Three devices, each one assuming the two before it have failed. That is the whole design of unvented safety, and it is worth saying out loud because it changes how you treat them on site: the energy cut-out is not a spare thermostat, and the temperature and pressure relief valve is not a slightly slower cut-out. Each exists for a failure that has already got past everything upstream of it.
This article covers lesson 4 of the PlumbMate unvented hot water course: the three layers of temperature protection and their set points, why a sealed heating circuit needs only two, the motorised valve every indirect installation must have, and the temperature figures that get confused with one another more than anything else in hot water. There is a 10-question mock test at the end.
Three layers
The purpose is single and absolute: stored water must never reach 100 °C. That is the Approved Document G3 limit, and it applies whatever the fuel.
Layer 1 — the control thermostat
About 60–65 °C. This is the only one of the three that operates in normal use. It switches the heat source off when the store is up to temperature and on again when it drops, hundreds of times a year.
The set point is not arbitrary. It is above 60 °C because that is the minimum storage temperature for legionella control, and it is not much above it because every degree beyond costs standing loss and increases the scald risk at the outlet.
Layer 2 — the high-limit energy cut-out
About 85–90 °C, and non-self-resetting. It cuts the energy source, and it must be reset by hand.
Both of those properties matter.
Cuts the energy source: it does not dump water or relieve pressure. It removes the thing causing the problem, which is the correct response to a runaway thermostat.
Non-self-resetting is the important one. A cut-out that reset itself would let the fault repeat — overheat, cut out, cool, re-energise, overheat — indefinitely, with nobody ever knowing. Requiring a hand reset guarantees that somebody has to attend, and it gives you a diagnostic: a cut-out that has tripped is proof that the control thermostat failed. Reset it without finding out why and you are relying on layer 3.
Layer 3 — the temperature and pressure relief valve
Opens at about 95 °C, dumping hot water at roughly 12–30 litres per minute.
Notice how it works, because it is not obvious: it does not cool the cylinder directly. It dumps hot water so that cold mains water flows in to replace it, and the incoming cold is what brings the temperature down. The valve is a route, not a refrigerator.
Which gives the rule that matters when you walk into an overheating system: turn off the heat source, not the cold water. The cold is the only thing carrying heat away.
The T&P valve also has to be in the right place, and this is a classic installation defect: it must be in the hottest water, at the top of the cylinder. Fitted too low it is sensing water that is cooler than the water at the crown, and it will let the top of the store go past the temperature it was fitted to catch.
Two layers or three
A comparison worth being able to make: a sealed heating primary circuit needs only two levels of protection. An unvented hot water store needs all three.
The difference is what the failure produces. A sealed heating circuit at 3 bar and 90 °C that fails is a burst and a mess. An unvented store is at a temperature that can flash to steam, and the consequence is not comparable — so it gets an extra layer.
The motorised valve on indirect systems
An indirect unvented system needs a motorised valve on the primary flow. It fails closed, and it is wired to the energy cut-out. This is required on every indirect unvented installation.
The reasoning follows from what “cut the energy source” means on an indirect system. On a direct electric cylinder, cutting the energy is easy: the cut-out breaks the immersion supply and the heat stops. On an indirect cylinder the heat is coming from a boiler through a coil, and switching the boiler off does not stop hot primary water that is already circulating — especially on a gravity or partly gravity primary, where flow continues on temperature difference alone.
So the cut-out has to be able to shut the coil off physically. The motorised valve is how it does that, and fails closed means a power failure or a burnt-out motor leaves the heat shut off rather than permanently on.
Related, and from the cylinder side: an unvented cylinder is not suitable for uncontrolled solid fuel, for exactly this reason. You cannot switch a fire off.
Scald protection, and four numbers people confuse
A thermostatic mixing valve blends down to a maximum 48 °C at the bath, and must be fitted within 2 metres of the outlet.
The 2 metre limit is the same reasoning as the Water Regs position on mixed runs: blended water sits in the bacterial growth range, so the length of pipe holding it is kept short.
Now the four figures, which are routinely quoted at each other as though they were the same kind of thing. They are not.
- 48 °C is a CEILING, not a setting. Approved Document G3 caps hot water to a bath in a dwelling. It is a limit that must not be exceeded.
- 43 °C is the Water Regulations maximum at outlets in schools, public buildings and facilities used by the public. Lower than 48, because those users are less able to react — children, elderly and disabled people, anyone who cannot get out of the water quickly.
- 41–43 °C is the TMV2 factory setting. It is what the valve arrives set to, before you commission it to the particular appliance. It is not a limit at all.
- Commissioned set points sit below every ceiling: bidet 38, basin and shower 41, bath 44.
The distinction to hold onto: a setting is commissioned; a ceiling must not be exceeded. Quoting a factory setting as though it were a legal maximum, or a legal maximum as though it were a target, produces arguments that cannot be settled because both sides are talking about different kinds of number.
The direction of each figure
One more idea that organises all of this: upstream figures are minimums, set for bacteria. Outlet figures are maximums, set for scalding.
- 60 °C stored — minimum
- 50 °C at the outlet within one minute (55 °C in healthcare) — minimum, and a performance test of the distribution
- 50 °C back on a secondary return — minimum (55 °C in healthcare)
- 48 °C at a bath, 43 °C at public outlets — maximums
They are not a range with a target in the middle. The water is deliberately kept too hot to be safe to touch, everywhere it is stored or moved, and is only blended down at the last fitting before it reaches a person. That is why a TMV three metres back down the pipe defeats the purpose, and why a system that cannot hold 60 °C in store is not solved by turning the mixer up.
Putting the lesson together
Thermostat at 60–65 doing the daily work. Energy cut-out at 85–90, non-self-resetting, so a failure has to be attended and cannot repeat unseen. T&P valve at about 95, dumping hot water so cold can refill and cool the store, mounted at the top where the hottest water is. A motorised valve failing closed on every indirect install, because the cut-out has to be able to stop heat that is already circulating. And a TMV within 2 metres of the bath, commissioned to a set point that sits below the ceiling rather than at it.
📝 10-Question Mock Test
Click an option to see whether you got it right. Explanations appear instantly — no submitting at the end.
Each layer assumes the two before it have failed. The purpose is single and absolute: stored water must never reach 100 °C, the Approved Document G3 limit, whatever the fuel.
It also gives you a diagnostic: a cut-out that has tripped is proof the control thermostat failed. Reset it without finding out why and you are relying on layer three.
The valve is a route, not a refrigerator. Which gives the rule for an overheating system: turn off the heat source, not the cold water — the cold is the only thing carrying heat away.
A classic installation defect. A valve reading cooler water than the water at the crown will let the top of the store go past the temperature it was fitted to catch.
The extra layer is bought by the difference in consequence, not by any difference in the pressures involved.
On a direct electric cylinder cutting the energy is easy. On an indirect one the heat comes through a coil, and on a gravity or partly gravity primary flow continues on temperature difference alone. The valve fails closed, so a power failure leaves the heat off rather than permanently on.
The same logic as the motorised valve requirement, taken to its conclusion. If the energy source cannot be cut, the second layer of protection does not exist.
Four figures get quoted at each other as though they were the same kind of thing. 48 is a G3 ceiling; 43 is the Water Regulations maximum at public outlets; 41–43 is the TMV2 factory setting; and the commissioned set points are bidet 38, basin and shower 41, bath 44.
The lower figure buys reaction time for people who have less of it. It is a Water Regulations limit, a different instrument from the G3 ceiling that gives the 48 °C bath figure.
Not a range with a target in the middle. The water is deliberately kept too hot to touch everywhere it is stored or moved. Which is why a TMV three metres back down the pipe defeats the purpose, and why a system that cannot hold 60 °C in store is not fixed by turning the mixer up.
The layering is the design, and it only works if each layer is treated as what it is. Resetting an energy cut-out without finding out why it tripped removes a layer without replacing it — the system still looks fine, and the only thing left between the customer and a superheated cylinder is a relief valve nobody has tested.
The one to carry away: 48 °C is a ceiling, 41–43 °C is a factory setting, and 43 °C is a different legal limit for public outlets. A setting is commissioned; a ceiling must not be exceeded.