Legionella control and the law

Legionella bacteria live naturally in water and soil at low levels. In a cooling tower, given warm water, stagnant zones, biofilm and sediment, they can multiply to high numbers, and the tower’s drift, the fine droplets it releases with its exhaust air, can carry them into the air people breathe. Inhaling contaminated aerosol can cause Legionnaires’ disease, a serious form of pneumonia that can be fatal, particularly for older people and those with weakened health. Outbreaks linked to cooling towers have occurred in Australia and worldwide, and every Australian state and territory regulates cooling towers to prevent them.

This chapter explains the conditions that let Legionella grow in a tower and spread from it, sets out the risk management approach the regulations require, describes the New South Wales framework as a worked example, and covers the most dangerous moments in a tower’s life: start-up after a shutdown. It is educational: the requirements that apply to a real tower are those of its jurisdiction, and the work they require must be done by the qualified people the law specifies. The running case finds that CT-250 was restarted after a three-week summer shutdown by simply switching on its pumps and fans, without the start-up procedure its risk management plan required.

How Legionella grows and spreads

Several conditions together raise the risk in a tower.

• Warm water: tower water spends much of its time at temperatures in which Legionella can multiply.
• Stagnation: water standing in basins, dead legs, idle cells and pipework allows growth and biofilm formation, and lets biocides decay.
• Biofilm and sediment: they shelter bacteria from biocides and provide nutrients; amoebae living in biofilm can harbour Legionella.
• Nutrients: dust, debris, organic matter and corrosion products feed microbial growth.
• Aerosol: drift carries droplets from the tower; damaged eliminators, high water loading or wind increase it.
• People nearby: air intakes, windows, walkways and public spaces downwind of the tower turn aerosol into exposure.

A tower can be managed so that each of these is controlled, which is what the regulations require, and no single control is enough on its own: biocide without cleaning, or cleaning without good drift eliminators, leaves part of the chain intact.

The risk management approach

The common thread of Australian regulation is risk management: identify the hazards in the particular tower, put controls in place, monitor that they work, act when they do not, and review the whole at set intervals. The core document is the tower’s risk management plan.

Figure 1The cycle of a cooling tower's risk management plan

1. 1Risk assessmentThe tower's hazards: design, stagnation, water quality, drift, nearby people
2. 2ControlsWater treatment, cleaning, design changes, drift eliminators, operating procedures
3. 3MonitoringInspections, chemical analysis, microbial testing, records
4. 4Corrective actionsPredefined responses to out-of-range results, including notification where required
5. 5ReviewAt set intervals and after any change or incident, by the people the law requires

The New South Wales framework, as an example

In New South Wales, the Public Health Act and Regulation govern cooling water systems, and NSW Health publishes guidance on managing them through their lifecycle. On that guidance, the occupier and a duly qualified person must install a system in accordance with AS/NZS 3666.1:2011, on design, installation and commissioning; operate it in accordance with AS/NZS 3666.2:2011, on operation and maintenance; and maintain it in accordance with AS/NZS 3666.3:2011, on performance-based maintenance of cooling water systems. A risk management plan is required. Monthly maintenance, chemical analysis and microbial testing, for Legionella and for heterotrophic colony count, must be carried out every month, or more often if the plan requires, and the duly qualified person must complete a monthly report on a prescribed form, recording the results and any remedial actions.

Other states and territories have their own legislation and requirements, commonly including registration of the tower with the health department or local council, a risk management plan, regular testing and reporting, and inspections or audits. The health department of the jurisdiction where a tower stands is the authority on what applies to it, and its guidance should be read in full, not summarised from another state’s or from this book.

Who does what

Several parties share responsibility for a tower, and the plan should name each. The owner or occupier of the premises carries the legal duty for the tower’s management in most jurisdictions and must make sure the plan exists, is followed and is reviewed. The duly qualified person, or the equivalent role elsewhere, prepares or reviews the risk assessment and plan and carries out or oversees the required inspections, testing and reporting. The water treatment provider runs the treatment programme. Auditors, where the law requires audits, independently check that the system complies. And the plant’s own maintenance staff operate the tower day to day, which is why the procedures must be in their hands. The people who clean and inspect towers also need protection from the aerosols they work in: under work health and safety law, the employer must assess that exposure and provide controls, including respiratory protection where the risk assessment calls for it, and procedures that stop the fans before anyone works near the fill or the eliminators.

Design features that reduce risk

Many of a tower’s risks are fixed when it is designed and installed, which is why the first part of the AS/NZS 3666 series addresses design, installation and commissioning. Features that reduce risk include high-efficiency drift eliminators that are easy to inspect and replace; basins that drain completely and can be cleaned; no dead legs or stagnant branches; covers that exclude sunlight from the water; safe access to every part that must be inspected; materials that resist corrosion and do not support microbial growth; and a location away from air intakes, windows and places where people gather, especially downwind in the prevailing winds. A tower selected only for its thermal duty, without these features, carries its risk for its whole life, and retrofitting them later is costly.

When a result is out of range

The plan sets, in advance, what happens when a test result or an inspection finding is outside its acceptable range: who is told, what immediate actions are taken, such as additional disinfection or shutting down the fans, what follow-up testing is done and when the system may return to normal operation. In New South Wales, the guidance also sets out results that must be notified to the local council. Writing these responses into the plan before they are needed matters, because a high result arriving on a Friday afternoon is not the moment to decide what it means. The plan’s records then show the result, the actions taken and the follow-up results, which together demonstrate that the tower was managed as the law requires.

The running case: CT-250’s risk management plan

This is an illustration, set in New South Wales. CT-250’s plan, prepared by its duly qualified person, identified its main risks as the summer production shutdown, when the tower would stand idle for up to three weeks; a dead leg left from a removed exchanger; and an office air intake about 20 m downwind in the prevailing summer wind. Its controls included removing the dead leg, a drift eliminator inspection at each monthly visit, the water treatment programme of Chapter 6, and a written shutdown and start-up procedure: before a planned idle period, the system is either kept circulating with treatment or drained and cleaned; before restarting after one, it is cleaned and disinfected as the procedure specifies, and not returned to service until the procedure has been completed and signed off.

The error: a restart without the procedure

This is an illustration. At the end of the summer shutdown, the maintenance supervisor, keen to have cooling water ready for the first shift, switched on CT-250’s pumps and fans the evening before. The tower had stood for three weeks with about 3.0 m³ of water in its basin and about 1.2 m³ in its pipework, warm in summer weather, with the biocide long decayed. The shutdown and start-up procedure, which called for the system to be cleaned and disinfected before the fans ran, had not been followed, because it was kept with the treatment provider’s records and the supervisor had not seen it.

Figure 2CT-250's summer shutdown and restart

1. Day 0Production stops; tower left full, circulation off, dosing off
2. Days 1 to 21Water stagnant and warm; biocide residual decays; biofilm grows
3. Day 21, eveningPumps and fans switched on without the start-up procedure
4. Day 22, morningTreatment provider's technician arrives for the scheduled restart and finds the tower running
5. Day 22Fans stopped; procedure carried out; additional testing arranged as the plan requires

The treatment provider’s technician, arriving the next morning to carry out the procedure, found the tower running, stopped the fans, and carried out the cleaning and disinfection, then arranged the additional sampling the risk management plan required after an uncontrolled restart. Fortunately, the restart had been brief and in the evening, when the office downwind was empty, and the follow-up results came back within the plan’s limits. The check that should have prevented it was the procedure itself, which existed but was not where the person restarting the tower would see it. The fix put the shutdown and start-up procedure on the tower’s control panel, with an interlock that prevented the fans from starting after a long idle period until the procedure was signed off. The general lesson is that a tower’s risk is highest at the moments outside its routine, shutdowns, restarts and changes, and that the procedures for those moments must be in the hands of whoever operates the tower, not only in a file.

Intermittent and seasonal operation

Towers that run intermittently carry more risk than towers that run continuously, because every idle period is a stagnation period. Plants with standby towers, seasonal loads or long weekends should decide, in the plan, how each idle period is handled: keeping water circulating with treatment through the idle period, which avoids stagnation at some cost in pumping; draining and cleaning, which removes the water but leaves wet surfaces and needs a full start-up procedure; or rotating duty between towers so that none stands idle for long. A standby tower that is never run is a reservoir of stagnant water connected to the system, and many plans require standby units to be circulated regularly or isolated and drained. For CT-250, the revised plan chose to keep the tower circulating with treatment during short shutdowns and to drain, clean and disinfect it before longer ones, with the choice written against each planned shutdown in the plant’s calendar.

Disinfection doses

Disinfection and the routine biocide programme are specified in the plan by the duly qualified person and the treatment provider, with target concentrations and contact times set by the applicable standard and guidance. The arithmetic of dosing is simple and worth understanding. This is an illustration, with an illustrative target chosen only to show the calculation. Raising CT-250’s 4.2 m³ of system water to a free chlorine concentration of 5 mg/L needs about 4.2 × 5 = 21 g of available chlorine, which a liquid sodium hypochlorite product containing about 125 g/L of available chlorine would supply in about 0.17 L, before allowing for the chlorine demand of organic matter and biofilm in the system, which can be large in a dirty, stagnant tower. The real target, contact time, the treatment of the biofilm and the neutralisation of the water before it is discharged all come from the plan, not from this example.

Figure 3Dose to raise a system to a target concentration

mass of active ingredient = system volume × target concentration; product volume = mass ÷ product strength

System volume

Basin plus pipework, m³

Target concentration

g/m³, numerically equal to mg/L

Product strength

g of active ingredient per litre of product

1. Mass ≈ 4.2 m³ × 5 g/m³ = 21 g
2. Product ≈ 21 ÷ 125 ≈ 0.17 L
3. Add the system's demand, found by measuring the residual after dosing

Drift and the people downwind

CT-250’s drift is small in volume: at an illustrative 0.005% of its circulating flow, about 53 litres a day at full load, as Chapter 5 estimated. But a litre of aerosol from water with a high bacterial count is the hazard, not the volume, which is why drift eliminators are a public health control. They should be inspected at the frequency the plan sets, kept intact, correctly seated and clean, and replaced when damaged. The tower’s position relative to air intakes, windows and public places, which Chapter 9 discusses for performance reasons, matters for health too: an intake downwind of a tower can draw its exhaust into a building.

Exercise: the dead leg

CT-250’s risk assessment found a dead leg: about 6 m of 80 mm pipe left capped after an exchanger was removed. What volume of water stood in it, and why does a small volume matter?

Worked answer. The pipe’s bore is about 0.08 m, so its cross-section is about π × 0.08² ÷ 4 ≈ 0.0050 m², and 6 m of it holds about 0.030 m³, about 30 litres.

Thirty litres is less than 1% of the system’s volume, but it is water that never circulates, never receives biocide and never warms or cools with the rest. It can grow biofilm and Legionella undisturbed, and each pressure change in the system can push a little of it into the circulating water. That is why dead legs are removed, cut back to the main, rather than tolerated, and why the risk assessment looks for them specifically, including those created later when equipment is removed, bypassed or replaced.