Hot water scalding hot and the cylinder overheating

Switch these off first if the water is scalding

The immediate job is to stop putting more heat into the cylinder. Everything else can wait until that is done. An immersion heater is fed from a fused spur, usually a switched plate within a metre of the cylinder and often inside the same cupboard, and turning that off removes the element from the circuit completely. If the cylinder is heated by the boiler, set hot water to off at the programmer or room controller, and if the controls are unfamiliar, turn the boiler off at its own switch. A cylinder with no heat going into it cannot get any hotter, and from that point the situation is stable while you arrange an engineer.

Once the heat is off, the stored water still holds a large amount of energy and it will take hours to fall on its own. You can bring the temperature down much faster by drawing hot water off, because every litre that leaves is replaced by cold mains water entering at the bottom of the cylinder. Do it at an outlet where nobody can be splashed and nobody walks past: a bath tap with the bathroom door shut, or an outside or utility tap, rather than a basin in a family bathroom. Stand clear of the spout, open it gently rather than fully, and let it run until the water coming out is only warm.

Tell everyone in the property that the hot taps are not safe until an engineer has been. This matters more than it sounds. The person who gets scalded is almost never the person who noticed the problem. It is the child who runs a basin the way they always do, or the visitor who steps into a shower expecting the mixer to behave.

• Immersion heated: switch the fused spur off at the wall and leave it off
• Boiler heated: turn hot water to off at the programmer, and turn the boiler off if you are unsure of the controls
• Draw hot water off at a bath or utility tap, standing clear, to pull cold mains into the cylinder
• Do not run hot water at basins or showers where somebody could be scalded
• Leave the discharge pipe and tundish completely alone, and never cap, plug or bend them
• Do not lift or lever the relief valve by hand to see what happens

Water leaving a cylinder at storage temperature scalds bare skin in seconds, and it burns a child or an older adult faster and deeper than a fit adult. If somebody has already been scalded, cool the skin under running cold water for twenty minutes and get medical advice. Do not put anything else on the burn.

Why hot water suddenly comes out scalding hot

Stored hot water is supposed to sit at a temperature that is already too hot to touch. That is deliberate. Water held below about sixty degrees allows legionella bacteria to multiply in the stored volume, so a cylinder is designed to run hot and then have that heat taken back out of the water on the way to the tap. Almost everything about the safety of a hot water system is built around that split: hot in the vessel, blended down at the outlet.

So when the water turns scalding at the tap, one of two things has happened. Either the cylinder has climbed well above its normal storage temperature because the control that should switch the heat off has stopped switching it off, or the storage temperature is perfectly normal and what has failed is the blending valve on the outlet that used to be taking the edge off it. Both produce the same complaint from a customer and they are completely different jobs.

The clue that separates them is how many outlets are affected. A cylinder that is genuinely overheating makes every hot outlet in the property scalding at once, and it usually brings other symptoms with it: pipework that ticks and knocks as it expands, a cupboard that feels unusually warm, water that spits or surges at the tap, and very often water running from the tundish. A single scalding shower, or one bath tap that has gone hot while the rest of the house is unchanged, is a blending valve or a mixer cartridge on that one outlet and the cylinder is innocent. A hot water cylinder making noise on its own, with the taps sitting at their usual temperature, is a separate question and a far less urgent one, but boiling or violent knocking heard at the same time as scalding taps belongs on this page rather than that one.

There is a third possibility worth ruling out before any of this, because it costs nothing. Somebody may have turned the thermostat up. Immersion heater stats have an adjustment screw or dial under the plastic head, cylinder stats on a boiler fed cylinder have a dial on the front, and both of them get moved by well meaning people chasing a shower that felt weak last winter. If the water became scalding shortly after anybody worked on the system or fiddled with a control, say so when you call. It changes what gets checked first.

• Every hot outlet scalding at once, plus a warm cupboard and ticking pipework: the cylinder is overheating
• One shower or one tap scalding while the rest are normal: a mixer cartridge or blending valve on that outlet
• Scalding water that arrives in surges, spits, or is followed by knocking: the stored water is close to boiling
• Water running from the tundish while the taps are scalding: a safety valve has lifted on temperature
• Scalding started right after somebody adjusted a control: the thermostat setting is the first thing to check

How hot should the water be, at the cylinder and at the tap

Stored water sitting in the region of sixty to sixty five degrees is normal and correct. It is hot enough to keep the stored volume safe from bacteria and it is what a cylinder thermostat is set to deliver. It is also hot enough to cause a serious burn, which is exactly why it is not supposed to reach a basin or a bath at that temperature.

The temperature that should be reaching you is far lower. A bath fed through a thermostatic mixing valve is held down near body temperature, well below the point where a short contact causes injury, and basins in properties where vulnerable people live are often blended too. A shower with a thermostatic bar or cartridge does the same job at the shower itself. Kitchen taps are usually left unblended on purpose, because that is where hot water is genuinely useful and where a scald is least likely to involve someone who cannot get out of the way.

The practical consequence is that turning the cylinder thermostat down is not the fix for scalding taps, even though it feels like the obvious one. Run the stored water cooler and you trade a burn risk for a bacterial one, and you still have a blending valve sitting in the pipework doing nothing. The correct fix is to restore the temperature control on the cylinder and to repair or fit the blending that protects the outlets. An engineer who suggests simply winding the stat down and leaving it there is giving you the cheap answer rather than the right one.

A cylinder that has been run cool for a long period should be brought back up to proper storage temperature rather than left where it is. Tepid stored water is the condition legionella needs, and a cylinder that has sat lukewarm through a summer in an empty flat deserves a proper look before anybody showers in it.

What fails first when a cylinder overheats

An immersion heater is not one control, it is two stacked in the same head. There is a control thermostat with an adjustable setting that switches the element on and off to hold the storage temperature, and behind it a thermal cut-out set considerably higher that is there for one job only: to kill the element if the control stat stops doing its work. The cut-out does not reset itself. It has a small button that has to be pressed in by hand, and that button exists so that an engineer can restore the circuit after finding out what went wrong, not so that you can keep pressing it.

That arrangement produces a very recognisable sequence. First the water goes scalding, because the control stat has failed with its contacts closed and the element is running continuously. Then, some hours or days later, the hot water disappears completely, because the cut-out has finally tripped and taken the element out of circuit. People often call about the second half of that story without mentioning the first, and it is the first half that tells an engineer what actually failed. If the water was unusually hot before it went cold, say so.

A cut-out that has tripped should never be reset and left in service with the original thermostat still fitted. The stat that allowed the overheat is the part that has failed, and pressing the button simply hands the job of protecting the cylinder back to a control that has already proved it cannot do it. The correct repair is a new combined thermostat and cut-out, and on an element that has been running hard against scale it is often sensible to change the element at the same time while the cylinder is drained. Where the cut-out has already taken the element out of circuit and the complaint has turned into an immersion heater not working at all, the part that failed is still the stat in front of it, and a proper immersion heater repair replaces the pair of them rather than putting a new element behind a control that has already let the water run away.

On a cylinder heated by a boiler the same logic applies with different parts. A cylinder thermostat is strapped to the outside of the shell under the foam lagging and wired to a motorised zone valve. When the stored water reaches temperature the stat breaks, the valve closes, and the boiler stops sending hot primary water through the internal coil. Two things can defeat that. The stat can fail closed, or the motorised valve can jam with its paddle held open so that primary flow continues through the coil regardless of what the stat is asking for. A valve stuck open is the more common of the two on older installations, and the giveaway is that the cylinder keeps getting hotter whenever the boiler runs for the heating, even with hot water switched off at the programmer. The same valve failing the other way, jammed shut rather than jammed open, produces the opposite complaint of no hot water but the heating works, which is why the valve gets checked mechanically as well as electrically. Separating a jammed valve from an appliance that is misbehaving in its own right is what boiler diagnosis is for, and it is worth settling before any part on the cylinder is changed.

• Scalding water followed later by no hot water at all: control stat failed closed, then the cut-out tripped
• Cut-out that trips again within days of being reset: the thermostat was never replaced
• Cylinder getting hotter while only the heating is on: the motorised valve is passing or jammed open
• Element covered in heavy scale: common in London water and it shortens the life of the stat behind it
• Cylinder stat that has slipped out from under its strap: it reads the cupboard air rather than the shell and never satisfies

A discharging tundish is the cylinder telling you it is overheating

On an unvented cylinder there is a temperature and pressure relief valve screwed directly into the shell with a sensing probe sitting in the stored water. It is not a comfort device and it is not an expansion control. It is the last mechanical defence between an overheating vessel and everything around it, and it opens when the water gets far hotter than it should or the pressure climbs far beyond normal. Whatever it releases runs through a tundish, an open gap in the pipework that lets you see the discharge, and then out to a safe visible point outside.

That means water pouring from a tundish while the taps are scalding is not a leak to be mopped up. It is a safety valve doing the job it was fitted for. The water coming out will be close to boiling and it will be under mains pressure, so keep hands and faces away from the tundish and the discharge pipe. Do not try to stop it. A discharge pipe that somebody has capped, reduced, kinked or run uphill is one of the genuinely dangerous things found in domestic plumbing, because it turns the only remaining protection into no protection at all.

The timing tells you which valve has lifted. Water that appears at the tundish for a short period at the end of a heating cycle and then stops, with hot water at a normal temperature, is usually the expansion relief valve on the inlet group passing, and that is a separate fault on the pressure side of the system. Water arriving at the tundish very hot, at the same time as scalding taps, is the temperature and pressure valve responding to heat. The second of those is the urgent one. Reading a tundish that is dripping on its own, with the taps behaving at their usual temperature, is a different exercise altogether, because that pattern points at the pressure side of the system rather than at the amount of heat going into it.

Once a relief valve has lifted it frequently does not seat perfectly again, because scale or debris lands on a seat that has only ever been closed. A valve that weeps afterwards is replaced rather than cleaned or adjusted. It is a safety component and it has already demonstrated that it does not seal. A relief valve that has been weeping ever since the overheat needs to be understood on its own terms, because the reason it will not close again is rarely the same as the reason it opened in the first place, and treating the symptom on the seat leaves the original heat fault exactly where it was.

Never cap, plug, extend upwards or fit a valve onto a tundish discharge pipe, and never leave a cylinder in service with a discharge that runs somewhere it cannot be seen. If the discharge pipe has been altered or terminates inside a cupboard, tell the engineer when you call so the right parts come with them.

Why an overheating unvented cylinder is genuinely dangerous

A vented cylinder fed from a tank in the loft is open to the atmosphere. If it overheats, the water can boil and the steam and hot water push back up the open vent pipe into the cold tank. That is alarming and it can scald somebody in the loft, but the vessel itself has a permanent escape route and cannot build pressure.

An unvented cylinder has no such route. It is a sealed steel vessel connected directly to the mains, so the water inside is held under pressure, and water under pressure does not boil at one hundred degrees. It can be carried well past that point and stay liquid purely because the pressure is holding it there. If the shell then fails, that pressure is released in an instant and the entire contents flash into steam at once, expanding to hundreds of times the volume. That is the reason unvented hot water is treated as a regulated safety installation rather than ordinary plumbing, and it is why the work is restricted to engineers holding the relevant qualification.

The important thing for anyone standing in front of an overheating cylinder is what the overheating actually proves. The vessel is designed with layers: a control thermostat that holds normal temperature, a separate high limit cut-out that removes the heat source if the control fails, and the temperature and pressure relief valve as the final mechanical backstop. Water that has reached scalding temperature means the first layer has already failed. Water at the tundish means the failure has travelled far enough to reach the last one. Nobody standing in the cupboard can tell by looking how many of those layers are still functional, and that is the reason an overheating cylinder is not something to watch for a week and see how it goes.

None of that applies in the same way to a thermal store or a Pulsacoil type unit, where the heated water stored in the vessel is not the water you wash in and the mains water is heated as it passes through. Those units carry their own protections, and the part that keeps you from being scalded is normally a blending valve on the outlet. When that valve fails on a thermal store, the water reaching the taps can go scalding immediately with no warning at all and with nothing wrong inside the vessel. A Pulsacoil repair in London is therefore mostly a matter of the plate heat exchanger, the internal pump and the blender on the outlet, and almost never a matter of a pressure vessel, which is why the safety reasoning on this page reads differently for those units.

Why one tap or shower runs scalding when the rest are fine

A blending valve, often called a thermostatic mixing valve, sits in the pipework and mixes stored hot water with cold to deliver a controlled temperature to an outlet. Inside it is a thermal element that expands and contracts with temperature and moves a shuttle between the hot and cold ports. It is a simple, effective device with one weakness: it lives permanently in hot water and depends on a moving part.

London water is hard, and hardness is what kills these valves. Scale builds on the thermal element and around the shuttle until the valve can no longer move freely, and when it locks it can lock anywhere. Locked towards cold gives you a shower that has gone lukewarm and will not get hotter. Locked towards hot gives you a scalding outlet with no protection at all. The same failure happens inside thermostatic shower cartridges and inside the mixer bodies of bath fillers, which is why one scalding shower in an otherwise normal house points straight at that shower rather than at the cylinder. Why hot water systems fail earlier in London is the long version of that argument applied to whole installations, and what hard water and hot water cylinders in London do to a thermal element is the same chemistry seen at the scale of one valve rather than one system.

The other cause worth knowing about is crossed pipework. After any work that involved disconnecting and reconnecting supplies, a hot and a cold can end up transposed, or a faulty non return arrangement can let hot push into a cold leg. The symptom is distinctive: a cold tap that runs warm or hot, often alongside a mixer that behaves unpredictably. If the scalding started within days of any plumbing work anywhere in the property, that is the first thing to say when you call.

A blending valve that has scaled up is normally replaced rather than stripped down. Some models allow a service kit, but by the time the element has enough scale on it to stick, the seats and the shuttle bore usually have scale on them too, and a valve that protects somebody from a burn is not the place for an optimistic repair.

• One scalding outlet, others normal: mixer cartridge or blending valve at that outlet
• Shower that swings between scalding and cold when another tap is used: the thermostatic cartridge is no longer compensating
• Cold tap running warm: crossed pipework or hot migrating into the cold leg
• Scalding that appeared after plumbing work anywhere in the property: suspect connections before components
• Repeated blending valve failures in the same property: hard water, and the valve may need a different specification

What an engineer checks when a cylinder is overheating

The first move is not diagnostic, it is to make the situation safe. Heat sources come off, the stored temperature is measured rather than guessed, and if the vessel is still very hot it is brought down under control before anything is dismantled. Working on a pressurised cylinder full of water above normal storage temperature is how people get hurt, so nothing gets opened until the readings are sensible.

After that the sequence follows the layers of protection outwards. The actual stored temperature gets compared against what the control is asking for, which immediately separates a control that has failed from a setting somebody has wound up. On an immersion system the head comes off the element and the control stat and cut-out are tested, with the state of the cut-out recording whether the overheat had already gone that far. On a boiler fed cylinder the stat, its wiring and its contact with the shell are checked, then the motorised valve is checked both electrically and mechanically for a paddle that is not closing.

Then the relief side. The temperature and pressure valve, the expansion relief valve on the inlet group, the tundish and the full run of the discharge pipe all get inspected, because an overheat event tests all of them and frequently leaves one of them passing afterwards. The discharge route is followed all the way to its termination, since a discharge that ends somewhere unsafe has to be corrected whatever else was wrong.

Finally the outlet side, which is what the person in the property actually experiences. Blending valves and thermostatic mixers are checked for the temperatures they are delivering, not just for whether they run. A cylinder can be perfectly repaired and the taps still be dangerous, and it is not a finished job until the water arriving at a basin or a bath is at a temperature that will not injure somebody who is not paying attention. Most of what follows an overheat is ordinary unvented cylinder repair work, and the checks themselves are the ones an annual unvented cylinder service is built around, which is how a drifting thermostat normally gets caught before it scalds anybody.

• Heat sources isolated and the stored temperature measured before anything is opened
• Control thermostat setting against actual stored temperature
• Immersion stat and thermal cut-out tested, and the cut-out state recorded
• Cylinder stat contact, wiring and motorised valve operation on boiler fed systems
• Temperature and pressure valve, expansion relief valve, tundish and the whole discharge run
• Delivered temperature at every blended outlet before the job is signed off

The rate is fixed before we attend and the total depends on how long the job takes. What cannot be sensibly quoted over the phone is which part failed, because an overheat usually damages more than one component and the relief valves have to be checked afterwards whatever the original cause was.