England and Wales High Court (Technology and Construction Court) Decisions

IN THE HIGH COURT OF JUSTICE
QUEEN'S BENCH DIVISION
TECHNOLOGY AND CONSTRUCTION COURT

		Royal Courts of Justice Rolls Building, 7 Rolls Buildings London EC4A 1NL
		28 November 2014

See: Schedule to Judgment

Mr. Justice Edwards-Stuart:

Introduction

1. On 12 February 2007 there was a disastrous fire at the Claimant's factory in Exeter. The Claimant ("Howmet") says that it was caused by the failure of a probe that was supposed to detect a loss of liquid in a hot water tank. As a result of the combination of some rather unusual events the heater to the tank was switched on at a time when the tank was virtually empty. The probe, being out of the water, should have isolated the heating units in the tank. It failed to do so and so the heaters overheated and set fire to the tank, and the fire quickly spread to the factory. It caused losses in excess of £20 million.
2. The First Defendant, Economy Devices Ltd ("EDL"), was the manufacturer of the probe. The Second Defendant, Electrochemical Supplies Ltd ("ECS"), was engaged to design, supply and install a new grain etch line ("GEL"), which included the tank that caught fire. The Third Defendant, MJD Technologies Ltd ("MJD"), purchased the probe from EDL and installed it as part of a subcontract with ECS for the electrical system for the new GEL. MJD is now dormant and has neither assets nor insurance. It has not served a Defence and has effectively played no part in the litigation. Howmet has now settled its claim against ECS and so the trial was confined to the issues between Howmet and EDL.
3. Howmet claims that the probe, known as a Therm O Level ("thermolevel"), was negligently designed with the result that it was unreliable in service and, in any event, was not a failsafe device. It complains also about the brochure produced by EDL which, it says, contained misleading information as to the qualities of the product.
4. EDL denies liability. It contends that the losses sustained by Howmet were not within the scope of any duty owed by EDL, that the fire was caused by acts of Howmet which broke the chain of causation and that there was nothing wrong with what it says was a simple and relatively low grade product. In the alternative, it relies on the defence of contributory negligence.
5. In addition, EDL puts Howmet to proof of the cause of the fire, which it says is far from self-evident.
6. In a more general way EDL asserts that this is a David and Goliath situation. Howmet is part of the very substantial Alcoa group, and itself had a turnover in excess of $100 million in 2005. EDL, by contrast, is said to have been a three person company - one director, his wife (as company secretary) and a technician - which had a turnover at the time of the fire of less than £50,000. It is said that over about 25 years it had sold about 5000 thermolevels without ever having received a substantiated claim. Since, in the event, EDL called no evidence^[1] none of this has been proved. On the other hand, EDL's history as a company has not been disputed, although the extent to which it had received complaints about the performance of thermolevels is in issue.
7. EDL says, in effect, that it is against reason to hold the supplier of a low level device responsible for enormous losses that result from the device being used in a situation and under conditions over which the supplier has neither knowledge nor control: all the more so, submits EDL, when the end user is a sophisticated organisation that is well able to satisfy itself of the suitability of the device for the purpose for which it proposes to use it.
8. In the context of this case the expression "failsafe" is used in its engineering sense, that is to say that it describes a safety device which, in the event of its own failure or maloperation, leaves the system it serves in a safe or deactivated condition.
9. Howmet was represented by Mr. Ben Quiney QC and Mr. James Sharpe, instructed by Reynolds Porter Chamberlain. EDL was represented by Mr. Andrew Bartlett QC and Mr. Alexander Antelme QC, instructed by Weightmans

The operation of the grain etch line ("GEL")

10. Howmet produces metal castings for use in the aerospace and other precision component markets. The castings are produced using the lost wax process which it is not necessary to describe for the purposes of this judgment. When the casting has been produced it is taken to the GEL. The GEL consists of several polypropylene tanks, each measuring 1450 mm x 700 mm x 600 mm (deep). The castings are lowered into the tanks by a mechanical hoist. The casting is first dipped in ferric acid, heated to 80°C. It is then washed in tanks containing hot and cold water. This process causes the grain of the casting to be exposed which enables the operators to check that it has been produced to the correct specification.
11. Four of the tanks in the line are heated by one or more heating units within the tank. The probe of the thermolevel is suspended vertically in the tank and is connected to a control box. That in turn is wired back to a control panel. The thermolevel has two functions: first, to measure the temperature of the liquid and, second, to detect a drop in level of the liquid below which the heater will be exposed and consequently liable to overheat.
12. As originally designed, the control box (or unit) of the thermolevel was connected only to the heater controls so that the heater would be turned off if the level of liquid in the tank fell below a certain point. However, it appears that the wiring in the control box was modified by the addition of alarm circuits which led back to the main control panel. This modification was presumably made by MJD.
13. The polypropylene tanks are combustible and so if a heater overheats there is a risk that it will set fire to the tank. Initially, the thermolevel was the only device to protect the heaters from overheating. As the evidence in this case demonstrates the thermolevel manufactured by EDL was not a failsafe device.

The background to the claim

14. By early 2005 Howmet had concerns about the safety of its existing grain etch line. A Request for Authorisation that was produced in about May 2005 described the current condition of the line in the following terms:

"The current etching line is 20 years old and requires full chemical resistant Personal Protective Equipment to be worn during operation. Due to the aggressive environment causing corrosion, excessive periods of maintenance are required with increasing failure costs.

The corrosion is such that there is the risk of a potential collapse of the tanks which would lead to an EHS incident. This could also result in the loss of at least 4 weeks production, due to manufacturing lead time. The loss in sales if such an incident was to occur would be approximately $10M."

15. The Request for Authorisation was circulated to certain members of Howmet's senior and middle management for their approval. These included two of the witnesses in the case, Mr. Simon Farrimond and Mr. Damon Gill. A table appended to the document identified the areas of importance, under each of which was listed a number of relevant features. Against each of these, under the column headed "Concept Phase", there was an X to indicate whether the particular feature was included in the proposal or not. One feature was whether or not controls had been designed to be failsafe, to which the response was "Yes".
16. If the Request for Authorisation resulted in the production of a specification for the new GEL, that document has either not survived or has not been disclosed. There is no evidence that a specification existed. In any event, Howmet decided to approach three contractors for their proposals and eventually chose ECS.
17. EDL sought to make much at the trial of various statements to the effect that the old grain etch line was unsafe. I think that this was reading too much into what was said. The position, as I find it to have been and as I explain in more detail below, was that the line was not safe for operators unless they were wearing suitable protective clothing. This was because the tanks were not entirely stable and there was a time when the structure was unsafe and had to be repaired. Clearly the line was in need of replacement, but I reject any criticism of Howmet's continued use of it prior to the installation of the new GEL.

The evidence at the trial

18. Although Howmet called a number of witnesses, many of its employees who were involved in the relevant events were not called, either because they could no longer be traced or because it was thought unnecessary and/or disproportionate to call them. EDL complained about Howmet's failure to call several witnesses who EDL alleged could have given evidence that would have been very relevant to the events leading up to the fire in February 2007: in particular, Mr. Darke, Mr. Palfrey and Mr. Moxey all of whom still worked for Howmet (or for its parent, Alcoa), or were thought to do so. Another was a Mr. Hunt: although he no longer worked for Alcoa, at least one other witness (Mr. Gill) was able to contact him.
19. For reasons that will become apparent in this judgment, I consider that there is some force in this. Since the burden of proof is on the party which has a case to prove, it must call the evidence that it requires in order to make good that case. Even if, strictly speaking, a particular witness is not essential for the proof of the case, in certain circumstances a failure to call that witness may give rise to an inference against a party who is in a position to call that witness and does not do so. In my view, such an inference may be drawn if there is material upon which the court can conclude that the witness may have relevant evidence to give and that his or her evidence may not support that party's case.
20. Another witness who was not called was Mr. Reed. He was an electrician who played a central role in relation to the thermolevels. However, he was not called because he could not be traced and so Howmet served a witness summary which consisted of the notes of an interview with Mr. Jonathan Boyle, the forensic expert instructed by Howmet's insurers, which took place shortly after the fire. This was understandable.
21. In the event, EDL had the advantage of extensive notes taken by Mr. Boyle, who interviewed a large number of witnesses many of whom did not give evidence at the trial. These notes were very full and had obviously been taken with care. Nevertheless, they had not been approved by those whose evidence they reflected. Parts of them are important and will be discussed in much greater detail later in this judgment.
22. As I have already mentioned, EDL called no evidence at the trial although it had served some witness statements.
23. With reference to these notes taken by Mr. Boyle, I should make an observation about one aspect of the cross-examination of Howmet's witnesses by counsel for EDL. Many of them were cross-examined by reference to Mr. Boyle's notes, which was entirely understandable. Some of these notes were of interviews that took place during the two days following the fire; others about two weeks later; and others about three months after the fire. Whilst there is no evidential difficulty about a witness being cross-examined about the notes of an interview that he had given several years earlier, there may be difficulties when a witness is being asked questions about the notes of an interview with someone else. This is particularly so if those notes have not been verified as accurate by the person interviewed.
24. One difficulty that arose in this case is that, on occasions, the questions to a witness either amounted to asking him^[2] if he was in a position to disagree with what someone else had said to Mr. Boyle, or amounted to asking for what was in truth thinly veiled evidence of opinion. In respect of the former, the evidence has limited value. The fact that witness is unable to challenge what somebody else has said on a previous occasion does not mean that he can confirm it: his position may be entirely neutral. As to the latter, a question that asks, say, in respect of something in a note made by Mr. Boyle of an interview with someone else, "… that appears to be a reference to corrosion on a plug?" (see, for example, Day 4/148), is really inviting the witness giving evidence to say what he thinks that other person meant. Again, such evidence is of limited value - even if it is admissible at all, arguably being evidence of opinion - and the court must be astute to distinguish between evidence of fact that is within the knowledge of the witness and evidence that is really little more than speculation.

The operation of the thermolevel

25. At this stage, I should explain how the thermolevel works. The low level sensing function in the probe depends on the difference between the voltage produced by an oscillator and a capacitive divider in the probe and a reference voltage. The thermolevel works because when the probe is immersed in, say, water, the voltage produced is less than when the probe is exposed. So as the probe is removed from the liquid the voltage increases. If it is higher than the reference voltage, then the probe will send a signal to its control unit and the heater will be de-energised.
26. This occurs because capacitance is proportional to permittivity, which is a term used to describe the influence of a material on an electric field. The permittivity of liquids varies considerably from one kind of liquid to another. Putting it very simply, immersing the probe in water increases the capacitance in one of the capacitors in the probe thereby reducing the voltage of the signal generated.
27. The probe is connected to its control unit by a screened four-core PVC sheathed cable. Two of the cores provide a 5v power supply. The third and fourth cores carry the temperature and level signals, respectively.
28. The reference voltage to which the probe's level signal is compared is adjustable by means of a small potentiometer in the control unit. This is somewhat misleadingly described as a "sensitivity" control. In order to adjust it, the front of the control unit has to be removed. As the tests carried out by Mr. Boyle and Mr. Braund^[3] showed, detection of a low liquid level is dependent on this control being correctly adjusted. Its design was such that if it was set too high or too low the heater unit would become enabled or disabled permanently, irrespective of whether the probe was immersed in liquid or not.

The events leading up to the fire

29. The GEL was installed by ECS in mid 2006, but did not go into initial production until early November 2006. ECS provided a thermolevel in some of the tanks as a device that would both measure the temperature and control the level of the liquid in it. Controlling the level of the liquid was very important for two reasons: first, because the casting had to be immersed at all times and, second, because if the liquid fell to a point where the element of the heater became exposed, there was a serious risk that the heater would overheat and catch fire. I find that Howmet's own employees played no part in the decision to purchase EDL's thermolevels, but relied on ECS to choose them.
30. The Operation and Maintenance ("O&M") Manual was issued by ECS to Howmet on 20 September 2006, together with a certificate of conformity. However, the sections entitled "Electrical", "Plant Wiring" and "Control Console" were not included in the manual and, so far as one can tell, were never supplied prior to the fire. Howmet's procedures required there to be a start-up Project Environmental Safety and Health Review ("PESHR"), which was to be carried out during the testing and commissioning period. This would involve members of Howmet's Plant Engineering, Maintenance and Health and Safety departments, together with certain operators. Their role was to identify issues and hazards. It was said^[4] that this was still in the process of being completed when the fire occurred.
31. A feature of this case has been the paucity of contemporaneous documentation. One reason for this on Howmet's side might be that it was Howmet's practice to keep a record of current issues and actions on a whiteboard which was in a corridor near the maintenance office. This is where daily meetings would take place and progress would be monitored by updating the information on the whiteboard.
32. One of the early problems with the GEL was that the main control panel was considered by Howmet to be unsatisfactory. Howmet therefore agreed with ECS that it (Howmet) would design and manufacture a new control panel at ECS's expense. The new panel was designed by Mr. Reed, whom I have already mentioned.
33. During the commissioning period various instruments, including the thermolevels, were calibrated by the Instrumental Team, who formed part of the Maintenance Team. Calibration was done monthly. In relation to the O&M manuals, it was Howmet's policy to produce its own operating procedures based on the supplier's O&M manual. Mr. Reed did this, and his procedure for emptying the hot water tank on the GEL required the operator to ensure that the heater was switched off before draining the tank.

The small fire on 12 December 2006

34. During the early evening of 12 December 2006 the heater in the hot water (or hot rinse) tank caught fire. It seems that an operator, Mr. Lemon, opened the drain valve on the tank in order to empty it without first switching off the heater. The result was that as the level of the liquid fell below the top of the heater element. As it did so, the element overheated and caught fire. Fortunately it was put out quickly before it caused any damage to other plant or equipment. The thermolevel should have prevented this by cutting the supply to the heater once the liquid fell below the set level. Howmet says that after the fire Mr. Reed removed the thermolevel and tested it in another tank, where it appeared to work properly. It appears that he found that there was corrosion inside the plug or between the plug and the socket of the extension lead to which it was connected. He attributed the failure of the thermolevel to cut the power supply to the heater to this corrosion. Having repaired and resoldered the connection Mr. Reed told Mr. Boyle that he applied a heat shrink sleeve to protect it against further corrosion.
35. One witness (Mr. Gildersleve) said in his witness statement that after this small fire in December signs were put on the outside panels of the GEL to remind operators to turn the heaters off when they were draining down tanks. Apart from Mr. Reed's continuing investigation into the functioning of the thermolevels, it seems that no other action was taken. However, at some point, which appears to have been several weeks later, Mr. Reed decided to install a float switch in the hot water tank on the GEL as an alternative or additional safety device.
36. In the meantime, an e-mail dated 20 December 2006 included this entry: "Damon would like the level probe looked at on the new grain etch line desmut^[5] tank. JNC". Mr. Damon Gill (the "Damon" referred to in the message), who gave evidence at the trial, was unable to recall anything about this problem. All he could say was that JNC stood for "job not completed". There is no further reference to this potential problem in the documents.
37. There was then a problem with the probe on the hot ferric tank on 11/12 January 2007. An e-mail sent by the shift Maintenance Team on 12 January 2007 (at 05:59) recorded that the probe on the ferric tank was not reading and that there was a "dodgy" five pin plug at the back of the tank which was corroded. It then said "Removed used connectors for now working better but not prefect [sic]".
38. Later that day a further e-mail, timed at 17:45, said "Hot ferric tank level probe problems again sorted for now COMPLETE". There were two entries on the SAP system^[6] dated 11 and 12 January 2007, respectively, which appear to reflect the notes in these two e-mails relating to the problem with the probe in the hot ferric tank. However, these throw no further light on the matter: in particular, there is no indication that the level sensor in the probe was not working properly – it might have been the temperature gauge.
39. Mr. Boyle's notes of an interview with an electrician, Mr. Darke, on 16 May 2007 record him as saying this:

"The probe that I changed was on the ferric tank on 12/1/07"

40. This, if correct, suggests that the problem with the probe in the hot ferric tank recorded in the e-mail timed at 17:45 on 12 January 2007 was "sorted" by Mr. Darke changing the probe. There is no indication in either of these e-mails, or in the note of the interview with Mr. Darke, that the probe was not acting as a failsafe device on this occasion. There is no reference to the probe not switching off the heater when the level of the liquid was too low.

The heater burnout and possible small fire at the end of January 2007

41. Another incident, similar to the small fire in December 2006, occurred at the end of January 2007. It seems that an operator, Mr. Palfrey, was working on the GEL and had to drain the hot water tank. Although he remembered that he had to switch off the heater, by mistake he switched off the heater to the wrong tank. As a result, the hot water tank was drained with the heater on. Again, the thermolevel failed to operate when the liquid fell below the set point so that the heater overheated. According to Mr. Boyle's note, the heater caught fire but was quickly doused with a hose by the operator.
42. This incident appears to have generated no documents and there is a serious issue between the parties as to how widely within Howmet it became known. Every witness who gave evidence disclaimed having any recollection of it.
43. In this context, an earlier passage in the same note of the interview with Mr. Darke on 16 May 2007 has been strongly relied on by EDL. It includes an account given by Mr. Darke of his conversation with Mr. Chris Palfrey following the incident on 29/30 January 2007. Part of it, therefore, is double hearsay. Since it is important I will set out the relevant part of this note in full (as it appears in the original manuscript notes, not the typed transcript):

"	Chris told me that he forgot to turn off the heater at control panel which shouldn't make difference because they are fitted with level probes but the heater still burnt. He told me there had been smoke from heater. Nobody else there. No supervisor around Chris came and saw me. Not logged on mtce system. Heaters not stock item, went to see Damon. Talked to Damon about it. Found a heater under P Reed's desk.
Not on 29/30 Jan actually on 12/1/07[7]	Looked at level probe, changed level probe for one under P Reed's desk. But after I changed the probe the tank would[n't] heat up at all. I went off to do something else. Probe measures temp and level. I'd not come across that type of sensor before."
12/1/07	Probe I fitted wasn't in a packet, not sure whether it was new. Temperature display wasn't reading correctly. Didn't make any adjustments when fitted probe."

44. It was suggested by EDL that the words emphasised (in the first paragraph of the note) did not come from Mr. Palfrey, but represented a comment by Mr. Darke on Mr. Palfrey's account. This may be correct; in the absence of evidence from either of them, it is difficult to be certain. But if EDL is right, it suggests that Howmet's operatives might not have been relying on the thermolevel as a failsafe device: Mr. Palfrey was simply acknowledging that he had failed to follow the instruction to switch off the heater before draining the tank.
45. In fact, Mr. Boyle interviewed Mr. Palfrey the day before this interview with Mr. Darke. Mr. Palfrey said, according to Mr. Boyle's notes, that

"Low-level alarm would come on when you drained tank but possibly not if heater turned off - not sure."

46. A little later, referring to the incident on 29 January, Mr. Palfrey is recorded as having told Mr. Boyle this:

"6 pm accidentally switched off hot ferric heater.

Opened valve on water tank and tank started draining after 5 minutes.

Washing castings near the anodic panel.

Saw smoke from hot water tank. Flames ~ 8" above level of tank.

Both heaters burnt out.

Reported to?

Might have put a ticket in

went to find Andy Dart (Darke), electrician and he came and fitted one heater

Think Andy might have reported it.

After Jan switched off at both plugs and panel.

Told Graham Moxey.

Can't remember speaking to either supervisor."

47. There are two notable differences between the account given by Mr. Palfrey to Mr. Boyle and Mr. Darke's account of what Mr. Palfrey told him. The first is that in the latter there is no reference to Mr. Palfrey having switched off the heater to the wrong tank. One might have expected Mr. Palfrey to want to emphasise that by mistake he had switched off the wrong heater, rather than that he had forgotten to switch off the heater at all. But this may be just the sort of potential discrepancy that can arise with indirect reported speech. At any rate, it shows that it must be treated with caution.
48. The second difference is the reference to flames. Mr. Palfrey told Mr. Boyle that he saw not only smoke from the hot water tank but also flames. Mr. Darke is recorded as saying that Mr. Palfrey told him that he had seen smoke from the heater, but his account of that conversation given to Mr. Boyle contains no mention of flames.
49. Mr. Palfrey's account to Mr. Boyle suggests also that he was aware that the thermolevel would cause an alarm if a tank was drained whilst the heater was switched on. But on any view, if this account is correct, Mr. Palfrey would not necessarily have expected the thermolevel to trigger an alarm if a tank was being drained when its heater was switched off.
50. Mr. Gill agreed in cross-examination that it would have been Mr. Darke's duty to report a fire (Day 2/140), but that of course begs the question whether Mr. Darke had been told that there had been a fire - that is to say combustion involving flames - or that the heater had just burnt out - possibly involving smoke but not flames. What Mr. Darke first said to Mr. Boyle, in the course of the interview on 16 May 2007, was that:

"Heater burnt out, couple of weeks before main fire.

…

The heaters that were taken out the centre core section was blackened not just the top section of the heater.

Replaced one heater but took two out. Threw old heaters away. Both heaters burnt.

Heaters sat side by side in end of tank. Two slots in plastic at end of tank."

51. Finally, in relation to the incident of 29 January 2007, Mr. Darke said this to Mr. Boyle:

"I explained to Damon that the heater had burnt out and this seemed similar to fire on old grain etch."

Whilst in this version Mr. Darke appears to be making a comparison with the fire on the grain etch line that occurred in the 1990s, he still refers to the heater as having "burnt out".

52. It seems to me very likely that if Mr. Darke described what happened on 29 January 2007 as a heater having "burnt out" when speaking to Mr. Boyle in May 2007, he might very well have said the same to Mr. Gill shortly after the incident, some three or four months earlier.
53. What Mr. Gill told Mr. Boyle about the incident of 29 January 2007 when he was interviewed after the fire was this:

"When A Dark came to see me he told me the heater had burnt out but for an electrician to describe something as burnt out means that it has failed not that it has caught fire. I interpreted this to mean that the heater had failed but I wasn't aware that there had been a fire.

I didn't follow this event up."

54. In his witness statement Mr. Gill said that towards the end of January 2007 Mr. Darke came to the Facilities Office to request a replacement heater for the GEL as he said that a heater had burnt out and failed. Mr. Gill said that the replacement heater was smaller than the heater that had burnt out, as it was only 3 kW compared to 5 kW. He said that he remembered this because it was raised at a team meeting by the operators who complained that it did not heat up the water quickly enough. He said that he did not remember Mr. Darke saying that there had been a fire or that there had been visible flames. He said that when a heater fails you do not always get a fire.
55. In cross-examination Mr. Gill said that he did not recollect having a conversation in which Mr. Darke had mentioned the earlier fire on the old grain etch line. He said that he remembered having a conversation with Mr. Darke but he did not recollect what was said in detail. Mr. Gill agreed that he was not in a position to dispute the note that Mr. Boyle had taken of what he had been told Mr. Darke. He agreed that if the occurrence of a fire had been reported to him it would have been his duty to follow it up (Day 2/151-2).
56. On 29 January 2007 an e-mail from the shift Maintenance Team, at 17:46, included this item:

"10) new grain etch - 2x heaters replaced hot water tank as old were down to earth and taking out rcd. completed."^[8]

57. It was suggested to Mr. Gill that the description in that e-mail was rather economical with the truth. Mr. Gill explained that when people say "burnt out", it could mean that it was down to earth (by this I assume that he meant a failure of insulation leading to a short to earth).
58. On the following day, 30 January 2007 there was a further e-mail from the shift Maintenance Team, at 17:51, which included the item:

"9) grain etch hot water tank - heater replaced. completed."

59. 12 hours later, at 05:45 on 31 January, the e-mail from the shift Maintenance Team included this entry:

"GRAIN ETCH HOT WATER TANK HEATERS U/S REPLACED ONLY ONE HEATER FOUND NEEDS SOME MORE PRONTO. INFO"

60. Mr. Gill agreed that it looked as if two further heaters had been found to be unserviceable in the hot water tank on 31 January 2007. He was then shown the entries for the SAP record for the relevant period, which included an entry on 2 February 2007 that "Hot water element needs replacing". It was suggested to Mr. Gill that from these records it looked as if heaters were failing on a daily basis and he was asked if it had occurred to him that something must be wrong. His answer was: "Clearly not, or I would have done something about it" (Day 2/155).
61. EDL relied also on Mr. Boyle's notes of his meeting with Mr. Moxey on 20 February 2007, where Mr. Moxey was reported as saying:

"Aware of two fires on plant After draining tank fires have started within 5 mins

Old grain etch line automatic switch

12/12 1^st fire David Leeming (Lemon) shell l each

end Jan 2^nd fire Chris Palfrey Sunday pm - DL noticed hot water switched off

Procedures say to re-fill tank and switch heater back on, but more sensible to have tank drained with heater switched off

When tanks drained low level alarms come on, but on hot water tank low level alarm hasn't worked recently.

Low level alarms on other tanks don't come on because heaters/agitators switched off when tanks drained"

(My emphasis)

62. It will be recalled that, according to Mr. Boyle's notes, Mr. Moxey was one of the people whom Mr. Palfrey told about the incident on 29 January 2007.
63. Mr. Webber told Mr. Boyle on 15 May 2007 that elements catching fire was becoming a concern and that he mentioned this to someone, probably Mr. Gildersleve. He said that he was told that "they were looking to replace level probe". It was put to him in cross-examination that this showed that, as at 29 January 2007, the thermolevel on the hot water tank was not working and that he was told when he raised it as an issue that Howmet was going to fit something else. The exchange then went as follows (Day 4/160):

"A. … that is what my statement says at that time, yes.

Q. So that's how it looks, isn't it?

A. Yes.

Q. That's probably right?

A. I would think so, yes.

Q. That reference to 'changing something', they were looking to replace level probe, could mean they were going to fit a different kind of level device?

A. I would think so, yes."

64. Howmet's documents show that on 1 February 2007 Mr. Reed ordered a float switch for delivery the following day. Mr. Gill said in his witness statement that Mr. Reed was concerned that the thermolevels were not working and that he wanted to install float switches in the tanks as a secondary protective measure. He thought that the switch that Mr. Reed ordered arrived about a day before the fire. He said that he remembered seeing it on Mr. Reed's desk. In fact, when he was asked about this he clarified his evidence by saying that because he remembered seeing the float valve on Mr. Reed's desk shortly before the fire on 12 February 2007 he assumed that that was when it arrived.
65. Howmet's documents show that the order was processed on the following day but they provide no indication of when the float switch was delivered.
66. If Mr. Reed was concerned about the reliability of the thermolevels generally, it is not clear why he ordered only one. In my judgment, it is more likely that it was ordered for the hot water tank because Howmet had concluded that there appeared to be a particular problem with the operation of the level sensor in that tank.

The involvement of Mr. Hunt

67. A document that was strongly relied on by EDL - indeed, in its opening submissions it was at the forefront of this part of its case - was a "Long Text" which had been posted on the SAP system by a Mr. Hunt on 2 February 2007. Mr. Hunt was a continuous improvements manager on the post casting aside. He was not called as a witness. His Long Text was against an entry for the hot water tank, which was shown on a separate dialog box on the SAP system. The Long Text was in the following terms:

"The hot water tank will not turn off when the water level is low, this has already caused a fire and could happen again. Grain Etch."

68. In addition to the entry to which this Long Text related, Mr. Hunt entered five other notifications into the SAP system on 2 February 2007. The six entries were as follows:

Short Text	Long Text Indicator
Bolt down barrier by G/E shower
Hot Water tank	X
Desmut/Ferric cutting out Grain Act
Hot water element needs replacing
Cold water tank does not fill in auto	X
Cold water tank no 6	X

69. Where there is a X in the column entitled "Long Text Indicator", the Long Text appears in a separate dialog box. Not surprisingly, EDL relies on the Long Text entry against the hot water tank as showing that Howmet was well aware of the risk of fire and of the danger posed by the failure of the thermolevel in the hot water tank to function properly.
70. Mr. Boyle interviewed Mr. Hunt, quite briefly, on 16 May 2007. At the trial Mr. Boyle was unable to recall what it was that prompted him to see Mr. Hunt (at that stage Mr. Boyle was unaware of Mr. Hunt's Long Text). Since Mr. Boyle's note of this interview is important, I will set it out in full:

"Bruce Hunt, continuous improvements mgr (manager) post cast

Ian McGill, manufacturing engineer was on a Kaizen event, asked me to put a ticket in because tanks weren't heating up quick enough.

Second Kaizen:

Ian McGill - manufacturing engineer

Graham Moxey - operator

Ian Harris - manufacturing engineer Said that heater element wasn't very Good.

Ticket 02.02.07

I initiated first Kaizen event.

2 day - 30.11.06 - Chris Palfrey

01.12.06 - Martin Leaman

Second event - 1&2/02/07."

A "Kaizen event" is an exercise involving the analysis of a particular activity and seeing how it can be improved^[9]. The first Kaizen event recorded here took place before the fire on 12 December 2006. The second occurred just after the incident on 29 January 2007.

71. It is quite clear from these notes that Mr. Hunt did not say anything to Mr. Boyle about the fire risk identified in his Long Text. Of the six entries that he made in the SAP system on 2 February 2007, the only one that Mr. Hunt appears to have mentioned to Mr. Boyle is the one that says "Hot water element needs replacing".
72. I can conceive of only two possible reasons for this. The first is that Mr. Hunt was not prepared to reveal to Mr. Boyle that he had given this warning about the fire risk on 2 February 2007. The second is that, by the time Mr. Hunt spoke to Mr. Boyle, and after he had entered the Long Text, he had been made aware by one means or another that the thermolevel in the hot water tank had been checked and was thought to be functioning properly or, alternatively, was to be replaced.
73. The other curious feature of Mr. Hunt's text is that it refers to "a fire" and not to "two fires". In my judgment this cannot have been an accident: if Mr. Hunt knew that there had been two previous fires caused by the failure of a thermolevel, he would surely have said so. I consider that the only inference to be drawn from the reference to "fire" - in the singular - is that Mr. Hunt was unaware of one or other of the two incidents that occurred on 12 December 2006 and 29/30 January 2007. If Mr. Hunt had been aware of the incident on 29 January 2007, immediately before his second Kaizen event, I would have expected him to mention it during his interview with Mr. Boyle. On the balance of probability, therefore, I consider that the previous fire to which he referred in his long text was the small fire that occurred on 12 December 2006, the occurrence of which was fairly widely known^[10].
74. In its closing submissions EDL described Mr. Hunt's interview with Mr. Boyle as providing a "highly selective history of events" - by implication suggesting that he was not being wholly truthful. I have already mentioned this possibility, but I consider that the alternative explanation that I have set out above is much more likely.
75. It is interesting also that, although Mr. Moxey was involved in the second Kaizen event, he appears to have said nothing about the incident on 29 January 2007 apart, possibly, from mentioning that there were shortcomings in the heater for the hot water tank.
76. In the context of this litigation, the existence of Mr. Hunt's Long Text emerged for the first time when Mr. Webber made a second witness statement dated 15 November 2013. In this statement he referred to Mr. Hunt's Long Text and quoted it in full. As I understand the position, it was not until shortly before the preparation of this witness statement that those conducting the litigation on behalf of Howmet became aware of this long text. Mr. Webber signed his second witness statement six days before the meeting of the fire experts, which took place on 21 November 2013. There is no reference to any of Mr. Hunt's entries in the SAP system in the notes of that meeting, so I consider that it can be safely inferred that none of the experts present was aware of them. Mr. Boyle was unable to recall precisely when he received that witness statement (he said that he would have to check the e-mails on his computer in order to find out).
77. It is a surprising feature of the expert evidence generally, and not just that of Mr. Boyle, that Mr. Hunt's entry on the SAP system was seemingly not considered or raised by any of the experts. Whilst it is possible that Mr. Webber's statement may not have been made available to the fire experts before their first meeting on 21 November 2013, they must have had it by the time they signed their joint statement on 23 January 2014. The joint statement of the electrical experts was signed on 18 December 2013, and that of the process experts on 24 January 2014.

The witnesses

Mr. Damon Gill

78. Mr. Damon Gill was employed by Howmet for 25 years, from 1986 to 2011. He is an electrical engineer. He was appointed Facilities Manager in 2003, which was the position he held at the time of the fire. In his capacity as Facilities Manager he was in charge of the Plant Engineering Team and the Maintenance Team.
79. When he was first appointed Facilities Manager he reported to the Deputy General Manager, Mr. Simon Farrimond. From the beginning of 2007 he also reported directly to Mr. Roger Hambleton. Apart from Mr. Farrimond, he was the most senior of Howmet's employees at the time of the fire to give evidence.
80. He was taken at some length during cross-examination through the procurement process for the new GEL and then through the various faults that developed when the line was first put into service. The events about which he was being asked occurred over seven years ago and so it would be unrealistic to expect him to have much recollection of the detail of some of those events.
81. I thought that Mr. Gill was an honest witness, although he was somewhat reluctant to concede points against Howmet's interests until he was driven into a position that really left him with no alternative. The following passage in his cross-examination by Mr. Bartlett (at Day 2/104-5) provides a good example of this:

"Q. Whatever the details were, this incident demonstrated to you and to everyone who received Mr. Hughes' e-mail that the Therm-o-level wasn't a fail-safe device, didn't it? In other words, when it failed, it didn't fail in such a way that the heater went to a safe condition of being on?

A. Well, yes, but our understanding was that it should be a fail-safe device. It should fail - if the plug had corroded, the heater should stop working, you know.

Q. Yes, if the plug corroded so that a connection was broken, you're saying with a fail-safe device, that would mean the heater would stop working?

A. Yes.

Q. What this incident showed you was that the heater didn't stop working?

A. Our understanding was that it should be a fail-safe device. It became apparent that it probably had issues around its integrity as a fail-safe device.

Q. So it became apparent that it wasn't?

A. Well, there were concerns about its integrity as a fail-safe device.

Q. Well, it was clear to you -

A. Our confidence in it as a fail-safe device.

Q. It was clear to you it hadn't failed safe on that occasion?

A. Yes, it was clear then."

82. Much of his cross-examination was by reference to Mr. Boyle's notes of interviews with various Howmet employees (including Mr. Gill himself). Mr. Gill was, of course, in no position to confirm the accuracy of any of these interview notes, apart from those of the interview with him (as were other witnesses who were cross-examined in the same manner). For the reasons that I have already given, I bear in mind that notes of what other people are recorded as having said to an expert must always be treated with some circumspection.
83. Mr. Gill's recollection of the procurement process was sketchy, but he did not seem unduly concerned at the apparent absence of a specification for the contract to supply and install the new GEL. He took the view that ECS could be relied on to provide appropriate equipment in accordance with good industry practice. I found this view rather surprising.
84. When pressed, after a detailed tour of the relevant contemporaneous documents, Mr. Gill was not prepared to disagree that, by early February 2007, the risk of a fire being caused in the GEL as a result of the failure of a thermolevel to operate properly was obvious. On the basis of the documents that he was shown, this concession was, with hindsight, pretty much inevitable.

Mr. Simon Farrimond

85. Mr. Simon Farrimond was the Precast Manufacturing Manager, although at the time of the events leading up to the fire he acted as de facto deputy General Manager when the General Manager, Mr. Roger Hambleton, was not on site.
86. Mr. Farrimond gave evidence by video link because he was abroad. He struck me as an honest and authoritative witness. He said that he spent about 50% of his time on the factory floor and that Howmet was a very "hands-on" company. He spoke to Mr. Gill most days, and had a meeting with him once a week to discuss any matters that Mr. Farrimond might wish to raise at the weekly meeting of the senior management. He said that the atmosphere at Howmet was such that anyone could come and talk to him at any time.
87. He said that he saw his relationship with Mr. Gill partly as that of a coach and mentor and that he would have expected Mr. Gill to tell him about any relevant issue in relation to safety: indeed, he agreed that it would have been Mr. Gill's duty to do so.
88. He was challenged about a reference in his witness statement to the old GEL being not safe to run. He said that this depended on what one meant by unsafe. He said that it was very tired and needed replacing and that it would have been unsafe for the operators if they were working on it without protective clothing. In his view the use of protective clothing amounted to an appropriate counter-measure. Mr. Antelme pressed him as to what he meant by the line being not safe to run, and he said that what he meant was that it would not be safe to continue to run it in that condition.
89. Whilst Mr. Antelme's line of questioning was entirely fair, what I think that Mr. Farrimond meant in both his witness statement and his evidence was that the old line was not safe to work on unless special precautions were taken which, so far as the maintenance staff were concerned, meant the wearing of chemical proof protective clothing. With full protective clothing, Mr. Farrimond said, there was no risk of injury from any escape of chemicals from the tanks. Whilst it is clear that the old GEL was not in a satisfactory condition, I am not prepared to find that Howmet continued to run it in circumstances that presented a risk of injury to their employees. Of course the maintenance staff would not like working on it if it meant having to wear full protective clothing: it is doubtless tiresome to work in and probably pretty uncomfortable.
90. Mr. Farrimond accepted that fire would be a risk on the new GEL, particularly as a result of any electrical failure, but that it was just one of many risks that existed. He did not know the cause of the fire on the old GEL that took place in 1994-95.
91. When he was asked about the small fire on 12 December 2006 he said that he did not think at the time that this incident showed that the thermolevel was not a failsafe device, although when pressed he conceded that that must have been the case and that it would have been obvious to any engineer if he had specifically asked himself that question.
92. When he was asked about Howmet's decision to continue to run the new GEL following the fire on 12 December 2006, he gave these answers (at Day 3/85-86):

"Q. So, putting those two together, there was an obvious risk of a fire?

A. Well, that's where we disagree, because at the time I did not believe that there was a risk of a fire. Had we believed there was, we wouldn't have released the equipment.

Q. Well, did you not think there was a chance that the operators would not follow their procedures?

A. No.

Q. You thought they would?

A. Yes.

Q. Exactly, yes.

A. Because we had an incident, so they would follow them.

Q. So you believed there wasn't a risk of fire because you believed that the operators would follow their procedures?

A. And we had an engineer working on the problem, yes.

Q. Well, while the engineer was working on the problem, you didn't have a solution, so on the electrical/mechanical side, that was still under investigation, but I understand that you decided that the operators carrying out the procedures properly was sufficient to guard against fire?

A. Correct.

Q. That remained the position until the major fire?

A. Correct."

93. Mr. Farrimond agreed also that there were ongoing problems with corrosion affecting the plugs and sockets to which the thermolevels were connected and that this problem was still being worked on up to the time of the fire. Mr. Farrimond said that he was not aware of the further incident that occurred on 29 January 2007. I accept his evidence about this.
94. He was asked about the Long Text that Mr. Hunt posted on the SAP system suggesting that, a fire having already occurred because the hot water tank did not turn off when the water level was low, this could happen again. He said that as far as he could recall Mr. Hunt did not raise his concern with him, which he would have expected him to have done if he thought that there was an immediate fire risk. He concluded his evidence by saying this (Day 3/100):

"A. ... I can only keep repeating to you that the safety culture in the business is extreme, and I can give you examples where I have shut equipment down, the alloy furnaces at the alloy plant were shut. Last year we had an incident at the Hampton plant where four of the inspection lines, I shut those down because we had an accident on one of them and so I shut all four of them down, so we could be sure that we didn't have risk on the other three. I can only say to you had we been aware that there was a risk, it would not have been ignored. It would have been dealt with and shutting the line down, we have a good history of doing that. We're not afraid to do that, even at the cost of manufacturing."

95. I see no reason to doubt Mr. Farrimond's evidence on this or, indeed, any of the other matters about which he gave evidence. He struck me as truthful and sincere and I conclude that he, like others, had not appreciated the full implications of the fire on 12 December 2006, namely that it showed that the thermolevel was not a failsafe device. I suspect that Mr. Farrimond, and others at Howmet, somehow formed the view that because the problem identified on 12 December 2006 concerned corrosion at a plug and socket to which the thermolevel was connected, that there was really nothing wrong with the thermolevel itself.

Mr. Roger Gildersleve

96. Mr. Gildersleve was and is the Plant Engineering Manager at Howmet, a position that he has held since 1993. At the time of the fire he supervised about four engineers, one of whom was Mr. Reed. At the time of the fire his particular role was to oversee capital projects for new equipment and any improvements to existing plant or equipment. He was not well enough to attend court and so his evidence was given by video link. Unfortunately, the arrangements for the link were not very satisfactory and it was not possible for me to observe his demeanour in any useful way.^[11]
97. Nevertheless, I formed the impression that Mr. Gildersleve was a reasonably straightforward witness who gave his evidence honestly. He was, perhaps, a little easily led, particularly under skilful cross-examination, but that may in part have been attributable to his state of health. His evidence did not prove to be particularly controversial and was in large measure to similar effect to that given by Mr. Farrimond.
98. Several witnesses, including Mr. Gildersleve, were asked about an e-mail that was sent by Mr. Hughes to various Howmet employees at 20:36 on 12 December 2006. This included the following passage:

"Rod called Roger Gildersleve who attended plant.

Roger and Peter Reed made an investigation into the event which appeared to have happened partly due to electrical/mechanical failure.

They may also be partly due to operator procedural/training issues.

As we now need to establish root causes and I would suggest the following ownership.

Establishing any electrical/mechanical failures R Gildersleve/P Reed

Establishing any operator training/compliance issues D Vayle/N Cartwright.

You may wish to formally review and discuss the incident and set the timescales for responses, actions and any notifications (major incident) ?? required."

99. In his witness statement Mr. Gildersleve had said that Mr. Reed had investigated and found corrosion on the plug and socket of the thermolevel which had failed to operate. Mr. Boyle interviewed Mr. Gildersleve about three months after the February 2007 fire. As with many of the other interviews, a transcript of his notes of the interview was in the trial bundle. He recorded Mr. Gildersleve as having said this:

"On 12 Dec I was on my way home when I received a phone call. Rod Turner rang me and told me that there had been a minor fire in the grain etch area. I came into work. I was surprised. The heaters on the hot water tank had caused a problem. I didn't look at the heaters, made sure everything was safe, left relevant people to isolate cause and fix problem. At this time all production is going through this piece of equipment. The old line had been shut down.

I'm not sure who was working on it from a mtce [maintenance] point but PR was on shift and was dealing with it.

I spoke to PR before he finished his shift at 10 pm. The original assumption was it was a level probe problem. PR investigated and found that the probe was operating satisfactorily but he discovered corrosion on the plug and socket. He stripped it down and cleaned it up and re-soldered some of the pins and checked all the other plugs and sockets and then wrapped all the plugs and sockets with heatshrink. This was all done that evening. There was no further formal investigation by plant engineering.

I was satisfied that the problem had been found. I didn't arrange for any additional measures to be put in place."

Mr. Gildersleve confirmed that this was a reliable account of what had happened, and I accept it.

100. In evidence (Day 3/147-8) Mr. Gildersleve said this:

"A. ... He [Mr. Reed] would be working through to 10 o'clock because of another project that he was on so he took it on to actually carry out the investigation within the equipment and to find out the cause of the problem within the hot water tank area and, if possible, put a fix in place.

I spoke to Peter later in the evening and he told me what he had done, which was he had carried out a systematic, in my opinion, a systematic diagnosis where he had moved the probe into another tank to ensure that it was functioning correctly, which it was, and then he looked further and found that there was a corrosion situation in the plug and socket assembly which connects the probe through the thermolevel control unit."

101. It seemed to me that it was being suggested to both Mr. Gildersleve and Mr. Farrimond in cross-examination that the corrosion problem had already been discovered by the time that Mr. Hughes sent his e-mail at 20:36 hours on 12 December 2006, so that it remained to carry out an investigation into the root cause. The suggestion was then made that the investigation into the root cause was never carried out. Mr. Antelme was at pains to establish in cross-examination the difference between an immediate cause, in this case said to be the corrosion, and the root cause, perhaps being that the system was not failsafe. Mr. Antelme's analysis of the true root cause of this incident may well be correct, but in my opinion what is relevant for present purposes is how the situation was seen and understood by those on the ground at the time.
102. What Mr. Gildersleve said was this (Day 3/151):

"I was firmly of the belief, as were various other people, including, I believe, the health and safety manager, that we had actually found a root cause of the problem and had put something in place to avoid a repercussion of the incident."

I find that it was understandable of Mr. Gildersleve to have left the site that evening under the impression that the probe was functioning correctly and that the problem lay with the connection in the lead between the probe and its control box. (For the reasons given later in this judgment, I find that this connection had been made because the original lead was not long enough.) However, in cross-examination Mr. Gildersleve did accept that, with hindsight, he should have appreciated at the time that the thermolevel was not a failsafe device (Day 3/155).

103. Mr. Gildersleve also accepted in cross-examination that on the GEL it would not be appropriate to use components that were not guaranteed to be failsafe (Day 3/119). However, he said that Howmet left it to the supplier, ECS, to provide equipment that was suitable. Mr. Gildersleve also conceded that it looked as if the GEL had been in production for about four months without going through the process of completing the start up PESHR. This was the second stage of the PESHR, the first being the concept stage at which the requirements for the line were set by Howmet. The purpose of the start up stage was to check that all the requirements identified at the concept stage had been met. It seems that this had not been done by the time of the fire in February 2007.
104. Although, for the reasons that I have already given, the evidence of Mr. Gildersleve was given under slightly unsatisfactory circumstances, I thought that he was a truthful witness and I see no reason not to accept his evidence.

Mr. Paul Webber

105. Mr. Webber is and was a Maintenance Supervisor in the Maintenance Team. He has been with Howmet for 40 years. He reported to Mr. Gill. He described the SAP system as enabling the operators to request assistance from the Maintenance Team. He said that the issues raised on the system would be reviewed by the Maintenance Team at the end of each shift, but he said there could be 50 to 100 notifications a day, and so the Maintenance Team tended to pay more attention to the e-mails sent from the shift operators. He said that the SAP system was really used to create a job ticket which would enable the appropriate spare parts to be booked out of the store (Day 4/162-3). He said that he would have expected Mr. Hunt's entries to have been seen by the Maintenance Team.
106. In his witness statement he said that the old GEL had been "… around 20 years and was not safe" because of the potential for chemicals to spill out of the tanks. He said that members of his team often came to him to complain about the problems. He used to take up these issues with Mr. Gill.
107. He said that in relation to the new GEL he was the Maintenance Team's representative involved in the design. He said that he had visited a grain etch line that ECS had built for another customer and had been impressed by it. He said that he understood that the thermolevel could measure the temperature and level of liquid in the tanks, but he left it to ECS and MJD to investigate the suitability of the thermolevel for the GEL.
108. In relation to the fire on 12 December 2006, Mr. Webber said this (at paragraph 37 of his witness statement):

"My understanding was that the fire was caused because the Therm-o-level had failed to operate. Peter Reed had investigated the cause of the fire and worked out what the problem was with the Therm-o-level. No action was required by the Maintenance Team although of course we helped Peter out where we could."

A little later he said that the plugs on the thermolevel had to be changed a number of times because they kept corroding.

109. On the basis of a note of a conversation that he had with Mr. Boyle on 15 May 2007, Mr. Webber agreed that at some point he had been concerned about the heating elements catching fire and that he had said to someone, probably Mr. Gildersleve, that something needed to be done and was told that they were looking to replace the level probe (Day 4/160).
110. When asked about his second witness statement, which dealt with Mr. Hunt's entry on the SAP, he said that he did not recall seeing Mr. Hunt's entry or discussing the matter with Mr. Hunt. He said that since at that time the GEL had not been handed over to the Maintenance Team and was still in the control of Plant Engineering, it is likely that Mr. Hunt would have contacted Mr. Gildersleve or Mr. Reed to report the problem with the hot water tank.
111. Mr. Webber believed that the fire that occurred in 1994-95 was in the GEL extraction system. He said he that he did not know what caused the fire but he knew that it was in the ducting. He had no recollection of a heater setting fire to a tank and that this did not accord with his recollection of what happened.
112. He was asked about Mr. Boyle's notes of a conversation with an electrician, Mr. Andy Darke, and it was suggested to him that Mr. Darke might have been one of the people who had not been trained which would explain why he did not know that the probes needed to be stood upright. Quite unprompted, Mr. Webber volunteered this comment (at Day 4/142):

"It's possible. Andy is the sort of guy who makes it his business to know about most things. I would be surprised, but things pass by. It's a busy factory so it's possible he didn't get trained. I don't know."

113. Overall, Mr. Webber struck me as an honest witness, although I found his evidence to be of relatively limited assistance in resolving the main factual issues in dispute.

Mr. Chris Hughes

114. Mr. Hughes is a Senior Health and Safety Technician at Howmet. Having originally worked as an operator he moved to the Health and Safety Department over ten years ago. In his witness statement he explained the use of a lock, tag and verify system ("LTV system"), which involved isolating the power to a production line secured by a yellow padlock. The key to that padlock was then secured so that only trained personnel had access to it.
115. Mr. Hughes was on shift at the time of the fire on 12 December 2006. He was telephoned by Danny Vayle, the Post-Casting Supervisor, at about 5:45 pm and told that there was a small fire in the GEL. He said that they were attempting to put it out themselves and wanted to know whether the factory should be evacuated. Since Mr. Hughes was fairly nearby at the time, he said that he would come straight away. By the time he arrived at the scene the fire had been put out by Mr. Vayle and Mr. Lemon, the operator who had discovered the fire. It had started in a hot water tank which Mr. Lemon had been emptying at the time. Mr. Hughes arranged for the power to the GEL to be isolated, but he did not use the LTV system.
116. Shortly afterwards, Mr. Hughes sent an e-mail to ten addressees which included, amongst others, Mr. Farrimond, Mr. Gill and Mr. Gildersleve. I have already quoted extracts from this e-mail of 12 December 2006, but since it is important I will set it out again in full. It was timed at 20:36. It read as follows:

"Gentlemen,

As you will be aware, last night there was a fire in one of the grain etch tanks.

Thanks to the prompt action from Danny Vale, a plant evacuation and a visit from the fire services was avoided.

Rapid responses were forthcoming from Plant Engineering and Maintenance.

An overview of the events are detailed below.

At 17:46 I received a call on the mobile from Danny Vayle Pre finishing supervisor saying that there was a fire on the grain etch line.

I made my way to the line calling in on Richard Easterbrook in the Foundry asking him to contact Maintenance as we had a fire on the grain etch line.

When I arrived at the line Danny Vayle and the operator (D Lemon) had extinguished the fire which had taken hold in one of the water tanks being emptied.

The fire itself being contained in the tank and emanating from the tank heaters.

When I arrived the operator (D Lemon) stated that he thought the tanks had a "level cut out" on which is why he did not turn off the heater prior to empting [sic] the tank.

(As I understand it the tank is fitted with a 'level cut out' but the probe had failed.

According to the procedure the operator should also have turned off the heaters prior to emptying the tank

The black file containing the procedure was not available on the line but was later retrieved from Plant engineering)

Maintenance (M Pardey and M Holmes) arrived shortly afterwards armed with fire extinguishers.

I requested the operator to turn off the power to the line which he did.

The fire was confirmed to be out and after an inspection of the area and tank with Maintenance (Mark Pardey) it was decided to leave the tank and heaters to cool and allow any fumes to dissipate.

I then called Rod Turner to advise him of the incident.

Rod called Roger Gildersleve who attended plant.

Roger and Peter Reed made an investigation into the event which appeared to have happened partly due to electrical/mechanical failure.

They may also be partly due to operator procedural/training issues.

As we now need to establish root causes and I would suggest the following ownership.

Establishing any electrical/mechanical failures R Gildersleve/P Reed

Establishing any operator training/compliance issues D Vayle/N Cartwright.

You may wish to formally review and discuss the incident and set timescales for responses, actions and any notifications (major incident)?? required."

117. By way of clarification, Mr. Hughes explained that he referred to the fire as having occurred "last night" because he anticipated that the majority of the recipients of his e-mail would not see it until the following day. There is no doubt that it occurred on 12 December 2006.
118. Mr. Hughes said in his witness statement that sometime after the incident he had a conversation with Mr. Reed about the cause of the fire. He understood that Mr. Reed had replaced the thermolevel with another one and had rectified the fault. However, he said in evidence that by the time he sent the e-mail no-one had come back to him with the results of any investigation (Day 4/28). He said that he did not have any discussion with Mr. Lemon about his practice at the time of draining a tank without switching off the heater beyond what was set out in the e-mail. His evidence about Mr. Reed replacing the thermolevel does not accord with other evidence, but I accept that Mr. Hughes thought that, by one means or another, the problem had been solved.
119. Mr. Hughes agreed in cross-examination that there was a difference between an immediate cause and the root cause, and that a root cause investigation should look at the question: how is it that when the single component fails, for whatever reason, a fire can occur? It was suggested to Mr. Hughes that when he sent his e-mail the investigation to which he referred had been completed. Mr. Hughes said that he had not been told that it had been completed; he knew that an investigation had been started but no-one had come back to him with any results and so he was not aware that it been completed (Day 4/27-28).
120. Mr. Hughes agreed that there was a pretty approachable atmosphere at Howmet and that there was an open culture. He said that he had some recollection of there being an earlier fire on the old grain etch line but he did not know the cause of it.
121. The evidence of Mr. Hughes was not really challenged, save for the extent to which the investigation into the cause of the fire had been completed by the time he sent his e-mail: on this point I accept his evidence as summarised above, which is consistent with that of Mr. Gildersleve.
122. It is convenient at this point to draw the threads together in relation to the events of 12 December 2006. I find that the correct sequence of events was this. The first assumption was that the incident had been caused by a combination of a problem with the thermolevel and the fact that the tank had been drained down without first switching off the heater. This was the position as it was probably understood by Mr. Hughes at the time when he wrote his e-mail: that would explain why his e-mail referred in rather general terms to an electrical/mechanical failure and said nothing about corrosion. Meanwhile, and probably at about the same time, Mr. Reed was discovering the corrosion on the plug and socket connecting the probe to its control box and had started to take steps to fix it. So when Mr. Gildersleve spoke to Mr. Reed at the end of his shift that evening he thought that the cause of the problem had been found. It was therefore unnecessary, as he saw it, to carry out an investigation to discover the root cause, because it had already been found. It may be, as Mr. Antelme suggested in cross-examination, that an investigation into the root cause would not stop at the discovery of the corrosion, but I find that that is not how the people on the ground saw matters at the time.

Mr. Rodney Turner

123. Mr. Turner was the Health and Safety Manager at Howmet between 1992 and 2010, when he left the company. He is now a self-employed Health and Safety consultant. He supervised Mr. Hughes and reported directly to the Quality Control Manager. He was not involved in either the design or the installation of the new GEL. He explained the Request for Approval process and how the pre-approval PESHR was a document that required the consideration of a number of health and safety issues prior to the procurement of any new equipment. He explained also that there was a start up PESHR, but he was unable to recall whether or not the start up PESHR had been completed by the time of the fire.
124. He explained in his witness statement that he understood that the fire on 12 December 2006 had been caused by the thermolevel failing to turn off the heater in the hot water tank and that the problem had been investigated and resolved by Mr. Reed, following which the GEL was put back into production. He said that there was some discussion between himself and Mr. Farrimond as to whether the fire should be classified as a "major incident" as defined in the company's procedures and it was decided that it did not meet the relevant criteria.
125. He said that after the fire he discussed it with Mr. Gill and Mr. Gildersleve who told him that Mr. Reed was making further investigations into why the thermolevel had failed and had been in contact with ECS. He said that he did not consider that there was an imminent risk of such an incident occurring again. Had he done so, he would have not hesitated to shut down the line. He said that he had a vague recollection that there was a further incident in January 2007 relating to the burning out of a heater, but he could not recall the details.
126. Mr. Turner said that he had had concerns about the safe operation of the old GEL which he had discussed with Mr. Webber. But he said that Howmet put in counter-measures to control the risks so that they were not running the line in an unsafe manner (Day 4/57). He agreed that Mr. Webber had raised valid points, to which the response was to make sure that they controlled the risks. However, the line still needed to be replaced.
127. Mr. Turner agreed that the new GEL presented a fire risk if the tanks were made of a flammable material, which they were. He agreed that there should have been further risk assessments but that there did not appear to have been any. He agreed also that if there were no risk assessments during the first three months when the new GEL was in operation that would have been a fundamental disregard for the basic principles of safety in a factory. But he said that it was now seven or eight years ago and he was not in a position to say what happened. He accepted that it would have been his responsibility to make sure that the line was stopped until appropriate risk assessments had been carried out. It was suggested to him that if a proper risk assessment had been carried out Howmet would have identified the risk before it ever occurred. Mr. Turner said that he was not sure about this because his understanding was that the equipment failed safe (Day 4/74). He said that he thought that the GEL would have been designed with appropriate isolation points to enable an LTV system to be applied. However, he was unable to say whether or not such a system was applied.
128. Mr. Turner agreed that one of the assumptions made about the GEL as reflected in the PESHR was that all electrical controls would be failsafe. He agreed that if an investigation had shown that the thermolevel was not a failsafe device, steps would have been taken to address the problem. He agreed that with the benefit of hindsight his view that there was not an imminent risk of fire was incorrect.
129. In this context, when it was suggested to Mr. Turner that throughout the period leading up to the fire in February 2007 he was content to rely on the operators doing their job properly pending Mr. Reed completing an investigation, Mr. Turner said that the information was arriving in bits and pieces so that its significance may not have been appreciated. He then said this (Day 4/102):

"A. No, I am not saying it wouldn't have struck me as important, but my perception of risk might have been different to seeing it all in front of me now, rather than bits coming in on a daily basis or weekly basis."

130. In my judgment, this is an important observation. It is all too easy - as a forensic exercise - to assemble disparate pieces of information and then, with the benefit of hindsight, conclude that such and such a consequence must have been obvious at the time. When considering such a situation it is in my view important for the court to bear in mind two things. First, as Mr. Turner pointed out, information coming in bit by bit does not always have the same impact as it does when all the information arrives at once. Second, it is sometimes the case, and I am sure that it was the case here, that not every bit of information is known to every participant.
131. In re-examination Mr. Turner said that he recalled only one fire in the old grain etch line, and that was associated with the extraction system. In addition, he said that he thought that he did not hear of the January 2007 incident until after the major fire in February 2007. I have no reason to doubt his evidence on either of these points.

The experts

Mr. Jonathan Boyle

132. Mr. Boyle has the qualifications of BEng and MEng and is a member of the Institution of Engineering Technicians ("MIET"). He is a Principal Associate of Hawkins and Associates, the well known forensic investigators, having formerly worked as an engineer with ICI and Terra Nitrogen (UK) Ltd.
133. He was instructed within a day of the fire on 12 February 2007 and attended Howmet's factory in Exeter on 13/14 February. He returned again on 26 February and again on 14-18 May 2007. On each of these occasions he interviewed a number of Howmet's employees, probably about 30 in all. He made fairly full notes of these interviews, most of which have been transcribed, which were the subject of considerable analysis at the trial. Most of those interviewed did not give evidence, so I will have to consider the weight that is to be given to what these various employees told Mr. Boyle. In almost all cases, the accuracy of Mr. Boyle's notes has not been challenged.
134. On the whole, I thought that Mr. Boyle was a good, thorough and careful expert whose evidence was objective. However, there was one troubling aspect of his evidence and, indeed, that was not confined to his evidence alone. It relates to the SAP entry made by Mr. Hunt. I deal with it below.
135. On a few occasions during his evidence Mr. Bartlett challenged Mr. Boyle's objectivity as a witness. The most serious of these was in fact based on an error made by Mr. Bartlett, and Mr. Bartlett readily withdrew it when this was pointed out. However, there were two or three other occasions on which Mr. Bartlett challenged Mr. Boyle's adherence to his duties as an expert. The first related to Mr. Boyle's description in his report of how a witness had said that he saw flames coming from "… either the centre tank or one nearer to the control panel". His note of his interview with this operator, a Mr. Marson, read as follows: "Possibly centre tank or one nearer to control panel". It was suggested that the omission of the word "possibly" in his report made a "pretty big difference". Mr. Boyle dealt with it robustly by saying that the meaning of his note was that it was either one tank or the other. I have to say that seems to me to be a perfectly good response.
136. In the face of an indication from the court that this might not be a good point, Mr. Bartlett immediately switched his attack to a point about the use of heat shrink tape by Mr. Reed when replacing the plug and socket connection on the probe lead with a soldered joint. The passage in his cross-examination went as follows:

"Q. ... We don't see any reference in your notes to the use of adhesive heat shrink, do we?

A. I don't know.

Q. Well, there are two kinds, aren't there? There are two kinds of heat shrink, one of which has adhesive and one doesn't?

A. Yes.

Q. And one is more expensive than the other?

A. Yes. Probably. I don't know.

Q. When you were telling his Lordship about what you understood Mr. Reed to have done, you simply assumed that he had used the adhesive kind?

A. I did assume, yes.

Q. You had no basis for that assumption, did you?

A. No.

Q. If you had no basis for that assumption, why did you make it?

A. Because I think it's likely that Mr. Reed being -- he came across as a very competent technician, that he would have used adhesive heat shrink. It's very rare that you would use any other kind of heat shrink."

137. In fact, Mr. Boyle's earlier evidence, when explaining how the heat shrink was applied, went as follows:

"A. ... You make the solder connection and then you slide the tube over the whole lot, and then you use a heat source to just warm it up.

MR. JUSTICE EDWARDS-STUART: What, a hairdryer, as it were?

A. Yes, and the tube shrinks and it has adhesive on the inside of the tube usually.

MR. JUSTICE EDWARDS-STUART: Yes.

A. So that it shrinks tightly around the cable and it also sticks to the cable.

MR. JUSTICE EDWARDS-STUART: Yes, I see.

A. So, done correctly, it's a very robust connection.

MR. BARTLETT: I think it follows that you agree with the next sentence, which is that if these were insufficient, that is if the soldering wasn't done well, or if the use of the shrink wrap wasn't done well, then the connection would have remained susceptible to damage caused by a humid and/or corrosive atmosphere?

A. Well, there is quite a lot of ifs there.

Q. Yes, there are. They are quite deliberate, because I think the principle is clear, isn't it?

A. Well --

Q. If it wasn't done well.

A. Mr. Reed was an experienced sort of technician working with Howmet. He was familiar with the environment in which the equipment had to operate. I would expect him to be able to do a joint and heat shrink it in a manner which made it a robust connection.

MR. JUSTICE EDWARDS-STUART: Sorry, do you want to just pause for a moment. Okay. Carry on.

A. My Lord, I would expect Mr. Reed to be in a good position to know and to have completed a good joint on that cable.

MR. BARTLETT: You might but we might not, because he's not a witness. So could you please answer the question instead, which is on a hypothetical basis because he's not here as a witness, which was if he didn't do the soldering well or if he didn't do the shrink wrap well, an in-line soldered connection could have been susceptible to damage caused by a humid or corrosive atmosphere in the grain etch line?

A. Yes.

Q. Thank you. You were not trying to argue the claimant's case, were you, when you talked about how well you think Mr. Reed would have done it?

A. I don't think so, no. I was just merely -- I have met Mr. Reed. He came across as a competent technician.

Q. Moving on to the next point, it's right, isn't it, that solder joints are not flexible so strain on or flexing of a cable can damage a solder joint?

A. The actual soldered joint where the action between the two conductors is not flexible, no. So you get a small region which is inflexible.

Q. So strain on or flexing of a cable can damage a soldered joint?

A. Well, it can, but if you have -- heat shrink provides a robust sort of mechanical basis for that connection. So you are not relying on -- the solder joint effectively provides some of the mechanical strength, but primarily it is for the electrical strength. So the heat shrink would affect -- because it's got adhesive, if that's the type of heat shrink he used, which it almost certainly was, the adhesive and the heat shrink provides the mechanical strength of the joint.

Q. So your answer is: yes but remember that heat shrink helps with the mechanical strength?

A. Yes."

138. In my view Mr. Boyle's evidence about this was entirely fair. I do not consider for one moment that he was trying to argue Howmet's case. In the earlier passage he had made it clear that he was assuming that adhesive heat shrink had been used because that is what he would have expected a competent electrician to use. Mr. Boyle is an experienced investigator and I would expect him to know a competent technician when he saw one. I see nothing wrong in an expert placing reliance on evidence that in his assessment is coming from a competent and reliable source. I reject EDL's criticism of Mr. Boyle insofar as it is based on this evidence.
139. In fact, it was only thanks to the thoroughness with which Mr. Boyle carried out and recorded his investigation that EDL had so much material on which it could cross-examine. I find it a little ironic that in these circumstances it chose to challenge Mr. Boyle's credibility.
140. Mr. Boyle was cross-examined at some length on his failure to mention Mr. Hunt's entry in the SAP system and I thought that he was not really able to provide a very satisfactory explanation for having apparently disregarded it. All he was able to say was that, looking back on it, he should have found out why Mr. Hunt had made the entry and the basis for his understanding that the thermolevel did not work. Mr. Boyle appears to have relied on information from what he described as the "people that are closest to the situation" and to use that information as the basis for his consideration of the cause of the fire. But it seems to me that any criticism of Mr. Boyle can be levelled equally at all the other experts: it seems that, for whatever reason, Mr. Hunt's entry in the SAP system was not something that they considered to be of any particular significance or relevance.

Mr. Stephen Braund

141. Mr. Stephen Braund is a Chartered Electrical Engineer who has a degree in Electrical and Electronic Engineering from UMIST. He too is a Principal Associate at Hawkins, by whom he has been employed since 2003. Prior to that he had experience in the defence and consumer electronics industries. He has practical working experience of the design of electronic products, such as electronic displays and sub-sea acoustic measurement systems. He was clearly well qualified to give evidence about the operation of the thermolevels.
142. In cross-examination he agreed that a device which is critical to safety needed to be failsafe, although he thought that it was not always possible to achieve that (Day 6/100-101). He agreed that immersion heaters with built in over-temperature cut-outs were readily available at modest cost.
143. Whilst he agreed that EDL's literature did not provide a clear assurance that the thermolevel was designed to deal with the situation when a heater is switched on in an empty tank, he said he thought that the reference to the probe being "out of liquid" would cover the situation when a tank was drained (Day 6/119). He then commented that having empty tanks in this type of process was very common and so he would have expected that to be a situation which the designer of a device like thermolevel would anticipate (Day 6/120, 125). It was his view that it was reasonable of MJD to assume that the thermolevel was safe, when in fact it was not (Day 6/133). However, he was critical of ECS in that he thought that they did not appear to have looked into the safety aspect, or at least to have considered the safety aspect carefully enough (Day 6/134).
144. He explained that there was a difference between long-term voltage drift, which could occur over a period of hours, and the time within which the thermolevel would respond after being switched on - which he said was half a second or so (Day 6/121).
145. Whilst Mr. Braund accepted that in general it was important to have a safety device that failed to safe, this would be less important if the device was extremely reliable (Day 6/135). He said later that he thought that the design for the GEL would have been adequate if the thermolevel had been reliable (Day 6/165-7). He explained that by "reliable" he meant a device that could be relied upon to perform its function with almost certainty, as in the case of some types of industrial switch (Day 6/165).
146. Whilst Mr. Braund had a little difficulty in reconciling some of the evidence that he gave in cross-examination with a statement made at paragraph 3.3 of the experts joint statement in relation to the role of ECS (for example, at Day 6/161-3), I thought that his evidence in relation to the functioning of the thermolevel, which was not really challenged, was reliable and I accept it.

Mr. Richard Ward

147. Mr. Ward is a Chartered Mechanical and Electrical Engineer who is an expert in process engineering. He is principal of the firm of Robert Bruce and Sons, Consulting Engineers, of which he has been a partner since 1973. He has more than 40 years' experience as a consulting engineer practising in the field of process plant engineering. He is clearly well qualified to give evidence on the process engineering aspects of this dispute. He prepared a report and a supplemental report.
148. Mr. Ward agreed in cross-examination that since the original PESHR specifically stated that failsafe was a requirement, there should have been a proper engineering justification for departing from it when the GEL was designed (Day 7/26). He confirmed that it was his view that the thermolevel was not suitable for safety critical duty and that it was not reasonable for ECS to rely on MJD and/or EDL to ensure that devices were adequately tested (Day 7/38). In relation to the Code of Practice, Mr. Ward said that since Howmet was not involved in either the electroplating or the surface finishing industry, it might not have come across the Code. However, he said that suppliers of equipment to the electroplating industry might well be aware of the grain etch process because it used similar equipment and similar processes, and that, as he understood the position, equipment suppliers to the electroplating industry would be likely to be considered suitable suppliers for a grain etch facility (Day 7/43-44).
149. Mr. Ward described the way in which the GEL was specified as "abominably unsatisfactory", which led him to question whether the relevant individuals at Howmet had any serious expertise in the matter of equipment at all (Day 7/53).
150. In relation to the need for failsafe equipment, Mr. Ward said this (at Day 7/68):

"... I think that the concept of failure to safety is one that in my experience is, I regret to say, not fully understood, even by some chartered engineers. I think that an ordinary person reading the Therm-o-level document might be led to the expectation that in our terminology this was a fail-safe device when in fact it isn't."

151. Mr. Ward was an expert who clearly knew what he was talking about and I thought that his evidence was authoritative, subject only to one small qualification. Like any other expert who is very knowledgeable in his field, it was sometimes difficult for him to put himself in the position of the ordinary engineer on a factory shop floor. However, in general - as the answer quoted above indicates - Mr. Ward seemed to have this point well in mind. I accept Mr. Ward's evidence which, for the most part, was not really challenged. Indeed, EDL relied on much of it.

The fire on the old grain etch line

152. EDL made much of a fire which occurred on the old grain etch line in the mid-1990s. Mr. Boyle interviewed a Mr. Lemon, the operator who was responsible for the fire in December 2006, who told him, according to Mr. Boyle's notes, that the fire on the old grain etch line about twelve years ago was caused when someone switched the heater on when the tank was empty. The drain valve was broken so the tank could not be re-filled. The heaters melted and set fire to the tank.
153. This version of events is very similar to the events of 12 February 2006, when Mr. Lemon drained the hot water tank without switching off the heater. Mr. Lemon did not give evidence but, since he appears to have been responsible for the fire in December 2006, he may have thought that it was in his interests to suggest that this was not first time that such a sequence of events had occurred.^[12] I do not suggest that he did so, but it does indicate that his version of events should be treated with an element of caution to the extent that it is not corroborated by other accounts.
154. EDL submitted that the version of events given by Mr. Lemon to Mr. Boyle about this incident should be preferred to the evidence about it of other witnesses who were actually called. In my view, EDL's submissions largely miss the point. In the context of the fire in February 2007 what matters is not how the fire in the mid-1990s actually occurred, but rather what the relevant Howmet employees knew about it in 2006/07.
155. In my view, the evidence establishes beyond doubt that there was no generally accepted understanding of the cause of the earlier fire. Those who thought that they knew how it started - Messrs Gildersleve, Turner and Webber - all said that it started in the extraction system of the old grain etch line. More than this they could not say. Messrs Farrimond, Gill and Hughes said that they could not recall any of the details about the earlier fire, merely that they were aware that there had been a fire on the old grain etch line in the 1990s.
156. Whether Mr. Lemon's account is right or wrong, I find as a fact that there was no general awareness amongst the operational management of Howmet in 2006/07 as to the cause of the fire in the mid-1990s, save that some people thought that it started in the extraction system. I can see no basis whatever for attributing Mr. Lemon's knowledge, if that is what it was, to Howmet as a company. Accordingly, I regard the occurrence of "the first fire", as EDL tendentiously insisted on calling it, as being, at best, of marginal relevance to the issues in the present case.

The extent to which employees of Howmet knew about the incident on 29 January 2007

157. It was EDL's submission that the events of 29 January 2007 were widely known: the list of people set out at paragraph 3(m) of its written closing submissions as being those who knew about it included Mr. Farrimond, Mr. Gill and Mr. Gildersleve. It submits that Mr. Darke told Mr. Gill what happened (which it says is clear from Mr. Boyle's notes) and that the matter was probably discussed when Mr. Darke went to Mr. Reed's office to fetch another heater when Mr. Gill, Mr. Gildersleve and Mr. Reed were present.
158. In evidence Mr. Boyle said this in relation to the events of 29 January 2007 (Day 5/181):

"A. The way this incident came out was quite interesting because most people in the first instance when I arrived at Howmet were not aware of it and it was only when I think Mr. Moxey or some gentleman mentioned something and said, oh, there was another incident, so I think this is the context of the incident and was kept quite closely between Mr. Darke and Mr. Palfrey.

Q. You do understand, don't you, Mr. Boyle, just to be clear that if in fact the evidence shows that virtually everybody was aware of it, it follows that the wool has been pulled over your eyes, doesn't it? Do you see that?

A. I don't know what the evidence - what other evidence you have seen."

159. I do not consider that there was a general conspiracy within Howmet to pull the wool over Mr. Boyle's eyes about the incident on 29 January 2007. I am not in a position to make any finding as to what Mr. Darke knew, but I accept the evidence of Mr. Gill that, following whatever Mr. Darke said to him, he did not appreciate that the incident involved a fire as had happened on 12 December 2006. I regard it as unlikely that either Mr. Farrimond or Mr. Gildersleve knew any more about it than Mr. Gill. As I have already explained, if Mr. Hunt knew about it I consider that he would have referred to "fires" in the plural when writing his Long Text on 2 February 2007. All this is entirely consistent with Mr. Boyle's description of how the details of the incident unfolded during his investigation. Accordingly, I reject EDL's conspiracy theory.
160. However, I accept that it is very likely that Mr. Reed knew about it, because he told Mr. Boyle on 26 February 2007 that there had been another problem in January with the hot water tank and that on that occasion he checked the level system and the low level alarm worked.

The testing of thermolevels by the experts

161. In June 2007 Mr. Boyle carried out a series of tests on some probes that had been provided to him by Howmet and which did not appear to have been used. He constructed a basic test rig consisting of a small plastic tank with a board across the top which was used to mount the probe in a vertical position. The tank was fitted with a cold water feed and a drain valve to enable the level of water in the tank to be raised or lowered at varying rates during the tests. Mr. Boyle used a ruler to measure the level of the water in the tank. An electric light was connected to the output of the control unit to simulate the presence of the heater.
162. During the first three tests with the first probe the control unit switched on and off as expected. However, when the water level was lowered on the fourth test the control unit did not switch off the light, even when the whole of the probe was exposed. Sometimes mechanical interference with the exposed probe, such as wiping or gently tapping it, caused it to reset the control unit and switch the light off. Tests on a second probe showed that it seemed to operate correctly.
163. Mr. Boyle then decided to see what happened if the sensitivity control to the second probe was adjusted. He found that when the potentiometer was turned clockwise the water level at which the control unit switched the light on and off increased: in other words, it was necessary to raise the water level in the tank to a higher level before the light would switch on and then the water level did not have to drop much before the light was switched off.
164. Mr. Boyle found that it was possible to set the potentiometer so that the light would be switched on when the water level was raised, but would only switch off intermittently when the water level was lowered. If the potentiometer was turned further anticlockwise the light came on as the water level was raised but did not switch off when the water level was lowered again. The light just remained on.
165. Mr. Boyle concluded from these tests that the operation of the low level cut-out for the thermolevel was highly dependent on the setting of the potentiometer or sensitivity control in the control unit. At one setting the instrument operated correctly; at another it operated intermittently when the water level was lowered - it might or might not switch off the light; and at yet another setting the light was switched on when the water level was raised but then remained on when the water level was lowered.
166. Mr. Boyle found also that the operation of the probe could be affected by its orientation and whether or not the silicon oil inside the probe covered the printed circuit board and the sensors. If it did not, and the effect of the potentiometer setting was to cause the probe to operate intermittently or to send an "on only" signal, inverting the probe had the effect of causing it to switch the light off.
167. Mr. Braund also carried out a series of tests. These were on four thermolevels with which he had been provided. His tests also showed that the correct setting of the sensitivity control was crucial to the proper operation of the thermolevel. However, he noted that the correct setting was achieved only within an angular range of about plus or minus 23° (out of a total angular range of 235°) and so accurate adjustment was very difficult to achieve in practice, particularly on a factory floor.
168. In addition to the correct operation of the probe being highly sensitive to the setting of the sensitivity control and the practical difficulty of adjusting that control, Mr. Braund found two other flaws in the design or construction of the thermolevel. First, if there was a break or a bad connection (say, through corrosion) in the five-volt DC feed to the probe, the heater control relay would be continually energised irrespective of the environment of the probe. Alternatively, if the core carrying the level sensing signal was broken or suffered from a bad connection, the heater control relay would become disabled. Only this mode of failure, therefore, was failsafe.
169. The second flaw was that the thermolevel suffered from voltage drift. That is to say that the voltage would change with time after the probe was switched on even though its environment did not alter. One of the probes tested by Mr. Braund showed a drop in voltage from 2.74v to 2.69v over one hour. The probe signal voltage also changed with temperature. For example, one probe produced a signal voltage of 2.70v at 16°C, but 2.62v at 95°C.
170. Tests on a further pair of thermolevels confirmed in general terms the existence of voltage drift. However, the overall conclusion by Mr. Braund was that there was little consistency or repeatability in the results of tests on different thermolevels, from which he concluded that the thermolevel was not a stable device.
171. None of this evidence was challenged or contradicted by any other experimental work, and so I accept it.

The joint statement of the electrical experts

172. Although the only electrical expert to give evidence was Mr. Braund, electrical experts had also been instructed on behalf of the ECS and EDL. Those experts met in accordance with directions given by the court and produced a joint statement dated 18 December 2013. The points on which they were agreed ran to 57 paragraphs. They agreed, amongst other things, the following:

"In our view, there ought to have been a robust and reliable automatic 'fail safe' device in the GEL to provide protection against low liquid level and overheating of the process heaters. Thermolevel did not provide robust and reliable fail safe protection." (Paragraph 2.12)

"The fact that an item of equipment has not been designed or shown (e.g. by test or certification) to comply with relevant Technical Standards does not mean that it would not meet those standards. However, where there is no compliance with relevant standards there would be an onus on the manufacturer to show by other means that the equipment is safe." (Paragraph 2.14)

"We consider that Thermolevel was unsuitable for use as a low liquid level sensing device in a safety-related application, because it had no safety approvals or CE marking, it was unreliable and it had uncertain operating characteristics." (Paragraph 2.22)

"In relation to adjustment of the 'sensitivity' control, Mr. Braund and Dr Lipczynsky consider that the precise setting is critical to the operation of the low level sensing function ... [EDL's] instructions did not indicate or state how critical the adjustment actually was." (Paragraph 2.27)

"The potential effect of mal-adjustment of the 'sensitivity' control would have been for the heaters to remain on warm, irrespective of the liquid level." (Paragraph 2.28)

"From a theoretical point of view, we would expect Thermolevel to have suffered from a degree of drift in operating characteristics eg. as a result of short-term thermal effects and long-term drift (ageing). This would have affected the level sensing function, but any such problems should have been insignificant if Thermolevel had been suitably designed. It would have been necessary to consider these effects in the design, commissioning and use of the GEL." (Paragraph 2.29)

"In our view, the literature published by ED for Thermolevel was inadequate as a reference for equipment selection and system design purposes in a safety-related application. The documentation supplied by ECS in relation to Thermolevel did not address any of those inadequacies." (Paragraph 2.37)

"We agree that MJD and ECS should have considered the possibility that Thermolevel might be unreliable and should have sought assurance from the manufacturer before using it in a safety-related application." (Paragraph 2.38)

173. In my judgment it is clear, both from the tests carried out by Mr. Boyle and Mr. Braund and from the extracts from the expert's joint statement that I have set out above, that the thermolevels produced by EDL were both unreliable and unpredictable in operation, which is not acceptable in a safety device. In addition, the thermolevel was difficult to set and the precise setting of the potentiometer was essential for proper operation. That, too, made it unsuitable as a safety critical device.
174. I now turn to what EDL said about it.

The material provided by EDL

175. EDL produced a two-page technical specification and a one-page document giving installation and operating instructions. The technical specification described the thermolevel as a "3kW TEMPERATURE CONTROLLER WITH BUILT IN LEVEL CUT OUT". It said that it was designed and built specifically for plating solutions. It said that the built-in level sensor:

"… will automatically switch heater off and flash the display when the probe is out of liquid. Prevents heater burn-outs, fires or solution boiling, caused by evaporation, leaks or withdrawing probe".

It gave the temperature range as 20-99°C.

176. The installation and operating instructions contained the following information:

"... included in the device is a safety low level cut out which will switch off the heater whatever the setting should the liquid fall below the probe.

...

The probe must be wired correctly to avoid damage. It should be positioned in the tank near to the heater to avoid thermal black overshoot.

It should be mounted completely surrounded by liquid ...

... The level cut out operates with the bottom 100 mm of the probe exposed. The probe should not be continually immersed above the red level label otherwise the probe/cable seal can eventually break down under chemical attack. If rise and fall of the liquid due to work loading is excessive or surface agitation causes splashing of the chemical onto the seal/cable then longer or right angle probes should be considered.

The unit leaves the works preset for safety cutout to operate on water. However other liquids may require sensor adjustment as follows.

Remove the cover by undoing the four plastic screws. Locate the blue preset situated in the top right corner of the main PCB turning this preset clockwise will increase the cut out sensitivity. With the probe immersed the display should remain constant when the probe is withdrawn from the solution the display should flash indicating the heater is switched off.

MAINTENANCE

The only regular maintenance required is with the probe. Test the level cut out monthly by removing from the liquid. This should make the display flash and turn off the heater load."

177. In my view, this material taken as a whole, would lead the reader to understand the following about the thermolevel:

i) It was a safety device designed to switch off the heater when the liquid fell below a particular level.

ii) It would therefore prevent heater burn-outs or fires caused by evaporation, leaks or withdrawing the probe.

iii) The thermolevel left the factory preset for operation in water.

iv) If the thermolevel was not immersed in liquid it would turn off the heater and make the display flash.

178. There was no warning in this material that the thermolevel should not be used as the only safety device or that it might not always fail to safe. Equally, it did not say that it was failsafe. Also, there was no mention that it carried a CE mark or that it complied with any particular legislation. In fact the probes were not CE marked, although no-one appears to have noticed this.
179. Further, the instructions provided by EDL fell far short of being a satisfactory guide on how to set the sensitivity control. In addition, there was no warning that the sensitivity control was such that, if turned too far in one direction, it would prevent the probe from de-energising the heater irrespective of the level of liquid in the tank. In my view this was a serious omission. Another significant omission was the failure to give any warning about the likelihood of voltage drift.
180. No witnesses from ECS or MJD gave evidence at the trial, so there is no evidence as to whether or not either of them made any further enquiries of EDL about the thermolevel. But if they made no enquiries, and if this failure was negligent, I do not consider that it would have been negligence of a type capable of breaking any chain of causation between the negligent manufacture or supply of the thermolevel and the occurrence of the fire^[13]. It lies ill in the mouth of a manufacturer who has supplied a defective safety device to say that he should be under no liability because the buyer should have been alert to deficiencies in the literature supplied with the product and should have made further enquiries which would or might have revealed that the device in question was defective.

Relevant guidance and Codes of Practice

181. The BSTSA/LPC Joint Code of Practice was a joint publication by the British Surface Treatment Suppliers Association and The Loss Prevention Council. It was produced in May 1997. The introduction said this:

"The high incidence of fires in plating and anodising shops caused by inadequate design and poor maintenance of electrical process heating systems in open tanks needs to be controlled. Fires are especially prevalent where plastic materials are used as a material of construction for tanks, fume exhaust hoods, exhaust fans and ducting. The primary cause is the loss of process liquid level through leakage or evaporation. This lowers the solution level, exposing the hot surfaces of the immersion heater and allowing high temperatures to develop. This is sufficient to ignite the tank walls and fire then spreads to the fume extraction system. Such fires commonly occur during night time and weekends when production operations have ceased.

... A typical process tank layout is shown in figure 1."

182. The Code advised:

"2.8 Preferably the heater should have a built-in device to detect overtemperature of the heater."

and:

"5.1 It is necessary to ensure that the process liquid level does not fall and thus expose the hot zone of the heater. This can be achieved through the installation of an automated device such as a float valve which admits water and thus maintains liquid level in the event of uncontrolled evaporation, tank leakage, maloperation or other cause.

5.2 In the event that the level maintaining device becomes inoperative, a low-level sensor positioned above the heater hot zone will automatically disconnect the power supply to the heater and initiate a visual and audible alarm.

5.3 Preferably, the heater should have a built-in over-temperature device incorporated into the low level sensor control circuit as a further safeguard, in the event that the tank low level sensor malfunctions."

183. The diagram at figure 1 of the Code, said to be a typical layout of a process tank (described as being made of plastic), showed a level control which controlled the water supply to the tank. This was not connected to the control unit that controlled the power supply to the heater. Its purpose was to maintain a flow of liquid to the tank whenever the level dropped below a particular point. Since it was not connected to the heater it could not operate as a low level cut-out. The diagram also showed a temperature sensor and a separate "low level shut-off", both of which were connected back to the control unit which controlled the power supply to the heater.
184. The GEL, as designed and when first installed by ECS, did not have any means of controlling automatically the water feed to the tanks, but an automatic "auto fill" system was added later and, as I understood the position, prior to the fire in February 2007^[14]. Mr. Boyle said that this automatically filled the tank with water until it reached a particular level when the supply would be shut off. Once the water fell below this level the auto fill would top up the tank automatically (Day 5/57, 62). It would, of course, have to be overridden if an operator wished to drain the tank. However, when the tank was in normal operation the auto fill would be an additional device to prevent the liquid in the tank dropping below the required level, although it was not a safety device in the sense that it was not connected to the heater control.
185. In my view, the auto fill system that was installed by Mr. Reed was the same sort of device as the one referred to in paragraph 5.1 of the Code. EDL submitted that the Code envisaged that a low level cut-out would be a second line of protection after a float switch (paragraph 11 of its closing submissions), implying that what was shown in the diagram in the Code was a different configuration to that adopted on the GEL^[15]. If that is how the submission is to be read, then in my view it is simply wrong.
186. The built in over-temperature device was shown on the diagram at figure 1 in dotted lines. Thus, if the heater did not have its own built-in over-temperature device, the only safety device connected to the heater was the low level shut-off. The only difference between the configuration shown in figure 1 and the configuration of the hot water tank in the GEL was that in the latter the temperature control and the level cut out were incorporated in the same device, but this does not seem to me to be significant (in any event, no criticism has been made of the temperature control feature of the probe). I find that the configuration in place on the hot water tank in the GEL at the time of the fire in February 2007 was effectively the same as that shown in figure 1, the level sensor in the probe corresponding to the low level shut-off shown in figure 1 in the Code of Practice.
187. It is, in my judgment, a fair inference from the Code that, at least at the time when it was published, it was not uncommon for plating shops and similar establishments to have heaters which did not have a built-in over-temperature control. Accordingly these establishments would have only one safety device, the low level cut-out, to prevent overheating of the heater in the event of loss of liquid in the tank.
188. It was clear that heaters with built-in over-temperature devices were available in the market. However, Howmet did not have them. EDL did not submit (in my view correctly) that a built-in over-temperature device for the heater was a mandatory requirement of the Code.
189. Whilst it is clear that the Code was encouraging owners of plating shops and similar establishments to install heaters that had a built-in over-temperature device, this was only described as "preferable". This is in contrast to the use of verbs such as "should" and "must" in relation to other features of an installation. The Code stated, at paragraph 5.1, that it was necessary to ensure that the process liquid level does not fall and thus expose the hot zone of the heater. It said that this could be achieved through the installation of an automated device such as a float valve which admits water and thus maintains liquid level in the event of uncontrolled evaporation, tank leakage, maloperation or other cause.
190. Paragraph 5.2 of the Code did not say that the low level sensor (which operated as the low level cut-out) had to be a failsafe device. Interestingly, EDL accepted (at paragraph 11 of its closing submissions) that the Code did not envisage that the low-level sensor would be a failsafe device.
191. To my reading, the provisions of the Code are inconsistent with any suggestion that its authors regarded it as bad practice to have only one safety device, even with tanks made of inflammable material such as plastic. Since, as I find to be the case, the hot water tank on the GEL had an auto fill installed by the time of the fire, I consider that the installation complied with the Code, even though the heaters did not have built-in over-temperature devices. A built-in over-temperature device for the heater was not a mandatory requirement of the Code.
192. The court was also referred to an HSE publication, the COMAH Guidance for the Surface Engineering Sector. This appears to be the version that was published in 2005, or possibly early 2006. It lists, at paragraph 29, a number of features that are "… considered to be good practice for the prevention of fires caused by electrical process heaters". These included the following:

i) automatic fluid make up to maintain the process liquid level

ii) a low level cut-out in the event of catastrophic loss of process fluid

iii) built in overtemperature device for the heater

iv) construction of process tanks from fire retardant polypropylene

This section then referred the reader for further guidance to the BSTSA/LPC Code of Practice, to which I have already referred. There is no suggestion that this guidance was intended to supersede the Code of Practice.

193. One point made by EDL is that Howmet's factory was a completely different type of installation from a typical plating shop so that Howmet's use of the thermolevels was not a use that could have been anticipated by EDL. As to the first part of this submission, I agree that, taking the factory as a whole, this was probably the case. Mr. Bartlett suggested to Mr. Braund in cross-examination that EDL's literature did not say anything about the use of a thermolevel in the particular environmental conditions which existed in the perspex tunnel in Howmet's grain etch line. In response to this Mr. Braund said (Day 6/126):

"To an extent I agree with that but it did state that it was designed for use in electroplating shops and similar, which in my view is precisely the application for which it was used. Well actually not quite precisely, but very similar."

Mr. Ward's evidence was to similar effect: see paragraph 148 above.

194. I accept this evidence. The process carried on by Howmet in the GEL involved very similar plant and equipment to that which would be found in a typical plating shop, as the diagram in the Code of Practice illustrates. I do not see that the size of Howmet's factory makes any difference. Just as a fire originating in the GEL could spread through the factory, so could a fire originating in a plating shop spread to adjacent buildings. The extent of the potential damage that a fire can cause will depend largely on the configuration of the particular establishment and any surrounding buildings (and, of course, the existence and operation of any fire extinguishing system).
195. Accordingly, I find that the use to which the thermolevels were put at Howmet's factory was well within the contemplation of a manufacturer in the position of EDL.
196. I find also, having regard to the way in which the Code is written, that it was not of itself negligent to design and install the GEL without requiring the heaters to have built in over-temperature devices, provided that the designer took into account the provisions of the Code and had specified a reliable device that would cut the supply to the heater in the event that the level of liquid in the tank fell below the point at which the heating element was no longer immersed in the liquid. At face value the thermolevels supplied by EDL met these criteria.
197. EDL submitted also that there was nothing in the Code specifically about the provision for automatic protection for the different situation where a tank is deliberately left empty and the heater is switched off. I agree. However, the arrangement shown in the diagram in the Code would, by its design, cause the power supply to the heater to be cut if the liquid level was below the low-level sensor. That was a feature of the system. At one stage this appeared to be accepted by EDL, because at paragraph 7 of its Defence it said that the thermolevel was "… capable of detecting whether its probe was in or out of liquid and could operate an on/off switch accordingly". The facts of this case demonstrate that the thermolevel did not do this, or at least not reliably.

Were the thermolevels designed and manufactured with reasonable care?

198. The expert evidence suggests very strongly that the design and manufacture of the thermolevels was deficient: it is not easy to see how a properly and carefully designed and manufactured device could have so many defects.
199. Mr. Boyle's tests showed that an unsophisticated and simple test regime revealed serious deficiencies in the operation of the thermolevels. Such tests would have been relatively easy for a manufacturer to carry out and, if carried out on a reasonable sample of EDL's output, would surely have revealed the flaws discovered by Mr. Boyle. In the absence of any evidence from EDL, I can only conclude that EDL did not implement any form of satisfactory test regime.
200. As a manufacturer of a piece of equipment that it described as a "safety low level cut out" that "prevents heater burn-outs [and] fires", I consider that EDL should have had in place a proper system of testing a reasonable proportion of the thermolevels that it manufactured. Its failure to do so amounted in my judgment to a want of proper care.
201. The evidence in this case does not enable me to reach any conclusions as to whether some the flaws in the thermolevels were attributable to defective design or manufacture by EDL or to defective components that EDL bought in and incorporated into the thermolevels. However, since I have concluded that EDL was at fault in failing to implement a proper test regime, it is not necessary to decide to what extent there was negligence in the design or manufacture of the thermolevels, although I have no doubt that the so-called sensitivity control was badly designed because it was so difficult to set properly and that the extent of the voltage drift indicates a want of proper care in the design.
202. However, even if the thermolevels were otherwise properly manufactured, I consider that the instructions provided by EDL for their operation were manifestly unsatisfactory. There was no satisfactory explanation as to how the sensitivity control really operated or any warning to the effect that the thermolevel might not work as a level sensor if the sensitivity control was not correctly adjusted. That, too, in my view demonstrated a lack of reasonable care.
203. If the cause of the fire on 12 February 2007 was a defect in the thermolevel (as opposed to a defect in its connections) and if, as a matter of law, EDL owed a duty of care to Howmet to take reasonable care to prevent a thermolevel causing damage to Howmet's property, then I consider that - subject to one possibility - EDL was in breach of that duty for the reasons that I have given.
204. The one possibility is that the fire may have been caused by a one-off defect in a thermolevel attributable to a faulty component bought in by EDL - and therefore without any fault on the part of EDL. However, I consider that this is unlikely. There were, as I understood the evidence, four heated tanks on the GEL each of which had at least one thermolevel. The contemporaneous documents show that during the period from December 2006 to February 2007 about three or four probes were changed. It is possible there may have been more. But on any view there were three occasions on which a probe failed to detect that it was not immersed in water. Whilst I cannot rule out the possibility that the failure was caused by a different mechanism in each case, as a matter of probability it is more likely than not that the mechanism was the same, in at least two of those three cases and perhaps in all of them. This suggests that the fire on 12 February 2007 was caused by a mechanism that had happened before and not by a one-off defect in a component bought in by EDL. I therefore reject the latter as a likely explanation for the fire on 12 February 2007.
205. Further, for the reasons given above, and in the light of the points agreed by the electrical experts, I consider that the thermolevel was not a safe device for use as a level sensor in a heated tank.

The scope of the duty of care and the possibility of intermediate examination

206. I have already discussed the use to which the thermolevel was put. In my view, the diagram in the Code of Practice to which I have already referred shows that the configuration of the hot water tank in the GEL at the time of the fire was typical of that which might be found in a plating shop. The Code shows also that, whilst it was "preferable" to have a heater with a built-in over temperature device, it was to be anticipated that some establishments would not have such heaters.
207. I am not persuaded by EDL's submissions that the thermolevel might have been loose, wrongly positioned or had fallen to the bottom of the tank. There is no evidence that any of these things had happened in the hot water tank, although on the evidence they cannot be eliminated. To affect the operation of the thermolevel the tests show that it would have to be installed so that the oil did not cover the printed circuit board. This would require it to be very seriously out of alignment. Further, the evidence suggests that when this occurred the thermolevel would be more likely than not to cut the power to the heater. I find that, on the balance of probability, the thermolevel in the hot water tank was in its correct or at least a serviceable position immediately prior to the fire.
208. Howmet relies on the fundamental principle formulated by Lord Atkin in Donoghue v Stevenson [1932] AC 562, at 599:

"A manufacturer of products, which he sells in such a form as to show that he intends them to reach the ultimate consumer in the form in which they left him with no reasonable possibility of intermediate examination, and with the knowledge that the absence of reasonable care in the preparation or putting up of the products will result in an injury to the consumer's life or property, owes a duty to the consumer to take that reasonable care."

209. EDL submitted that the principle in Donoghue v Stevenson applied only when the product caused a direct injury to the claimant's property, and not when the product simply failed to prevent another device from causing that injury. I can find no such restriction or limitation in the passage quoted above. Take the example of a negligently manufactured brake cable in a car. Driving too fast, the driver loses control on the approach to a bend. The brakes fail to work. The car leaves the road and crashes into a tree. The driver is severely injured. Had the brake cable not been defective, the speed on impact would have been greatly reduced and the driver's injuries either minor or avoided altogether. I can see no reason why the driver should not have a claim in negligence against the manufacturer of the defective brake cable.
210. EDL suggests that there was an expectation that the thermolevel would be subject to an intermediate examination. However, insofar as any physical examination or testing is concerned, I am unclear as to precisely what type of examination (if any) might have been anticipated or, if carried out, what it would have revealed. EDL's case on this aspect, as developed in cross-examination, was that a careful reading of EDL's literature would have revealed to a competent engineer that the device might not be suitable for use in a safety critical function. For example, it was suggested that because the literature included no statement that the thermolevel would operate reliably in circumstances such as those in which Howmet proposed to use it, the reader should infer that it was not reliable. When cross-examined about this Mr. Braund appeared to be as puzzled as I was. His view was that somebody looking at the literature would infer that the thermolevel would work reliably when called upon to do so (Day 6/116). I agree: in my view there was nothing whatever in this point, particularly since I have already found that the use to which Howmet put the thermolevel was a use typical of those which could be expected.
211. It was suggested also that because the literature did not say that the thermolevel was not a failsafe device or that it had any built in redundancy, it was to be assumed that it had neither of these features. Accordingly, submitted EDL, the overall inadequacy of the thermolevel should have been obvious to any engineer since there was nothing to suggest that it would operate to any particular standard of reliability or that it would be failsafe.
212. The cross-examination of Mr. Braund on this topic concluded as follows (Day 6/128):

"Q. The next proposition: "Overall Economy Devices' literature was inadequate as a reference for equipment selection and system design in a safety related application since it did not give detailed information about performance, safety or reliability as would be required by anyone intending to select and rely upon the equipment." Do you agree?

A. I do agree.

Q. And the above overall inadequacy that refers to that previous proposition [sic] should have been obvious to an engineer who considered the literature since there was nothing in the literature to suggest that the Therm-o-level would operate to any particular standard of reliability or would fail safe. Do you agree?

A. It should have been obvious to an experienced engineer who was familiar with the potential problems that can occur.

Q. So applying that to this case, certainly it should have been obvious to ECS given the role that they were undertaking?

A. Well, certainly the question of whether the equipment was adequate should have been apparent but I think it is reasonable to assume or reasonable for a designer to assume that a piece of equipment that is placed on the market for a particular purpose is going to be suitable and designed with all the necessary safety features without it having to say so explicitly."

213. In the context of his evidence as a whole, what I understood Mr. Braund to mean by this answer was that whilst EDL's literature may have raised a question about the adequacy of the device, it was reasonable for a designer to assume that it had been properly designed with appropriate safety features so as to make it fit for its purpose. That seems to me to be a reasonable view and I accept it.
214. One obvious matter that might have been picked up was the absence of a CE mark, but neither Howmet nor ECS appeared to have noticed that the thermolevels supplied by EDL did not carry a CE mark. In my view, the answer to this was provided by Mr. Braund, at Day 6/113:

"... equally the absence of a CE mark need not immediately raise alarm bells because there is an assumption that every electrical product sold in the UK has been checked for safety and complies with the relevant standard. There should be a CE mark, but even if there is not I think it would be reasonable for anyone to assume that a product put on the market by a reputable company would indeed comply."

215. If it were right that the thermolevel should have been rejected for want of a CE mark, and that the failure to do so defeats the claim, this would put a premium on supplying products that did not carry a CE mark. This is because if the user fails to reject the product for want of a CE mark, he would, on this approach, release the supplier from any further liability if he were to use the product and to suffer damage because it was defective. This is why I consider that Mr. Braund's response that I have quoted above is correct. In commerce the general assumption is that manufacturers have complied with their obligations, not that they are likely to have acted in breach of them: see, for example (albeit in a different context), Compania Naviera Maropan SA v Bowaters Lloyd Pulp and Paper Mills Ltd [1955] 2 QB 68, per Devlin J at 77.
216. I would not, therefore, accept any suggestion that the failure to reject the thermolevel for want of a CE mark discharges any duty that EDL might otherwise have owed to Howmet.
217. I do not accept EDL's submission that a designer in the position of ECS should have appreciated, on the basis of EDL's literature, that the thermolevel was or might be inadequate for its purpose. In my view, there was no other form of examination that could have been anticipated that would have revealed that the thermolevel was or might be defective, and EDL has not suggested any. As Mr. Braund observed, the operation of the probe would be a mystery to anyone who had not looked into it in detail (Day 7/23).
218. Accordingly, if Howmet reasonably relied on the thermolevel as a protection against fire at the relevant time, then a failure by the thermolevel to operate properly was in my view within the scope of the duty of care owed by EDL to Howmet.

Breach of statutory duty

219. Howmet's claim for breach of statutory duty is based on regulation 14(1) of the Electrical Equipment (Safety) Regulations 1994 ("the 1994 Regulations"). That imposes a statutory duty not to supply electrical equipment in respect of which the requirements of regulations 5(1) and 9(1) of the regulations have not been satisfied. Regulation 5(1) concerns safety and regulation 9(1) requires products to carry a CE mark.
220. Regulation 5(1) provides that electrical equipment shall be safe. Section 41(1) of the 1987 Act makes the contravention of any obligation imposed by safety regulations actionable in civil proceedings. It is common ground that the thermolevel falls within the voltage thresholds in regulation 4.
221. The definition of "safe" is to be found in section 19(1) of the Consumer Protection Act 1987. This provides that:

"'safe', in relation to any goods, means such that there is no risk, or no risk apart from one reduced to a minimum, that any of the following will (whether immediately or after a definite or indefinite period) cause the death of, or any personal injury to, any person whatsoever, that is to say-

(a) the goods;

(b) the keeping, use or consumption of the goods;

...

(e) reliance on the accuracy of any measurement, calculation or other reading made by or by means of the goods,

and 'unsafe' shall be construed accordingly."

222. By Regulation 3(1) of the 1994 Regulations the reference to risk in that subsection is to be construed as including a reference to any risk of damage to property.
223. Howmet relies principally on the reference to reliance on the accuracy of any measurement. On the face of it, it seems to me that it is entitled to do so because the probe of the thermolevel measures the permittivity of the liquid in which it is immersed. The efficacy of the device depends on this measurement being reliable and the accuracy of the calculation (or other reading) that compares it with the reference voltage.
224. EDL submits that the 1994 Regulations and the 1987 Act were enacted to comply with the Low Voltage Directive (73/23/EEC) and the CE Marking Directive (93/68/EEC). EDL relies on Article 2 of the Directive, which directs Member States to take measures

"… to ensure that electrical equipment may be placed on the market only if, having been constructed in accordance with good engineering practice in safety matters in force in the Community, it does not endanger the safety of persons, domestic animals or property when properly installed and maintained and used in applications for which it was made."

225. EDL then relies on Annex 1, point 2, which is entitled "Protection against hazards arising from electrical equipment". This refers to ensuring:

"(a) that persons and domestic animals are adequately protected against the danger of physical injury or other harm which might be caused by direct or indirect contact;

(b) that temperatures, arcs or radiation which would cause a danger, are not produced;

(c) that persons, domestic animals and property are adequately protected against non-electrical dangers caused by the electrical equipment which are revealed by experience;

(d) that the insulation must be suitable for foreseeable conditions."

226. EDL submits that the thermolevel complied with these principal objectives. EDL submits also that Howmet's case is that a thermolevel did not prevent a danger arising from electrical equipment, namely the immersion heaters, because it did not switch it off when it should have done, and that this is not something covered by the Directive.
227. In my view, there are three answers to this point. First, the purpose of the UK legislation was to implement the Directive. It should therefore be construed so as to have an effect no more limited than that intended by the Directive. I can see no reason why the legislation should not be construed as having a wider scope if, on a plain reading, that is what it appears to do.
228. Second, it seems to me that Howmet can bring its case within paragraph (c) of Point 2 because in the context of this claim the non-electrical danger to property caused by the thermolevel was that of fire. The damage to Howmet's property was not caused just because the heater overheated, but because the heater overheated and set fire to the tank. That fire then spread and caused damage to property. Third, the thermolevel allowed a temperature to be reached that would cause a danger within the meaning of paragraph (b).
229. EDL submits also that liability under the Regulations can only arise when the equipment has been "… properly installed and maintained and used in applications for which it was made" as stated in Article 2 of the Directive. It says that that was not the case here. I have already found that the thermolevel in the hot water tank at Howmet's factory was used in an application for which it was made, because the application was very similar to the one described in the Code of Practice.
230. I have already held that there is no evidence that the thermolevel was not properly installed. The only question is whether it was properly maintained. However, in my view for the reasons that I have already given the thermolevel was unsafe whether it was properly maintained or not, principally because, as the electrical experts agreed, it was unreliable. Another reason why I consider that it was unsafe was that it was in practice very difficult to adjust it properly and, even if it were properly adjusted, it suffered from voltage drift which would affect its ability accurately to measure the permittivity of the liquid in which it was immersed.

The circumstances of the fire on 12 February 2007

231. Mr. Boyle interviewed an operator, Mark Woodland, on 26 February 2007. He had been on duty at the time of the fire. He was familiar with the GEL, but at the time was working in a nearby part of the factory known as "core removal/shell leach".
232. Mr. Woodland said that at about 2 am on Monday, 12 February 2007, there was a power cut. When the power was resumed he and others noticed that acrid fumes appeared to be coming from the area of the GEL. It seems that the scrubber that would normally extract fumes from the GEL had tripped following the power cut and was not in operation.
233. Mr. Woodland went to the GEL and pressed the reset button on its control panel. He then noticed that one of the heater switches was in the off position, whereas all the others were on. He thought that the operators on the next shift, which was due to start at 4 am, would need to have the water in the tank heated so that they would be able to start production straightaway. He therefore switched on the remaining heater. At the same time he thought he heard a tank filling, although he did not check whether the tanks were full or empty. Mr. Woodland then went out of the building for a few minutes, after which he heard the fire alarm go off.
234. On the basis of the eyewitness evidence and the damage Mr. Boyle concluded that the fire started in the hot water tank on the GEL. I have already mentioned his evidence in relation to the seat of the fire, and that the eyewitness evidence suggested that it was one or other of two tanks on the GEL.
235. In its closing submissions EDL described Mr. Boyle's conclusions as to the circumstances of the fire as "logical", even though it noted that Mr. Boyle had chosen to reject some evidence in order to reach his conclusions.
236. I see no reason to doubt Mr. Boyle's conclusion that the fire started in the hot water tank, which was Tank 6. It is inherently unlikely that it started in the adjacent cold water tank. I therefore find that the fire on 12 February 2007 started in the hot water tank and was the result of a heater in that tank overheating and catching fire.
237. The more difficult question, to which I now turn, is whether that fire was caused by a foreseeable failure of the thermolevel to operate in the manner intended.

What actually caused the fire on 12 February 2007?

The claim in negligence

238. As EDL accepts, it is clear that the thermolevel in the hot water tank did not operate so as to prevent the heater from overheating after Mr. Woodland switched it on at a time when it was not immersed in water. There are in my view four potential reasons why this might have happened.^[16] First, the potentiometer or "sensitivity control" in the thermolevel control unit may have been incorrectly set. Second, there may have been a component failure or defect within the thermolevel itself. Third, there may have been a break or bad connection in the core carrying the five-volt DC feed to the probe (which would cause the heater to be permanently energised^[17]). Fourth, the thermolevel voltage may have drifted over time so that it was no longer capable of accurate measurement.
239. So far as the fire on 12 February 2007 is concerned, I consider that the last of these can be safely eliminated. The evidence as recorded by Mr. Boyle suggested that, following the power cut, the power supply to the thermolevel had been restored only minutes before the heater was switched on. I doubt very much whether in that short space of time there could have been any significant voltage drift. Whilst I consider that the presence of voltage drift as revealed by the tests carried out by Mr. Braund indicates a lack of care in the design of the thermolevel, that lack of care did not cause the fire on 12 February 2007.
240. Mr. Braund's report appears to have been directed primarily to Howmet's case against ECS and his conclusions said fairly little about precisely how the thermolevel caused the fire. He said that he considered it "… likely that one or more defects in the Thermolevel led to the fire", but he did not go into much detail (paragraph 5.2.1).
241. In the conclusions to his report Mr. Boyle said this:

7.4 It has not been possible to identify with certainty why the Therm-o-level did not prevent the heater from being energised on this occasion but the two most likely explanations are as follows -

• The Therm-o-level malfunctioned possibly because either the sensitivity control was incorrectly set or the design of the instrument resulted in the operating parameters changing (drifting) whilst in service.

• There was a fault with the Therm-o-level.

7.5 I have not established the relative likelihood of these explanations, however, my tests have shown that the Therm-o-level system is prone to malfunction and would not reliably prevent the heaters from being energised when there was insufficient water in the tank, particularly at elevated water temperatures. Similarly, the design of the Therm-o-level system is such that should a fault or poor connection develop on one of the wires connected between the probe and the controller, the device does not 'fail safe' and does not prevent the heaters from being energised.  In my view these features indicate that this probe was unsuitable for reliably preventing the heaters from being energised when there was insufficient water in the tank ….  It is my opinion that the most probable cause of the fire in the hot water tank of the GEL was a failure of the Therm-o-level to prevent the heaters from being energised when there was insufficient water in the tank.

7.6 I consider it unlikely that the heaters were energised because the Therm-o-level probe was not correctly positioned or secured within the hot water tank."

242. I have already said why I consider that voltage drift could not have been a cause of the fire on 12 February 2007. As to the other potential causes, I note first that Mr. Boyle does not distinguish between the type of "fault" that there may have been (in other words between a fault of design or manufacture or a one-off fault as a result of the incorporation of a defective component). Second, whilst Mr. Boyle mentions the potential for failure of the cable or its connections, he does not appear to deal with this as a possible cause.
243. In relation to the cause of the fire it is relevant to recall that Mr. Moxey told Mr. Boyle on 20 February 2007 that on the hot water tank the low level alarm "hasn't worked recently" (see paragraph 59 above). Mr. Moxey, together with Mr. Lemon and Mr. Palfrey, worked as operators on the GEL and so probably knew the line better than anyone else.
244. There was some debate during the evidence as to whether Mr. Moxey was referring to both the alarm and the low level cut-out or only to the alarm. Mr. Boyle said in cross-examination that he was not aware of anything that could be used to switch off the alarm but not the cut-out (Day 4/107). If this is correct, and I see no reason to doubt it, then Mr. Moxey must have been referring to both the alarm and the cut-out.
245. If it were the case that, to the knowledge of the operators, the thermolevel in the hot water tank was not working in the days leading up to the fire, then one might have expected someone to change the probe to see if that made any difference. If the probe was changed, but the low level sensor still did not work, that would suggest either that the sensitivity control had been wrongly set at the control unit or that there was a problem with the connections. It is unlikely, although not impossible, that a replacement probe would also have had a defective component. However, the evidence does not reveal whether or not the probe was changed during the week or so before the fire. The only relevant evidence is that Mr. Reed told Mr. Boyle (in February 2007) that he had checked it and that it was working. For these reasons, together with the reasons that I have already given paragraph 204 above, I regard a component failure within the probe as an unlikely cause of the fire. However, it is not one that can be excluded altogether.
246. As I have already mentioned, the fact that the thermolevel cables had plug and socket connections suggests that they were not long enough and were extended when the GEL was being installed. As EDL's literature makes clear, cables longer than the standard two metre length were available if specially ordered. Given the dimensions of the tanks and the positions of the probe and the control unit, I am quite satisfied that a two metre cable would not have been long enough to connect the probe to the control unit. The fact that there were plug and socket connections would indicate that cables of sufficient length were not ordered at the outset so that the standard cables had to be extended.
247. There is an entry in EDL's sales ledger, which, very unsatisfactorily, was disclosed only on the day before the trial, which shows that EDL sold five plugs and sockets to ECS in April 2006. But this does not explain why EDL were selling plugs and sockets to ECS some three months before MJD bought the thermolevels on 27 June 2006. I suspect strongly that there was no connection between the two transactions.
248. In the light of at least two recorded incidents involving corrosion of the plug and socket connection in thermolevel cables, together with Mr. Webber's evidence that the plugs on the thermolevels had to be changed "a number of times", it seems to me that corrosion cannot be eliminated as a possible cause of the failure of the low level sensor to operate in the days before the fire on 12 February 2007 - assuming that what Mr. Moxey told Mr. Boyle is correct.
249. However, the evidence is - and I find as a fact that this happened - that Mr. Reed repaired the connection in the hot water tank probe cable following the fire on 12 December 2006 and then applied heat shrink to it for additional protection. It seems unlikely, therefore, that this particular connection would have been affected by corrosion again less than two months later. There is, of course, the possibility that the cable was damaged by some other means, but there is no evidence of this. Although I cannot rule it out, therefore, I regard a failure of the connections in the probe cable to the hot water tank as an unlikely cause of the fire.
250. It is possible that Mr. Reed adjusted the setting of the sensitivity control after the incident on 29 January 2007, but there is no evidence that he did so. Mr. Boyle's notes record him as saying that he checked the thermolevel.^[18] It does not appear that anyone else knew how to do it.^[19] But if Mr. Reed did adjust the setting, one might have expected him to check during the next few days whether it was working properly. The other alternative is that he had decided to abandon reliance on the thermolevel and to replace it with the float switch that he had ordered, with the result that he did not bother to check it during the few days before the fire. Of the various possible reasons why the thermolevel might not have cut off the supply to the heater, incorrect setting of the potentiometer seems to me to be the least unlikely.
251. Whilst I am satisfied that the fire was the result of a failure of the thermolevel to operate properly, on the evidence as it stands I am not able to reach a conclusion as to the probable mechanism by which that came about and, therefore, as to precisely what led to the overheating of the heater in the hot water tank.
252. If it was a failure of a component within the thermolevel, that does not necessarily indicate a lack of care by EDL: in theory, it may have been a one-off defect in a bought-in component that would not have been picked up by proper testing. However, for reasons that I have already given I consider that it is unlikely that the cause of the fire on 12 February 2007 was the failure of a component within the thermolevel.
253. If it was a failure of a connection in the probe cable, which again I regard as a possible, but unlikely, cause, it is hard to see how any responsibility for that could rest with EDL.
254. If the cause was incorrect setting of the thermolevel, this could be the responsibility - at least in part - of EDL for the reasons that I have already discussed. However, the evidence, such as it is, suggests that this state of affairs might have existed for several days before the fire. If that were the case, Howmet had the opportunity to readjust the setting. I can only infer that it did not take it.
255. The employees of Howmet who might have been in a position to give evidence about this are Mr. Moxey and Mr. Palfrey, in particular the former given what he told Mr. Boyle about the thermolevel not working: the court has not been provided with any explanation as to why they have not been called. I do not regard proportionality (or disproportionality) as an adequate answer. So far as Mr. Reed is concerned, Howmet served a witness summary of his evidence (comprising the notes of his interview with Mr. Boyle) because he left Howmet fairly soon after the fire and cannot be traced.
256. Whilst I am reluctant to draw inferences adverse to Howmet on this basis alone, in these circumstances I do not consider that it would be appropriate or just to make assumptions favourable to Howmet that would be in conflict with Mr. Boyle's notes of what he was told by Mr. Moxey.
257. In Nulty v Milton Keynes Borough Council [2013] BLR 134, the Court of Appeal held that the civil "balance of probability" test meant no less and no more than that the court had to be satisfied on rational and objective grounds that the case for believing that the suggested means of causation occurred was stronger than the case not so believing (see paragraph 35 of the judgment of Toulson LJ). As the Court of Appeal explained in that case, it is not enough for the court to choose between, say, three causes - each of which taken by itself is an unlikely cause - and then, as a matter of logic, to conclude that the least unlikely must be the probable cause of the loss.
258. But, as I have already said, there is no evidence that anyone adjusted the thermolevel in the hot water tank very shortly before the fire. I have already noted that, if the potentiometer was adjusted at all in the period leading up to the fire, it would probably have been done by Mr. Reed when he checked the thermolevel following the incident on 29 January. If the cause of the fire was that the potentiometer was incorrectly adjusted following the incident on 29 January 2007, then it could have remained in that condition for some days prior to the fire. This would be entirely consistent with what Mr. Moxey told Mr. Boyle.
259. But, all in all, applying the approach in Nulty to the facts of this case, I am unable to conclude that incorrect setting of the potentiometer in the control unit was more likely than not the reason why the thermolevel did not cause the heater to cut out. If it did, I would hold that this was the result of, or at least materially contributed to by, the badly designed potentiometer control and the negligently drafted instructions on how to set it that were supplied by EDL. The potentiometer may well have been incorrectly set at the time of the fire, but on the balance of probability I cannot say that it was. Accordingly, Howmet's claim in negligence against EDL must fail for want of proof of causation.
260. It is convenient to deal with other questions of reliance and causation in the context of the claim for breach of statutory duty, to which I now turn.

The claim for breach of statutory duty

261. Howmet's claim for breach of statutory duty is more straightforward, because it does not require Howmet to prove precisely why the thermolevel was unsafe once it is found, as I have found it to be the case here, that it was unsafe. Nevertheless, Howmet still has to show that at the time of the fire it was using or relying on the thermolevel as a safety device and that its lack of safety caused the fire.
262. EDL submits that as a result of its experience of the thermolevel in use Howmet should have been aware, from at least the time of the fire on 12 December 2006, that the thermolevel (a) was not a failsafe device and (b) was in practice unreliable.
263. I accept that if Howmet had stood back and analysed properly the events of 12 December 2006, it would have appreciated that the thermolevel was not a failsafe device. Howmet's witnesses accepted as much in cross-examination. But I do not consider that in this respect Howmet's employees were reckless: they may have been careless. In the light of the authorities discussed below, it was not in my judgment a want of care that came close to being so gross as to break the chain of causation or otherwise to discharge EDL from the consequences of its obligations. In any event, it did not prevent Howmet from treating the thermolevel as a safety device which it could rely which, at that stage, is what it did.
264. A more powerful criticism of Howmet is that it carried on using the thermolevel at a time when it ought to have appreciated that it was unreliable. It was submitted by EDL that this was the position from 12 December 2006 onwards, and even more so following the incident on 29 January 2007. I will consider first the later period.
265. I have already rejected EDL's submission that the incident of 29 January 2007 was widely known amongst Howmet's employees. However, I do find that Mr. Reed must have known about it. As I have already mentioned, on 1 February 2007 Mr. Reed ordered a float level for the hot water tank.
266. In Trebor Basset Holdings Ltd v ADT Fire and Security plc [2012] BLR 441, a fire case in which an issue arose about the attribution of an employee's knowledge to his employer company, Tomlinson LJ said this:

"67. Whatever be the correct approach, I have no doubt that it is critical to a proper analysis to determine whether the knowledge alleged to break the chain of causation or to give rise to a duty to mitigate can properly be attributed to the claimant party. The basis for denying recovery on the first footing is that continuing to operate the production line in the knowledge that the fire detection or suppression system is defective is a voluntary act which can be held to be the cause of the subsequent damage – see per Purchas LJ in Schering at pages 4, 5 and 9 of the transcript of his judgment. On the second basis, the analysis is that it is reasonable to expect the claimant party to take appropriate steps to minimise the consequences of the breach-caused defect of which he has become aware – see in particular per Hobhouse LJ in the County case at pages 858/9. On both bases the act can only be said to be voluntary or the duty to mitigate to arise if the relevant knowledge comes to the attention of the claimant party. The identification of the natural person whose knowledge is appropriate for this purpose will depend upon questions of delegation of duty within the organisation and, in the present context, the system of supervision which Cadbury might reasonably have been expected to have in place. The problem was addressed in these terms in the Schering case by Hobhouse J at page 22 of the transcript of his judgment and by Purchas LJ at page 4 of his judgment in the Court of Appeal.

68. The judge here refers at paragraph 554 of his judgment to the Cadbury management at Monkhill and says of it that it would have reacted very differently to the June 2004 fire had it thought that ADT had given a guarantee or warranty as to the efficacy of the system. However, with respect to the judge, he had made no finding upon the basis of which knowledge of the June 2004 fire can properly be attributed to the Cadbury management. That is unsurprising, given that the point was neither pleaded nor explored at trial."

267. The reference to the Schering case in the passage quoted is to Schering v Resibel (CA, 26 November 1992, unreported). In that case the claimant operated a bottling line for flammable chemicals which included a mechanical heat sealer for the tops of the bottles. The safety device in the bottling machine supplied by the defendant was defective. As a result a bottle remained under the heat sealer for too long and exploded, causing a disastrous fire. However, a few weeks earlier the same thing happened, only the bottle did not catch fire. The claimant's foreman to whom the incident was reported did nothing about it. It was held that the claimant was prevented from recovering for the losses sustained in the fire.
268. Unfortunately, there has been no consensus of judicial opinion as to the principle by which the claimant was denied a remedy. Hobhouse J held at first instance that it was the consequence of a failure to mitigate because the claimant was to be taken to have known of the defendant's breach of contract. In the Court of Appeal opinions were divided: Scott LJ and, I think, Purchas LJ, took the view that there had been a break in the chain of causation, whereas Nolan LJ favoured the mitigation approach.
269. For present purposes the significance of the case is that, once the foreman's knowledge was attributed to the claimant, the claimant was to be taken to have known that the safety device did not work and therefore had to take responsibility for the fact that nothing was done about it. So far as this case is concerned, I find that Howmet did not know that the thermolevel might be defective until, at the earliest, the incident on 29 January 2007. Thereafter, as I have explained, it is unclear to what extent Howmet knew, through Mr. Reed, that the thermolevel in the hot water tank was not or might not be working. On the basis of what Mr. Moxey is recorded as having told Mr. Boyle, it is quite possible that Mr. Reed knew several days before the outbreak of the fire on 12 February 2007 that the thermolevel was not working. However, it is also possible that he did not know. But since Mr. Gill said that Mr. Reed was concerned that the thermolevel was "… not operating correctly as it kept failing" and since Mr. Reed ordered a new float switch on 1 February 2007, I consider that it is more likely than not that by then he knew, or at least strongly suspected, that the thermolevel was not working properly.
270. Mr. Reed was the person to whom Howmet's management entrusted the checking and setting of the thermolevels. Whilst I do not consider that Mr. Reed was responsible for the design or operation of the GEL such that his knowledge of the GEL generally is to be attributed to Howmet, I find that he was the person who was charged with adjusting the thermolevels and checking that they performed satisfactorily.
271. In the circumstances, I consider that if Mr. Reed knew that the thermolevels generally, or a particular thermolevel, was not or might not be working properly, that knowledge is to be attributed to Howmet. If a thermolevel was not working properly, then it was Mr. Reed's job to do something about it or, if he could not, to report the situation to Mr. Gill (or to someone else at his level). Howmet's evidence, which on this point I accept, was that it had an open culture and that its senior employees made themselves accessible to their subordinates.
272. Mr. Gill said in his witness statement that he thought that the switch that Mr. Reed had ordered on 1 February 2007 arrived about a day before the fire, but that was only because that was when he remembered seeing it on Mr. Reed's desk. If Mr. Reed was concerned about the reliability of the thermolevels generally, it is not clear why he ordered only one. The most likely inference is that he had decided to try it out on the hot water tank first because he thought that the thermolevel in that tank was not working properly.
273. If this is what happened, then it is hard to avoid the inference that, whilst the operators of the GEL and Mr. Reed knew that the thermolevel in the hot water tank was not working properly, they decided to do nothing about it (beyond following the instructions to operators to switch off the heaters when draining the tanks) - perhaps because they knew that a decision had been taken to install a float valve. In those circumstances, it would be that decision or, at least, the decision not to do anything about the thermolevel in the meantime, and not any incorrect setting or functioning of the thermolevel, that resulted in the thermolevel's failure to cut the supply to the heater on 12 February 2007.
274. In Lambert v Lewis [1982] AC 225, Lord Diplock said, at 276 E-H:

"The implied warranty of fitness for a particular purpose relates to the goods at the time of delivery under the contract of sale in the state in which they were delivered. I do not doubt that it is a continuing warranty that the goods will continue to be fit for that purpose for a reasonable time after delivery, so long as they remain in the same apparent state as that in which they were delivered, apart from normal wear and tear. What is a reasonable time will depend upon the nature of the goods but I would accept that in the case of the coupling the warranty was still continuing up to the date, some three to six months before the accident, when it first became known to the farmer that the handle of the locking mechanism was missing. Up to that time the farmer would have had a right to rely on the dealers' warranty as excusing him from making his own examination of the coupling to see if it were safe; but if the accident had happened before then, the farmer would not have been held to have been guilty of any negligence to the plaintiff. After it had become apparent to the farmer that the locking mechanism of the coupling was broken, and consequently that it was no longer in the same state as when it was delivered, the only implied warranty which could justify his failure to take the precaution either to get it mended or at least find out whether it was safe to continue to use it in that condition, would be a warranty that the coupling could continue to be safely used to tow a trailer on a public highway."

(My emphasis)

275. Although Lambert v Lewis involved a claim in contract between the owner of the Land Rover and the dealers, I can see no reason why the requirement for reliance on the supplier or manufacturer to provide a product that was fit for its purpose should be any less in a situation such as this where I have found that the use of the thermolevel by Howmet was one that was within the contemplation of EDL.
276. In my judgment, in the absence of any knowledge to the contrary Howmet was entitled to rely upon EDL to provide a device that operated reliably and in a manner that was consistent with what EDL said in its brochure and, in addition, which was fit for the purpose of being used as a low level cut-out for the heater in a hot water tank on a line such as the GEL. I do not consider that Howmet acquired any knowledge to the contrary as a result of the fire on 12 December 2006: whilst with the benefit of hindsight it should have realised then that the thermolevel was not a failsafe device, I find that it did not appreciate that at the time. I find also that, having attributed its failure on 12 December to corrosion of the connections, Howmet had no reason to think at that stage that the thermolevel was or might be unreliable.
277. However, I am not satisfied that Howmet was entitled to, or did, rely on the thermolevel operating correctly or reliably as a low level cutout after the incident on 29 January 2007. I say this for the following reasons:

i) Mr. Moxey must have known that, at the time of the fire on 12 February 2007, that the low level alarm had not "worked recently" on the hot water tank, because that is what he told Mr. Boyle after the fire.

ii) On the basis of the evidence of Mr. Boyle that I have already mentioned, this must have referred to the operation of the thermolevel.

iii) Mr. Reed was told about the incident on 29 January 2007, probably very shortly after it happened.

iv) It is more likely than not that Mr. Reed also knew, or at least strongly suspected, that the thermolevel was not working at the time of the fire and that it had not been working properly for several days.

v) The evidence of Mr. Gill in his witness statement that Mr. Reed was concerned at that stage that the thermolevel in the hot water tank was not "… operating correctly as it kept failing" is consistent with this.

vi) The fact that Mr. Reed ordered a float switch on 1 February 2007 tends to confirm that he knew or suspected that the thermolevel in the hot water tank was not working properly.

vii) Mr. Reed's knowledge that the thermolevel was not or might not be working properly in February 2007 is knowledge that is to be attributed to Howmet. But, irrespective of this, since Mr. Gill also knew this before the fire his knowledge is plainly that of Howmet.

viii) The evidence shows that, following the fire on 12 December 2006, Howmet relied on its operators to follow instructions about switching off the heaters whenever tanks were drained. I accept that Howmet did not do this because it knew that the thermolevels were unreliable, but rather because it knew that there had been an occasion on which a thermolevel had not operated as it should have done when in an empty tank (probably as a result of a corroded connection). However, this does suggest that Howmet - through Mr. Reed and Mr. Gill - might have been prepared to accept operator vigilance as a suitable safeguard during a short period in February 2007 before a replacement low level cut-out device could be obtained and fitted in the hot water tank.

278. In these circumstances, I find that Howmet has failed to prove that in the days immediately before the fire on 12 February 2007 it was relying on the thermolevel in the hot water tank to work properly and to act as a reliable safety device. In these circumstances a claim based on EDL's failure to provide a safe product must fail.

Break in the chain of causation

279. EDL's alternative case is that it is not liable because Howmet's conduct in continuing to operate the GEL when it knew that the thermolevel was not working broke what it described as "any lingering chain of causation". In fact, EDL goes further and submits that the chain of causation was broken when Howmet took no steps to address the thermolevel's failure to operate at the time of the fire in December 2006.
280. It is clear from the authorities that reckless conduct by the claimant will ordinarily break the chain of causation, whereas conduct that is unreasonable will not necessarily do so. The effect of the authorities was summarised by Gross LJ, sitting at first instance in the Commercial Court, in Borealis v Geogas Trading [2011] 1 Lloyd's Rep, at 488, in the following terms:

"44. Secondly, in order to comprise a novus actus interveniens, so breaking the chain of causation, the conduct of the claimant 'must constitute an event of such impact that it 'obliterates' the wrongdoing…' of the defendant: Clerk & Lindsell on Torts (19^th ed.), at para. 2-78. The same test applies in contract. For there to be a break in the chain of causation, the true cause of the loss must be the conduct of the claimant rather than the breach of contract on the part of the defendant; if the breach of contract by the defendant and the claimant's subsequent conduct are concurrent causes, it must be unlikely that the chain of causation will be broken. In circumstances where the defendant's breach of contract remains an effective cause of the loss, at least ordinarily, the chain of causation will not be broken: County Ltd v Girozentrale [1996] 3 All ER 834, at p. 849 b-c, per Beldam LJ and at pp. 857 f-g and 858 b-c, per Hobhouse LJ (as he then was) ... .

45. Thirdly, it is difficult to conceive that anything less than unreasonable conduct on the part of the claimant would be capable of breaking the chain of causation. It is, however, also plain that mere unreasonable conduct on a claimant's part will not necessarily do so – for example where the defendant's breach remains an effective cause of the loss, albeit in combination with the claimant's failure to take reasonable precautions in its own interest: see, for example, County Ltd v Girozentrale, per Beldam LJ (loc cit). By its nature, reckless conduct by the claimant would or would ordinarily break the chain of causation, though there is no rule of law that only recklessness on the part of the claimant will do so: Lambert v Lewis [1982] AC 225, per Roskill LJ (as he then was) in the Court of Appeal, at p.252; County Ltd v Girozentrale (supra), per Hobhouse LJ at p. 857, more conveniently discussed below, when dealing with the claimant's knowledge or lack of it.

46. Fourthly, the claimant's state of knowledge at the time of and following the defendant's breach of contract is likely to be a factor of very great significance. For the chain of causation to be broken, the claimant need not have knowledge of the legal niceties of the breach of contract; nor, as it seems to me, will the chain of causation only be broken if the claimant has actual knowledge that a breach of contract has occurred – otherwise there would be a premium on ignorance. However, the more the claimant has actual knowledge of the breach, of the dangerousness of the situation which has thus arisen and of the need to take appropriate remedial measures, the greater the likelihood that the chain of causation will be broken. Conversely, the less the claimant knows the more likely it is that only recklessness will suffice to break the chain of causation."

281. In the light of these considerations, I am quite satisfied that, in continuing to use the thermolevels between the fire in December 2006 and 2 February 2007, Howmet did not act in a manner that was so unreasonable as to break the chain of causation. My reasons are these:

i) Howmet's management thought that the fire in December 2006 was caused by a corroded connection and that the probe itself was functioning satisfactorily. This appears to have been Mr. Reed's conclusion as understood by Mr. Gildersleve.

ii) There is no mention in the contemporaneous documents or the evidence of any incident in which a probe failed to cut the supply to the heater when the liquid in a tank fell below the set level until the incident of 29 January 2007.

iii) Following that incident, known to Howmet's management through Mr. Reed and, little later, Mr. Gill also, Howmet decided to install a float switch as an added level of protection.

iv) Howmet appears to have acted promptly in taking this decision because a float switch was ordered on 1 February 2007 with a request for next day delivery.

v) In the meantime Howmet must have been relying on operator vigilance, together with a procedure for leaving the hot water tank drained over the weekend (which is how it had been left until Mr. Woodland switched it on).

282. However, there is no explanation for the fact that the float switch (ordered on 1 February 2007 for delivery the following day) had not been installed by the time of the fire. EDL invites the court to infer that it must have been delivered on 2 or 3 February 2007 (Closing Submissions, paragraph 109) and that Howmet thereafter did nothing about installing it.
283. Howmet's evidence, such as it was, rested on the statement of Mr. Gill that the float switch was not delivered until about the day before the fire. But, as I have already explained, this recollection is not very reliable as an indication of when the float switch was delivered because it is based only on the fact that Mr. Gill noticed the float switch in Mr. Reed's office a day or two before the fire and therefore assumed that it had just been delivered.
284. If, for reasons beyond Howmet's control, the float switch was not delivered until, say, late on the Thursday or on the Friday before the weekend during which the fire occurred, then the fact that it had not been installed straight away would not necessarily indicate a lack of care by Howmet. There may have been a perfectly good reason for this. In my view, the fact that it had not been installed by the time of the fire is not of itself conclusive of negligence or any want of diligence by Howmet.
285. If, on the other hand, the float switch had been delivered on 2/3 February 2007, then a failure to install it during the course of the next ten days would suggest at least a culpable lack of urgency and, possibly, a reckless indifference to safety. If that is what happened then, depending on the precise circumstances, it might have been sufficient to break the chain of causation.
286. I see no proper basis upon which the court can infer, as a matter of probability, that the float switch must have been delivered on 2/3 February 2007: in the absence of any reliable evidence there is simply no way of knowing when it was delivered. In these circumstances I feel unable to reach a conclusion as to whether or not the chain of causation was broken by Howmet's conduct between 2 and 12 February 2007. Insofar as there is any onus on EDL to prove this, it has failed to do so.
287. In some ways this really amounts to finding that what is sauce for the goose is also sauce for the gander. Since Howmet has failed to persuade me that after 2 February 2007 it relied on the thermolevel to work properly as a safety cut-out, it is perhaps unsurprising that EDL's submission that the chain of causation was broken by Howmet's conduct during the same period does not fare any better.

Contributory negligence

288. In the light of my findings so far, this does not arise. But in case the case goes further and I am found to be wrong in some of my conclusions so far, I will deal with it briefly.
289. Mr. Ward, Howmet's expert, described the procurement process for the GEL as "abominably unsatisfactory" (Day 7/53). In my view, that was no exaggeration. It was abysmal: the identified need for failsafe safety devices was ignored; the tanks were made of inflammable material; there was no specification; there was no risk assessment (either at all, or following the fire on 12 December 2006); and there appears to have been no start up PESHR (or, if there was, it was never completed).
290. I am in no doubt that in these circumstances Howmet was seriously at fault. The whole exercise was thoroughly unprofessional. Turning to the fire on 12 December 2006, I find it surprising that there was no report into the incident. There appears to be no written record of it beyond the e-mail sent by Mr. Hughes and the contemporaneous reports in the shift team's e-mails.
291. I find it surprising that Howmet did not require the heaters in the tanks to have built in over-temperature cut-outs. Although I do not consider that the failure to do this was negligent at the outset, it would have been an obvious step to take in relation to the hot water tank on the GEL following the fire on 12 December 2006.
292. The observation in the Long Text posted by Mr. Hunt in the SAP system about the risk of another fire was entirely justified. As I have already noted, the evidence provided no explanation as to why he did not take it further. I have reached the conclusion that the only reason for this is that someone must have reassured him that all was well, or at least that appropriate steps were in hand.
293. I do not propose to address individually the many criticisms of Howmet made by EDL in its submissions. At the end of the day, it is really a matter of impression. I have to consider the relative blameworthiness of Howmet and EDL and the causative potency of the conduct of each of them. I do so bearing in mind the points made by both sides.
294. As between Howmet and EDL, I consider that the lion's share of the fault lies with Howmet. Not only was its procurement of the GEL open to severe criticism (as I have already indicated), but also its response to the fire on 12 December 2006 was fairly ineffective. Its conduct appears to have been even less satisfactory after the incident of 29 January 2007 although, as I have explained, the evidence does not tell the full story as to what happened.
295. For its part, EDL put into circulation a device that should never have been allowed on the market. In addition, it appears to have carried out no satisfactory testing regime and the instructions supplied with the thermolevels were inadequate - almost to the point of being misleading.
296. In these circumstances, I would apportion liability for the fire on 12 February 2007 at 75%/25% against Howmet.

Conclusions

297. For the reasons that I have given, the claim fails and must be dismissed.
298. For ease of reference, my principal findings of fact are set out in the schedule attached to this judgment.
299. I will hear counsel on any matters arising out of this judgment, including costs if an appropriate order cannot be agreed.
Schedule to Judgment
300. The table below contains a summary of the principal findings of fact in the judgment for the ease of reference. It is not intended to be exhaustive.
301. In particular, findings in relation to the evidence given by particular witnesses, or as to the reliability of particular a witness, have not been included.
302. If a particular finding of fact is not included in the table, that is more likely to be the result of inadvertence than intent.

Paragraph	Finding
17, 89	Rejection of the criticisms of Howmet's continued use of the old grain etch line prior to the installation of the new GEL.
29	Howmet's own employees played no part in the decision to purchase EDL's thermolevels, but relied on ECS to choose them.
33	Mr Reed prepared the procedure for emptying the hot water tank on the GEL which required the operator to ensure that the heater was switched off before draining the tank.
52	Mr Darke probably told Mr Gill shortly after the incident on 29 January 2007 that the heater had "burnt out".
73	When he entered the Long Text into the SAP system on 2 February 2007 Mr Hunt was unaware of one or other of the two incidents that occurred on 12 December 2006 and 29/30 January 2007, but on the balance of probability he was aware of the first and but not of the second.
74	When Mr Hunt was interviewed by Mr Boyle on 16 May 2007 he did not mention the fire risk presented by the hot water tank because, on the balance of probability, he had been reassured that the risk had been addressed.
122	Findings as to the sequence of events 12 December 2006 and Howmet's understanding of the root cause of that incident.
155	There was no generally accepted understanding amongst Howmet's management of the cause of the fire in the mid 1990s.
156	Any knowledge of Mr Lemon as to the cause of that fire is not to be attributed to Howmet as a company.
159	There was no general conspiracy within Howmet to pull the wool over Mr Boyle's eyes about the incident on 29 January 2007.
160 & 262	It is very likely that Mr Reed knew about the incident on 29 January 2007.
171	The descriptions of the tests carried out by the experts and the results, as set out at paragraphs 161-170, were accurate.
173	The thermolevels produced by EDL were both unreliable and unpredictable in operation. This was not acceptable in a safety device. Further, the difficulty of setting the potentiometer made the thermolevel unsuitable as a safety device.
177	Conclusions as to what the reader would understand about the thermolevel from EDL's literature.
179	The instructions provided by EDL fell far short of being a satisfactory guide on how to set the "sensitivity" control. The absence of any warning that it was such that, if turned too far in one direction, it would prevent the probe from de-energising the heater irrespective of the level of liquid in the tank was a serious omission.
180	If there was a failure by ECS or MJD to make further enquiries of EDL about the operation of the thermolevel, this did not break the chain of causation between the negligent manufacture or supply of the thermolevel and the occurrence of the fire.
186, 189 & 206	The configuration in place on the hot water tank in the GEL at the time of the fire on 12 February 2007 was effectively the same as that shown in figure 1 in the Code of Practice. The installation in the hot water tank complied with the Code (189).
191	A built in over-temperature device for the heater was not a mandatory requirement of the Code.
194	The process carried on by Howmet in the GEL involved very similar plant and equipment to that which would be found in a typical plating shop.
195	The use to which the thermolevels were put at Howmet's factory was well within the contemplation of a manufacturer in the position of EDL.
196	At face value the thermolevel supplied by EDL appeared to be a reliable device that would cut the supply to the heater in the event that the level of liquid in the tank fell below the point at which the heating element was no longer immersed in liquid. It was therefore not negligent to design and install the GEL without requiring the heaters to have built in over-temperature devices.
197	The thermolevel was not capable of detecting whether its probe was in or out of liquid so as to operate an on/off switch accordingly, or at least not reliably.
200	EDL should have had in place a proper system of testing a reasonable proportion of the thermolevels that it manufactured: its failure to do so amounted to a want of proper care.
201	The "sensitivity" control was badly designed because it was difficult to set properly and the existence of voltage drift indicates a want of proper care in the design of the thermolevels.
202	The instructions provided by EDL for the operation of the thermolevels were manifestly unsatisfactory, particularly in that they failed to warn the user that the thermolevel might not work as a level sensor if the sensitivity control was not correctly adjusted, and that this demonstrated a lack of reasonable care by EDL.
203	If the cause of the fire on 12 February 2007 was a defect in the thermolevel and if, as a matter of law, EDL owed a duty of care to Howmet to take reasonable care to prevent a thermolevel causing damage to Howmet's property, then EDL was in breach of that duty because, as a matter of probability, the fire was not caused by a one-off defect in a thermolevel (see paragraph 204).
205	The thermolevel was not a safe device for use as a level sensor in a heating tank.
207	The thermolevel in the hot water tank was, immediately prior to the fire on 12 February 2007, in its correct or at least a serviceable position.
213	It was reasonable for a designer to assume that the thermolevel had been properly designed with appropriate safety features so as to make it fit for its purpose.
216	A failure to reject the thermolevel for want of a CE mark did not discharge any duty that EDL might otherwise have owed to Howmet.
217	A designer in the position of ECS should not have appreciated, on the basis of EDL's literature, that the thermolevel was or might be inadequate for its purpose.
218	If Howmet reasonably relied on the thermolevel as a protection against fire at the relevant time, then a failure by the thermolevel to operate properly was within the scope of the duty of care owed by EDL to Howmet.
236	The fire on 12 February 2007 started in the hot water tank of the GEL and was the result of a heater in that tank overheating and catching fire.
242	The failure of a component within the probe of the thermolevel was an unlikely cause of the fire on 12 February 2007.
246	Following the fire on 12 December 2006 Mr Reed repaired the connection in the hot water tank probe cable and then applied heat shrink to it for additional protection.
246	The failure of the connections in the cable to the thermolevel in the hot water tank was an unlikely cause of the fire on 12 February 2007.
247	Of the various possible reasons why the thermolevel might not have cut off the supply to the heater immediately prior to the fire on 12 February 2007, incorrect setting of the potentiometer is the least unlikely.
256	If the fire was caused by incorrect setting of the potentiometer, this was the result of, or at least materially contributed to by, the negligent instructions supplied by EDL.
266	It is more likely than not that by 1 February 2007 Mr Reed knew, or at least strongly suspected, that the thermolevel in the hot water tank was not working properly.
268	The knowledge of Mr Reed that a thermolevel was not working properly is knowledge that is to be attributed to Howmet.
273	Following the fire on 12 December 2006 (and until the incident on 29 January 2007) Howmet had no reason to think that the thermolevel was or might be unreliable.
274	Howmet has not satisfied the court that it was entitled to, or did, rely on the thermolevel operating correctly or reliably as a low level cutout between the incident on 29 January 2007 and the occurrence of the fire.
278	In continuing to use the thermolevels after the fire in December 2006 and until 2 February 2007 Howmet did not act in a manner that was so unreasonable as to break the chain of causation.
283	In the absence of any reliable evidence it is not possible to reach a conclusion as to whether or not the chain of causation was broken by Howmet's conduct between 2 and 12 February 2007.
291	If the fire on 12 February 2007 was caused or contributed to by the negligence of both Howmet and EDL, liability should be apportioned 75%/25% against Howmet.

Note 1    EDL did put it in a witness statement from one of the fire officers, a Mr. Jones, on the basis that he was deemed to have been tendered for crossexamination but was not asked any questions. In the event, therefore, no live evidence was called on its behalf.    [Back]

Note 2    I have said “him” because it was always a man. No woman gave evidence.    [Back]

Note 3    Mr Braund was Howmet’s electrical expert.    [Back]

Note 4    For example, in the witness statement of Mr. Gildersleve, at paragraph 36.    [Back]

Note 5    The desmut tank was one of the eight tanks on the new GEL.    [Back]

Note 6    The SAP system was a computer database that enabled operators to request assistance from the Maintenance Team: it is explained in more detail in the section of this judgment that deals with Mr. Webber’s evidence.    [Back]

Note 7    The whole of the paragraph in the note from “Looked” to “something else” appears to have been originally taken down by Mr. Boyle in the belief that it related to the incident on 29/30 January 2007, but it seems that Mr. Darke then explained that it related to the earlier incident on 12 January 2007.    [Back]

Note 8    I assume that “rcd” stands for residual current device.    [Back]

Note 9    The word “Kaizen”, meaning good change or improvement, is probably derived from the Japanese words “kai”, meaning change, and “zen” meaning (in this context) betterment.    [Back]

Note 10    The e-mail sent by Mr. Hughes on 12 December 2006 was circulated to ten people.    [Back]

Note 11    A further handicap that emerged in the course of his evidence was that it appeared that Mr. Gildersleve was not able to hear anything that I said because it seems that the only microphone that was transmitting was the one placed in front of counsel. Unfortunately, there was a defect in the court equipment, as a result of which the evidence was interrupted for about an hour. In addition, Mr. Gildersleve was sitting some way away from the camera so that it was not possible to observe him from reasonably close up, and I was not prepared to lose any further time in an attempt to improve the arrangements in the video room in which Mr. Gildersleve was giving evidence.    [Back]

Note 12    In relation to information derived from witnesses generally, Mr. Bartlett made a similar point to Mr. Boyle in crossexamination (at Day 5/126-7).    [Back]

Note 13    See the authorities discussed below at paragraphs 263-265 and 277.    [Back]

Note 14    Mr. Boyle’s note of a conversation with Mr. Reed on 26 February 2007 refers to Mr. Reed having designed and installed an auto fill system, so it must have been there the time of the fire.    [Back]

Note 15    Although this submission appears be inconsistent with the assertion at paragraph 63 of EDL’s written closing submissions that the auto fill system was a process control feature, not a safety feature.    [Back]

Note 16    I have already eliminated incorrect positioning as a cause: see paragraph 207.    [Back]

Note 17    See paragraphs 3.5.13 and 5.14.3 of Mr. Braund’s report.    [Back]

Note 18    When Mr. Boyle spoke to Mr. Reed in February 2007, Mr. Reed told him that he “… checked the level system” and that “… the low level alarm worked”. When asked about this again in January 2008 he said that he could not remember doing this himself, but that he thought that it was done by somebody.    [Back]

Note 19    Mr. Reed knew how to do it because he explained the procedure to Mr. Boyle during the interview on 26 February 2007.    [Back]