A tower is not a house with extra floors stacked on top. By the time water reaches the twentieth storey it has passed through more tanks, more pumps and a great deal more pipework than anything in a low-rise building, and every one of those additions is somewhere warm water can sit still. The control measures themselves barely change. The map does. And the map is where high-rise Legionella control usually comes unstuck.

That is the pattern behind most failures in tall buildings. Not a wrong temperature or a single missed flush, but a water system that turns out to be bigger and more fragmented than the risk assessment ever described. Below are the mistakes that keep recurring across towers, what each looks like on a real site, why it happens, and the fix.

The mistakes that catch out tall buildings

Treating the building as one system instead of a stack of zones

The tell is a risk assessment that talks about “the cold water storage tank” and “the calorifier” in the singular. A high-rise almost never works that way. Mains pressure will not push water cleanly to the top of a tall building, so the supply gets carved into pressure zones: typically a roof tank feeding the upper floors by gravity, with break tanks and booster sets serving the middle and lower zones. Each zone is, in effect, its own little water system, with its own storage, its own dead legs and its own temperature behaviour.

When you assess the tower as one thing, the lower zone’s stored water and the upper zone’s long gravity runs get averaged into a picture that matches neither. HSE’s guidance on the systems most likely to create risk puts stored water and complex pipework near the top of the list precisely because they are easy to under-map [1][2]. The fix is to draw the zones before you do anything else and assess each as a system in its own right.

Forgetting the break tanks and transfer vessels

The roof tank gets its annual inspection. The incoming main gets a temperature check. The booster break tank in the basement plant room never makes it onto the schedule at all. It is buried, it is not “the” storage tank in anyone’s mental model, and it often predates the current managing agent by a couple of refurbishments.

A break tank or transfer vessel sitting in a warm plant room, rarely turned over, is close to a textbook growth environment. Every vessel that holds water belongs on the asset register with its own inspection, temperature and cleaning regime: break tanks, transfer tanks, header tanks, and any priming or feed tank that holds a standing volume. If it stores water, it counts.

Ignoring solar gain on the roof

Cold water that tests comfortably cold in February can drift well up into the growth range across a July afternoon. Roof-level cold tanks, and the top runs of riser exposed to hot plant spaces, warm in summer in a way ground-floor storage does not. The whole point of cold-side control is keeping the water below the temperature at which Legionella proliferates, commonly cited as below about 20C [4], and a poorly insulated roof tank quietly defeats that for months at a time.

A single annual visit in spring will never see this. Check tank insulation and the fit of the lid, and monitor the worst-case roof tank through the warm months rather than assuming one winter reading represents the year.

Letting hot water lose the fight on the way up the riser

Water leaves the calorifier hot and arrives at the top-floor outlet merely warm. The longer the riser and the longer the return loop, the more heat bleeds away, and a tall, poorly balanced return drops temperature at exactly the floors furthest from the plant. Hot water is meant to be stored hot and still arrive hot at the outlet, with figures commonly cited as around 60C stored and roughly 50C delivered [3][4]; if you only ever measure near the plant room, you will never see the floors where it has fallen into the tepid zone.

Balance the return so each riser actually circulates, lag the pipework properly, and measure delivery temperature at the index outlet, the highest and furthest tap on the loop, not the convenient one by the boiler.

Choosing sentinel outlets for convenience, not for the extremes

Sentinels picked because they are easy to reach, like the cleaner’s tap on level two, tell you about level two and nothing else. In a zoned tower the readings that matter are the genuine near and far points of each loop, and those tend to be the awkward ones: the top of a riser, the foot of a rarely-used branch, the last flat on a corridor.

HSG274 frames sentinel monitoring around the nearest and furthest outlets on each loop so the data brackets the real range [2]. In a high-rise that means a sentinel set per zone, even when it forces an access conversation. Easy sentinels produce reassuring numbers that describe the wrong part of the building.

Losing track of who owns which pipe

Communal risers sit with the freeholder or managing agent; the outlets inside each leased flat get filed under “the leaseholder’s problem”; and so the spare bathroom in a sublet flat never gets flushed by anyone. Split ownership is one of the defining headaches of residential towers, and the boundary is usually nobody’s job to write down.

Landlords and freeholders still carry duties for the systems they control, and the demarcation between communal and demised pipework needs to be explicit, not assumed [5]. Draw the responsibility boundary on the schematic, tell occupiers in plain language what running their taps actually achieves, and make sure void or vacant units fall to the managing party rather than into the gap. Stagnation in an empty flat behaves exactly like stagnation anywhere else, as neglected systems tend to demonstrate; the residential responsibilities themselves are unpicked in more detail under rental properties.

Forgetting the empty flat and the untenanted floor

Occupancy in tall buildings swings hard. A whole commercial floor sits between tenants; a flat is held empty for sale; live but unused outlets keep branching off a shared riser the whole time. None of that announces itself to the water-safety regime, so the dead legs accumulate silently and a positive result reappears at the same riser month after month.

Tie flushing of void units into the lettings and voids process so an empty unit triggers a flushing task automatically. If positive results keep coming back at the same point despite remedial work, the cause is often a stagnant branch you have not mapped rather than a failed disinfection, a trap worth understanding before you re-treat blind, covered under failed remedial close-out.

If you fix one thing first

Fix the map. A verified, zone-by-zone schematic, showing every tank and pump, every riser, and the ownership boundary, is the single most useful thing you can do in a tall building, because almost every other decision is downstream of it. Sentinel choice, flushing scope, temperature monitoring and remedial targeting all depend on knowing what is actually there. Walk the system against the drawings, mark up what has changed since the last refurbishment, and only then set the regime. A risk assessment built on an out-of-date schematic is confident about a building that no longer exists.

A note on the numbers

None of the figures above substitutes for a survey of your actual building. Towers vary enormously: a 1970s residential block, a new build-to-rent scheme and a refurbished commercial HQ share almost nothing beyond height. Treat the temperatures here as orientation, not as settings to copy, and let a competent, site-specific risk assessment fix the storage temperatures, flushing scope, sentinel positions and monitoring intervals for your zones, risers and the people actually exposed. Where you need precise limits, take them from current HSE guidance applied to your system, not from a generic figure online.

FAQ

Do roof-level cold water tanks really need different attention from ground-level storage?

In practice, yes. A roof tank is exposed to solar gain and often to warm plant spaces, so it can drift into the growth range in summer while ground-floor storage stays cold. Insulation, a well-fitting lid and warm-season temperature checks matter more here than anywhere else in the building, and a single spring reading will not catch the July problem.

Who is responsible for Legionella inside a leased flat in a residential tower?

It depends on where the demarcation sits between communal and demised pipework, but the freeholder or managing agent retains duties for the systems they control, including the risers and any communal storage feeding the flats. The cleanest approach is to draw the boundary explicitly on the schematic and make sure void and vacant flats are flushed by the managing party rather than left to an absent occupier.

How do we choose sentinel taps when the building has several pressure zones?

Per zone, not per building. Pick the nearest and furthest outlet on each loop or zone so your readings bracket the real temperature range, even when the genuine extremes are awkward to reach. Convenient sentinels on a single floor describe that floor and mislead you about the rest of the tower.

Sources

[1] HSE, “Systems most likely to create legionella risk”. https://www.hse.gov.uk/legionnaires/risk-systems.htm [2] HSE, “Legionnaires’ disease: Technical guidance (HSG274)”. https://www.hse.gov.uk/pubns/books/hsg274.htm [3] HSE, “Legionnaires’ disease. The control of legionella bacteria in water systems - Approved Code of Practice and guidance (L8)”. https://www.hse.gov.uk/pubns/books/l8.htm [4] HSE, “Hot and cold water systems”. https://www.hse.gov.uk/legionnaires/hot-and-cold.htm [5] HSE, “Legionella and landlords’ responsibilities”. https://www.hse.gov.uk/legionnaires/legionella-landlords-responsibilities.htm