Set the calorifier to 60 degrees C and you have controlled one number: the storage temperature. You have not yet controlled the building. The temperature that reaches a shower, a kitchen tap or a wash hand basin is decided much earlier - in how the pipework is routed, how long the runs are, where the return loop closes, and how much water sits unused between the riser and the outlet.
That is the whole point of designing for temperature control. You are not choosing a setpoint; you are building a system that keeps hot water hot and cold water cold at the point of use, every day, without anyone having to fight the layout to do it. Get the geometry right and the readings look after themselves. Get it wrong and no amount of monitoring will make a tepid far outlet behave.
What the design is actually trying to achieve
HSE sets out the familiar hot-and-cold benchmark: keep cold water below 20 degrees C where practical, store hot water at around 60 degrees C, and distribute it so it reaches roughly 50 degrees C at the outlet within about a minute (55 degrees C in healthcare premises) [1]. Those numbers are the target. The design is the means.
The reason temperature works as a control is that Legionella multiplies in roughly the 20 to 45 degrees C band and is held back below and killed above it [2]. So a good plumbing design has one structural job: keep as little water as possible sitting in that band for as long as possible. Everything below is a way of doing that.
Hot water: store hot, then deliver hot. Storing at 60 degrees C is easy. The hard part is delivering near 50 to a tap at the end of a long run before the water has cooled into the growth zone on the way. In anything larger than a small house, that means a secondary return loop - a circulating pump that keeps hot water moving in a ring so every branch tees off water that is already hot, not water that has been standing in a spur cooling down. A return loop that is poorly balanced, or fitted with an undersized pump, leaves the far side of the building tepid while the plant room reads perfect.
Dead legs: design them out, do not manage them later. A branch teed off the loop and run too far to an outlet is a dead leg - a length of pipe holding warm, still water that only moves when someone opens the tap. HSE highlights infrequently used outlets and lengths of dead pipework as classic risk features [3]. The cure is geometric, not procedural: keep the run from the live loop to each outlet as short as practical, and cap any redundant branch back at the main rather than leaving a blind stub. Pulling a redundant pipe once beats flushing it for the next decade.
Cold water: it does not look after itself. “Cold” drifts. Cold pipes share warm risers and pass through plant rooms and roof voids that sit well above 20 degrees C in summer, so without segregation, insulation and ventilation the cold side warms into the same band you are fighting on the hot side. Storage matters too: an oversized tank in a warm loft turns over slowly and warms through, which is why sizing should track real daily demand rather than a generous “just in case” figure.
TMVs: a scald control, not a temperature control. A thermostatic mixing valve blends hot and cold down to a safe-to-touch temperature at outlets where scalding is a concern. That blended water sits below the kill threshold by design, so the pipe between the valve and the outlet is a small pocket of growth-zone water. The design answer is placement: fit the TMV as close to the outlet as practical, so the warm blended section is as short as possible, and avoid serving a long run of basins from one remote group mixer.
Myths that get designed into buildings
The expensive mistakes are not usually bad plumbing. They are reasonable-sounding assumptions baked into the design before anyone runs a thermometer.
| The assumption | What actually happens |
|---|---|
| Storing hot water at 60 degrees C means every tap is safe | Storage controls the cylinder, not the run. Heat is lost along the pipe, so a far or low-use outlet can sit in the growth band even with a properly hot calorifier |
| Bigger tanks and wider pipes add resilience | Oversized storage and pipework slow turnover, so water stands longer and warms toward the danger zone. Capacity should match real demand, not a worst-case guess |
| A TMV keeps the outlet at a safe temperature | A TMV blends water down to prevent scalding, creating a short length of warm water below the kill threshold. Useful for scald safety, a hazard if that length is long |
| The cold side is fine as long as it is cold at the tank | Cold pipes warm up in risers, plant rooms and roof voids next to hot services. Without segregation and insulation, delivered “cold” can creep past 20 degrees C |
| Monitoring can be added once it is built | If sentinel outlets, test points and flushing access are not in the design, you end up unable to prove control on the system you have just paid to install |
The one thing that quietly wrecks a good design
Oversizing. It feels prudent to specify a larger cylinder, fatter pipes and a generous tank so the building “never runs short”, but in Legionella terms it is the opposite, because every extra litre of capacity is more water sitting still and drifting into the growth band. The same trap closes in from another direction as water-efficiency targets push flow rates down: lower draw-off means slower turnover, so a system sized for yesterday’s demand can stagnate under today’s fittings. If you are specifying spray taps or low-flow showers, size storage and pipework for the flow you will actually use. on low-flow fixtures digs into how that turnover problem shows up at the outlet.
The second quiet wrecker is designing a system nobody can check. Optimal control is only optimal if it is verifiable, so the layout needs designed-in sentinel outlets - typically the nearest and furthest points on each loop - plus accessible test points and a way to flush low-use branches without acrobatics. A system you cannot measure or flush is not controlled; it is hoped about.
Before you sign anything off
Walk the proposed layout - on paper or on site - and ask one question at the hardest point in it: at the furthest and least-used outlet on each loop, what temperature will the water be after a minute, and how will anyone ever measure it? If the honest answer involves a long spur off the return, a remote TMV serving a row of basins, a cold run baking in a riser, or an outlet no one can reach to test, that is a change to make now, while it is lines on a drawing rather than pipework in a wall. Mark those points up, hand them to the designer with the temperature target attached, and make “demonstrably reaches temperature and can be monitored” a condition of acceptance, not a problem you inherit on handover.
Common questions
Can good plumbing design remove the need for temperature monitoring?
No. Good design makes the right temperatures achievable and measurable, which is a real advantage, but it does not replace the duty to monitor and review. UK control still runs on a site-specific risk assessment, a written scheme and routine evidence under L8 and the supporting technical guidance in HSG274 [2][4]. Design lowers the effort and the risk; it does not switch off the management chain.
Where should a TMV go in the layout?
As close to the outlet it serves as practical. The blended water downstream of a mixing valve sits in the growth band by design, so the shorter that section, the smaller the risk. Serving several basins from one remote group mixer creates a long stretch of warm, low-flow pipe - usually a worse outcome than point-of-use valves at each fitting.
Does specifying larger pipes and tanks future-proof the building?
Rarely, for water safety. Extra capacity means more standing water and slower turnover, which pushes temperatures toward the 20 to 45 degrees C band rather than away from it. Size storage and distribution against realistic daily demand and the flow rates of the fittings you are actually installing - and revisit the sizing if usage or occupancy changes.
A note on scope
This is background to help you brief and challenge a design, not a substitute for it. Plumbing layout, sizing and materials must be set by a competent designer working to current water regulations, building standards and your Legionella risk assessment. The temperature figures here are common HSE benchmarks; the values that bind your particular system, and how often they are checked, come from that site-specific assessment and the design that delivers them.
Sources
[1] HSE, “Hot and cold water systems”. https://www.hse.gov.uk/legionnaires/hot-and-cold.htm [2] HSE, “Legionnaires’ disease. The control of legionella bacteria in water systems - Approved Code of Practice and guidance (L8)”. https://www.hse.gov.uk/pubns/books/l8.htm [3] HSE, “Systems most likely to create legionella risk”. https://www.hse.gov.uk/legionnaires/risk-systems.htm [4] HSE, “Legionnaires’ disease: Technical guidance (HSG274)”. https://www.hse.gov.uk/pubns/books/hsg274.htm