A continuous monitoring system will not kill a single Legionella cell. It does not heat water, flush a dead leg, or descale a shower rose. What it does — and the only thing that justifies the cost — is shorten the gap between a control measure slipping and someone who can act finding out. Judge any system on that gap, not on how the dashboard looks in the sales demo.

That reframing matters, because the technology is sold as reassurance and bought as proof, and it is neither. It is a faster smoke alarm for your water system. A faster alarm only saves you if it is wired to someone who comes running.

What “continuous” can and can’t measure

Start with an honest boundary. You cannot continuously count Legionella. There is no probe that gives a live colony count; culturing is a laboratory process that takes days, and sampling for it stays periodic and method-bound under BS 7592 [1]. So continuous monitoring almost always means continuous physical and chemical parameters — the conditions that let Legionella grow — not the organism itself.

In practice that is three things, in descending order of how well sensors handle them:

  • Temperature. The strongest case. A sensor on a sentinel outlet, on a calorifier flow and return, or in a cold-water tank can log a reading every few minutes, around the clock. This is where continuous monitoring genuinely beats the clipboard: it catches the calorifier that has been running a few degrees low for a fortnight, which a monthly manual check would miss eleven times out of twelve.
  • Flow and use. Sensors or smart valves can tell you whether an outlet actually ran. That turns “low-use outlet” from a guess into a record, and it can trigger or evidence automated flushing.
  • Disinfectant residual and similar chemistry. Where a system is chemically dosed, inline sensors can track residual, turbidity or pH. Useful, but more prone to drift and fouling than a temperature sensor, so treat those numbers with more suspicion.

Everything microbiological still goes to a suitably accredited (UKAS) laboratory on the schedule your risk assessment sets [1]. The sensor network watches the conditions; the lab confirms the outcome. Confusing the two is the first mistake people make.

The thing it actually changes: response time

Manual monitoring has a long, lumpy response loop. A temperature is taken on the first Tuesday of the month, written on a sheet, perhaps typed up a week later, perhaps reviewed at the next quarterly meeting. If a thermostatic mixing valve failed open the day after that check and dragged a hot return down into the growth range, the system could sit warm for the best part of a month before anyone knew.

Continuous monitoring collapses that loop. The same fault throws an out-of-range reading within minutes and, if the system is set up properly, an alarm to a named person the same day. The control measure is identical. What changes is the time the system spends in an unsafe state with nobody aware of it. That is the whole product. Proactive versus reactive monitoring makes the same point from the management side: the value sits in responding before a sample ever has to.

This is also why a continuous system with no escalation path is worse than a clipboard. The clipboard at least gets read. A dashboard nobody owns produces thousands of green ticks and a handful of unseen reds, and quietly builds a record that the organisation was told and did nothing — which is precisely the evidence you do not want surfacing in an investigation.

How a continuous system is actually wired

Picture the data path as a chain of five stages, and draw a box for each. The reason to sketch it is simple: the failure almost always hides in whichever box you forgot to fund.

  1. Sensing points. Sensors at chosen locations — sentinel outlets (nearest and furthest from each calorifier or tank), the calorifier flow and return, the cold tank, and any outlet the risk assessment flags. You will never instrument every tap, so this stage is a sampling decision, not a coverage guarantee.
  2. Local logger / gateway. A device on site that collects readings and timestamps them. It should store locally, so a network drop does not lose data.
  3. The link. How readings leave the building — often a cellular or low-power radio (LoRaWAN-type) connection, sometimes the site network. Note the dependency: if this drops silently, your “continuous” record quietly stops.
  4. The platform. Where readings are stored, trended and turned into alarms against rules — for example, hot below the delivery threshold for longer than a set period, or an outlet showing zero flow for a defined number of days.
  5. The response loop. The named recipient, the acknowledgement, the action taken, and the close-out written back to the record. This is the only stage that actually reduces risk, and the one most often left as an afterthought.

Draw those five boxes and write, under each, who owns it and what happens when it fails. Any box without an owner is your real vulnerability — not the bacteria, the management gap.

Where it earns its place, and where it doesn’t

Continuous monitoring pays off where risk is driven by conditions that drift slowly and silently: large or complex estates, hard-to-reach plant, healthcare and care settings where manual rounds are expensive, and sites with a lot of genuinely intermittent use. Remote temperature monitoring and smart-valve flushing can take real labour out of those buildings — the device-level detail is in smart thermometers and IoT.

It earns far less on a small, simple, fully occupied building where a competent person already walks the system every week. There, sensors add cost and data without changing the response time much, because the response time was already short.

And it never substitutes for what it cannot see. Sensors do not detect biofilm on a pipe wall, scale in a shower rose, or a dead leg three metres off the monitored branch. A monitored system is not a controlled system; it is a watched one. HSE guidance is consistent here — the method and frequency of monitoring follow the risk assessment, and automating a check does not retire the underlying control measure [2][3].

The failure modes nobody demos

  • Sensor drift. A probe reading 2°C high makes an unsafe calorifier look compliant. Calibration and periodic manual cross-checks are not optional extras; they are what makes the data defensible.
  • Alarm fatigue. Set thresholds too tight and the team learns to dismiss reds. Set them too loose and you miss the slow drift. Tuning is ongoing work, not a one-off install setting.
  • Coverage illusion. A wall of green covers only the points you instrumented. The unmonitored majority of outlets still need their place in the written scheme.
  • Silent dropout. A dead gateway shows no alarms because it shows nothing at all. The system needs a heartbeat check, so that “no data” itself raises a flag.

A note on what the data is and isn’t

Continuous readings are evidence, not a verdict, and they are only as trustworthy as the calibration behind them. Treat any threshold a vendor pre-loads as a starting point, not gospel: the temperatures, dwell times and flush frequencies that count are the ones in your written scheme, set through a competent, site-specific risk assessment for your building and your users. A green dashboard is no defence if the scheme behind it was never reviewed. This is general guidance, not a design specification for your system.

FAQ

Does continuous monitoring replace Legionella sampling?

No. Sensors track the conditions that allow growth — mainly temperature and flow — but they cannot count the bacteria. Microbiological sampling stays periodic and laboratory-based, on the schedule your risk assessment sets, and continuous data does not remove that requirement [1][2].

Can we cut our manual temperature checks if sensors cover those outlets?

Cautiously, and never to zero. You still need periodic manual readings to cross-check the sensors and catch drift, and your risk assessment — not the supplier — decides what coverage justifies a reduced manual frequency [2]. Treat the sensors as added assurance, not a licence to stop walking the system.

What happens, legally, if an alarm is logged and then ignored?

That is the worst case. A continuous system creates a timestamped record that you were informed; an unactioned red shows you knew and did nothing. The duty to act on monitoring evidence sits with the duty holder, however the reading was captured [3]. Wire alarms to a person with the authority and time to respond before you switch them on.

Sources

[1] BSI, “BS 7592:2022 - Sampling for Legionella bacteria in water systems. Code of practice”. https://knowledge.bsigroup.com/products/bs-7592-sampling-for-i-legionella-i-bacteria-in-water-systems-code-of-practice-1 [2] HSE, “Legionnaires’ disease: Technical guidance (HSG274)”. https://www.hse.gov.uk/pubns/books/hsg274.htm [3] HSE, “Legionnaires’ disease - what you must do”. https://www.hse.gov.uk/legionnaires/what-you-must-do/index.htm