Bulb thermostat for the safety of a heating appliance, in particular electrical storage water heater, comprising: - means (1, 4, 5, 6, 8) for the standard safety, comprising: - thermo-sensitive elements adapted to sense the temperature of a fluid to be controlled, consisting of a membrane expansible according to the temperature sensed by a bulb and transmitted therefrom to said membrane from a capillary, - return means (4, 5, 6, 8) activated by the expansion of said membrane in case of overtemperature and adapted to open permanently the electrical contacts (8.1, 8.2) supplying the heating elements, said return means (4, 5, 6, 8) consisting of a kinematic chain comprising: - a spring compressed by said membrane, operating on an inert disk of bistable material in order to vary snap-wise the concavity thereof, - an actuating stem activated by said inert disk, which acts on an underlying arm in order to open said electrical contacts (8.1, 8.2), characterised in that it further comprises means (2, 3, 7) for the positive safety, adapted to open permanently and irreversibly said electrical contacts (8.1, 8.2) even in case of breakage of said thermo-sensitive elements that causes the inability to expand by said membrane and the consequent impossibility of activation of the standard safety, said membrane being filled with expansible liquid vacuum inserted at low temperature, such that it is already partially expanded at room temperature, the loss of said pre-expansion of said membrane activating said means for the positive safety (2, 3, 7) that comprise: - a rocker located underneath the membrane, comprising an arm (2.2) placing underneath said membrane and an opposed arm (2.1) extending beyond an oscillation fulcrum (2.0), - an elastic element associated to said rocker, located underneath said arm (2.2) and adapted to keep it continuously in contact with said pre-expanded membrane, by operating in contrast with the movement of such membrane caused by the expansion or contraction thereof, - an actuating stem, positioned vertically and capable of sliding longitudinally, actuated by said opposed arm (2.1) of said rocker in case of breakage of said thermo-sensitive elements that cause the loss of the pre-expansion of said membrane, causing the rise of said arm (2.2) and the consequent lowering of said opposed arm (2.1), the lower end (7.1) of said actuating stem acting on the underlying arm in order to open said electrical contacts (8.1, 8.2) permanently and irreversibly. - means (1, 4, 5, 6, 8) for the standard safety, comprising: - thermo-sensitive elements adapted to sense the temperature of a fluid to be controlled, consisting of a membrane expansible according to the temperature sensed by a bulb and transmitted therefrom to said membrane from a capillary, - return means (4, 5, 6, 8) activated by the expansion of said membrane in case of overtemperature and adapted to open permanently the electrical contacts (8.1, 8.2) supplying the heating elements, said return means (4, 5, 6, 8) consisting of a kinematic chain comprising: - a spring compressed by said membrane, operating on an inert disk of bistable material in order to vary snap-wise the concavity thereof, - an actuating stem activated by said inert disk, which acts on an underlying arm in order to open said electrical contacts (8.1, 8.2), - thermo-sensitive elements adapted to sense the temperature of a fluid to be controlled, consisting of a membrane expansible according to the temperature sensed by a bulb and transmitted therefrom to said membrane from a capillary, - return means (4, 5, 6, 8) activated by the expansion of said membrane in case of overtemperature and adapted to open permanently the electrical contacts (8.1, 8.2) supplying the heating elements, said return means (4, 5, 6, 8) consisting of a kinematic chain comprising: - a spring compressed by said membrane, operating on an inert disk of bistable material in order to vary snap-wise the concavity thereof, - an actuating stem activated by said inert disk, which acts on an underlying arm in order to open said electrical contacts (8.1, 8.2), - a spring compressed by said membrane, operating on an inert disk of bistable material in order to vary snap-wise the concavity thereof, - an actuating stem activated by said inert disk, which acts on an underlying arm in order to open said electrical contacts (8.1, 8.2), - a rocker located underneath the membrane, comprising an arm (2.2) placing underneath said membrane and an opposed arm (2.1) extending beyond an oscillation fulcrum (2.0), - an elastic element associated to said rocker, located underneath said arm (2.2) and adapted to keep it continuously in contact with said pre-expanded membrane, by operating in contrast with the movement of such membrane caused by the expansion or contraction thereof, - an actuating stem, positioned vertically and capable of sliding longitudinally, actuated by said opposed arm (2.1) of said rocker in case of breakage of said thermo-sensitive elements that cause the loss of the pre-expansion of said membrane, causing the rise of said arm (2.2) and the consequent lowering of said opposed arm (2.1), the lower end (7.1) of said actuating stem acting on the underlying arm in order to open said electrical contacts (8.1, 8.2) permanently and irreversibly.