Why a reptile thermostat can fail with
the heater stuck on.
It is the failure that empties a rack overnight, and the one your controller is least likely to tell you about. Here is the mechanism, how to check your own setup, and what actually protects against it.
A thermostat that fails with the heater permanently on has usually suffered relay fusion. The mechanical relay that switches the heater has welded its own contacts together, so current keeps flowing whether the controller commands it or not. The controller has no way to detect this — it sends the "off" signal, assumes the heater is off, and carries on displaying a setpoint it is no longer enforcing. The enclosure climbs until something else intervenes, and on most thermostats nothing else does.
What relay fusion actually is
A mechanical relay is a switch thrown by an electromagnet. When the coil energises, a moving contact slams against a fixed one and current flows to your heater. When the coil releases, a spring pulls them apart.
Two things happen at that contact, thousands of times over the life of a thermostat:
On closing, the contacts bounce — they make, separate microscopically, and make again within a few milliseconds. Each bounce draws a small arc. With a cold filament bulb the current in that first instant is far higher than the steady running current, because a cold tungsten filament has a fraction of the resistance it will have once hot. That inrush is exactly when the contacts are bouncing.
On opening, the current does not stop cleanly. It sustains a brief arc across the widening gap, and that arc is hot enough to melt contact material.
Every cycle erodes and redeposits a little metal. Most of the time it simply wears. Occasionally, two surfaces that are molten at the same instant cool while touching — and they weld. The relay is now a piece of wire. The coil can click all it likes.
Why it fails on rather than off
This is the part that matters for your animals. A welded contact fails closed — stuck delivering power. There is no corresponding failure mode that leaves a heater permanently off; a relay that stops working mechanically simply stops heating, and you find out when the enclosure goes cold and the animal is uncomfortable but alive. Fusion fails in the dangerous direction, and it fails silently.
Why the controller does not notice
Almost every thermostat on the market, at any price, commands its output open-loop. The microcontroller decides "heat off", drives the relay coil low, and updates its internal state to off. Nothing reads the contact back. There is no sensor on the output telling the processor whether current is actually flowing.
So the display stays plausible. The log stays plausible. If the probe is on the cool side or in open air, the reading can stay in range for a long time while the hot spot climbs well past anything survivable. By the time the probe itself registers the problem, the damage is usually done.
This is why "it showed 31 °C the whole time" is such a common sentence after a loss. The thermostat was not lying. It genuinely did not know.
What makes it more likely
- High inrush loads. Halogen and incandescent basking bulbs draw a large surge on every switch-on. Ceramic heat emitters and heat mats are gentler, being closer to purely resistive.
- Running near the relay's rating. A relay rated 10 A switching an 8 A load has almost no margin. Contact life falls sharply as you approach the rating.
- Frequent cycling. Contact wear is cumulative. A simple on/off thermostat with tight hysteresis can cycle every couple of minutes — that is hundreds of thousands of operations a year.
- Age. This is a wear-out failure, not a manufacturing defect. A relay that has worked faultlessly for four years is closer to failing than a new one, not further from it.
How to check your own setup
You can test any thermostat for this in about a minute, and it is worth doing on every unit you own:
- Set the target well below the current temperature. The thermostat should command the heater off. You should hear a click on a relay unit.
- Check the heater actually stopped. Not the display — the heater. A plug-in power meter is the clearest answer; a bulb visibly going out is good; the element cooling by hand after a few minutes is acceptable.
- If power is still flowing with the output commanded off, stop using that unit. It is not a glitch and it will not improve.
Do this seasonally. It takes longer to read this paragraph than to run the test.
What actually protects against it
You cannot prevent relay fusion by buying a better relay. You can only make it survivable, and every one of these applies whatever brand you run:
- Put something independent downstream of the thermostat. A second thermostat or a mechanical high-limit stat wired in series, set a few degrees above your target, costs little and fails independently. If the first one welds, the second still opens.
- Derate. Keep the load comfortably under the relay's rating rather than close to it.
- Prefer solid-state switching for heaters. Triac and SSR outputs have no mechanical contacts to weld. They have their own failure modes, but not this one.
- Make sure you find out. Every protection above is worth more if something tells you it fired. A thermostat that cannot reach you is a thermostat you will debug after the fact.
- Place the probe where it reports the danger. A probe reading ambient air will not see a basking spot running away. This one deserves its own guide.
How the Ectoscale 6 handles it
We designed around the assumption that any single switching element will eventually fail closed.
The heating channels do not switch through a mechanical relay at all — they are driven by triac circuits under pulse-proportional control, so there are no contacts in the heating path to weld, and no mechanical wear accumulating with every cycle. Behind that sits an independent master safety relay that cuts power upstream of the outputs, and wired in series with its coil is a physical thermal cut-off that needs no firmware, no network and no working processor to do its job. Heating itself runs on its own watchdog-supervised CPU core, isolated from the network stack, so a hung cloud connection cannot stall the control loop. If anything does trip, a Telegram message reaches you with retry and back-off, rather than waiting for you to walk into the room.
None of that makes failure impossible. It means several independent things have to fail in the same window before heat reaches your animal — which is the only honest claim any thermostat manufacturer can make.
Built around the failure, not around the spec sheet
Five independent climate zones, pulse-proportional heating, hardware failsafes that work with the power and the internet down.