Your BMS probably already knows the calorifier is running at 60°C and the secondary return hasn’t dropped below 55. What it almost certainly doesn’t know is whether the shower in the far wing reaches temperature, or whether anyone has run the tap in room 312 this month. That gap — between what the plant room reports and where Legionella actually grows — is the whole question behind connecting the two.
A Building Management System is built to run plant: boilers, calorifiers, pumps, ventilation, sometimes a whole estate from one screen. Legionella control is built around outlets, tanks and the dead pipework in between. Where those two overlap, a BMS is a genuinely useful tool. Where they don’t, treating the BMS as your control system is how sites end up with a wall of green readings and a sentinel outlet nobody has checked in a year.
What the BMS sees, and where Legionella actually lives
Hot and cold water temperature is one of the central Legionella controls: keep stored hot water hot, keep cold water cold, and keep both moving [1]. Commonly cited guidance puts stored hot water around 60°C and cold water below roughly 20°C, with hot water delivered hot at the tap — but the figures that apply to your building come from its risk assessment and written scheme, not a generic table [2].
A BMS is good at the plant end of that. It can trend calorifier flow and return temperatures, watch the secondary return loop, alarm when a circulating pump fails, and hold months of data you would otherwise be reading off a clipboard. For the parts of the system it is wired to, it does continuous monitoring far better than a monthly walk-round ever will.
But Legionella risk does not concentrate in the plant room. It concentrates at the sentinel and far outlets, in the low-use shower, in the oversized cold tank sitting in a warm roof void, and in the dead leg behind a basin that was decommissioned three refurbishments ago. A BMS reading the calorifier at 60°C tells you the plant is hot. It tells you nothing about whether the top-floor shower reaches temperature within a minute, or whether that en-suite has been used since the last occupant left. The reach of the sensors is the reach of the evidence — no further.
Reading the dashboard honestly
The quickest way to misjudge a BMS is to trust the colour instead of the question behind it. Four assumptions catch facilities teams out:
| What teams assume | What’s actually true |
|---|---|
| The BMS runs the boilers, so it’s controlling Legionella | It controls and logs plant temperatures. Risk lives at outlets, tanks and dead legs the BMS usually isn’t wired to. Plant control is necessary, not sufficient |
| A green dashboard means we’re compliant | Green means readings sat inside their thresholds at the monitored points. Compliance is a documented, reviewed management system, not a colour |
| BMS temperature trends replace the Legionella logbook | Trend data is strong evidence, but L8-style records also need the task, the asset, who is responsible, and what happened when a reading went out of range [3] |
| Once sensors feed the BMS, we can drop manual monitoring | Sensors extend reach where they’re calibrated and well placed. They rarely reach every sentinel outlet, and an uncalibrated sensor gives confident, wrong numbers |
The thread through all four is the same. A BMS is an instrument, not a duty holder. It reports conditions at the points it is connected to. Everything past that — interpretation, action, and the records that prove both — is still a human job.
The mistake that undoes the whole integration
The common failure here is not technical. It is quietly letting the BMS become the control system instead of an input to it.
It plays out like this. Temperature monitoring gets pointed at the BMS, the manual sentinel checks fall away because “the system has it”, and a few months later an auditor asks to see the reading for the outlet that runs low. Nobody can, because the BMS was never wired to it. The trend data was real; it just described the wrong points.
The decision rule for any BMS integration is blunt: connect a point only if it improves a decision you actually have to make, and only if the out-of-range case has a named owner. A sensor on the secondary return is worth having when it is calibrated, located somewhere meaningful, reviewed by a competent person, and tied to an escalation route when it drifts. A dashboard that only displays numbers — no ownership, no thresholds tied to your written scheme, no record of what happened when a reading turned red — is decoration, not control.
Before you connect anything
You don’t need a procurement project to start. You need to lay your written control scheme next to your BMS points list and mark the overlaps and the gaps.
- List what the BMS already monitors that matters: calorifier flow and return, secondary return, cold tank temperature, pump status.
- List what your scheme requires that the BMS can’t see: sentinel outlets, far and low-use outlets, point-of-use delivery temperatures, flushing of intermittent outlets.
- For every BMS point you would rely on as evidence, confirm it is calibrated, sensibly located, and reviewed by a competent person — not merely logged.
- Decide what happens when a reading goes out of range: who is alerted, in what timeframe, and where that action is recorded.
That last point does more for real-world safety than any sensor. If the live question is narrower — whether to put loggers on outlets or keep reading them by hand — Wireless data loggers vs manual temperature readings works through that trade-off in detail.
One honest limit before you wire anything up: BMS trend data supports a competent risk assessment, it does not stand in for one. The temperatures, monitoring frequencies and remedial actions that apply to your building are set by that assessment and your written scheme, applied by a competent person — not by a sensor’s default thresholds or by anything on this page. Where you intend to rely on a BMS reading as compliance evidence, confirm what the assessment expects at that point and how an out-of-range result gets escalated and recorded.
FAQ
Does a BMS count as our Legionella monitoring record?
It can be part of it, but rarely all of it on its own. L8 expects records that show the precaution, the asset, the responsible person, the result, and what happened when something was out of range [3]. BMS trends cover the temperature evidence at wired points well, but you still need the surrounding management record — and separate evidence for the outlets and tanks the BMS does not reach.
Can BMS sensors replace manual sentinel outlet checks?
Usually not entirely. Sentinel outlets are chosen as representative points, and most sit at the far reach of the system where a BMS isn’t wired. Sensors can extend coverage where they are calibrated and well placed, but the monitoring regime — what is measured, where, and how often — follows your risk assessment, not the sensor estate you happen to have inherited [2].
If the BMS shows every temperature in range, do we still need sampling?
Temperature control and sampling answer different questions. In-range temperatures are evidence the control regime is working day to day; sampling for Legionella verifies or investigates conditions at a point in time. HSE guidance is clear that testing frequency follows the system and the risk assessment, not a dashboard colour [4].
Sources
[1] HSE, “Hot and cold water systems”. https://www.hse.gov.uk/legionnaires/hot-and-cold.htm [2] HSE, “Legionnaires’ disease: Technical guidance (HSG274)”. https://www.hse.gov.uk/pubns/books/hsg274.htm [3] HSE, “Legionnaires’ disease. The control of legionella bacteria in water systems - Approved Code of Practice and guidance (L8)”. https://www.hse.gov.uk/pubns/books/l8.htm [4] HSE, “Testing and monitoring your water system for legionella”. https://www.hse.gov.uk/legionnaires/testing-monitoring-water-system.htm