A building management system that shows every water temperature in green tells you one thing for certain: its sensors are happy. Whether your water system is actually holding control is a separate question, and the gap between the two is exactly where Legionella risk hides.

If you run a maintenance team or a contract across several sites, the appeal of a BMS is obvious. Continuous logging, no clipboard, an alarm before a calorifier drifts cold. All real, and all worth having. But a BMS only ever reports the points it is wired to, and those points are rarely the ones that decide your risk.

Where the sensors actually sit

On most installations the BMS reads a familiar handful of points: the calorifier or cylinder storage temperature, the hot flow and the secondary return, and, if you are lucky, a sensor in the cold water storage tank. These are plant-room measurements. They tell you the system is generating and circulating hot water at temperature, and that is genuinely useful.

The HSE benchmark those readings get judged against is well established: cold water kept below 20°C where practicable, hot water stored at 60°C or above, and hot water reaching roughly 50°C at the outlet within a minute, or 55°C in healthcare premises [1]. A BMS is good at the storage and circulation half of that. It is poor at the outlet half, because almost nobody fits a permanent sensor at every sentinel and little-used tap.

So the honest mental model is this. The BMS watches the loop; the risk lives at the leaves. A secondary return limping back at 48°C, a roof tank warming through a July plant room, a blended dead leg behind a rarely-used shower — these are precisely the conditions a plant-room dashboard can miss while reporting all green.

What continuous data is good at, and what it isn’t

The strength of automation is trend, not snapshot. A monthly handheld check catches the storage temperature on the one day someone walks the plant room. A BMS catches the slow slide: the calorifier that loses a degree a week as a coil scales up, the return that sags every night when a setback pump throttles back. Spotting that drift early is the best single argument for the technology.

The weakness is that a number on a screen carries an authority it has not earned. Three failure modes recur on the sites I have reviewed.

A sensor reads where it is clamped, not where people draw water. A flow sensor at the calorifier says nothing about the far riser three floors up.

Sensors drift. Immersion and contact probes wander over months, and the BMS will report a drifted value with total confidence. Without a periodic check against a calibrated handheld, the log can be precisely, reassuringly wrong.

The BMS often controls the very thing it measures. Night setbacks, secondary-pump optimisation, and energy or decarbonisation upgrades all move temperatures around. Devices that sit closer to the point of use, such as smart valves and instrumented mixing arrangements, can narrow the gap between what is measured and what is delivered, though they bring their own monitoring overhead — see Smart valves and devices for temperature management.

What the dashboard won’t tell you

A few things rarely make it into the BMS pitch, and they are the ones that decide whether the system earns its place in your control regime:

  • A green screen is a statement about sensors, not about safety. Continuous monitoring of the wrong points is just a faster way to be confident and exposed at the same time.
  • The BMS log is not, by itself, your compliance record. It becomes evidence only when its points map onto your written scheme, its alarm thresholds come from the risk assessment rather than the installer’s defaults, and a named person owns what happens when an alarm fires. Data without a response process is noise with a timestamp.
  • Automation changes the failure you should fear. Manual monitoring fails loudly: a missed check is an obvious blank in the logbook. Automated monitoring fails quietly — a frozen trend, a stuck sensor, an alarm routed to an inbox nobody reads. The question stops being “did we take the reading?” and becomes “would we notice if the readings stopped meaning anything?”
  • Energy optimisation and Legionella control share the same valves and setpoints. The person tuning the BMS for carbon and the person responsible for water safety are often not the same person, and sometimes not even in the same meeting. That handover is where control regimes get quietly lost.

Making the BMS data count as evidence

If you want the automation to do real compliance work rather than just decorate a screen, three things have to be true.

First, the monitored points have to represent the system. Decide with a competent person which plant and sentinel points genuinely characterise your water, and make sure the BMS watches those, not just whatever the HVAC installer happened to wire in during commissioning.

Second, alarm thresholds and escalation come from the risk assessment, not the factory default. A storage low-temperature alarm set at 55°C reflects a different control philosophy from one set at 60°C; your assessment, not the screen, decides which is right for the building.

Third, exceptions need an owner and a paper trail. Record the decision, not just the reading. “Secondary return alarmed at 47°C on the east riser; pump checked, strainer cleared, return restored to 52°C, retested next day, action closed.” That one sentence is worth more than a year of green dashboards.

Where automation stops and a person starts

A BMS does not retire your sentinel outlet checks, your TMV servicing, or your inspections of the cold-tank surface and the little-used outlets that no sensor watches. It also does not calibrate itself, so build in a periodic comparison of BMS readings against a calibrated handheld at a known point to keep the log trustworthy. And it is largely blind to a building that empties out — voids and seasonal closures change water turnover faster than any setback algorithm and need their own plan, covered in Managing water temperatures during building downtime. Treat the system as a very attentive assistant that never leaves the plant room, and remember the risk does.

A note on what this can and can’t decide

This is general guidance, not a control scheme for your building. Sensor placement, alarm setpoints, monitoring frequency and the right response to an exception all depend on your system, who uses it, and the risk assessment a competent person sets and reviews. A BMS can strengthen monitoring and verification, but HSE is clear that the regime — including how, where and how often temperatures are checked — follows the risk assessment for the specific system rather than the capabilities of the kit you happen to own [2].

FAQ

Can BMS temperature logs replace manual monitoring for Legionella?

Not wholesale. They can take over some routine plant-room readings and add trend data no clipboard could match, but sentinel outlet checks, TMV-served and little-used outlets, and periodic sensor calibration sit outside what a typical BMS measures. Your risk assessment decides what the automation can legitimately stand in for [2].

What temperatures should the BMS be alarming on?

Set them from your risk assessment, anchored to the established benchmarks: broadly, cold storage staying below 20°C and hot storage at or above 60°C, with distribution warm enough to reach around 50°C at the outlet [1]. Confirm the exact setpoints for your system with a competent person rather than accepting installer defaults.

Does an energy or heat-pump upgrade affect Legionella control through the BMS?

It can. Lowering storage temperatures or adding setbacks to save energy changes the very conditions your control regime depends on. Any change to BMS control strategy that touches water temperature should trigger a review of the risk assessment before it goes live.

Sources

[1] HSE, “Hot and cold water systems”. https://www.hse.gov.uk/legionnaires/hot-and-cold.htm [2] HSE, “Legionnaires’ disease: Technical guidance (HSG274)”. https://www.hse.gov.uk/pubns/books/hsg274.htm