control signal(s) 118 to deny electrical power to the water heater 100 and to override the control signal(s) 118 to provide electrical power to the water heater 100. More particularly, the safety override circuit 120 includes control logic 130 in communication with the current input 122, the control input 124 and the timing element 126. According to the control logic 130, when the control input 124 receives a control signal 118 to deny electrical power to the water heater 100, where the current drawn by the water heater 100 has fallen to zero within the predetermined prior time period, the safety override circuit 120 denies electrical power to the water heater 100 in response to the control signal. Otherwise the safety override circuit provides electrical power to the water heater despite the control signal 118.
If the high temperature limit switch 110 is set to shut off the water heater 100 when the temperature reaches a predetermined level of 60 C or higher and the predetermined prior time period is 24 hours, this means that where the current drawn by the water heater 100 has fallen to zero within the predetermined prior time period, it follows that the WHO
recommendations for Legionella control have been complied with for the previous day. Thus, the safety circuit 120 can safely deny electrical power to the water heater 100 in response to the control signal without jeopardizing Legionella control. Conversely, if the current drawn by the water heater 100 has not fallen to zero within the predetermined prior time period, this means that he high Date Recue/Date Received 2021-09-03 temperature limit switch 110 did not shut off the water heater 100, meaning that the temperature did not reach the predetermined level of 60 C or higher in the past 24 hours and Legionella control cannot be presumed. Thus, if the current drawn by the water heater 100 has not fallen to zero within the predetermined prior time period, the safety override circuit 120 overrides the control signal(s) 118 and provides electrical power to the water heater 100.
Determination of whether the current drawn by the water heater 100 has fallen to zero within the predetermined prior time period is carried out by use of the current input 122 and the timing element 126.

[0035] Conceptually, the safety override circuit 120 operates as a logic gate for controlling the supply of electrical power to the water heater. Conceived of as an OR
gate, electrical power will be provided to the water heater 100 if the external control signal 118 permits (does not request denial of) electrical power supply to the water heater 100 OR the current drawn by the water heater 100 has not fallen to zero within the predetermined prior time period.
Alternatively, conceived of as an AND gate, for electrical power to be denied to the water heater 100, the external control signal 118 must request denial of electrical power to the water heater AND the current drawn by the water heater 100 must have fallen to zero within the predetermined prior time period.

[0036] In some embodiments, the safety override circuit 120 is a physical hardware circuit with a hardware implementation of the control logic 130; in other, preferred embodiments the safety override circuit 120 comprises a programmed microprocessor or similar computing device which executes program code for implementation of the control logic 130.

[0037] Reference is now made to Figure 2, which shows an illustrative schematic of a circuit connecting an illustrative microprocessor-based safety override circuit 220 in electrical communication with a power supply 212 and with an electric water heater 200.
Thus, the safety override circuit comprises a microprocessor 240 which includes a current input 222, a control input 224, and a timing element 226. The microprocessor 240 may also include memory or other storage, for example to store external control signals and/or program code.
In the illustrated embodiment, the microprocessor 240 is a Wi-Fi enabled microprocessor including a Wi-Fi module 232 and the control input 224 is adapted to receive the control Date Recue/Date Received 2021-09-03 signal(s) from the Wi-Fi module 232. Thus, in the illustrated embodiment shown in Figure 2, control signals can be sent to the control input 224 from a computer network, for example the Internet, either for immediate action or storage. Examples of suitable Wi-Fi enabled microprocessors include the ESP32-S Series offered by Espressif Systems (Shanghai) Co., Ltd. (https://www.espressif.com/en/products/modules), the Argon Wi-Fi Development Board (SKU: ARGN-H), offered by Particle Industries, Inc.
(https://store.particle.io/collections/wifi/products/argon), Telit WiFi Modules offered by Telit IoT Platforms, LLC (https://www.telit.com/m2m-iot-products/wifi-bluetooth-modules/) and Tuya Modules, offered by Tuya Global Inc., having an address at 3979 Freedom Circle Suite 340 Santa Clara, CA 95054 (https://developer.tuya.com/en/docs/iot/wifi-module?id=Kaiuyi301kmk4).

[0038] A switching power supply 234 is connected to the power supply 212, and delivers 5V
electrical power to the microprocessor 240 to provide operating voltage for the microprocessor 240. In other embodiments, the microprocessor 240 may be powered by other sources, including a battery.

[0039] The current input 222 of the microprocessor is coupled to a current transformer 236 interposed between the power supply 212 and the water heater 200. The current transformer 236 provides a signal representing the current drawn by the water heater 200 to the current input 222 of the microprocessor 240. The microprocessor 240 executes program logic 230 for using the timing element 226 to measure lapse of the predetermined prior time period (e.g. 24 hours) and for using the current input 222 to determine whether the current drawn by the water heater 200 has fallen to zero within the predetermined prior time period.

[0040] The safety override circuit 220, and in particular the microprocessor 240, is connected in electrical communication with the power supply 212 and with the water heater 200 by a relay circuit 228 configured for coupling the power supply 212 to the water heater 200. The relay circuit 228 comprises a first switch 242 interposed between a first terminal of the power supply 212 and a first terminal of the water heater 200, and a second switch 244 interposed between a second terminal of the power supply 212 and a second terminal of the water heater 200. The switches 242, 244 are controlled by the microprocessor, which executes program Date Recue/Date Received 2021-09-03 logic 230 for responding to a control signal that requests denial of electrical power to the water heater 200. According to the program logic 230, when the current drawn by the water heater 200 has fallen to zero within the predetermined prior time period, the microprocessor 240 controls the switches 242, 244 to deny electrical power to the water heater 200 in response to the control signal. However, absent the current drawn by the water heater 200 having fallen to zero within the predetermined prior time period immediately preceding the control signal, the microprocessor 240 controls the switches 242, 244 to provide electrical power to the water heater 200 despite the control signal.

[0041] In the illustrated embodiment, the first and second switches 242, 244 are single pole double throw relay switches whose coils are coupled to signal voltage (in this case +5V) through a switch control circuit 246 in which the microprocessor 240 is interposed. The microprocessor 240 is configured to selectively provide electrical power to the water heater 200 and to selectively deny electrical power to the water heater 212 by selectively grounding the coils to energize the coils of the first and second switches 242, 244 and thereby actuate the switches 242, 244. In particular, the coils of each of the switches 242, 244 are coupled at one end to the signal voltage and at the other end, by an electrical connection 248, to a switch control terminal 250 on the microprocessor 240. The microprocessor 240 can selectively connect the switch control terminal 250 to, and disconnect the switch control terminal 250 from, a ground terminal 252 on the microprocessor to selectively ground the coils of the switches 242, 244 and permit current from the signal voltage to flow through the coils. When the coils are grounded and the switches 242, 244 are actuated, electrical current can flow through the switches 242, 244 between the terminals of the power supply 212 and the water heater 200. When the coils are not grounded, the switches 242, 244 are open to prevent electrical current from flowing through the switches 242, 244 between the terminals of the power supply 212 and the water heater 200.

[0042] The switch control circuit 246 includes an override switch 254, which is interposed in the electrical connection 248 between the coils of the switches 242, 244 and the switch control terminal 250 on the microprocessor 240. The override switch 254 can toggle between connecting the coils of the switches 242, 244 to the switch control terminal 250 on the Date Recue/Date Received 2021-09-03 microprocessor 240, and connecting the coils of the switches 242, 244 directly to ground, effectively bypassing the microprocessor 240. Thus, the override switch 254 provides a manual override function.

[0043] In the illustrated embodiment, the current transformer 246 is interposed between the first switch 242 and the first terminal of the water heater 200, and hence between the first terminal of the power supply 212 and the first terminal of the water heater 200. Other configurations are also contemplated.

[0044] The safety override circuit 220 may include, or be coupled to, additional components.
For example, a relay LED 260 may indicate whether the relay circuit 228 is active, a Wi-Fi status LED 262 may indicate whether the microprocessor 240 has a Wi-Fi connection, and a Legionella status indicator LED 264 may indicate whether the current drawn by the water heater 200 has fallen to zero within the predetermined prior time period.

[0045] Additionally, the microprocessor 240 may be coupled to temperature sensors 266, which may result in delivery of a temperature-driven external control signal to the control input 224. This control signal may indicate that electrical power to the water heater 200 should be denied when a certain temperature has been reached. Notably, the temperature sensors 266 are external temperature sensors that differ from (indeed, are entirely different physical elements from) the lower temperature limit switch 104 and the upper temperature limit switch 108 forming part of the water heater 100, 200 as described in the context of Figure 1 above.

[0046] The circuit arrangement shown in Figure 2 is merely one illustrative embodiment, and is not intended to be limiting; a wide range of other configurations are contemplated within the scope of the present disclosure.

[0047] Reference is now made to Figure 3, which shows a first illustrative method 300 of controlling supply of electrical power to a water heater. As the method 300 begins, electrical power is being provided to the water heater at step 302. At step 304, the method 300 monitors a current drawn by the water heater, and at decision block 306, the method 306 monitors one or more external control signals supervising supply of electrical power to the Date Recue/Date Received 2021-09-03 water heater to see if a control signal requests denial of electrical power to the water heater.
The control signal may be (or result from), for example, a schedule to provide electrical power to the water heater only at specific times (e.g. from a homeowner or an electrical utility), a temperature control signal or a signal to cease electrical power to the water heater because of conditions affecting the utility, among others. If there is no control signal requesting denial of electrical power to the water heater, or the control signal does not request such denial ("no" at decision block 306), the method 300 returns to step 302 to continue providing electrical power to the water heater, then to step 304 to monitor current drawn by the water heater and then to step 306 to monitor for a control signal.

[0048] Responsive to there being at least one control signal requesting denial of electrical power to the water heater ("yes" at decision block 306), the method proceeds to decision block 308 to determine whether the current drawn by the water heater has fallen to zero within a predetermined prior time period (e.g. 24 hours). Responsive to there being at least one control signal requesting denial of electrical power to the water heater ("yes" at decision block 306, leading to decision block 308) where the current drawn by the water heater has fallen to zero within the predetermined prior time period ("yes" at decision block 308), method 300 proceeds to step 310 to deny electrical power to the water heater in response to the control signal(s). Otherwise ("no" at either decision block 306 or decision block 308), the method 300 returns to step 302 and continues providing electrical power to the water heater despite the control signal(s). After step 310, the method 300 proceeds to decision block 312 to continue monitoring the control signal(s) supervising supply of electrical power to the water heater to see if a control signal continues to request denial of electrical power to the water heater. If the control signal continues to request denial of electrical power to the water heater ("yes" at decision block 312), the method 300 returns to step 308 and, so long as the current drawn by the water heater has fallen to zero within the predetermined prior time period ("yes" at decision block 308), the method continues to deny electrical power to the water heater at block 310, then returns again to decision block 312 to continue monitoring the control signal(s). Thus, as long as the control signal continues to request denial of electrical power to the water heater at a time when the current drawn by the water heater has fallen to zero within the predetermined prior time period (which "rolls forward" as time passes), the Date Recue/Date Received 2021-09-03 method 300 denies electrical power to the water heater. If the control signal is no longer requesting denial of electrical power to the water heater ("no" at decision block 312), or if enough time has elapsed so that it is no longer true that the current drawn by the water heater has fallen to zero within the predetermined prior time period ("no" at decision block 308), the method 300 returns to step 302 to again provide electrical power to the water heater, and then returns to step 304.

[0049] The method 300 shown in Figure 3 describes an implementation that checks whether the current drawn by the water heater has fallen to zero within the predetermined prior time period only in response to there being at least one control signal requesting denial of electrical power to the water heater. Figure 4 shows a second illustrative method 400 of controlling supply of electrical power to a water heater in which monitoring for at least one external control signal requesting denial of electrical power to the water heater occurs only if the current drawn by the water heater has fallen to zero within the predetermined prior time period. Where the current drawn by the water heater has not fallen to zero within the predetermined prior time period, any external control signal will be ignored.

[0050] As the method 400 begins, electrical power is being provided to the water heater at step 402. At step 404, the method 400 monitors a current drawn by the water heater and then proceeds to decision block 406 to determine whether the current drawn by the water heater has fallen to zero within the predetermined prior time period. If the current drawn by the water heater has not fallen to zero within the predetermined prior time period ("no" at decision block 406), the method 400 returns to step 402 to continue providing electrical power to the water heater and then proceeds to step 404 to continue monitoring the current.

[0051] Responsive to determining that the current drawn by the water heater has fallen to zero within the predetermined prior time period ("yes" at decision block 406), the method 400 proceeds to decision block 408 to monitor one or more external control signals supervising supply of electrical power to the water heater to see if a control signal requests denial of electrical power to the water heater. Thus, the method 400 only monitors the external control signal(s) where it has already been determined that the current drawn by the water heater has Date Recue/Date Received 2021-09-03 fallen to zero within the predetermined prior time period ("yes" at decision block 406);
otherwise any external control signals are ignored.

[0052] Responsive to the control signal(s) requesting denial of electrical power to the water heater ("yes" at decision block 408) where the current drawn by the water heater has fallen to zero within the predetermined prior time period ("yes" at decision block 406, leading to decision block 408), the method 400 proceeds to step 410 to deny electrical power to the water heater in response to the control signal(s). Otherwise ("no" at either decision block 406 or decision block 408) the method 400 returns to step 404 and continues providing electrical power to the water heater despite the control signal(s). After step 410, the method 400 proceeds to decision block 412. At decision block 412, the method 400 again determines whether the current drawn by the water heater has fallen to zero within the predetermined prior time period (which, as noted above, "rolls forward" as time passes). If it remains true that the current drawn by the water heater has fallen to zero within the predetermined prior time period ("yes" at decision block 412), the method 400 will return to step 408 and continue to monitor the control signal(s) supervising supply of electrical power to the water heater to see if a control signal continues to request denial of electrical power to the water heater. So long as the control signal continues to request denial of electrical power to the water heater ("yes" at decision block 408), the method continues to deny electrical power to the water heater at block 410, then returns again to decision block 412 to continue checking whether current drawn by the water heater has fallen to zero within the predetermined prior time period. Thus, as long as the control signal continues to request denial of electrical power to the water heater at a time when the current drawn by the water heater has fallen to zero within the predetermined prior time period (which "rolls forward" as time passes), the method 400 denies electrical power to the water heater. If enough time has elapsed so that it is no longer true that the current drawn by the water heater has fallen to zero within the predetermined prior time period ("no" at decision block 412), or if the control signal is no longer requesting denial of electrical power to the water heater ("no" at decision block 408), the method 400 returns to step 402 to again provide electrical power to the water heater, and then returns to step 404.
Date Recue/Date Received 2021-09-03

[0053] Thus, in both the method 300 shown in Figure 3 and the method 400 shown in Figure 4, where the current drawn by the water heater has fallen to zero within a predetermined prior time period, the control signal(s) will be permitted to deny electrical power to the water heater but otherwise the control signal(s) are overridden and electrical power is provided to the water heater. Figures 3 and 4 are merely illustrative examples and are not intended to be limiting;
for example in other embodiments some steps may be carried simultaneously rather than sequentially, among other variations.

[0054] In some embodiments, the safety override circuit or method may be used in conjunction with external control signals that implement a "top-up" mechanism for use where time of use rates or other time-sensitive scheduling considerations exist, for example carbon intensity in power generation. When a household has used sufficient water during the day that the water heater needs to energize to maintain continued hot water supply, but it is before the regularly scheduled time for reheating, the top-up mechanism will energize the water heater for a short period of time to partially re-heat the water in the tank of the water heater and save the bulk of reheating until off-peak or later scheduled hours. This "top-up"
reheating could, for example, be for only 30 minutes, where the full re-heating for the entire tank could take an additional three to four hours (or more) depending on the incoming water temperatures (which have seasonal variation) and the temperature set point for the water heater.
Most electric water heaters start by energizing the upper heating element and heating the water nearest to where it is discharged; accordingly a short top will often provide sufficient supply to meet the demand of the later part of the day. Also, if needed, the top up can be repeated. Depending on the jurisdiction, this top-up functionality can save the homeowner significant water heating costs. The use of the systems and methods described herein obviate risk that such a top-up mechanism will undermine Legionella control.

[0055] As can be seen from the above description, the safety override circuits and electrical supply methods described herein represent significantly more than merely using categories to organize, store and transmit information and organizing information through mathematical correlations. The safety override circuits and electrical supply methods are in fact an improvement to the technology of Legionella control in electric water heaters, as they prevent Date Recue/Date Received 2021-09-03 external control signals from undermining Legionella control. Moreover, the safety override circuits and electrical supply methods are applied by using a particular machine, namely an electric water heater. As such, the safety override circuits and electrical supply methods are confined to electric water heater applications. Furthermore, the safety override circuits possess physical existence, and both the safety override circuits and the electrical supply methods manifest a discernible effect by selectively permitting or denying electrical power to an electric water heater. Hence, embodiments of the technology described herein have a "practical form".

[0056] Certain illustrative embodiments have been described by way of example.
It will be apparent to persons skilled in the art that a number of variations and modifications can be made without departing from the scope of the claims.

Date Recue/Date Received 2021-09-03

Claims (18)

WHAT IS CLAIMED IS:

1. A safety override circuit for controlling power supply to a water heater, comprising:
a current input for monitoring a current drawn by the water heater;
a control input for monitoring at least one external control signal supervising supply of electrical power to the water heater;
a timing element adapted for monitoring elapse of a predetermined prior time period;
the safety override circuit being connectable in electrical communication with a power supply and with the water heater;
the safety override circuit being configured to selectively permit the at least one control signal to deny electrical power to the water heater and to override the at least one control signal to provide electrical power to the water heater, wherein:
where the current drawn by the water heater has fallen to zero within the predetermined prior time period, the safety override circuit denies electrical power to the water heater in response to the at least one control signal; and otherwise the safety override circuit provides electrical power to the water heater despite the at least one control signal.

2. The safety override circuit of claim 1, wherein the timing element is a timer forming part of the safety override circuit.

3. The safety override circuit of claim 2, wherein the timer is a hardware timer.

4. The safety override circuit of claim 2, wherein the timer is a software timer.

5. The safety override circuit of claim 1, wherein the timing element is a timing input adapted to receive a timing signal from a timer that is external to the safety override circuit.

6. The safety override circuit of claim 1, wherein:
the safety override circuit comprises a microprocessor;
the current input, the control input and the timing element fonn part of the microprocessor;
the microprocessor executes program logic for:
using the timing element to measure lapse of the predetermined prior time period;
using the current input to determine whether the current drawn by the water heater has fallen to zero within the predetermined prior time period; and where the at least one control signal requests denial of electrical power to the water heater:
when the current drawn by the water heater has fallen to zero within the predetermined prior time period, denying electrical power to the water heater in response to the at least one control signal; and absent the current drawn by the water heater having fallen to zero within the predetermined prior time period, providing electrical power to the water heater despite the at least one control signal.

7. The safety override circuit of claim 1, wherein:
the safety override circuit is connectable in electrical communication with the power supply and with the water heater by a relay circuit configured for coupling the power supply to the water heater, wherein the relay circuit comprises:

a first switch interposed between a first terminal of the power supply and a first terminal of the water heater; and a second switch interposed between a second terminal of the power supply and a second terminal of the water heater;
wherein the switches are controlled by the microprocessor.

8. The safety override circuit of claim 7, wherein:
the first and second switches are single pole double throw relay switches whose coils are coupled to signal voltage through a switch control circuit in which the microprocessor is interposed; and the microprocessor is configured to selectively provide electrical power to the water heater and to selectively deny electrical power to the water heater by selectively grounding the coils to energize the coils and thereby actuate the switches.

9. The safety override circuit of claim 7, wherein:
the current input is coupled to a current transformer interposed between the power supply and the water heater, wherein the current transformer provides a signal representing current drawn by the water heater to the current input.

10. The safety override circuit of claim 6, wherein:
the microprocessor is a Wi-Fi enabled microprocessor including a Wi-Fi module;
and the control input is adapted to receive the at least one control signal from the Wi-Fi module.

11. A safety override circuit for controlling power supply to a water heater, wherein:
the safety override circuit is connectable in electrical communication with a power supply and with the water heater to selectively provide electrical power to the water heater and deny electrical power to the water heater;
the safety override circuit comprising:
a microprocessor, wherein the microprocessor comprises:
a current input for monitoring a current drawn by the water heater;
a control input;
a Wi-Fi module adapted to receive at least one external control signal supervising supply of electrical power to the water heater and direct the control signal to the control input; and a timing element adapted for monitoring elapse of a predetermined prior time period;
a relay circuit for coupling the power supply to the water heater, wherein the relay circuit comprises:
a first switch interposed between a first terminal of a power supply and a first terminal of the water heater; and a second switch interposed between a second terminal of the power supply and a second terminal of the water heater;
wherein the first and second switches are single pole double throw relay switches whose coils are coupled to signal voltage through a switch control circuit in which the microprocessor is interposed whereby the switches are controlled by the microprocessor; and a current transformer interposed between the power supply and the water heater, wherein the current transformer is coupled to the current input of the microprocessor to provide a signal representing current drawn by the water heater to the current input;
the microprocessor is configured to selectively provide electrical power to the water heater and to selectively deny electrical power to the water heater by selectively grounding the coils to energize the coils and thereby actuate the switches; and wherein the microprocessor executes program logic for:
using the timing element to measure lapse of the predetermined prior time period;
using the current input to determine whether the current drawn by the water heater has fallen to zero within the predetermined prior time period;
where the at least one control signal requests denial of electrical power to the water heater:
when the current drawn by the water heater has fallen to zero within the predetermined prior time period, controlling the switches to deny electrical power to the water heater in response to the at least one control signal; and absent the current drawn by the water heater having fallen to zero within the predetermined prior time period, controlling the switches to provide electrical power to the water heater despite the at least one control signal.

12. A safety override circuit for controlling supply of electrical power to a water heater, comprising:
a current input for monitoring a current drawn by the water heater;
a control input for monitoring at least one external control signal supervising supply of electrical power to the water heater;

a timing element adapted for monitoring elapse of a predetermined prior time period;
the safety override circuit being connectable in electrical communication with a power supply and with the water heater and adapted to selectively permit the at least one control signal to deny electrical power to the water heater and to override the at least one control signal to provide electrical power to the water heater, wherein:
where the current drawn by the water heater has fallen to zero within the predetermined prior time period, the safety override circuit permits the at least one control signal to deny electrical power to the water heater; and otherwise the safety override circuit overrides the at least one control signal and provides electrical power to the water heater.

13. A method of controlling supply of electrical power to a water heater, the method comprising:
monitoring a current drawn by the water heater;
monitoring at least one external control signal supervising supply of electrical power to the water heater;
determining whether the current drawn by the water heater has fallen to zero within a predetermined prior time period; and where the at least one control signal requests denial of electrical power to the water heater:
where the current drawn by the water heater has fallen to zero within the predetermined prior time period, denying electrical power to the water heater in response to the at least one control signal; and otherwise providing electrical power to the water heater despite the at least one control signal.

14. A method of controlling supply of electrical power to a water heater, the method comprising:
monitoring a current drawn by the water heater;
determining whether the current drawn by the water heater has fallen to zero within a predetermined prior time period;
responsive to determining that the current drawn by the water heater has fallen to zero within the predetermined prior time period, monitoring at least one external control signal supervising supply of electrical power to the water heater; and responsive to the at least one control signal requesting denial of electrical power to the water heater where the current drawn by the water heater has fallen to zero within the predetermined prior time period, denying electrical power to the water heater in response to the at least one control signal; and otherwise providing electrical power to the water heater despite the at least one control signal.

15. A method of controlling supply of electrical power to a water heater, the method comprising:
monitoring a current drawn by the water heater;
monitoring at least one external control signal supervising supply of electrical power to the water heater;
responsive to the at least one control signal requesting denial of electrical power to the water heater, determining whether the current drawn by the water heater has fallen to zero within a predetermined prior time period; and responsive to the at least one control signal requesting denial of electrical power to the water heater where the current drawn by the water heater has fallen to zero within the predetermined prior time period, denying electrical power to the water heater in response to the at least one control signal; and otherwise providing electrical power to the water heater despite the at least one control signal.

16. A method of controlling supply of electrical power to a water heater, the method comprising:
monitoring a current drawn by the water heater;
determining whether the current drawn by the water heater has fallen to zero within a predetermined prior time period;
responsive to determining that the current drawn by the water heater has fallen to zero within the predetermined prior time period, monitoring at least one external control signal supervising supply of electrical power to the water heater; and responsive to the at least one control signal requesting denial of electrical power to the water heater where the current drawn by the water heater has fallen to zero within the predetermined prior time period, permitting the at least one control signal to deny electrical power to the water heater in response to the at least one control signal; and otherwise overriding the at least one control signal and providing electrical power to the water heater despite the at least one control signal.

17. A method of controlling supply of electrical power to a water heater, the method comprising:
monitoring a current drawn by the water heater;

monitoring at least one external control signal supervising supply of electrical power to the water heater;
responsive to the at least one control signal requesting denial of electrical power to the water heater, determining whether the current drawn by the water heater has fallen to zero within a predetermined prior time period; and responsive to the at least one control signal requesting denial of electrical power to the water heater where the current drawn by the water heater has fallen to zero within the predetermined prior time period, permitting the at least one control signal to deny electrical power to the water heater in response to the at least one control signal; and otherwise overriding the at least one control signal and providing electrical power to the water heater despite the at least one control signal.

18. A method of controlling power supply to a water heater, the method comprising:
monitoring a current drawn by the water heater;
monitoring at least one control signal governing supply of electrical power to the water heater;
determining whether the current drawn by the water heater has fallen to zero within a predetermined prior time period; and where the at least one control signal requests denial of electrical power to the water heater:
where the current drawn by the water heater has fallen to zero within a predetermined prior time period, permitting the at least one control signal to deny electrical power to the water heater; and otherwise overriding the at least one control signal and providing electrical power to the water heater.