199 Knightsbridge Development Ltd v WSP UK Ltd

  Neutral Citation Number:  [2014] EWHC 43 (TCC) Case No:  HT-10-38IN THE HIGH COURT OF JUSTICEQUEEN’S BENCH DIVISIONTECHNOLOGY AND CONSTRUCTION COURT Royal Courts of JusticeRolls Building, 7 Rolls BuildingsLondon, EC4A 1NL Date:  28th February 2014 Before : MR. JUSTICE EDWARDS-STUART- – – – – – – – – – – – – – – – – – – – -Between :  199 Knightsbridge Development Ltd Claimant – and –  WSP UK Ltd Defendant – – – – – – – – – – – – – – – – – – – – — – – – – – – – – – – – – – – – – – – – – David Sears Esq, QC & Benjamin Pilling Esq(instructed by DAC Beachcroft LLP) for the ClaimantRoger ter Haar Esq, QC & Richard Coplin Esq (instructed by CMS Cameron McKenna LLP) for the Defendant Hearing dates:  4th & 5th December 2013;  9th – 13th December 2013;  16th December 2013 and 19th December 2013.Additional written submissions 4th and 5th February 2014.- – – – – – – – – – – – – – – – – – – – -Approved JudgmentI direct that pursuant to CPR PD 39A para 6.1 no official shorthand note shall be taken of this Judgment and that copies of this version as handed down may be treated as authentic. ……………………….. MR JUSTICE EDWARDS-STUART  ContentsIntroduction 4The background 5The system at 199 Knightsbridge 6The design process 7The “black building” test on 30 August 2005 11The events of 15 September 2005 11The witnesses who were not involved in the events of 15 September 2005 16Mr. Groves 16Mr. Keith Shenstone 19Mr. Scott 20The experts 20Dr. Andrew Prickett 20Mr. David Gosling 21Mr. Terry Dix 21Other evidence as to the availability of anti-surge valves for residential systems prior to 2005 22The CAVSA anti-surge valve 22The Vent-O-Mat RBX surge arrestor (“Cla Val”) 22Other material 23WSP’s duty and the applicable law 24The scope of WSP’s duty 27The relevant principles 27The configuration of the cold water pipework and its implications 28The mechanism of the failure 36The Claimant’s general case on design 38The Claimant’s case on the trigger events 41The substitution of the Grundfos pump set for the Allan Aqua set 43The request for an instruction to install double check valves 43The commissioning stage 43Review of the O&M manuals 48The discussions about the emergency generator 48The “black building” test 49Was there a conversation between Mr. Groves and WSP 49Causation 51The installation of surge arresters 51The establishment of a slow refill procedure following an unplanned shutdown 53Conclusions 55RULING 57The Claimant’s case in relation to potentiometers 57 Mr. Justice Edwards-Stuart: Introduction1. 199 Knightsbridge is a large and very prestigious apartment block in London that was built a few years ago.  It is now known as “The Knightsbridge”.  At the relevant time the freehold owner of the building was the Claimant.2. On 15 September 2005, when the building had been partly handed over, there was serious flooding resulting from two failures of the cold water pipework.  In the first case, a 25 mm pipe joint failed, in the other a 15 mm copper pipe burst under pressure.  Extensive damage was caused by the subsequent escape of water.3. The issue in this case is whether WSP UK Ltd (“WSP”), the Mechanical and Electrical (“M&E”) engineers who designed the cold water system, are liable for the flooding.  WSP say that no reasonable engineer at the time would have foreseen or guarded against the events that occurred.4. The Claimant says that everything that occurred could have been foreseen.  If WSP had thought through their design, says the Claimant, they would have identified the risk of a potentially catastrophic failure following an unscheduled shutdown of the cold water booster pumps and the ensuing partial drain down of the water system which would occur as the occupants of the building continued to use water.5. One of the striking features of this case is that, with the benefit of hindsight, the potential problem can be identified without any great difficulty.  Once the problem was identified, so the Claimant submits, the solution would have been equally apparent.6. However, another notable feature of the case is that not one of the leading building services practices in the UK identified the problem prior to 2005.  In the light of this it is submitted on behalf of WSP that they cannot have been negligent if what they did was no different from that being done at the time by apparently competent engineers of similar experience and resources.  This is a formidable point.7. At one stage during the evidence I came close to thinking that WSP’s case was a good one.  However, after hearing all the evidence and having had time to reflect, I have concluded that competent engineers in WSP’s position should have foreseen the problem and taken steps to deal with it.  However the question then arises as to whether, had they done so, the flooding could have been prevented.8. This question of causation is also very difficult.  However, I have reached the clear conclusion that, if WSP had appreciated the problem as I consider they should have done, it has not been shown that the steps that WSP should have taken would have prevented either of the two failures that occurred on 15 September 2005.9. The Claimant was represented by Mr. David Sears QC and Mr. Benjamin Pilling, instructed by DAC Beachcroft, and WSP was represented by Mr. Roger ter Haar QC and Mr. Richard Coplin, instructed by CMS Cameron McKenna.The background10. During the latter part of the 1990s the statutory water undertaker for London (Thames Water) decided to reduce the mains water pressure in order to limit the volume of water that was being lost through leaks in the system.  Until then the practice in London had been for domestic water systems in relatively low rise residential buildings to be fed from a tank in the roof space.  The only exception was one tap, usually in the kitchen, that was fed directly from the mains.11. As a result of the combination of the reduction in the mains water pressure and the need to make more use of the limited building land available in London by building high rise residential developments, the conventional solution of supplying the cold water to the building by a gravity fed system from a tank at the top of the building was no longer always viable.12. An additional factor was that, from a commercial point of view, apartments at the top of a high rise building are the ones that command the highest prices.  It was therefore uneconomic to use this premium space for the storage of water, quite apart from the added problems and cost of having to strengthen the building in order to support a substantial weight of water at high level.13. Thus towards the end of the 1990s the practice of supplying the cold water system in a residential building from a holding tank at the top of the building was often no longer followed.  Instead, at least in high rise developments, cold water systems used booster pumps to increase the mains pressure and to pump the water to all parts of the building.14. Initially a major difficulty in the design and operation of such systems was the wear on the pumps.  This was because when water was drawn off the system the pumps, which only operated at one speed, would start up at full speed, sometimes only to stop again after a few minutes.  Whenever a conventional fixed speed electric pump is started there is a very high load on the motor and so frequent starting of the pump can damage the armature.  Experience showed that unacceptable damage might occur if fixed speed pumps were started more frequently than about once every 10 minutes.15. At first this problem was solved by the incorporation of a small jockey pump that could recharge the cold water system when small quantities of water were drawn off, thereby avoiding the need for the main pumps to start so often.  But one drawback of this arrangement was that the single jockey pump represented a vulnerable point of weakness in the system.16. However, by the turn of the century a new type of pump motor with a variable speed drive (“VSD”), controlled by a device known as an inverter, had been developed at a commercially viable price.  VSD pump sets then began to replace the combination of fixed speed pumps and a jockey pump.  VSD pumps would typically be set, when in automatic mode, to reach, say, 70% of their capacity within 2-3 seconds of start up, although this period could usually be made longer, if required.  However, if a VSD pump was started manually it would usually start up at full speed straight away.  At least, that is how the system operated as it was installed in 2003 at 199 Knightsbridge.17. There was a further device that was designed to ease the load on the pumps in boosted cold water systems and to maintain a more consistent pressure of water.  This was the accumulator.  An accumulator, crudely described, is a tank which contains a rubber balloon or membrane.  The balloon, or one side of the membrane, is filled with a compressible gas.  When the booster pumps are started water is pumped into the accumulator, which is installed downstream of the pumps, thereby compressing the gas within the membrane.  As water is drawn off the system, the compressed gas expands and pushes water back into the system so as to maintain the pressure.  This not only evens out the small variations in pressure that would otherwise occur but also saves the pumps from having to start in order to supply only a small quantity of water.18. However, the capacity of accumulators is not large.  The one installed at 199 Knightsbridge had a capacity of 100 litres.  In the context of a building containing over 200 apartments, this is not substantial.  It is important to emphasise that its function was to improve the consistency of the pressure in the system and to save wear on the pumps by reducing the number of occasions on which they had to start.  Although to a limited extent the accumulator might be able to absorb a sudden increase in the water pressure of the system, I did not understand that to be its principal function:  it was simply a feature of how it operated.The system at 199 Knightsbridge19. The cold water system consisted of 18 risers fed from a ring main.  These served the 206 apartments.  Two of the risers (AR 8 and AR 10) served most of the floors up to and including the eleventh floor.  The other risers all served the first four floors (including the ground floor) and some served some of the higher floors up to the tenth floor.  The risers were of varying diameter, being wider at the bottom than the top, the upper sections being 28 mm in diameter.  There were also two smaller risers that fed cleaners’ sinks on each floor.20. There was one cold water feed to each apartment which passed through a non-return valve.  This was required – by The Water Supply (Water Fittings) Regulations 1999 – in order to prevent back contamination of the system.  It was agreed by the experts that these valves would also prevent the entry of any air into the system.  In addition, there was a manual air vent at the top of each cold water riser.21. The effect of these arrangements, which was the state of the system in September 2005, was that there was no means by which air could either enter or leave  the risers, save by operation of the manual air vent.22. Every householder will be familiar with the phenomenon known as “water hammer”, although few may understand what causes it.  At its simplest, when water travelling at speed through pipework is suddenly stopped – say, by the operation of a ceramic tap – the sudden loss of kinetic energy sets up a shockwave that passes through the water in the pipes, the energy of which is then absorbed by the structure of the pipework, particularly at sharp bends.  These shock waves travel at speeds close to the speed of sound in water – at about 1,100 metres per second.  Sometimes this results in reverberation in the pipework which can persist for some time – hence the description “water hammer”.  High velocity surges can cause damage directly to the component that arrests the water or, by the pressure energy of the shockwave, to another component remote from the location of the component that actually arrests the flow of the water.23. The strength or energy of the shockwave produced in this way will depend largely on the velocity of the water in the pipe and the suddenness with which it is stopped.  The feature of the cold water supply at 199 Knightsbridge which was not appreciated by WSP was the combination of two factors:  first, the very high velocity at which the water could travel through the risers when one or more of the pumps was operating and, second, that, under certain conditions, there would be little or no air trapped in the system that could operate as a buffer to cushion the shock of the impact of the water as it came to rest when the system was refilled.24. One situation in which this could occur was if the water supply to the risers was unexpectedly interrupted because the pumps had shut down.  The occupiers of the apartments would continue to draw water from the system as usual, for example by running a tap or flushing a lavatory, with the result that the water level in the risers would start to drop.  As it did so the supply of water to the apartments would dry up, beginning with the highest floor.25. As I shall explain in more detail in a later section of this judgment, the effect of an automatic restart of the pumps would be to force the cold water back up the risers at a very high velocity (between them the four booster pumps could deliver more than 50 litres of water per second).  Since there was no means of permitting air to enter the partly drained risers, the pumps would be pumping the water back into a partial vacuum.  The lack of any air in the risers to cushion the flow of the water once the system became full meant that a very significant surge pressure would be generated when the flow of water came to a sudden halt.26. This is exactly what happened following the unexpected shutdown of the booster pumps on 15 September 2005.  In one apartment on the sixth floor a 28 mm pipe joint was forced apart, and in another on the eleventh floor a 15 mm section of copper pipe was simply ruptured.  The water pressure that was required to cause these failures was of the order of about 70 bar and 250 bar, respectively.  A typical pipework joint is designed to withstand a pressure not much in excess of 16 bar.27. Prior to 2005 neither WSP, nor, according to the evidence, any other major firm of building services engineers within the UK, had foreseen that an unexpected shutdown of booster pumps could have such dramatic and catastrophic consequences.  The central issue in this case is whether or not WSP were negligent in failing to appreciate this sequence of events.The design process28. The evidence about the detailed course of the design of the cold water system was somewhat sparse.  This was not due to any failure by WSP to produce the relevant documents:  there was a major fire in July 2006 in the building in which their hard copy files were stored, so WSP were not in a position to produce or rely on any of the contemporaneous documentation that was in those files unless copies of those documents were also held electronically.29. WSP called its lead M&E engineer for the project, Mr. Bellinger.  His evidence was that the design of the cold water system was the responsibility of a public health engineer, which he is not.  The two public health engineers who were principally involved in the design of the cold water system at 199 Knightsbridge were Mr. Oswald Kennedy and Mr. Keith Haworth.  Mr. Kennedy prepared the initial or scheme design, but then left WSP in 2002.  His successor was Mr. Haworth, who was in place by February 2003 (if not earlier).  He prepared the detailed design of the cold water system.  Like Mr. Kennedy, he is no longer employed by WSP.  The evidence did not disclose when Mr. Haworth left WSP, save that it was after the incident in 2005.  Mr. Terry Marsh was the resident engineer for the mechanical services, and he was involved in the discussions about the choice of booster pump set in 2003 although he was not himself a public health engineer.30. Mr. Hinton, a director of WSP since 2002, who had overall responsibility for the project at 199 Knightsbridge, was called on behalf of WSP.  He said that unsuccessful efforts had been made to contact Mr. Kennedy, but he did not know whether or not any attempt had been made contact Mr. Haworth.  Mr. Hinton said that he had seen Mr. Marsh about two years ago on a train to London.  Neither Mr. Haworth nor Mr. Marsh was called to give evidence.  WSP did not attempt to provide any explanation for this.31. I did not find Mr. Bellinger to be a particularly impressive witness.  However, since he was not himself a public health engineer and therefore was not involved in the detail of the design of the cold water system, his evidence in relation to the design process was of relatively limited value .  However, he said that the possibility of catastrophic pressure surges was not one of which he was personally aware prior to the failures at 199 Knightsbridge in September 2005.  He said also that he was unaware of the failure of a joint in a 28 mm pipe that occurred during or after a “black building” test on 30 August 2005 until after the subsequent failures on 15 September 2005.  I have no reason to doubt his evidence on either of these points (the latter was not challenged by the Claimant:  see paragraph 43 below).32. Much time at the trial was taken up in relation to a decision taken by the client, in the light of advice from WSP, to choose a booster set manufactured by Grundfos, in place of the Allan Aqua set that was initially specified by WSP.  The Claimant relied strongly on what it said were warnings by Allan Aqua of the potential for pressure surges which, it claimed, were ignored by WSP.  WSP contended equally strongly that this point was misconceived.33. What happened was this.  Axima, the M&E sub-contractors, wanted to substitute a Grundfos booster set for the Allan Aqua set initially specified by WSP.  WSP sent the details of the Grundfos system, which they had received from Axima, to Allan Aqua asking them to identify the differences between the two pump sets.  There were discussions between WSP and Allan Aqua, with Mr. Marsh representing WSP.34. On 14 March 2003 Allan Aqua sent a fax to WSP responding to their enquiry.  Since its contents are heavily relied on, it is necessary to set out the text of the document in full.“Further to your recent fax in connection with the above site we are pleased to offer our opinion on the following.  The main difference between our original offer and the Grundfos Quadcompact MF4CR booster set are as follows: ALLAN AQUA-SYSTEMS GRUNDFOS1 Each pump provided with a dedicated frequency inverter Single lead pump inverter, all subsequent support pumps operate on star/delta starters through the lead pump inverter and Delta M6 control.2 Dedicated pressure transducers for each pump Common pressure inducer3 100 litre accumulator 24 litre accumulator4 IP55 IP545 Unit fully painted Partially painted6 Unit fully packaged, all motors and transducers pre-wired to control panel, fully tested at works. Panel separate from pumps, motors and transducer wiring to be carried out on site by contractor (not part of Grundfos offer).  If not pre-wired unit cannot be tested at factoryConsequences of the disparity between the units could be as follows:1. Lead pump is permanently operating through inverter;  if the inverter fails could it be that no pumps will operate in automatic mode or will they all revert to manual operation?  Significant surge will occur on star/delta starting.  Excessive pressure?2. Single transducer is a single point of failure.  Should the transducer fail all pumps will try to start including those on start/delta.  Surge problems, excessive pressure?3. Small vessel for such large capacity pumps, particularly if support pumps are on star/delta.4. No major problem with IP54/55 rating.5. No significant consequence except AAS unit will look a better ‘bespoke’ package and appear to be a more thorough design.6. If the unit is not fully packaged it cannot be fully tested prior to despatch.  Significant reliance on site contractor to wire pumps and transducer correctly, not the most reliable way to complete a booster set installation, particularly if they are not familiar with the product.  Possible problems at commissioning.  Who has responsibility for overall performance of pump set?  You may wish to ask why won’t Grundfos fully package unit?Should the Grundfos principle be acceptable to you we could expect savings of between £5k and £6k for an Allan Aqua version.  We would still offer a complete package, fully wired and tested.In our view the two systems are not wholly comparable.  As a minimum the vessel size on the fixed speed support pump set should be increased significantly to reduce surge, all support pumps should be soft start.  However, this will not reduce the probability of over pressure in the system.We hope the above helps clarify the technical differences between the two systems and look forward to receiving your comments in due course.”35. Mr. Gosling, the expert public health engineer called on behalf of the Claimant, said in his report that this fax should have:“…  served to highlight to WSP something that they should already have been aware of, namely the potential of the booster set to generate significant pressure surges and, the need to satisfy itself that the selected pumps in the system as a whole had all the necessary controls to ensure safe performance in all foreseeable circumstances.”36. In particular, the Claimant submitted that Allan Aqua was flagging up the possibility of the pump set generating significant surge and/or excessive pressure on star/delta  starting, whether in auto or hand mode, and this should have put WSP on notice of the fact that there could be excessively high pressures when the system was started and what might happen in this situation.  37. I do not agree with the Claimant’s interpretation of this document.  In relation to the first comment made in the fax, Allan Aqua was comparing a pump set in which each pump was provided with a dedicated inverter (in other words, its motor had a VSD) and a pump set in which only the lead pump had a VSD motor.  The main purpose of VSD motors is to permit the pump to operate at variable speeds in order to match the demand and save energy, whereas a fixed speed motor always starts at full speed.  So if the lead pump failed, leaving only fixed speed pumps, the booster set would start up at full speed (irrespective of the outlet pressure) which would produce pressure surges and, perhaps, excessive pressure at times.  I can see absolutely nothing in this document to suggest that Allan Aqua was addressing the possibility of the pumps starting up when the system was partly drained down.  38. In my view the second comment made by Allan Aqua is simply a variant of the first.  Again, it is not addressing the problem of pumps starting up when the system is partly drained down.  39. However, if contrary to my view, Allan Aqua was referring to very significant pressure surges, this is arguably a point against the Claimant.  This is because, adopting the Claimant’s approach, it would follow, by inference, that Allan Aqua was suggesting that its system, namely one with four VSD pumps rather than just one lead VSD pump and three fixed speed pumps, would avoid significant pressure surges.  In fact, everyone now knows that having a booster set with four VSD pumps was not sufficient to prevent the catastrophic pressure surges that occurred on 15 September 2005.40. Following receipt of this e-mail WSP accepted Allan Aqua’s criticisms of the Grundfos booster set and required Grundfos to upgrade it accordingly so that each pump had a VSD motor and a dedicated pressure transducer;  in addition, the capacity of the accumulator was increased to 100 litres.  However, I am not clear whether or not the Grundfos set was prewired in the same way as the Allan Aqua set.  But even though WSP were satisfied that the Grundfos substitute, as modified, was similar (in terms of specification) to the Allan Aqua system that they had specified, Mr. Bellinger told his client in a fax dated 8 May 2003 that, whilst the Grundfos booster set met the technical requirements, they would be getting “a Ford rather than a Rolls”.The “black building” test on 30 August 200541. On 30 August 2005 there was a test of the M&E systems at 199 Knightsbridge known as a “black building” test.  This is because it tests the operation of the emergency systems when the electricity supply is cut off.  By the time of this test the booster set was no longer supported by the standby generator.  Accordingly, the pump set would have shut down when the electricity supply was cut.  As the system was set at the time, it would then have restarted in Auto mode when power was restored.42. On the following day, 31 August 2005, a leak was discovered in an apartment on level 11.  It was found that the joint in the 28 mm pipe work had separated.  Mr. Lee Burgess, the group manager for Axima, promptly took the failed coupling to the manufacturers, Yorkshire Fittings, for examination and testing.  Yorkshire Fittings concluded that the joint had been correctly formed and was not in any way weak or faulty.  A pressure test was carried out on a similar joint which did not fail until a pressure of about 50-70 bar was reached.  The written report from Yorkshire Fittings was not produced until after the failures on 15 September 2005.43. The Claimant accepted in its opening submissions that it was not clear whether WSP knew about either the leak or the results of those tests before the incident on 15 September 2005 (see paragraph 50).The events of 15 September 200544. On 15 September 2005 there was to be a reception in an apartment on the ninth floor.  It had been arranged by the architects, who had invited important clients that they wished to impress.  At about 4:30 pm Mr. Pope, a construction manager employed by Multiplex, was told that the caterers who were setting up the reception in the apartment had reported that there was no water.  Understandably, it was for him a very high priority to discover what had happened and to restore the supply as soon as possible.45. Mr. Pope immediately went to the office of Mr.  Burgess and told him what had happened.  Shortly afterwards he and Mr. Burgess went down to the plant room, where a number of people had already gathered.  He said that they found that the pumps were not working, although he was not sure of the reason.  The display on the pump control panel indicated that the water was at a low level.  There was a discussion as to what had happened.  In evidence Mr. Burgess said that at the time he was not aware that a partial vacuum might exist in the system which could cause a catastrophic pressure surge.  He agreed that Mr. Pope was under considerable pressure to restore the water supply to the ninth floor.  He said that he told Mr. Pope that the system was not to be switched back on until they had discovered the fault.46. Mr. Burgess was emphatic that he told not only Mr. Pope but all those in the plant room that the system should not be switched back on until the cause of the problem had been discovered.  Mr. Burgess then left the plant room to find Mr. Pindolia, the construction manager, because of his experience in the operational field.  In his witness statement Mr. Pope said that he left the plant room before Mr. Burgess went to find Mr. Pindolia.  However, before Mr. Burgess had returned to the plant room, which in his witness statement he said was at about 5:30 pm, he was told that the pumps had been switched back on and the water supply restored.  He said that he was furious that this had been done without his agreement.  When he returned to the plant room he found the pumps running but decided that it was better to leave them running rather than switch them off again.  The flood occurred later that evening.47. Mr. Pope’s evidence was that he did not recollect any firm statement that the pumps should not be turned back on, although he does remember an inquiry as to who had drained down the tank.  Mr. Pope recalled that Mr. Burgess had made a remark to the effect that the people attending the party would have to be given bottles of water and that buckets could be used to flush the toilets, but he didn’t think that he was being serious.48. Mr. Greg Dacey, an electrical engineer who was employed as the services manager at the project, was not present during the incident on 15 September 2005, but he did see Mr. Burgess the following morning and remembers Mr. Burgess saying that he had told everyone not to turn the pumps back on.  He said in evidence that Mr. Burgess was very cross that his instruction had been disregarded.  In an e-mail sent at 14:37 on 16 September 2005, Mr. Dacey said this:“Axima advised that they would not turn on the system immediately, as they were concern (sic) that air may now be in the system, which would cause excess pressure build up, and they would rather investigate the situation prior to turning on the system.  What this investigation would consist of has not been determine (sic).Prior to the investigation taking place the pumps were switched on, it has not been ascertained by whom.Axima advised that they were concern (sic) that the pumps had been switched on, and surveyed levels 11, 10 and 9, no leaks were found Axima advised that they suggested Hyatt monitor the system.”This e-mail also put the time of the report of the lack of water on the ninth floor as at approximately 16:30 hours.49. Mr. John Browne was the director of engineering for Hyatt Holdings, who were responsible for managing the building, and although he had no professional qualifications he had 20 years’ experience in managing building systems.  He was present on the afternoon and evening of 15 September 2005.  On the previous day he had been concerned about the relatively high temperatures in the two cold water tanks (22.5°C and 23.5°C, respectively), which he regarded as a potential health risk.  In order to increase the flow rate of the water through the tanks he decided to isolate tank 1 from tank 2, so that the building would be fed only by water from tank 1.  On the morning of 15 September 2005 one of his assistants checked the water level in tank 1, which was 400-500 mm above the outlet and above the low level sensor (which in fact, unknown to anyone at the time, was not connected to the pumps).  This was thought to be a sufficient level of water.50. When Mr. Browne heard about the failure of the water supply to the ninth floor, which he said was at about 5:30 pm, he went to the plant room, where he found Mr. Burgess, Mr. Pindolia and Mr. Budd.  He said in his witness statement that shortly after he arrived he was joined by Mr. Aitchison and Mr. Hughes, an engineer from the company responsible for overseeing the commissioning of the plant.  He said that the booster pump set was found to be in a fault condition with all four pumps having previously been set to Auto mode.  At that point the controls were all in the off position.  Mr. Browne again checked the water level in tank 1 and noted that it was still above the low level sensor and about 400 mm above the outlet.  There was no obvious explanation as to why the pumps had tripped out.  He said that it was decided to isolate tank 1 and make tank 2 the feed tank.51. No-one in the plant room on 15 September 2005 appears to have been aware of the fact that the level sensors in the break tanks were not connected to the pumps.  Instead the pumps had a pressure sensor on the inlet pipework, but it seems that it was set so as to cut out when the water level in the tank was above the level of the break tank sensors.  This is what caused the difficulty:  the water level in the break tank was above the level sensor, yet the pumps had cut out for no obvious reason.  It was therefore unclear why the control panel was indicating a low water level.52. Mr. Browne said that there was then a discussion as to whether or not to switch the pumps back on.  He said they discussed if there was any air in the system and if air had been sucked out of the tank.  The general consensus, said Mr. Browne, was that the pumps could be switched back on because there was sufficient water in the tank.  He said that in order to check whether there had been a loss of supply to the pumps either an Axima employee or Mr. Hughes turned the pump 1 control to manual and then off again “in a quick on off motion”.  He said that the pump only ran for seconds but he thought that it made an unhealthy sound.  This has been referred to as “blipping” the pumps.  I understood this to refer to an action that would have lasted about 2-3 seconds, which would be long enough to hear the pump start and then switch it off.53. In the next paragraph of his witness statement, Mr. Browne said that “ … the fact that the pumps had started to run when they were ‘blipped’ indicated that they were not damaged” (my emphasis).  This suggests that more than one pump had been “blipped”.54. He said in evidence that when he heard that there was no water to the ninth floor, he assumed that the system had just drained down to that level and that restarting the pumps should not be a problem.  He said that pump sets trip out constantly and it was just one of those situations.55. Mr. Browne said that they did not go and consult the O&M manuals:  they occupied a whole room and there were hundreds of files.  He described himself as a copious note taker, and said that at the end of the evening he went back to his office and wrote up the incident.  The statement that he made shortly after the incident was based on his notes.  He said that he was in the plant room throughout the relevant time, but he was quite adamant that he did not hear Mr. Burgess say that the pumps should not be switched on in any circumstances.56. Mr. Browne said that he was pretty certain that Mr. Burgess was in the plant room when the pumps – in the plural – were “blipped” to check that they had power (Day 3/46).  He said that Mr. Hughes, a manager employed by the company responsible for overseeing the commissioning of the plant, interrogated the control panel in order to establish why the pumps had tripped.  He described Mr. Hughes as “the wisest man in the room at that point” (Day 3/50).  He described the “blipping” of the pumps as a very quick turn on and off to see whether they operated.57. Mr. Stephen Budd, who was employed by Axima as a building services engineer, was also present in the plant room.  He has 30 years’ experience in the industry.  He knew Mr. Burgess well and they worked in the same office.  He had no recollection of Mr. Burgess saying that he had given instructions not to turn the system back on but that his instructions had been disregarded.  He said that Mr. Burgess was the sort of person who did not lose his temper often and that if he had been angry on this occasion he was sure that he would have noticed.  He could not recall who gave the instruction to switch the pumps back on.58. Mr. Hughes was not called as a witness.  He had made a statement shortly after the incident in January 2006, but since then the Claimant had lost track of him but no steps had been taken to serve a Civil Evidence Act notice in respect of his original statement.  An application to do so was made for the first time during the trial.  Since his evidence was clearly contentious, I refused the application to put his statement in evidence.59. Mr. Browne said that he went into the garden at about 7:00 pm and saw a great deal of water running down the outside of the building, although he could not tell from which floor level it was coming.60. In the absence of at least one crucial witness, Mr. Hughes, it is not easy to establish with any degree of confidence what happened in the plant room that afternoon.  As I have already indicated, there was evidence that more than one pump was “blipped” briefly in order to check that the pumps had power.  I accept this evidence and I find that at least two pumps were “blipped”.  Apart from anything else, it seems the sort of thing that people would do in this situation.  There is a dispute as to whether or not Mr. Burgess was in the plant room when this happened.  I find that he was.  This is what Mr. Browne said in his witness statement, which I am satisfied was made on the basis of notes that he took very shortly after the relevant events occurred.61. There was an acute conflict of evidence about:i) whether or not Mr. Burgess gave an instruction not to switch the pumps back on;  and ii) his reaction to the incident the following day.On the latter issue, I prefer the evidence of Mr. Budd.  I think that it is very likely that Mr. Burgess told Mr. Pope that the pumps should not be switched back on until he, Mr. Burgess, had investigated the problem.  However, I am not satisfied that Mr. Burgess gave such an instruction in the presence of all those in the plant room.  It seems to me to be inherently unlikely that such an instruction would have been disregarded.  What seems to be more likely is that Mr. Burgess intended that Mr. Pope should pass on the instruction but that, for whatever reason, this did not happen.  Further, if the evidence of Mr. Burgess and Mr. Dacey about this was correct, I would have expected Mr. Dacey’s e-mail of 16 September 2005 to have been expressed in rather more forceful terms.62. The events which took place in the plant room on the afternoon of 15 September 2005 were, in my view, unsurprising.  It is clear that no one present appreciated the implications of the water in the risers having drained down to below the ninth floor or the consequences of switching the pumps back on in that situation.  However, Mr. Burgess, whether out of caution or previous experience, considered that it would be imprudent to switch to pumps back on until the cause of the problem had been discovered.  He cannot be criticised for this.  Far from it, we now know that he was quite right.63. There was no one in the plant room, with the possible exception of Mr. Pope (who, in any event, left early and was not involved in any decision making), who should not have known what he was doing.  Between them they had an enormous amount of experience in building services.  Whether they were right or wrong, they were certainly not untrained personnel.  In the absence of any clear instructions on the face of the pump controls as to the action to be taken in the event of a shutdown of the pumps, it seems to me that what happened was entirely foreseeable.64. What is quite clear is that it would have made no difference to the events that happened if WSP had required Grundfos to set up the booster set control panel so that the pumps would have to be restarted manually in the event of an unexpected shutdown.  In effect, this is exactly what happened.  The control panel was interrogated, two or more pumps were “blipped” briefly, the fault status was cleared and the pumps were restarted manually, albeit in Auto mode.65. For the reasons that I set out later in this judgment, I find as a matter of causation that the only precaution that would surely have prevented the pipework failures that occurred on 15 September 2005 was the fitting of anti-surge valves at the top of the risers.The witnesses who were not involved in the events of 15 September 2005Mr. Groves66. Apart from his evidence in relation to a conversation with Mr. Bellinger in the summer of 2005, which I discuss later in this judgment, Mr. Groves gave evidence on several other important aspects of the case.  He was employed by Grundfos as an area sales manager.  He had been employed by Grundfos for 20 years.  He dealt principally with major building services engineers, such as WSP.67. Initially Mr. Groves declined to give a witness statement, which he had been asked to do by the Claimant’s solicitors, DAC Beachcroft.  They then prepared a witness summary in relation to his evidence.  When the contents of that witness summary came to the attention of Mr. Groves and Grundfos, which was on 19 November 2013, Grundfos’s solicitors immediately took instructions from Mr. Groves and Grundfos.  On 22 November 2013 they wrote pointing out that the witness summary had not been approved by Mr. Groves.  They then set out in eight numbered paragraphs what his evidence would be.  A short witness statement was subsequently prepared by Mr. Groves, dated 5 December 2013, in which he confirmed the accuracy of the contents of the letter from Grundfos’s solicitors dated 22 November 2013.  In spite of this rather unpromising beginning, Mr. Groves proved to be one of the central witnesses in the case.68. Mr. Groves said in evidence that, from about early 2004 onwards, he was aware of incidents where “blow outs” had occurred in high rise buildings with boosted cold water systems.  As I will explain later in this judgment, Mr. Groves first heard about the “Cla Val” anti-surge valve at a meeting on 1 July 2004 but it was not until July or August 2005 that Grundfos was in a position to market these valves as an adjunct to their booster systems.  Mr. Groves said that until 2004 the Cla Val valve had been used for heavy duty purposes in pipelines, sewage works and so on, but not in building services.  He agreed that in July 2005 it was still the norm for engineers to specify booster sets with VSDs and accumulators but without anti-surge valves.  As he said (at Day 2/144):“It’s like anything.  People don’t like change.  So initially it was quite hard to sell the idea [of anti-surge valves] but even harder to find a site that people would try the valve out on to see if it actually worked.”He went on to say that it was only in those cases where there had been floods that engineers realised that they had something wrong and were therefore receptive to new ideas.69. Mr. Groves was referred to an article published in May 2005 by Mr. Peter Reynolds, who was then the Director of commercial building services with Grundfos.  It was entitled “Design considerations for pressure-boosting sets”.  As Mr. ter Haar pointed out in cross examination, that article said nothing about the need for anti-surge valves or the danger of serious pressure surges.  Indeed, the system was described as consisting of one or more vertical multistage pumps and, in most applications, a membrane tank (ie. an accumulator) in addition.  As to the benefits of such a system, it said merely that “… many system problems such as water hammer and noisy valves can be resolved using inverter pumps”.  Mr. Groves said that the article said nothing about the problem of partial vacuums in pipework because Grundfos as a company did not fully understand the problem at that time.70. The evidence of Mr. Groves was in line with the text of an e-mail sent to Mr. Dix by Ian Burke, of Allan Aqua, dated 31 October 2013.  In that e-mail he said:“It should also be pointed out that the use of variable speed drive technology was, at the time, in its infancy and that practically all manufacturers were learning how best to use and control frequency inverters in booster set applications.  It wasn’t until after several similar instances, such as the one at Knightsbridge, that booster set manufacturers started to incorporate automatic protective control features such as low pressure restart and high pressure shut down along with the recommendation of pressure relief/anti-vacuum valves such as the RBX on high rise installations.”71. Mr. Groves was then taken to another article, this time dated September 2007, from a publication called WET News.  It described how Grundfos, as a responsible supplier, had considered the possible causes of blow outs in high-rise buildings which had caused serious flooding.  The article explained how, following an interruption of the water supply, water continued to be drawn off the system through normal usage thereby creating a partial vacuum in the system.  It then went on to say:“When the power was subsequently restored, the set tried to replace the lost water as quickly as possible.This sudden increase in flow rapidly pressurised the partial vacuum in the empty pipework.  This (was) then stopped the liquid flow suddenly just like a fast-acting valve.The resulting surge then passed through the liquid until it found something to absorb force, like a weak joint.  The result was catastrophic flooding.”The article then went on to explain how help was at hand in the form of a specialist valve, such as the Grundfos “AnTi-Shock Valve”, which could be fitted at the top of each riser that would eliminate any hydraulic shock.“These valves also act as air and surge anticipation valves as they dampen the effect of water hammer at the start-up.  This allows for the controlled release of air from the system at the start-up or after maintenance.They operate by allowing the valve to take in air through the unobstructed large orifice.  When the pumps restart, the resistance offered by this air cushion dampens the surge.This enables the pumps to slowly – and safely – refill the system in a controlled manner.”It seems reasonably clear that the source of the information in this article was Grundfos.  Certainly, Mr. Groves did not suggest otherwise.  It is of interest to note that the article did not suggest that the installation of anti-surge valves was a precaution that was in addition to any slow fill procedure that could be initiated by the control systems of the pumps.72. There was then the following exchange between Mr. ter Haar and Mr. Groves, at Day 2/160:A. The exclusive bit to Grundfos is the T, at the top, the blue bit.  That’s why it’s called AnTi-Shock.  It is clever stuff.Q. Clever stuff, yes.  But quite apart from that as a solution what was also being developed at the time was sophistications to the software of the pumps, wasn’t it, in particular an alteration to the slow fill algorithms to the pumps?A. That’s correct, yes.  With new software coming through, it changes every month;  along with other companies we introduced a soft fill programme into our controller.Q. There is at least a school of thought among engineers that that in itself is the answer to the problem with which we have been concerned.  Do you not agree that there are only some engineers who believe that’s the answer?A. I’m sure that there are some engineers who believe that’s the be all and end all but people can turn controllers off, can’t they?Q. One of the important things you do as a plant manager is to issue operating instructions which draw attention to such problems?A. Yes.Q. Where you are aware that problem can be as acute as blow outs then you make sure that your operating and maintenance instructions reflect those risks because you know people are relying on you for good information? A. Well, operating and maintenance would only explain how to maintain the product itself:  ie. if the new controller now, which has soft fill, there would be a write up on how to activate that soft fill and how it works et cetera.”73. The relevance of this evidence is that it is the only evidence in the case about the existence of slow fill programmes forming part of the control system of Grundfos pump sets.  It is not at all clear from this evidence as to whether such programmes existed in 2005;  if anything, this evidence suggests the contrary.  As I have already mentioned, there was no suggestion in the article published in September 2007 that the problem of high pressure surges on a restart could be alleviated by the operation of slow fill programmes in the pump sets.Mr. Keith Shenstone74. Mr. Shenstone is a design consultant with over 30 years’ experience in the building services industry.  He promised to be an interesting witness because he was called by the Claimant with a view to showing that there was an engineer who had identified the problems with partial vacuums in cold water risers at a time when so many others had failed to do so.  At the relevant time he was employed by a large building services company, of which he was the technical director.75. Mr. Shenstone said that in about 1998 he was involved in the design of a project known as the Mount Vernon Apartments, where there had been at least two floods which subsequently turned out to have been caused by pressure surges in cold water systems.  This was the first time that he was aware of this problem.  He said in evidence that at that time he and his colleagues were of the opinion that a control valve would mitigate the problem to a large extent, but a couple of years later they decided that surge arresters were the right solution.  76. The second project to which Mr. Shenstone referred was one known as Falcon Wharf.  He thought that surge arresters had been used on that project.  However, the drawings that were exhibited to his witness statement, which included a construction drawing and a record drawing, did not show any surge arresters.  The only evidence that suggested that surge arresters had been fitted at Falcon Wharf was the O&M manual, issued a year after the project had been completed, which said that the top of each riser was fitted with a surge arrester.  Mr. Shenstone was unable to provide an explanation for this, but he accepted that it was a possibility that surge arresters had been fitted between the time when the record drawing was prepared and when the O&M manual was issued in 2005.77. Mr. Shenstone then referred to a project to redevelop the former Victoria bus station in Pimlico.  Work began sometime after 2000 and was completed in 2004.  The drawings for that project did not show any surge arresters, but there was a manuscript note on one of the drawings made in about November 2003 which referred to “28 diameter surge arresters fit to top of all BCWS risers”.  Mr. Shenstone accepted that these surge arresters were not installed.  By the conclusion of his cross examination Mr. Shenstone accepted that it looked as if surge arresters had been fitted at only one project, the Wandsworth Riverside project, in about 2005.78. In the end, Mr. Shenstone accepted that at no time prior to 2005 was there a universal practice of installing surge arresters on riser pipework for boosted cold water systems:  on the contrary, he agreed that there was no such practice.79. Mr. Shenstone was clearly an honest witness who was doing his best to assist the court.  What his evidence shows is that there had been failures on some building projects caused by high pressure surges in cold water systems, and that these had caused the designers involved to address the problem.  However, it was some time before it was concluded that the best solution was to fit surge arresters.80. But unlike those practices, WSP had had no experience of any failures caused by excessive pressure surges in cold water systems.  Indeed, their researches carried out for the purposes of this case established, so far as they could tell, that 199 Knightsbridge was only the second boosted cold water system that had been designed by WSP.81. I am therefore not persuaded that Mr. Shenstone’s evidence establishes that there was any body of professional opinion amongst M&E building services engineers prior to 2005, at the earliest, to the effect that surge arresters should be fitted as a matter of course to the risers of cold water boosted systems.  Mr. Scott82. Mr. Scott was, between 1989 and 2007, employed by Axima as a Technical Manager.  He was not involved in the installation of the boosted cold water system at 199 Knightsbridge.  He was first approached after the failures in September 2005 by Mr. Burgess who wanted him to look at some of the technical issues.  In particular, he was asked to consider how a pressure of 70 bar could have been generated in a system that was designed to operate at a pressure of only 9 bar (by this time he knew about the failure of the pipe joint that occurred during or after the black building test on 30 August 2005).  Mr. Scott did some research, which included looking at a copy of the Institute of Plumbing and Heating Engineering Plumbing Engineering Design Guide that he had in his office, which provided a formula describing the relationship between the velocity of sound pressure waves in pipework and the properties of the fluid and pipe material.  There was also a formula which described the relationship between the shock pressure rise in a pipe, the velocity of the sound pressure wave and the initial water velocity prior to it being suddenly arrested.  Assuming a pressure of 72 bar, Mr. Scott was able to calculate that the velocity of the water in the pipes immediately prior to it being arrested was about 6.3 m/s.  He calculated also that the flow rate was about 3.5 litres per second.  I did not understand Mr. Scott’s calculations to be challenged, at least as a matter of approximation.  I find as a fact that the velocity of the water when it was travelling through the risers at sixth floor level was at least 6.3 m/s, and probably rather more.83. In cross examination he said that he did not think that he had ever seen a design with surge arresters at the top of the risers during the period 2003-2005.  He said that the first time when he became aware of the potential destructive forces that could arise from a booster system starting up in an uncontrolled manner was as a result of an incident that took place on another project in which Axima was involved about three or four months before the failures at 199 Knightsbridge.The experts84. Since I discuss the relevant features of the expert evidence in various sections of this judgment, I will do no more at this stage than introduce the experts and make some brief observations on their evidence.Dr. Andrew Prickett85. The first expert called by the Claimant was Dr. Prickett, an engineer employed by Hawkins, the well known forensic investigators.  He investigated the cause of the escapes of water.  He did not address the principal issues of liability.86. Dr. Prickett was, I thought, a good witness.  His evidence was clear and he was able to give cogent reasons for his conclusions.  His evidence was not shaken by cross examination and I accept it.  I discuss some particular aspects of his evidence in more detail later in this judgment.Mr. David Gosling87. Mr. Gosling is a public health engineer.  He is employed as an Associate Public Health Engineer by Atkins Ltd, the international design, engineering and project management consultancy.  He has not designed a system of a similar nature to that provided at 199 Knightsbridge.  His evidence in this case was based substantially on research that he had done since he was instructed.88. I found Mr. Gosling to be a somewhat diffident witness whose evidence I did not find to be particularly authoritative.  Nevertheless, it is clear that he knew his subject, even though he lacked the practical experience of his opposite number, Mr. Dix.  Importantly, Mr. Gosling was not in any position to disagree with the evidence of Mr. Groves about the extent of the knowledge in the industry about surge arrester valves.Mr. Terry Dix89. Mr. Dix was the sole expert instructed on behalf of WSP.  He is a very experienced public health engineer, with extensive practical experience of designing systems of this sort.  During the period relevant to this case his role was substantially one of high-level design direction rather than detailed design of individual projects.  At the relevant time he was a director of Arup and its Mechanical Global Technical Skills leader.  As such, he said that he was responsible for the technical quality of the mechanical and public health services design work that Arup undertook worldwide.  He also undertook project design reviews as part of Arup’s quality control processes, during which he would review all engineering systems that formed part of the building services design in conjunction with the project design engineers.90. Mr. Dix is not a person who is reluctant to speak his mind and he holds firm views.  He has had a very successful career and I have no doubt that he is a highly competent engineer.  However, I consider that there is some force in the Claimant’s criticism that in his report Mr. Dix did not really address the question of whether WSP’s process of reasoning when carrying out the design was appropriate.  In addition, there were one or two occasions in his evidence when I felt that he was getting close to becoming an advocate for his client.  However, all that said, his report was careful and thorough and I consider that his views were genuinely held.91. The real difficulty facing Mr. Dix was that he could not really provide any logical or reasoned basis for the approach adopted by WSP.  He was always driven back to the basic point that they were only doing what everyone else was doing at the time.Other evidence as to the availability of anti-surge valves for residential systems prior to 2005The CAVSA anti-surge valve92. Mr. Gosling relied on a data sheet for this valve which was available in 2001.  This data sheet stated that:“As buildings become reliant on pumps to provide the water supply, the risk of damage to the system and equipment due to ‘TRANSIENT PRESSURES’ has also increased.THE PROBLEMParts of a pipeline may sometimes experience transient sub-atmospheric pressures, caused by pumps shutting down under a fault condition (e.g. loss of power, low level in break tank), in these conditions air can be drawn into the system through open orifices as the system drains due to continued demand.When the pumps are re-started, the rising columns of water expels the air in an uncontrolled manner;  if the expulsion is violent enough, the returning water enters the system at a high velocity and is brought to a sudden rest, which will at best cause water hammer, but also may result in a dangerous surge in pressure causing damage to equipment and/or pipe bursts …”93. This is a remarkably prescient summary of what occurred in the system at 199 Knightsbridge, although in that case the cause of the problem was the lack of any air in the system rather than the ability of air in the system to escape at an uncontrolled rate.94. In cross examination Mr. Gosling agreed that CCD Pumps, which manufactured the CAVSA valve, was not a particularly well-known supplier.  Mr. Dix said that he had never heard of CCD Pumps.  It is clear from this evidence, which I accept, that the company was not well known in the UK building services industry.95. It is wholly unclear from the evidence before the court as to what extent this valve was in use in residential installations in the UK prior to 2005.  There is no reliable evidence that it was regarded as a tried and tested product for use with boosted cold water systems in 2005.  Mr. Gosling agreed that surge arresters were new to the contracting fraternity in 2005 (Day 5/195). The Vent-O-Mat RBX surge arrestor (“Cla Val”)96. These valves were originally developed for use by public utilities in pipelines, sewage systems and similar installations.  The development of an anti-surge valve for use in public health systems in residential buildings did not occur until 2004, or at least that is when Grundfos first heard of it.  Mr. Dix said that public health engineers would not be expected to know about such systems, which were regarded as the subject of a separate discipline.  This evidence was not contradicted and I accept it.97. In relation to the availability of these valves, I find, in short, for reasons that I will give later in this judgment, that WSP were told about the availability of these valves in mid-2005 and should have advised their client to install them.  But I have concluded also that WSP, acting reasonably, would not have been in a position to give this advice in sufficient time to avert the damage that occurred on 15 September 2005.Other material98. Mr. Gosling relied on various other publications, many of which he had traced through the Internet.  Perhaps the most relevant of these was a “databyte” produced in July 2004 by the Institute of Plumbing and Heating Engineering (“IOP”).  This contained the following information:“SurgeRarely considered the natural and largely unavoidable characteristic of surge in pipes occurs whenever a tap or valve is closed.  If not properly controlled surge can, and frequently does, caused damage to pipes, fittings and appliances.  Solenoid valves and quarter turn ceramic disc type taps are prone to exaggerate surge in plumbing systems simply because they can instantly stop the flow of water.  The effect of surge is further exaggerated where check valves are fitted in the system, as they prevent the surge spike from dissipating back along the service pipe toward the water main.”And, a little later:“Usually not as destructive due to the presence of air, surge also occurs when any system is filled with water from new or after an interruption for repair, renewal or any situation where the system has been drained and refilled.”99. The publication then went on to refer to the existence of surge arresters which could be fitted where surge was likely to occur or was proving to be a problem.  It said that surge pressures had been “… recorded as spikes on a graph as much as 15 times normal working pressure”.  Mr. Gosling explained that the reason why surges that occurred when a system was refilled were described as “usually not as destructive”, was because the writer was assuming that there would be air within the pipework which would cushion an onrushing column of water as the pipework refilled.  In this I have no doubt he is correct, but the fact remains that the publication was not suggesting that catastrophic surge pressures could arise when a system is refilled following a whole or partial drain down.100. I am not persuaded that this is a publication that the typical public health engineer would receive or see in the course of ordinary practice.  As both Mr. Gosling and Mr. Dix said, building services engineers in general tend to look to the CIBSE guide, rather than publications issued by the IOP.  The only building services engineer involved in this case who, according to the evidence, appears to have referred to documents provided by the IOP was Mr. Kennedy, but he left WSP in 2002.WSP’s duty and the applicable law101. In considering the duty owed by WSP, the starting point must be their contractual obligation.  This is set out in Condition 2.1(c) of the Retainer, which required WSP to:“… exercise a reasonable level of care and skill as [was to be] expected of a qualified Consultant in the same profession, experienced and competent in carrying out work of similar size, scope and complexity to the Project.”102. In my view this obligation effectively brings in the standard of care and skill that the law ordinarily imposes in this type of situation and neither party submitted the contrary.  I must therefore turn to the authorities.103. The standard usually expected of a professional person is that set out in the classic statement by McNair J in his direction to the jury in Bolam v Friern Hospital Management Committee [1957] 1 WLR 582.  He said that a professional person:“… is not guilty of negligence if he has acted in accordance with a practice accepted as proper by a responsible body of medical men skilled in that particular art ….  Putting it the other way round, a man is not negligent, if he is acting in accordance with such a practice, merely because there is a body of opinion who would take a contrary view …”104. In the context of an architect, this duty was explained in Nye Saunders & Partners v Alan E Bristow (1987) 30 7BLR 92, by Stephen Browne LJ, at 103, in the following terms:“Where there is a conflict as to whether he has discharged that duty, the courts approach the matter on the basis of considering whether there was evidence that at the time a responsible body of architects would have taken the view that the way in which the subject of enquiry had carried out his duties was an appropriate way of carrying out the duty, and would not hold him guilty of negligence merely because there was a body of competent professional opinion which held that he was at fault.”105. It is well established that evidence by an expert of what he or she would have done in the situation in which the defendant was placed is of little assistance:  see J D Williams & Co Ltd v Michael Hyde Associates Ltd [2001] PNLR 8, at paragraphs [25]-[26] (in that case Ward LJ pointed out that, in order for the Bolam test to be available as a defence, there must be evidence of what a “responsible body” would have done or of “a recognised practice within the profession”);  and Midland Bank Trust Co Ltd v Hett Stubbs & Kemp [1979] Ch 384, at 402.106. Mr. Sears submitted that the fact that the practice in question must be “accepted” or “sanctioned” suggests that there is a significant difference between, on the one hand, the situation where a body of responsible practitioners considers a problem and decides what to do about it and, on the other, the situation where a body of practitioners commonly employs a certain practice without having considered whether to do so is proper.  He submits that in the latter situation the Bolam test has no application.  In this context, albeit not a case of professional negligence, Mr. Sears relied on an observation by Mustill J in Thomson v Smiths Shiprepairers (North Shields) Ltd [1984] QB 405, at 416, when he said that a defendant is not:“… exonerated simply by proving that other[s] … are just as negligent, but … the standard of what is negligent is influenced, although not decisively, by the practice in the industry as a whole.”107. Looking at it in another way, Mr. Sears relied on the following observation by Sedley LJ in J D Williams, at [46]:“… in general it can be said that the Bolam test is typically appropriate where the neglect is said to lie in a conscious choice of available courses made by a trained professional, and that it is typically inappropriate where it is in oversight that the neglect is said to lie.”108. Mr. Sears submitted, therefore, that even if WSP were able to establish that they acted in accordance with “a responsible body of opinion”, on the facts of this case there could be no logical basis for any such body of opinion and, in those circumstances, the court is entitled to disregard such a body of opinion in determining whether or not WSP was negligent.  In his written closing submissions he developed the argument as follows:38. In Bolitho v City & Hackney Health Authority [1998] AC 232, (which is a case cited by the Defendant in its Opening Submissions), Lord Browne-Wilkinson held (at pages 241-242) that:  ‘The Court is not bound to hold that a defendant doctor escapes liability for negligent treatment or diagnosis just because he leads evidence from a number of medical experts who are genuinely of opinion that the defendant’s treatment or diagnosis accorded with sound medical practice … the court has to be satisfied that the exponents of the body of opinion relied upon can demonstrate that such opinion has a logical basis.  In particular in cases involving, as they so often do, the weighing of risks against benefits, the judge before accepting a body of opinion as being responsible, reasonable or respectable, will need to be satisfied that, in forming their views, the experts have directed their minds to the question of comparative risks and benefits and have reached a defensible conclusion on the matter.’ (emphasis added)39. It has since been made clear that Lord Browne-Wilkinson’s judgment imports a two stage test that must be fulfilled before a body of opinion will be considered to have a ‘logical’ basis.  In Khoo James v Gunapathy [2002] SGCA 25 (at paragraphs [64] – [65]) it was said that the ‘threshold test’ was, first, that the body must have ‘directed his mind … to the comparative risks and benefits relating to the matter’.  At this stage, ‘It is … the process and not the result of the expert’s reasoning that is material in the eyes of the court’.  Secondly, as a result of that process, a ‘defensible conclusion’ must have been reached.  This requires that the ‘opinion must be internally consistent on its face.  It must make cogent sense as a whole, such that no part of the opinion contradicts with another’.  In addition, it cannot ‘fly in the face of proven extrinsic facts relevant to the matter.  It should not ignore or controvert known medical facts or advances in medical knowledge.’40. In a situation such as the present, where there has been no consideration or thought given to the risks, the body of opinion cannot fulfil the requirements of Bolitho.  A court is not simply focused on what conclusion a body of opinion reached.  Instead, it will also examine the way in which that body of opinion reached its conclusion.  If it cannot be demonstrated that this was as the result of a process by which the risks have been actively considered, it cannot be logical.  In this case, the risks involved have not been considered.  The profession did not direct its mind to the question.  Instead, it adopted, uncritically and without thought, a certain practice.  Such a practice cannot be logical.  There was no basis for its conclusions.” (Mr. Sears’s emphasis)109. Mr. ter Haar rightly reminded me that the court must be very careful to avoid the wisdom of hindsight and to concentrate on the standards of the time.  This is a case where, viewed from the position today, the risk of a catastrophic pressure surge seems obvious.  It is therefore all the more important for the court to be astute to avoid being beguiled by subsequently acquired knowledge.  This was a correct and salutary warning, and I have done my best to heed it.110. Mr. ter Haar also referred to Lord Browne-Wilkinson’s speech in Bolitho.  He relied in particular on the following passage page at 243D:“I emphasise that in my view it will seldom be right for a judge to reach the conclusion that views genuinely held by a competent medical expert are unreasonable.  The assessment of medical risks and benefits is a matter of clinical judgment which a judge would not normally be able to make without expert evidence.  As the quotation from Lord Scarman makes clear, it would be wrong to allow such assessment to deteriorate into seeking to persuade the judge to prefer one of two views both of which are capable of being logically supported.  It is only where a judge can be satisfied that the body of expert opinion cannot be logically supported at all that such opinion will not provide a benchmark by reference to which the defendant’s conduct falls to be assessed.”111. There is, therefore, little difference in the approach for which each side contends.  The real difference, as I see it, is how this approach should be applied to the facts of this case.The scope of WSP’s duty112. Mr. ter Haar had a further string to his bow.  He submitted that, whilst WSP owed the Claimant a duty to take reasonable care to prevent foreseeable damage to pipework, the prevention of a catastrophic pressure surge was outside the scope of its duty.113. As I explain below, WSP accepts that it was known by reasonably competent engineers in 2003 that if adequate precautions were not taken surge conditions of sufficient magnitude to cause the premature failure of pipework or failure of fittings could occur in piped water systems.  However, they submit that a catastrophic pressure surge of the type that occurred was not reasonably foreseeable.  This submission was based also on the assertion that a partial vacuum in the pipework could not have been foreseen, but in the light of all the evidence I find that this was not a sustainable proposition – as Mr Dix accepted in cross examination.114. For this and the other the reasons that I give in this judgment, I do not accept this submission as to the scope of WSP’s duty.  I cannot see how the consequences of a catastrophic pressure surge are not within the scope of their duty.  The damage that occurred was the very type of damage that WSP accepts could have been foreseen.  Further, I conclude in this judgment that each of the steps that gave rise to it could have been foreseen.  All that happened was a surge in pressure of a magnitude that WSP did not anticipate, with the result that the loss (ie. the flooding) occurred on a single occasion and not as a result of gradual damage over a period of time caused by many less severe pressure surges – an eventuality which I understood WSP to accept was one for which they could be liable.  The situation is not comparable with Lord Hoffman’s famous example of the climber’s knee and the doctor .The relevant principles115. So far as is relevant to this case, I draw the following principles from the authorities that I have cited.i) A professional man  does not warrant that the course of action that he takes or advises his client to follow will be successful.  To the extent that Mr. Gosling’s evidence (at Day 6/33-34) appeared to be to the contrary, I reject it.ii) If a professional man adopts or advises a course of action which although unsuccessful or shown to be wrong is a course of action that was in accord with or was adopted at the time by a responsible body of opinion held by practitioners in that discipline, he will not be negligent provided that that body of opinion has a logical or rational basis:  see Bolitho, at 241-242;  Nye Saunders, at 103.iii) If the exponents of the “responsible body of opinion” relied on cannot demonstrate that the opinion has a logical or rational basis, the defence will be unlikely to succeed:  see Bolitho, at 241-242.iv) If the reason why the impugned course of action or advice was wrong is that the professional man in question and others in his position did not identify or foresee a particular risk or sequence of events, then there is probably no room for the application of the Bolam test:  see J D Williams v Michael Hyde, at [46].116. Assuming that the claimant has shown that there is a case to answer (for example, that the defendant knew or ought to have known of all the elements of the particular risk in question), I consider that in the situations described in (iii) and (iv) above there will usually be an evidential onus on the defendant to show:i) what he did;  andii) the reasons for it.117. In considering whether or not a particular engineer was negligent, it is relevant to take into account what other engineers faced with similar situations were doing.  I see no reason why the observations of Mustill J in Thomson should not be applicable also to cases of professional negligence.118. A difficulty facing WSP in this case is that they have called no evidence from either of the public health engineers who had the closest involvement in the design of the system.  Whilst there is evidence that Mr. Kennedy could not be traced, no explanation has been offered for the failure to call Mr. Haworth.  119. WSP’s defence rests, essentially, on Mr. Dix’s evidence about the practice in the industry generally.  However, there are two limitations to this evidence.  First, it is clear that in a developing field what is an acceptable practice at one point may no longer be acceptable some, say, six or 12 months later.  Accordingly, any evidence as to general practice needs to be reasonably precise (in temporal terms, at least).  Second, no two projects are precisely the same and it may be that in other cases (the facts of which are not before the court) there were circumstances that appeared to justify the course taken.120. For these reasons, general evidence of practice by others in the profession or industry will be much less persuasive than the evidence of a responsible body of opinion that has identified and considered the relevant risks or events and which can demonstrate a logical and rational basis for the course of conduct or advice that is under scrutiny.121. With these considerations in mind, I now turn to consider the real issues in the case.The configuration of the cold water pipework and its implications122. As I have already mentioned, there are 18 risers taking the cold water to the eleven floors of the building, but not each riser serves all eleven floors.  Dr. Prickett prepared a table, using what he described as basic calculations, showing how long it would take the riser pipework to fill using one and four pumps, respectively.123. The table showed that the times required to fill the risers with one pump would be as follows:Extent of drain down(floor level) Time to refill with one pump running at full speed(seconds) Time to refill with four pumps running at full speed(seconds)Basement 75.1 18.8Lower Ground 66.3 16.6Ground 57.8 14.41 49.3 12.32 41.4 10.43 34.0 8.54 27.0 6.75 20.7 5.26 15.1 3.87 10.1 2.58 6.3 1.69 3.4 0.810 1.4 0.411 0.5 0.1Dr. Prickett emphasised that the estimates were no more than a guide and, on the same basis, the figure of about three seconds to fill the riser pipework from the ninth floor upwards was agreed by Mr. Dix (on the basis of his own calculations).124. From the plan of the cold water risers prepared by the M&E experts (ignoring the two Core Risers) it can be seen that there are two risers serving the eleventh floor, five risers serving the tenth floor and ten risers serving the ninth floor.  If one adopts Dr. Prickett’s assumption that there are about three metres of riser pipe per floor, then the lengths of the riser pipework serving the top three floors are roughly 6m, 15m and 30m, respectively.125. Thus on the basis of the times in Dr. Prickett’s table the velocity of the water in the pipework in the two risers serving the eleventh floor will be about 12 m/s.  For the tenth and ninth floors it is about 10.5 m/s and 9 m/s, respectively.  I must emphasise, like Dr. Prickett, that these deductions from Dr. Prickett’s calculations are very basic and are clearly only approximations , but if calculations along similar lines had been done at the time they would have given some indication of the potential velocities that could be achieved even if only one pump was used to fill the system.  If the system was refilled using all four pumps, Dr. Prickett’s table shows that the filling times are cut to about one quarter of the time taken if only one pump is used.  Accordingly, the velocities of the water in the risers would be correspondingly increased.126. In 1988 the IOP produced a Guidance document which, according to Mr. Dix, served the domestic heating and plumbing market.  An extract quoted by Mr. Dix entitled “Water Hammer”, contained the following extracts:“Pumped pipe water supplies are also liable to water hammer if provision is not made at the design stage ….Gravity water installations do not as a rule give rise to the problem but when water velocities exceed 3 m/s water hammer conditions may exist.”127. Although Mr. Dix pointed out in his report that building services engineers rarely use the guidance provided by the IOP, preferring, as he put it, “… the higher level industry representation offered by CIBSE”, I cannot accept that a competent building services engineer would have been unaware in 2002 of information as basic as this.  Indeed, Mr. Bellinger told the court that Mr. Kennedy, who as I have said was the engineer largely responsible for the preparation of the initial or scheme design of the cold water system, would have referred to the IOP guide, whereas he personally preferred the British Standard and the CIBSE guide (Day 3/118).  But whether or not the figure of 3 m/s is accurate, in my view any engineer who became aware that a system that he designed might produce significantly greater water velocities in the risers ought to have been put on serious enquiry as to the likely consequences of water travelling at such velocities being suddenly arrested when it reached the top of the risers.128. It is now agreed by the experts that the existence of a partial vacuum in the risers following a drain down of the system was foreseeable.  It was also admitted by WSP that if the pumps stopped for any reason the residents would continue to draw water from the system, and so it would drain down.  However, Mr. Dix says that what a reasonably competent engineer could not have foreseen was the generation of a catastrophic pressure surge when either there was inappropriate operation of the plant or the proprietary software controls restarted the equipment following a partial drain down of the system.129. Whether or not this opinion of Mr. Dix is correct is the question that is really at the heart of this case.130. Mr. Dix said in his report, and again in evidence, that engineers at the time reasonably assumed that the problems of pressure surge would be met by the adoption of a system that incorporated VSD pumps and an appropriately sized accumulator.  In my view, this is correct only to an extent.  Historically, as Mr. Dix explained, the use of fixed speed pumps was known to result in undesirable pressure surges during operation when the pumps started and stopped.  As Mr. Dix said in his report, this problem was in part met at first by the use of large buffer tanks or accumulators.  These were typically two metres or more in diameter by three-four metres long – thus having a capacity of 9-12 cubic metres and therefore, I assume, being capable of holding several thousand litres of water (even though they would only be partially filled with water).  Volumes of this order are to be compared with the volume of the accumulator at 199 Knightsbridge, which had a capacity of 100 litres.131. In this context, Mr. Dix relied on the CIBSE Guide G, 1999, which provided guidance on the installation of boosted water systems.  Paragraph 2.4.2.2 of this Guide, which was quoted by Mr. Dix in his report, explained the function of an accumulator in the following terms:“… the membrane vessel [the accumulator] cushions the water system from abrupt pressure changes and also provides for tap drippages and draw-offs when no pumps are operating.”Whilst I agree with Mr. Dix that this provides no hint of the risks of significant pressure surges, it seems to me that it must be read as a description of how an accumulator works during the course of normal operation of the system.  I can see no basis for any assumption that this section of the Guide was addressing the situation of a partial drain down of a large cold water boosted system following an unscheduled and unexpected stoppage or breakdown of the pumps.132. It was common ground that in the event of a partial drain down of the system it would have to be refilled slowly and in a controlled manner:  indeed, this was WSP’s pleaded case (see paragraph 44B.3 of the Amended Defence) and was put expressly to various witnesses in cross examination.  Implicit in this, it seems to me, is the assumption that VSD pumps and an appropriate accumulator would not, of themselves, provide the necessary cushion to protect the system if the pumps were simply started up without any precautions being taken.133. In these circumstances there is clearly considerable force in the submission that WSP ought to have appreciated that the system required some protection against a sudden surge during a restart following a shutdown.  WSP’s case was that it was for the manufacturer of the pump set to design a control system that would ensure that, following an unexpected shutdown of the pumps, water would be introduced into the system in a controlled manner so as to avoid any serious pressure surge.134. Mr. Bellinger, WSP’s lead mechanical engineer for the project, was not himself a public health engineer.  His evidence was that one of the things that the WSP design team would have considered would have been interruptions in the water supply.  In cross examination he said that what would happen in the event of a partial drain down was “something the public health engineer would have thought about” (Day 3/164).  This evidence accorded with the agreed expert evidence that a reasonably competent engineer should have foreseen the likelihood of a drain down of the system.  The M&E experts also agreed that:“… it was known by reasonably competent engineers, at the time of the WSP design, that if adequate precautions were not taken surge conditions of sufficient magnitude to cause the premature failure of pipework or failure of fittings could occur in piped water systems.”However, Mr. Dix then went on to say:“Mr. Dix’s view is that at the time the industry considered that the installation of VSD controlled booster sets and appropriately sized accumulators were sufficient to safeguard systems against pressure surges, of the magnitude that were known about at the time.  Before the end of 2005, competent building services engineers would not have known about the risk of the kind of catastrophic pressure surges that appear to have occurred at 199 Knightsbridge following a partial drain down.”135. For the reasons that I have already given, I have difficulty in accepting this observation by Mr. Dix.  If the mere presence of VSD pumps and an accumulator was sufficient to prevent all foreseeable pressure surges, then why was there any need to take special precautions following a partial drain down of the system?  However, if Mr. Dix’s observation is confined to surges that could be reasonably expected to occur in normal operation, then it is uncontentious.136. On this aspect WSP made an interesting and relevant concession in their Defence, which was in the following terms (at paragraph 67.1.4):“… upon commissioning of the cold water system prior to handover, it is likely, that the Defendant would have identified appropriate settings for the pump set through discussions with Grundfos and/or Axima and/or it would have made provision in the O&M manuals for a slow filling of the risers in any of these circumstances.”This rather undermines WSP’s case that it was for the manufacturers of the pump set to ensure that it provided a slow refill following an unplanned shutdown.  It is suggested by the Claimant, based on the terms of WSP’s Defence, that when this admission was made it was WSP’s understanding that, at the time of the failures in September 2005, the boosted cold water system had not been fully commissioned or handed over.  I did not understand this interpretation to be challenged.  However, by the time of the trial it was common ground that part of the system was in fact handed over on 2 August 2005, the pump set having been commissioned about a year earlier, prior to the occupation of part of the building by the first residents later that month .137. An exchange during the cross-examination of Mr. Dix by Mr. Sears was revealing.  I will set out in full (Day 8/74-78):“MR. SEARS:  What I am suggesting to you is you nowhere go on in your report to consider the question whether WSP should have asked itself:  what if the failure in the water supply carries on long enough to empty the water tank? Is that something you think they didn’t have to consider? A.   No.Q. You think that is something they should have considered?A. Well, I don’t know whether they did.Q. Sorry is it something they should have considered?A.   Yes.Q. If they had considered it, they would have very quickly realised, wouldn’t they, that in those circumstances water may continue to be drained down by occupants of the flats with the result there may be a partial drain down of the system?A. Agreed.Q. That is something they should have considered?A. Yes.Q.   It is your evidence, I know, that if there was a partial drain down a partial vacuum was likely?A. Yes.  Q. That is what you said on Friday.  So if they had considered, as they should have done, that a partial drain down might occur, then they should also have realised, should they not, that a partial vacuum was likely?A.   Yes.Q.   If that is right – well, two things.  First of all, as a matter of fact if they had considered that a partial drain down was likely, then as a matter of fact they would have realised or should have realised that when the system started again it was likely that the system would be at least partly empty?A. Yes.Q. And they would also or should also have considered, should they not – they should have also known in those circumstances should they not, that if there was a partial drain down and a partial vacuum, if the system restarted water would be being forced into a partial vacuum?A. Well, it follows from that, yes, that would happen.Q. Right.  I am just trying to identify where in the process you say WSP should have stopped.  They should have realised, they should have identified the failure of the incoming water supply as a possibility?A. Yes.Q. They should have realised that the water tank might actually be exhausted?A. Yes.Q. They should have realised that a partial vacuum might then be present?A.   Well, that is a possibility, whether they realised it or not.  As I say, it naturally flows from that, but I don’t know whether – Q. You said on Friday that if there was a partial drain down it was likely there would be a partial vacuum?A.   Under those circumstances, yes.Q. And that is something that any reasonable competent engineer would know?A. In reviewing the system, yes.Q.   So if they were carrying out this process, and again I am just trying to identify where you say they should have stopped in this process, so should have realised failure of the water supply;  should have realised tank might be exhausted;  should have realised the risk of partial drain down;  should therefore have realised the risk of a partial vacuum;  should have realised that when the system restarted it was likely that water would be forced into a partial vacuum?A. As I say, it follows that that will happen.  If the term ‘when they should have stopped’, stopped what – Q. Stopped the thought process.  Why, having got to the point, where as I think you concede, they should have addressed their mind to what would happen in the failure of an incoming water supply in the event the water tank is exhausted, in the event there is a partial drain down and a partial vacuum, and they just leave it at that or do they not then have to consider what’s going to happen when the system restarts?A. Well, it follows from that, yes, they ought to.  The reason I am struggling with it is that they, and Terry Dix and Arup and it would seem most of the building services industry, did not consider this to be a problem at the time.  VSD controls, as you say, I repeat, ad infinitum and accumulators and I think that has been backed up by some of the oral evidence were seen to be a robust installation against those occurrences.  There was no knowledge, there was no body of knowledge, there was nobody saying:  Hang on a second chaps.  This is all going to go terribly wrong.Q. So it was certainly foreseeable that parts of the system would be empty by the time the water supply was restored and the time the pumps started running again?A. Yes.Q. I would suggest to you, Mr. Dix that any reasonably competent engineer addressing his or her mind to that possibility should have realised that that might have consequences when refilling the system?A. Well, as I say, it seems perhaps remarkable.”And then, a little later, Mr. Dix said this:A. What we have is a situation where engineers up and down the country were installing boosted water systems and it’s become clear within the court that nobody was aware of the issues until 2004/2005.  No engineers.  There was no body of opinion.  I have not seen any technical evidence.  Now, it may seem incredible as we sit here because it would seem fairly obvious that this occurrence would happen, but of course with the benefit of hindsight it’s very easy.  Nobody at that time, nobody I know, nobody that I don’t think Mr. Gosling has been able to come up with, including Mr. Shenstone said, ‘yes, I knew of this situation and the answer to it was fitting surge arresters’.  It didn’t happen.  As I say, that may seem incredible to the court but that is where we are.” (My emphasis)138. This evidence was, in my view, a fair reflection of the situation.  There was no evidence of any body of opinion that (a) had considered the problem presented by a boosted cold water system in which there would be a partial vacuum if the water was permitted to drain down and (b) had produced what was considered to be an appropriate solution in order to deal with it.  The situation here was that by early 2005 very few engineers, if any, had identified the problem.  But, as Mr Dix fairly accepted in the exchange set out above,  a competent engineer when reviewing the system ought to have appreciated that following the partial drain down of the system (which was a foreseeable consequence of an unplanned shutdown of the pumps) it was likely that there would be a partial vacuum in the system.  139. Since this evidence of Mr. Dix shows that each of the steps in the mode of failure on 15 September 2005 was reasonably foreseeable by a competent mechanical services engineer, I find it difficult to escape the conclusion that in failing to think through the implications of their design WSP fell below that standard required of reasonably competent engineers.  WSP has not provided any evidence as to whether the designers considered what would happen when the system automatically restarted following an unplanned shutdown of the pumps or, if they did, how they thought that the system would respond.  To the extent that they simply relied on the fact that the booster set had VSD motors and an accumulator – which may have been what they did – there was no responsible body of opinion that provided any properly reasoned or logical basis for that approach.  As Mr. Dix fairly accepted, viewing the situation with hindsight, it seems incredible.  But it seems that WSP were probably not alone in what they did.140. Nevertheless, and in spite of the fact that it seems that WSP were not alone in their approach, in these circumstances – that is, on the evidence in this case – I consider that WSP should have appreciated that there was a risk that there might be an abnormally high pressure surge when the pumps were automatically restarted following an unplanned shutdown and should have investigated that scenario in more detail.  Had they done so, they should have realised that a catastrophic pressure surge was at least a real possibility.The mechanism of the failure141. The agreed position of Dr. Prickett and Mr. Dix prior to the start of the trial was that they could not say whether the two failures occurred when the pumps were operated in Hand mode (ie. when the pumps were momentarily “blipped”) or when the pumps were restarted subsequently in Auto mode.  This was an issue that I was required to decide.    Although the experts had not adopted specific positions before the start of the trial, as the case developed it was clear that Mr. Dix took the position that the damage probably occurred when the pumps were “blipped” in Hand mode.  This was based partly on his view about the extent of the drain down before the incident and partly because of the report that an “unhealthy noise” was heard when the pumps were “blipped”.142. In relation to the difference about the extent of the drain down before the pumps were restarted, Dr. Prickett thought that on the balance of probability the drain down was to a level of at least the sixth floor  (where the lower failure occurred).  But he agreed in cross examination that it was not scientifically impossible that the failure of the joint on the sixth floor was caused by the shockwave from the sudden arrest of the column of water when it reached the top of the riser.143. During the course of cross-examination Dr. Prickett explained why he thought that the water had drained down to at least at the level of the sixth floor.  He said this (Day 5/145):  “But AR 08, where failure on the sixth floor occurred, is of equal height to AR 10, so they are both up to the eleventh floor aren’t they on this drawing?  So if the drain down was only to the ninth floor they both drained down to the same extent and we do have a failure on AR 10 when it refilled, so in that scenario why didn’t AR 08 also fail at the top floor?  A good explanation as to why AR 08 didn’t fail at the top floor was because there was already a burst on the sixth floor which had taken the sting out of the force of the water refilling the riser.”144. By contrast, I understood Mr. Dix to suggest that the failure of the joint on the sixth floor could have been caused by the shockwave that was created when the water was suddenly arrested at the top of the riser, rather than by the force of the rising column of water hitting a right angle bend just downstream of the joint.  Accordingly, he thought that it could not be assumed that the water level was significantly below the ninth floor.145. On this I prefer the view of Dr. Prickett, substantially for the reason he gave in the passage I have just quoted.  Further, if the cause was a shock arising from the impact at the top of the riser one wonders why it damaged a joint on the sixth floor, rather than an equivalent joint on the pipework from the riser to the apartments on the seventh or eighth floor.  I understood from Dr. Prickett’s evidence that the energy of the shockwave diminishes as it travels through the pipework:  that would mean, other things being equal, that the joints first encountered by the shockwave would be the most at risk.146. It follows from this conclusion that prior to the “blipping” of the pumps the risers had drained down to below the level of the sixth floor.  I consider it unlikely that they had drained any lower because the rising column of water might then have been expected to damage a similar joint at a lower level.  In this context I should add that I accept the view of Dr. Prickett that the joint that failed was a properly formed joint so that there was no reason for thinking that it was likely to fail preferentially.  Although it is unlikely that any two joints will fail at precisely the same pressure , I understood from the evidence that the effect of friction from the pipe walls would tend to reduce the velocity of the water as it travelled through the pipework.  Thus, other things being equal, a joint at a lower level would be marginally more likely to fail as a result of a fast rising column of water than a similar joint at a higher level.  But whether or not this is correct, no-one has suggested that the level of the water in the risers had fallen significantly below the sixth floor.147. I therefore find that prior to the intervention by those in the plant room on the afternoon of 15 September 2005, the water in riser AR 08 had drained down to just below the sixth floor.  If, as I have already concluded, at least two pumps were “blipped” for 2-3 seconds each, then on Dr. Prickett’s timings that would probably be sufficient to cause the water to rise very fast from a point just below the floor level on the sixth floor to the level of the joint on the sixth floor and to cause the damage to the joint.  The shockwave resulting from the impact of the travelling water against the right angle bend just downstream of the joint may explain the “unhealthy noise” that was heard in the plant room when the pumps were “blipped”, as Mr. Dix suggested .148. For these reasons I find that the failure of the joint on the sixth floor occurred as a result of the “blipping” of the pumps.  However, on the basis of the times in Dr. Prickett’s table, there would not have been time for the water to travel from below the sixth floor to the top of the risers, unless at least each of two pump controls was held in the Hand position for about 7-8 seconds when they were being “blipped”  .  I find that unlikely.  Accordingly, the fracture of the 15mm pipe on the eleventh floor must have occurred after the pumps were subsequently switched to Auto mode.149. In my view, setting the pump controls so that the pumps did not start in Auto following a shutdown would not have made any difference to the consequences of the pumps being “blipped” for 2-3 seconds.  The reason is that the pumps did not restart automatically:  they were not restarted until the fault shown on the panel had been cleared.  Even if potentiometers had been fitted (as was done after the event), it seems to me to be unlikely that anyone would think of adjusting the potentiometer before momentarily switching a pump on and off just to check that it was working.  I doubt very much if it would have occurred to anyone at the time that three seconds might be sufficient to fill the risers if they had drained down to floor level at the ninth floor (which I consider that everyone in the plant room, like Mr. Browne, would have assumed must have happened since they knew that there was no water at that level).The Claimant’s general case on design150. In their closing submissions WSP submitted that a new case on design had emerged during the trial .  In the light of this, it is important to see how the case was actually put, both in the Particulars of Claim and through the medium of Mr. Gosling’s report.151. At paragraph 60.1 of the Amended Particulars of Claim, the Claimant alleged this:“In summary, the Defendant failed adequately to consider the possibility of a partial drain down occurring within the system, and to consider how the system ought to be designed and/or commissioned so as to ensure that when the pumps were restarted following a partial drain down, a high-pressure event did not occur which could damage the pipework and cause a leak.  Further, the Defendant ought to have taken steps to warn the Claimant, either as part of its design, or as part of the information provided in relation to the Health and Safety File, of the circumstances which could give rise to significant pressure surges capable of damaging the pipework, and the procedures which would have been adopted to avoid such pressure surges.”  (The underlining, here and below, represents the passages inserted by amendment)152. By way of further example, at paragraph 60.9 and 60.11 the Claimant pleaded:“60.9.1 The Defendant could have designed the system so that in the event that the pumps stopped working, they would have to be restarted manually, in accordance with a procedure designed to ensure that pressure surges were avoided.  The Defendant did not design the system in this way.…60.11 Further and alternatively, the Defendant ought to have designed the system in such a way that, once the pumps had shut down as a result of a reduction in pressure in the inlet manifold, the system would not restart automatically upon an increase in pressure.  The Defendant ought, either as part of its design, or as part of the information which it provided for the Health and Safety File, to have prescribed a procedure to be followed whereby the system could be safely restarted in such circumstances without causing significant pressure surges.  Such information ought to have been provided, at the latest, by the time the system was commissioned.153. Similar allegations were made at paragraphs 60.9.5 and 60.13.3.  No details were given of what the procedure should have been (either there or anywhere else).  The reference in paragraph 60.11 to “information …  provided for the Health and Safety File” suggests that the procedure contended for was one involving the system as installed, not some modified system.  There was no suggestion that anything other than the same procedure was the subject of each of these four sub-paragraphs.154. At paragraph 9.1.2 of his report Mr. Gosling summarised the Claimant’s case on design in the following terms:“i. design out the risk of pressure surges causing damage to pipework and fittings by failing to specify the use of anti-surge valves at the top of each of the risers and/or the use of a surge safety valve, adjacent to the pump set on the pipework leading to the risers;ii. specify that the pump set did not restart automatically and required manual intervention in the event of a shutdown following power failures, water supply failures etc.iii. warn the Claimant that the system it had designed and the pump settings selected gave rise to a foreseeable risk of damage being caused by pressure surges.”155. Mr. Gosling noted later that, as an engineer, he found the third of these allegations somewhat problematical.156. In section 12 of his report Mr. Gosling set out the ways in which a reasonably competent engineer, having identified the problem, should have made provision in his design for significant pressure surges.  In relation to the second of Mr. Gosling’s three points, at paragraph 12.1.26 Mr. Gosling said that in addition to specifying that the pump set should be configured to require manual intervention following a failure of the water supply, WSP should have specified “an appropriate procedure including slow refill to be used in such a scenario”.  However, he did not say what this procedure should have been.  He made the same point in paragraph 12.1.36, but again he did not identify the procedure that he was suggesting should have been specified.157. At paragraph 12.1.38 Mr. Gosling said that it was interesting to note that, following the incident, WSP made various recommendations for changes to the design, which were as follows:i) the introduction of potentiometers;ii) the installation of a Honeywell 300 SV safety valve (a surge anticipation device) adjacent to the pump set;iii) changes to the pump settings;iv) a specified start-up/refill procedure;v) a laminated warning notice to be placed in the plant room;  andvi) the O&M manuals to be updated with the new procedures.A potentiometer is, in effect, the industrial equivalent of a domestic light dimmer switch.  It would enable the operator to control the speed of each pump manually.  However, the Amended Particulars of Claim contained no allegation that WSP should have advised that potentiometers should be installed on the booster sets.158. Mr. Gosling said that these were all steps that could have been taken as part of the original design.  This is the only place in Mr. Gosling’s report in which the installation of potentiometers is mentioned.  Unless the installation of potentiometers were to be included as part of the unspecified procedure for ensuring a slow refill, then Mr. Gosling’s position appears to have been that the addition of potentiometers to control the pumps when in Hand mode was not a step that a reasonably competent engineer should have recommended at the design stage.159. That this was Mr. Gosling’s position appeared from an exchange with the court at the conclusion of his evidence.  It was as follows:MR. JUSTICE EDWARDS-STUART:  Mr. Gosling, really only this:  it seems to go without saying, I would have thought, that in a building of this sort that if you get an unexpected failure of the water supply, you have got to have a system for getting it back on stream as quickly as possible?A.   Yes.MR. JUSTICE EDWARDS-STUART:  Do I understand it to be your evidence that apart from fitting anti-surge devices at the top of the risers so that you could effectively put the pumps back on knowing you had some prevention against damage by excessive surge, was there anything else in your view that could have been done to prevent this incident?A.   I don’t think there is because the, if you haven’t allowed – if you have a device at the top of the building that just doesn’t perform the functions that this type of valve performs then I think you are going – there is always going to be a risk of a reoccurrence of the event that happened.MR. JUSTICE EDWARDS-STUART:  Unless you take the course suggested at one point by Mr. Burgess of simply closing all the riser valves and then doing it one by one very gently?A.   Oh yes, yes, to do it in a manual way, that’s right, and a structured way.MR. JUSTICE EDWARDS-STUART:  But that would not be a procedure that would come as very good news to the residents?A.   It would take some time.”By “some time”, I think that Mr. Gosling was referring to evidence that this process could take at least a day.160. Then, in response to a supplementary question by Mr. Sears arising out of that exchange, Mr. Gosling mentioned that potentiometers would provide a means for controlling the fill rate so that a controlled fill could be carried out.161. Although in the Claimant’s closing submissions it was said that WSP should “… have required a notice to be fixed to the control panel alerting the operator to the importance of following the correct procedure for restarting the pumps”, what that procedure should have been was not identified beyond the assertion that it was “precisely what was done after the incident”.162. There is a post script to this part of the case which is rather curious.  At some stage after modifications had been carried out to the booster set, including the installation of a notice and the fitting of potentiometers, it was discovered that following a power failure the pumps operated at full speed for the first 20 seconds of operation in Auto mode before the pressure sensor was able to detect whether or not the actual pressure was below the pre-set pressure.163. This is reflected in an e-mail dated 16 March 2006 from WSP to Mr. Carne at Grundfos.  It said this:“You have confirmed … that a 20 second full speed run of one pump will normally occur following re-instatement of electrical power, even after ‘latching off’ on loss of system pressure ….This full speed run potentially compromises the ability to safely re-start the system following a power reconnection, as without operator intervention and depending upon the extent of the drain-down, it remains possible for a rapid increase of system pressure to occur.You have confirmed that the 20 second run is a basic function of the control system re-instatement and can only be avoided by modification of the control panel.  It is essential that the necessary modification is carried out as soon as possible.”164. The consequence of this, as pointed out by Mr. Dix in his report, was that if the system had been modified before 15 September 2005 with a view to preventing a restart in Auto mode following a shut down, it would have made no difference because a 20 second run of one pump at full speed would have been enough to bring about a catastrophic surge pressure (assuming that the level of the water in the relevant risers was at the sixth floor or above – which, for reasons already explained in this judgment, I find it would have been if two pumps had been “blipped” for 2-3 seconds each prior to the system being restarted in Auto mode).  In his witness statement, Mr. Bellinger said that this had the effect that all the other modifications to the pump set, such as the installation of potentiometers, would be bypassed.The Claimant’s case on the trigger events165. The Claimant submitted that WSP was under a continuing duty to review its design if events occurred that required the original design to be revisited.  It alleged that WSP missed at least seven key opportunities to identify the potential problem that would arise if there was a partial drain down of the system following an unexpected stoppage of the pumps and the system was subsequently started up after the fault being rectified.  In its opening submissions it described these as follows (although I have reordered them into rough chronological order):  i) The first was when considering Axima’s Technical Submission No. 48 by which Axima sought permission to substitute the Allan Aqua pump set which had been specified with the Grundfos pump set which was eventually used.  This gave rise to the enquiry to Allan Aqua and its fax in reply, to which I have already referred.  ii) The second was on issuing Request for Contract Administrator’s Instruction No. 334A, which required the installation of double check valves (i.e. non-return valves) on the supply or distribution pipework to each cold water service entering each apartment.  The Claimant alleged that WSP should have identified the fact that the installation of such valves could give rise to a vacuum within parts of the distribution pipework in the event of a partial drain down, and this should have prompted them to reconsider (or perhaps to consider for the first time) how the system would be refilled in such a scenario.  iii) The third was at the commissioning stage.  It appears that WSP did not become involved in the commissioning of the pump set.  Had it been involved, the Claimant alleged, it would have belatedly realised something which it should have understood from the outset, namely that there were a number of choices to be made when commissioning the pumps which were in fact design choices.  By discussing the available choices with the commissioning engineer WSP would probably have been alerted to the problems with its design.iv) The fourth was on reviewing the O&M manuals.  It was alleged that this process ought to have prompted WSP to think about the operation of the system following a partial drain down and to identify the problems with its design.  v) The fifth was in the course of discussions relating to the emergency generator, and the systems which should be provided with power in the event of a failure of the mains electricity supply, and the possibility of removing the pump set from the list of plant which would be powered by the generator.  The Claimant alleged that this should have prompted WSP to consider how the boosted cold water system would react in the event of a prolonged power failure.vi) The sixth was the black building test on 30 August 2005 that I have already mentioned.  The Claimant’s case on this hinged on the assumption that WSP knew about the leak that occurred during or shortly after this test.  Since I have accepted the evidence of Mr. Bellinger that WSP did not know about this incident until after the failures that occurred on 15 September 2005, this trigger point fails for that reason.vii) The seventh was a conversation which the Claimant says took place between a Mr. Barry Groves, of Grundfos, the manufacturer of the booster pump set, and someone at WSP, probably Mr. Bellinger.  Mr. Groves is said to have told Mr. Bellinger about a new anti-surge device that Grundfos had just approved and which was particularly suitable for installation in boosted cold water systems in high-rise buildings.166. I will take these allegations in turn.The substitution of the Grundfos pump set for the Allan Aqua set167. I have already discussed this allegation in the context of the design process.  For the reasons that I have given in that section of this judgment, I consider that this was not an event that should have alerted WSP to the possibility of a catastrophic pressure surge.The request for an instruction to install double check valves168. In my view there is nothing in this allegation.  The installation of double check (or non-return) valves had become mandatory following the introduction of the 1999 Regulations.  As I understand the position, they should have formed part of the specification from the outset.  169. In any event, this request was dated 21 June 2004, a little over a month before the month was booster set was commissioned on 28 July 2004.  Accordingly, this really adds nothing to the allegation that the commissioning of the pumps was a point at which WSP should have appreciated the potential for a catastrophic pressure surge on an automatic restart following an unexpected shutdown.  I turn to this allegation in the next section.The commissioning stage170. The Claimant’s submission was that if WSP had not already appreciated from the outset the potential for a catastrophic pressure surge on a start up of this system (as I consider they should have done, for the reasons I have already given) then they should have appreciated the existence of this risk when discussing the pump settings with Grundfos.  That WSP would have had such a discussion with Grundfos is entirely consistent with the concession in WSP’s Defence, which I have already quoted at paragraph 136 above.  I consider that WSP should have had such a discussion with Grundfos at around the time of the commissioning of the booster set.171. Whilst WSP was not required to attend the commissioning of the booster set , in my view the engineer responsible for the design of the system should have checked how the pump set would respond in certain situations, one of which would be a failure of the water supply and another would be an electrical power cut.  One obvious time at which to do this was when the pump set was being commissioned.  Mr. Bellinger said in cross examination that he would have thought that WSP’s public health engineer would have asked how the pump set would react in the event of a failure of the water supply and a subsequent partial drain down of the system (Day 3/204).  In my view this answer reflected what a reasonably competent public health engineer should have done.172. I therefore agree with the Claimant that if WSP had not applied their minds at the outset of the design process to the consequences of an unexpected shutdown of the pumps, they should certainly have done so at the commissioning stage because a competent engineer should have satisfied himself at that stage that the pumps would respond appropriately in certain foreseeable situations, one such situation being an unexpected shutdown of the pumps.  On the facts of this case, this should have happened no later than July 2004 when the booster pump set was commissioned.173. In the light of the evidence of Mr. Groves, of Grundfos, I find that the following things would have happened if WSP had asked appropriate questions at the commissioning stage.  First, WSP would have instructed Grundfos to ensure that in the event of an unexpected shutdown of the pumps, they would not restart automatically following the re-establishment of the water or electricity supply.  Instead, in the absence of any suitable alternative, the pumps should be set so as to require a manual restart.  It was not suggested that this was not possible.174. Second, WSP should have considered how the partially drained down system should be refilled.  Since it is WSP’s case that almost everyone who was involved with the cold water system should have appreciated the need for slow filling of the risers after an unexpected shutdown of the pumps and consequent partial drain down of the water in the risers, WSP should in my view have considered what might happen if a slow fill procedure was not initiated and how a slow fill procedure might be initiated.  At this stage, at the latest, I consider that WSP ought to have carried out some very crude calculations of the likely velocity that the water in the risers could reach were the pumps automatically to restart in Auto mode.  Had they done so, they should have appreciated that the velocities were such that very high surge pressures could be achieved on a restart of the pumps and that further consideration needed to be given as to how to control such pressure surges.  In this context WSP would have to bear in mind that the residents of these luxury apartments would have had a very low threshold of tolerance to any failure of the services and that the prompt restoration of any cut in the water supply would be a high priority.175. Third, if these matters had been discussed with Grundfos in about July 2004, as I consider they should have been, Grundfos would probably have told WSP that:i) It would be possible to set the system so that the pumps would not restart automatically following an unexpected shutdown, but that this could mean that residents might be deprived of cold water for longer than was necessary (depending upon how quickly the building maintenance staff reacted to the shutdown).ii) A controlled fill of the system might be achieved in manual operation by using the outlet isolating valve for one pump as a means of controlling the flow of water into the system.  This was the procedure recommended by Grundfos after the failures of 15 September 2005.   It required the operator gradually to open the valve ensuring that the pressure did not increase at a rate of more than 0.1 bar every 20 seconds, until a pressure of 5.5 bar was reached.  Thereafter the operator was to increase the pressure until the specified set pressure was achieved.  The pump could then be set in Auto mode.  This was evidently a process that would take the best part of 20 minutes since it involved taking the pressure from 0.5 bar to 5.5 bar, and then further increasing it to the set pressure .iii) A new type of valve known as a surge arrester had recently been developed for use in residential installations with boosted cold water systems and that Grundfos’s technical department was currently testing one such valve (the Cla Val surge arrester).  On the basis of the evidence of Mr. Groves, I would have expected Grundfos to tell WSP that it could well be up to 12 months before Grundfos would complete these tests .176. In these circumstances, the first question for the court is:  what should reasonably competent engineers in WSP’s position have done if presented with this information in July 2004?  One answer to this is that, as an interim measure at least, WSP should have instructed Grundfos to set the controls of the pump set so that the pumps would not restart automatically following an unexpected shutdown.  I find that WSP should have done this but, for the reasons that I have already given, such an arrangement would have made no difference to the events that occurred on 15 September 2005.177. However, more problematic is the question of what WSP should have done about recommending a procedure for the refilling of the system following an unexpected shutdown.  It seems to me that the procedure proposed by Grundfos was fairly heavily dependent on having an operator who knew exactly what he was doing:  the pump outlet isolating valve clearly had to be opened very carefully.  As Mr. Burgess said in his witness statement, the problem with a procedure of this sort was that it left the system vulnerable to operator error.  I agree.178. In an e-mail dated 11 January 2006 to Mr. Bellinger, Mr. Martin Christie, WSP’s Resident Mechanical Engineer, said:“When the modified panel (with potentiometers) was demo’d my understanding (and I am sure Hyatt’s.  I’ll confirm this and their continuing readiness to restart manually after power interruption/pressure loss etc tomorrow) was that any re-start would be carried out manually using the potentiometers.  Wasn’t that why they were fitted?I am not sure why Grundfos are now recommending re-start against closed valves instead of progressively raising pressure as demonstrated using the potentiometers.  They should be asked to explain.  There is nothing wrong with the method now given but the point about potentiometers was to come up with something as fool-proof as possible.The point raised about the risk of an auto re-start following a power interruption is disingenuous and a distortion of what was discussed during the demo.  It was agreed that Hyatt (even John Browne himself) would necessarily have to attend site following any interruption to ensure that under no circumstances would an auto restart occur.  Some sort of latching mechanism would be required to achieve this and this is what should now be being offered.  This could prevent a re-start after either a timed period from power interruption or in the event of loss of pressure to a predetermined value.”179. Mr. Bellinger says that he agreed with this and so he asked Mr. Christie to speak to Mr. Browne.  The following day Mr. Christie sent a further e-mail to Mr. Bellinger to say that he had spoken to Mr. Browne, who apparently reluctantly accepted that the system should latch out after a shutdown of the pumps following a loss of pressure so that a manual restart would be necessary.  It seems that Mr. Browne suggested that it might be possible to address the problem by increasing the ramp up time of the pumps .  However, according to this e-mail, Mr. Browne confirmed that it was his recollection that the pump demonstration involved ramping up the pumps using the potentiometers, and that he expected this to be the method used rather than gradual opening of isolation valves as was now being described by Grundfos.180. In the light of these exchanges I find it difficult to say whether in 2004, or even 2005, WSP should have recommended having a prescribed refilling procedure, particularly one involving gradual opening of isolation valves.  They might have thought it better to leave the method of refilling the system to the maintenance engineer on the ground.  Of course, in 2004, the system was still the responsibility of Axima (and would remain so for some time, well into 2005) and so its operation was primarily a matter for them.  I accept that if potentiometers could have been installed at that stage , then having a prescribed refilling procedure that involved using the potentiometers might well have encountered less resistance from WSP.181. I do not regard WSP’s attitude (as reflected in the post-incident contemporaneous correspondence in early 2006) as unreasonable.  I therefore consider that a prudent engineer in WSP’s position could not be criticised for failing, either in 2004 or 2005, to prescribe a refilling procedure, rather than stipulating that the system should automatically latch out following an unexpected shutdown so that it had to be manually reset by an operator.  It would then be for the maintenance engineer to use his judgment as to how to carry out a slow refilling of the system.  If there had been evidence that an appropriate and reliable solution was available involving the installation of potentiometers with the Grundfos pump set, then the position might have been different.182. There is no satisfactory evidence before the court that in mid 2004 Grundfos (or indeed any other pump manufacturer) had developed a system of controlling booster pumps by potentiometers, although the evidence, such as it was, suggests that this option was at least under development by mid 2004.  However, as I explain in more detail below, there is evidence that by July 2004 Grundfos had begun testing the Cla Val anti-surge valve, although the outcome of that testing might not be known before about mid 2005.  183. It may be that if WSP had discussed the situation with Grundfos during 2004 or early 2005, Grundfos might have come up with the suggestion of installing potentiometers.  However, apart from the fact that the installation of potentiometers was never mentioned in the Claimant’s case, the Claimant made no attempt to adduce any evidence about the use of potentiometers in conjunction with booster sets.  Whilst I am prepared to take judicial notice of the fact that potentiometers have been in use for many, many years, this is not the same as concluding that a potentiometer had been manufactured by, say, mid 2005 that was suitable for use with the Grundfos pump set.  All that is clear is that it was not a standard component at that time.  Certainly, in 2003 potentiometers did not form part of the Allan Aqua control system.  As I have already said, whether potentiometers were available in 2004 is unclear:  all we know is that Grundfos installed potentiometers in November 2005 following the failures.  Whether or not a potentiometer for use with the Grundfos pump set was available prior to mid 2005 was a matter upon which the Claimant could have obtained evidence, but I infer that its advisers did not do so because it formed no part of the Claimant’s pleaded case.184. Since I was concerned about the question of potentiometers, I invited the parties to make further submissions on the question of whether it was open to the Claimant to rely as a particular of negligence that WSP had failed to advise that potentiometers should be installed as additional controls for the booster pumps (assuming, of course, that they were available at the relevant time).  In its response the Claimant said this:“The Claimant does not allege that the Defendant should have ‘advised’ that potentiometers should be installed.  The Claimant alleges that the Defendant should have recognised the risk and designed the system accordingly.  The Claimant submits that if the Defendant had identified the risk (as it ought to have done), it should have taken whatever steps were necessary to safeguard against that risk.  One option was to prescribe a procedure which was the same as or similar to the procedure set out in the Grundfos document.”185. I do not regard this response as satisfactory.  The “procedure set out in the Grundfos  document” referred to is a revised procedure that Grundfos produced following the exchange of e-mails in January 2006 to which I have referred above.  It was a very similar procedure, although it involved an initial setting for the potentiometer of 7 rather than 9.  Since the Claimant says that it is not asserting that WSP should have advised the installation of potentiometers, its claim must be that WSP should have advised a procedure similar to that set out in “the Grundfos document”.  That could be the procedure that I have already described using the outlet isolating valve as the means of controlling the rate of fill.186. Nevertheless, for the purpose of discussion I will assume, in the Claimant’s favour, that by 2 August 2005, when the first part of the system was handed over, WSP should have placed a notice on the pump controls to the effect that when the cold water pipework was refilled following a drain down a prescribed procedure should be followed.  That procedure should then have been readily available in the plant room.187. As I understand the procedure proposed by Grundfos, I suspect that the set pressure would not be achieved until the pipework had been refilled or, at least, had been substantially refilled.  However, there was absolutely no evidence about this.  All that can be said, as I have already noted, is that this was a procedure that would have taken about 20 minutes to complete (that is to say, before the pumps could be switched over into Auto mode).188. The final question is what would have happened on 15 September 2005 if WSP had prescribed such a procedure and that it had been available to anyone in the plant room.  I will deal with this under the section of this judgment concerning causation.  So far as the Cla Val surge arrestor is concerned, I deal with this below in relation to the Claimant’s seventh trigger point.Review of the O&M manuals189. For reasons that will become clear later in this judgment, I consider that the exercise of reviewing the O&M manuals was unlikely to have made any difference to the outcome of this case.  The O&M manuals are usually reviewed at a fairly late stage in any project:  I would certainly not have expected their review to have been completed by WSP until after the commissioning of the relevant items of plant.  As I have already explained, by that time I consider that WSP should have appreciated the risks of a very serious or catastrophic pressure surge and should have been exploring possible methods of preventing its consequences.190. In any event, it is seldom likely that anyone will have the time to consult the O&M manuals in an emergency.  Those involved in the incident on 15 September 2005 were, understandably, anxious to restore the water supply to the ninth floor as quickly as possible.  If the party that the architects were hosting that evening were to be cancelled or to be held without available running water, I anticipate that the consequences would have been very embarrassing to all concerned.  I can well understand that those in the plant room would have had one concern first and foremost in their minds, and that was to get the water back on.  I regard the suggestion as fanciful that anyone in that situation would have started to plough their way through the O&M manuals in order to find the relevant instructions for starting up the pumps.The discussions about the emergency generator191. In about October 2004 WSP was asked by the Claimant to undertake a review of the systems supported by the emergency generator.  WSP prepared a document setting out a number of options, one of which was the removal of the pump set from the items of plant that were to be supplied by the emergency generator.  The evidence about what happened to this document was not at all clear and, as I understand the position, the documents do not record precisely when it was decided in principle that the booster set was to be removed from the circuit supplied by the emergency generator.192. In the circumstances I consider that the evidence on this issue is simply too nebulous to enable the court to reach any conclusions with safety.  I therefore find that the Claimant has not established that this alleged opportunity was one that should have put WSP on notice of the possibility of a catastrophic pressure surge.  In any event, in the light of the conclusions that I have already reached in relation to what WSP should have done at the commissioning stage, this allegation probably adds nothing.The “black building” test193. I have already mentioned this briefly in the context of the evidence of Mr. Bellinger.  Since I accept his evidence that he knew nothing of the failure that occurred on 31 August 2005 following the “black building” test until after the failures of 15 September 2005, the Claimant’s reliance on the “black building” test as a potential trigger simply fails.Was there a conversation between Mr. Groves and WSP?194. Mr. Bellinger’s evidence was that he could remember nothing of any conversation with Mr. Groves in July or August 2005 (“It certainly wasn’t me.  That’s all I can say.” Day 4/92).  He said that if he had been called by someone from Grundfos his first reaction would have been to ask for some details, which he would then have passed to the public health engineer.  He would have recorded the conversation, either in an e-mail or in his notes.195. The evidence of Mr. Groves was that there had been a presentation at Grundfos’s offices given by one of Cla Val’s sales managers, Mr. David Humphries.  Mr. Groves described what happened as follows (Day 2/136):“Cla-Val came up to our headquarters to do a presentation on the products and David Humphries, who was a sales manager or director at the time, I took him to one side, sat down with them for an hour and just discussed the situation and it was at that point that he came up with the anti-shock that we are talking about this last couple of days, but it had never been used in the building industry up to that point.  So he wasn’t sure whether it would work, but he thought it would work.  He got me thinking, gave it to my company for them to do a check on it because we can’t just start sending someone else’s product if Grundfos hadn’t approved it, and they went through the product, tested it and we felt that it was the answer and it was around about July, August 2005 that it was decided that I go to London and talk to consultants to see if we can get some in some building somewhere just to prove the point that it did work.”196. Mr. Groves said that prior to this presentation he had never heard of the valve before or, indeed, of any alternative similar valves.  He explained that he referred it to Grundfos’s technical department for investigation because Grundfos would not allow the promotion of another manufacturer’s product without having evaluated it first.  He said that the process usually took about 12 months.  In this instance it was completed in about July or August 2005.197. Mr. Groves said that he then discussed the matter with his boss, Mr. Leigh Nicholls, who had already discussed the new valves with Axima, but they were not prepared to spend their own money on purchasing valves for installation in 199 Knightsbridge.  It was suggested that Grundfos should contact WSP.  Mr. Groves described what then happened in these terms (Day 2/153):“At that time WSP had just recently moved from their previous office in Wimbledon to London so I wasn’t that au fait with WSP at the time.  But Leigh suggested I contact Ron Bellinger and I do remember making a phone call but I can’t be 100% sure if I spoke to Ron or not, but that is who I would have asked for, to suggest the valves, go through the sales process with them, to explain how they work and they were declined because the job was finished basically.”198. Mr. Groves said that he recollected these events because 199 Knightsbridge was the first live job where there was an opportunity to have these new valves installed.  That is why Mr. Nicholls told him to ring WSP.  He said that he did not mention that there had been previous blowouts “because he was trying to sell the valve” (Day 2/156), although he did say that it was to deal with a potential problem on installations in high rise buildings.  He said that if the telephone conversation was not with Mr. Bellinger, then he had no idea to whom he might have spoken.199. I thought that Mr. Groves was an honest and straightforward witness.  It was apparent that he did not wish to become involved in this litigation and I can conceive of no reason why he should not have given an account that was truthful to the best of his recollection.200. Equally I have no reason to doubt that Mr. Bellinger now has no recollection of this conversation, which would have taken place over eight years ago.  However, assuming that the conversation was with him, Mr. Bellinger would have had every reason for not wishing to recollect that such a conversation had taken place and it may be that he has subconsciously persuaded himself that it did not happen.201. I thought that Mr. Groves’s account had a ring of authenticity about it.  I have no doubt that his account of the presentation by Cla Val, supported as he said it was by contemporaneous records, was accurate and reliable.  Similarly, I accept his account of the evaluation of the valve by Grundfos’s technical department.  It is entirely plausible that, once the valve had received their endorsement, Mr. Groves would have approached the M&E consultants on a project where Grundfos had recently supplied the booster set.  I find that this is just what he did.  Even if he did not speak to Mr Bellinger, which I think he probably did, I am satisfied that he spoke to someone in WSP who should have acted on the information that he or she was given.CausationThe installation of surge arresters202. I accept the evidence of Mr. Groves that Grundfos was not aware of the existence of surge arresters that might be suitable for cold water systems in residential buildings prior to mid 2004 (when Mr. Groves had his conversation with Mr. Humphries).  If WSP had considered the problem of possible catastrophic pressure surges in the riser pipework following a partial drain down of the system, I would have expected them to discuss it with Grundfos.  They were the obvious people to go to since they had supplied the booster set.203. If WSP had approached Grundfos prior to mid 2004, I find that they would have been told that Grundfos was not aware of any satisfactory protection against the effects of excessive pressure surges.  However, I suspect that Grundfos would have said to WSP that they would make enquiries and let them know if they heard of anything.204. In these circumstances, for the reasons that I have already given, I consider that WSP would have discharged their duty at that stage if they had ensured that the pump controls were set so that the pumps could not restart automatically following an unexpected shutdown.  However, as I have already explained, this precaution alone would not have prevented the failures that in fact occurred.205. Continuing with this scenario, I would have expected Grundfos to get in touch with WSP once they had been told about the Cla Val anti-surge devices.  However, all they could usefully have said to WSP after mid 2004 was that the existence of these devices had been brought to their attention and that they proposed to test them.  I accept the evidence of Mr. Groves that such testing typically took about 12 months and that that is what WSP would have been told in mid 2004 (or later) if the matter had been discussed.  206. Mr. Gosling accepted that an engineer could not recommend a valve to his client until its suitability had been evaluated (Day 6/24-25).  Since in mid-2004 the building was still some way away from completion, and hence occupation by any residents, I find that WSP could reasonably have decided to wait until they heard further from Grundfos.  207. On the evidence of Mr. Groves, Grundfos completed its testing of the Cla Val surge arresters in about July 2005.  At that point, Mr. Groves said that he made contact with WSP, as I have found he did, and asked them if they were interested.  In my view a reasonably competent engineer in WSP’s position should then have obtained details of the surge arrester and sent them to Axima requesting a quotation for installing one to each of the 18 cold water risers at 199 Knightsbridge.208. I will assume, for the purpose of this analysis, that WSP were told about the successful tests on the surge arrester in early July 2005 .  I would have expected Axima to take a week or so to provide the requested quotation (at that time there was no particular reason for urgency) which WSP would then have to consider.  This would involve a discussion by the WSP design team and a decision whether or not to recommend the installation of surge arresters to their client.  I think it unlikely that this process would have been completed before the end of July 2005, at the earliest.  Although only approximate figures were mentioned in evidence, I would expect the cost of fitting Cla Val surge arresters to 18 risers in 2005 to be of the order of £10,000, possibly more.209. On the assumption that WSP would have submitted its recommendation to its client, the Claimant, at the end of July 2005, I would expect the Claimant to have taken at least two or three weeks (it being the holiday season) to make a decision.  Assuming that the Claimant would have decided to accept the advice to install surge arresters (an assumption that, in the light of what actually happened after the failures of 15 September 2005, is not one that can safely be made), WSP would have been in a position to place an order with Axima towards the end of August 2005.  However, since by then the relevant part of the building had been handed over, and residents were beginning to move into the apartments, there would have to be a fairly careful programme to ensure that the surge arresters could be fitted at times that would cause minimal disruption of the cold water supply to residents, probably involving installation taking place during the small hours of the morning.210. Against this timeline, I regard it as far from certain that the installation of the surge arresters would have even begun by 15 September 2005, let alone have been completed.  Accordingly, in this scenario I do not find as a matter of probability that surge arresters would have been installed by 15 September 2005 so as to prevent the failures that occurred. 211. This analysis should be compared with the timeline of events that actually occurred following the failures on 15 September 2005.  By this time Axima knew about the Cla Val surge arresters, because on the day after the incident Axima advised Multiplex that Cla Val surge arresters could be installed at the top of the risers.  Indeed, on 17 September 2005, Axima fitted two of them at their own expense on the hot and cold pipework in riser AR 10.212. On 19 September 2005 there was a meeting attended by representatives of Axima and WSP at which Axima explained that a pressure surge could occur in a system that had been partially drained and that surge alleviation valves were sometimes installed as a measure to prevent the effects of such surges.213. By an e-mail dated 22 September 2005 Grundfos advised WSP that its proposed modifications to the system included the installation of one potentiometer per pump and it strongly recommended that Cla Val surge arresters should be installed at the top of each riser “to eliminate a potential hydraulic shock situation, due to loss of power to the Booster Set”, and it gave a brief explanation how the valves worked.214. So the actual position after the event was that, within a week, WSP had proposals to modify the system by the installation of potentiometers as additional pump controls and the fitting of surge arrester valves at the top of each riser.  In fact, the installation of the potentiometers was carried out in November 2005 and surge arresters were never fitted at all.  So my conclusion, namely that if WSP had advised the Claimant at the end of July 2005 to fit surge arresters at the top of each riser, the Claimant, if minded to accept the advice, would have been unlikely to have had the surge arresters installed in time to prevent the failures that occurred on 15 September 2005, looks realistic in the light of what actually happened.215. But I must highlight the fact that the scenario sketched out above contains at least one doubtful assumption, namely that the Claimant would have accepted a recommendation to install surge arresters if it had been made in the summer of 2005.  It is interesting to note that, by a letter to Multiplex dated 5 January 2006, Axima expressed their concern that surge arresters were not being installed on the system.  It is not clear why the Claimant did not accept the recommendation to install surge arresters.  It was an issue on which no evidence was called.216. If the Claimant did not install surge arresters after the disastrous flooding in September 2005, I cannot be at all confident that it would have done so prior to that incident.  This simply reinforces my conclusion that the exercise of considering an “as if” scenario in relation to the fitting of surge arresters provides far too speculative a basis for holding that, if WSP had acted as reasonably competent engineers, the failures of 15 September 2005 would have been prevented.  The burden of proving this is on the Claimant and in my judgment it has failed to do so.217. It is a remarkable feature of this case that an enormous amount of time and effort, both at the trial and during its preparation, was taken up with issues relating to knowledge about and the availability of surge arresters in 2004 and 2005.  Yet in the event surge arresters were never fitted after the very serious flooding that occurred on 15 September 2005.  No explanation whatsoever was given for this.The establishment of a slow refill procedure following an unplanned shutdown218. I turn now to the events in the plant room on the afternoon of 15 September 2005.  It is not quite clear at precisely what time the pumps were switched back on.  The complaint about the lack of water on the ninth floor was made no earlier than about 4:30 pm on 15 September 2005, and possibly about one hour later, and so it is reasonable to infer that the relevant people could not have gathered in the plant room before about 4:40 – 4:45 pm, at the earliest.  I think it likely the investigation into what had happened, including the “blipping” of the pumps, probably took something of the order of 15-20 minutes.  So on these timings it would have been no earlier than about 5 pm when those in the plant room took the decision to switch on the pumps.  But other evidence suggests that it might have been closer to 5:30 pm.219. If, at that stage (whichever of these timings is correct), there had been a discussion about whether to simply switch on the pumps and hope for the best or whether to follow the prescribed procedure referred to in the notice on the pump control panel (which, for this purpose, I am assuming was in place), I am sure that concern would have been expressed about the time that the procedure would take, given that there were caterers trying to get ready for the party on the ninth floor and who, according to Mr. Pope, were pressing strongly to have the water reconnected as a matter of urgency.220. I consider that those present in the plant room would probably have assumed that the water had drained down to something just below the level of the ninth floor:  I say this because I would have expected the failure of the water supply to have been reported very quickly by the caterers.  It is, of course, possible that the caterers did not arrive until about 4:30 pm and then found on arrival that they had no water.  It is not possible to say, but I think that it is more likely than not that those present in the plant room would have assumed that the water supply had only failed very recently.  At least, Mr. Browne thought that the water must have had drained down to about the level of the ninth floor and I consider that it is reasonable to assume that his belief was shared with the others in the plant room at the time.221. In these circumstances I consider that it is quite possible that those in the plant room at the time would have taken the view that it was not necessary to embark on the somewhat cumbersome refilling procedure that I have described if the pipework had only drained down some two or three floors.  They might not have appreciated, perhaps understandably, that the water in the risers could reach very high velocities and over such a relatively short distance.  There is no reason to think that any of them would have known the precise reasons for the existence of a prescribed procedure for refilling the system, still less that it would be just as important to do it even if the water had only drained down some two or three floors.222. The difficulty with which the court is presented by this aspect of the case is the complete absence of any relevant evidence.  None of those who was present in the plant room that afternoon and gave evidence was asked about what he would have done if faced with the choice of either restoring the water immediately by switching the pumps in Auto mode or adopting the hypothetical slow fill procedure which could have been expected to take about 20 minutes.  It is quite clear what Mr. Burgess would have said, but then he was not present when the decision was taken.  In the absence of any evidence as to what any of the others would or might have done, I find it impossible to reach a conclusion:  both courses of action are plausible.  But at the end of the day it is for the Claimant to prove its case that a prescribed slow fill procedure should have been in place and that, if it had been in place, it would have been followed and so the failures (or on my findings, only the second of them) would not have occurred.  223. But in the light of the considerations discussed above I feel bound to conclude that the Claimant has failed to prove its case on this aspect.  Effectively, the Claimant is asking the court to make a number of factual assumptions in its favour which were not explored, let alone tested, in evidence or, indeed, properly pleaded and opened (the former is almost certainly a consequence of the latter).  As it is, in the light of my finding that the first failure on the sixth floor was caused when the pumps were “blipped”, this case can only affect the second failure.  224. Since the Claimant is not asserting that WSP was in breach of duty by failing to recommend the installation of potentiometers in time to prevent the failures that occurred on 15 September 2005, that is not a case that I have to consider.  In any case, I have decided that it was not a case that it was open to the Claimant to run since it had not been pleaded.  But if I had had to consider it, I would have concluded that the Claimant had failed to prove that potentiometers suitable for operation with the Grundfos pump set were available at a time when the Claimant says that they ought to have been considered as an option (and subsequently fitted) so as to prevent the failures that occurred on 15 September 2005 .Conclusions225. By mid 2004, at the latest, WSP should have appreciated that following a partial drain down of the system, water could travel up the risers at velocities well in excess of 3 m/s even if only one pump was in operation.  WSP should have appreciated that this water would be entering a partial vacuum, with the result that abnormally high pressure surges could result that would be capable of causing immediate damage to the pipework and its fittings.226. WSP should have raised this possibility with Grundfos, at the latest by the time of commissioning the booster set in July 2004, and asked what steps could be taken to prevent such a state of affairs from happening following a partial drain down of the system in the event of an interruption in either the water or the electricity supply.227. If this had been done, Grundfos would probably have advised WSP in mid-2004 that:i) The system could be set so as to prevent the pumps being restarted automatically following an interruption of the supply of either water or electricity.ii) A slow fill procedure could be devised using a pump isolating outlet valve operated by hand to control the flow of water into the system.iii) There was a new type of valve known as an anti-surge valve which could protect the pipework in the event of excessive surges in pressure, but that testing of this valve by Grundfos was in progress and would probably not be completed for many months, probably well into the following year.228. The failure of the pipe joint on the sixth floor on 15 September 2005 was probably caused when two pumps were momentarily “blipped” in the plant room that afternoon.  The evidence establishes that the only way in which this damage could have been prevented would have been if an anti-surge valve had been fitted to the top of riser AR 08.229. The rupture of the 15 mm pipe on the eleventh floor was probably caused when the pumps were switched back on Auto, probably several minutes after they had been “blipped”.  This failure would also have been prevented if there had been an anti-surge valve fitted at the top of riser AR 10.  230. Even if WSP had arranged for there to be a slow fill procedure, and if this had been clearly displayed in the plant room, the Claimant has failed to prove on the balance of probability that it would have been adopted by those present in the plant room on 15 September 2005 who took the decision to restart the pumps.  I find that it is not possible to say what they would have done given the urgency of the need for water on the ninth floor.231. Grundfos (Mr. Groves) contacted WSP in July or August 2005 and advised that testing had been completed successfully on the Cla Val anti-surge valve and that these valves were suitable for high rise buildings like 199 Knightsbridge and tried to persuade WSP to install them.  I consider that by the end of July 2005 WSP should have advised the Claimant to do this (but I find also that WSP could not reasonably have been expected to give such advice prior to about the end of July 2005).232. There is no evidence to show that such advice, if given, would have been accepted by the Claimant.  If anything, the evidence shows the contrary.233. Alternatively, even if the Claimant had decided to accept the advice to install anti-surge valves at the top of each riser, it is unlikely that they would have been installed in time to prevent the failures that occurred on 15 September 2005.  Accordingly, any failure by WSP to give such advice did not cause either of those failures.234. In the light of the way that the Amended Particulars of Claim was drafted and the contents of the expert’s report by Mr. Gosling on behalf of the Claimant, it was not open to the Claimant to assert at trial that the failures of 15 September 2005 would have been avoided if WSP had advised the Claimant that potentiometers should be installed on the Grundfos pump set so as to enable a controlled refilling of the system to be carried out.  My ruling to this effect is attached to this judgment.235. In any event there is no evidence as to whether or not Grundfos would have been in a position in mid 2004 (namely, at the commissioning stage, when the Claimant alleged the question of the pump controls and settings should have been discussed) to advise WSP of the possibility of controlling the pump speed manually by the installation of potentiometers.  Accordingly, even if it had been open to the Claimant to run such a case, I would have concluded that it had not been proved.236. For these reasons the claim fails and must be dismissed.  I will hear counsel in relation to the form of relief and any matters relating to costs. RULINGThe Claimant’s case in relation to potentiometers 1. There is no allegation in the Amended Particulars of Claim that WSP should have advised the Claimant to have potentiometers fitted to the pump controls prior to September 2005 and in its short supplementary submissions the Claimant has made it clear that it is not alleging that WSP should have advised the Claimant prior to the failures to have potentiometers installed.  Consistently with this, as I have already explained, it was not a solution advocated by Mr. Gosling in his report:  potentiometers received a passing mention as having been fitted after the incident, but that was all.2. An analysis of paragraphs 60.9.1, 60.9.5, 60.11 and 60.13.3 of the Amended Particulars of Claim shows that the allegations pleaded are all variants of the same allegation.  The fact that two of them are linked to written procedures that existed prior to 15 September 2005 (paragraphs 60.11 and 60.13.3) shows that they are based on the equipment that was actually installed, which did not include potentiometers.3. No cross examination was directed to the witnesses who were in the plant room on the afternoon of 15 September 2005 as to what they would have done if potentiometers had been fitted to the pump controls.  It was an issue that was simply not explored at all.4. In these circumstances, in my judgment it is not open to the Claimant to seek to rely on any failure by WSP prior to September 2005 to advise that potentiometers should be fitted to the pump controls.  If such an allegation were to have been pursued at the trial, it would have had to have been pleaded in the usual way and then fully and properly addressed by the Claimant’s expert in his report.  5. There was no application by the Claimant to amend its pleadings and so I conclude that it was never open to the Claimant to advance a case based on the failure to install potentiometers prior to the events of 15 September 2005.  However, for the reasons I have given, such a case, if permissibly advanced, would have failed for want of proof.