SUPREME COURT OF CANADA

[2008] 3 S.C.R. 453, 2008 SCC 66

Date: 20081121

Docket: 32062

Between:

Canadian National Railway Company,

Grand Trunk Western Railroad Incorporated

and St. Clair Tunnel Company

Appellants

and

Royal and Sun Alliance Insurance Company of Canada,

Axa Assurances Inc., Continental Casualty Company of Canada,

Reliance Insurance Company, Aviva Canada Inc. and

St. Paul Fire and Marine Insurance Company

Respondents

Coram: McLachlin C.J. and Binnie, LeBel, Deschamps, Abella, Charron and Rothstein JJ.

Reasons for Judgment:

(paras. 1 to 68)

Dissenting Reasons:

(paras. 69 to 131)

Binnie J. (McLachlin C.J. and LeBel and Abella JJ. concurring)

Rothstein J. (Deschamps and Charron JJ. concurring)

Canadian National Railway Co. v. Royal and Sun Alliance Insurance Co. of Canada, [2008] 3 S.C.R. 453, 2008 SCC 66

Canadian National Railway Company,

Grand Trunk Western Railroad Incorporated

and St. Clair Tunnel Company Appellants

v.

Royal and Sun Alliance Insurance Company of Canada,

Axa Assurances Inc., Continental Casualty Company of Canada,

Reliance Insurance Company, Aviva Canada Inc. and

St. Paul Fire and Marine Insurance Company Respondents

Indexed as: Canadian National Railway Co. v. Royal and Sun Alliance Insurance Co. of Canada

Neutral citation: 2008 SCC 66.

File No.: 32062.

2008: May 14; 2008: November 21.

Present: McLachlin C.J. and Binnie, LeBel, Deschamps, Abella, Charron and Rothstein JJ.

on appeal from the court of appeal for ontario

Insurance — “All risks” insurance — Exclusion clauses — Scope of “faulty or improper design” exclusion — Test applicable to exclusion — Construction of largest customized tunnel boring machine — Railway company subscribing builders’ risk policy — Policy excluding from coverage costs of making good “faulty or improper design” — Differential deflection foreseen, but design accommodated expected degree of differential deflection — Tunnel boring machine failed due to excess differential deflection between components of machine — Whether “faulty or improper design” exclusion to coverage applicable — Whether excess differential deflection was foreseeable.

In the early 1990s, CNR established an elaborate and sophisticated process to design and construct the largest customized tunnel boring machine (“TBM”) of its kind in the world for use in the construction of a tunnel under a river. CNR had insured the project under a builders’ risk policy covering all risks of direct physical loss or damage to all real and personal property of every kind and quality including but not limited to the TBM, plus any consequent economic loss occasioned by delay in the opening of the tunnel. The cost of making good faulty or improper design was excluded.

The design of a suitable TBM was a major challenge, partly because structural steel deflects (bends) under pressure. While differential deflection (adjacent components moving towards or away from each other) is acceptable within stated tolerances, excess differential deflection (deflection beyond acceptable tolerances) could lead to failure. This TBM had to withstand 6,000 metric tonnes of pressure from the soil and water above as it progressed under the river. In addition, the main bearing had to be protected from contaminants. To cope with the design challenge, an experienced tunnel equipment manufacturer was selected to design, engineer, and construct the TBM. A technical committee composed of expert tunneling contractors and consultants was formed to advise on the conceptual design parameters, and the technical committee’s work was guided by a steering committee which provided general guidance. A technical review committee also monitored, reviewed and advised CNR on the project as a whole.

As designed, the TBM was 32 feet (9.5 metres) in diameter and its body was 278 feet (83 metres) long. The cuttinghead rotates on roller bearings while the main bearing generates a hydraulic thrust which drives the cutting tool through the earth. To shield the main bearing from damage, a system of 26 independent seals lubricated by the constant injection of pressurized grease was designed to prevent excavated material from getting into the main bearing and to stop the grease from leaking out. To get to the main bearing, contaminants had to get through all 26 seals. The design tolerances for the seals were precise and demanding, requiring a gap of six millimetres, plus or minus three millimetres, between the rotating cuttinghead and the stationary bulkhead. The best engineering advice indicated that there would be no excess differential deflection and that the configuration of the seals provided a margin^* of safety approaching redundancy.

After completion of 14 percent of the tunnel, contamination was detected. Inspection revealed that some seals had been worn and destroyed due to excess differential deflection of the cuttinghead. Operations were halted, the main bearing was cleaned, and modifications were made. The project was then completed without further entry of dirt, but the 229‑day delay greatly increased costs. The experts were unable to explain how dirt penetrated the 26 seals while leaving some seals intact.

The insurers denied coverage on the basis of the “faulty or improper design” exclusion. The trial judge held the insurers liable. He found that, despite its failure, the innovative design accommodated all foreseeable risks however unlikely or remote and was not faulty or improper according to the state of the art at the time the design was finalized. The majority of the Court of Appeal set aside that decision, finding that the TBM’s design had been faulty within the meaning of the exclusion provision since the foreseeability standard also mandated that the relevant design succeed in withstanding all foreseeable risks.

Held (Deschamps, Charron and Rothstein JJ. dissenting): The appeal should be allowed.

Per McLachlin C.J. and Binnie, LeBel and Abella JJ.: Where, as here, the risk is broadly defined (“metal deflects under stress”) and the design addresses that risk with state of the art diligence and expertise, an insurer is not entitled to rely on the “faulty or improper design” exclusion just because existing engineering knowledge and practice lacked a proper appreciation of the design problem. Failure is not the same thing as fault or impropriety. In the interpretation of insurance policies coverage provisions should be construed broadly and exclusion clauses narrowly. The result should not be an unrealistic interpretation that would not be contemplated in the commercial atmosphere in which the insurance was contracted. The narrower interpretation of the exclusion best accords with the intentions of the parties based on a plain meaning of the words used in the policy. [5] [30] [32] [56]

At the time of contracting, all parties realized that this was to be the largest earth‑balance TBM ever built. Leading experts were enlisted to provide a state of the art machine, but, despite all efforts, there was an inevitable residual risk with the innovative design. The CNR purchased the “all risks” policy in recognition of that risk. The policy did not exclude all costs attributable to “the design”, but only costs attributable to an “faulty or improper design”. Although the TBM failed, the insurers did not meet the onus of bringing the loss within the exclusion. [5]

The “faulty or improper design” exclusion relates to faulty design, not designer fault. It implies a comparative standard against which the impugned design falls short. Such a standard can require no more than that the design comply with the state of the art. Under that standard, the loss may have been caused by the design, but the exclusion does not apply unless the design is faulty or improper. As there is inevitably a gap between the current state of engineering art and omniscience, a standard of perfection in relation to all foreseeable risks is too high, but the industry standard is too low. A design will have fallen below the standard reasonably required in the circumstances where the materialized risk was both foreseeable and avoidable by use of a design that matched state of the art standards. [31] [35] [41] [51] [53‑54] [65]

While differential deflection was a known risk in the design of the TBM, it had been properly explored in the design phase, as found by the trial judge. Based on the existing state of the art, excess differential deflection was not foreseeable, even as a remote or unlikely risk, with this design in these circumstances. Contrary to the finding of the majority of the Court of Appeal, failure to withstand does not discharge the onus of establishing fault — the insurer cannot rely on the benefit of hindsight to discharge its onus of proof. The CNR was entitled to insure against the possibility that the design might fail even though not faulty or improper according to the state of the art. The design failed, but, because it exhausted the state of the art, the insurers did not meet the onus of bringing the loss within the exclusion. [5] [48] [58] [61]

While the words of the exclusion may require interpretation, they are not ambiguous, and the policy was a manuscript policy negotiated between two sophisticated parties. The doctrine of contra proferentem did not apply. [33]

Per Deschamps, Charron and Rothstein JJ. (dissenting): The exclusion providing for faulty or improper design applies. The “faulty or improper design” exclusion attaches to the thing designed, not the work of the designers. Whatever standard their work meets or does not meet, a design is faulty or improper if it does not work for the purpose for which it was intended. While a design cannot be expected to withstand “rare and unforeseeable conditions”, it must provide for and withstand all foreseeable risks, including extreme examples of those foreseeable risks. In this case, the insurers proved there was a design problem: differential deflection was foreseeable, but the design was unable to cope with the degree of differential deflection that occurred under normal conditions. This type of risk was excluded from coverage under the “faulty or improper design” exclusion. As there is no coverage under Section I of the policy for faulty or improper design, there can be no coverage under Section II for resultant damage or economic loss. [86-87] [100] [103] [106] [108] [126-28] [130]

The term “faulty or improper design” does not imply the introduction of a “state of the art” standard against which an impugned design is to be compared. The relevant distinction is between a design that is defective and a design that is free from defect. Introducing a comparative standard essentially turns a claim that must have its foundation in contractual terms into a claim in tort or something akin to a tort that is entirely foreign to the contract. It shifts the focus from the adequacy of the design of the TBM for its intended purpose, having regard to all foreseeable risks, to the adequacy of the work done by the design engineers, a focus not suggested by the words of the exclusion. There is no foundation for the inference that a “state of the art” standard was the parties’ common intention. [70] [111-113] [115]

Since the term “faulty or improper design” is not ambiguous, it is unnecessary to apply the contra proferentem doctrine, which only applies when other rules of construction fail to enable a court to ascertain the meaning of the words in question. [74] [76]

Cases Cited

By Binnie J.

Not followed: Queensland Government Railways v. Manufacturers’ Mutual Insurance, Ltd., [1969] 1 Lloyd’s Rep. 214; considered: Foundation Co. of Canada Ltd. v. American Home Assurance Co. (1995), 1995 CanLII 7102 (ON SC), 25 O.R. (3d) 36, aff’d [1997] O.J. No. 2332 (QL); referred to: Consolidated‑Bathurst Export Ltd. v. Mutual Boiler and Machinery Insurance Co., 1979 CanLII 10 (SCC), [1980] 1 S.C.R. 888; Reid Crowther & Partners Ltd. v. Simcoe & Erie General Insurance Co., 1993 CanLII 150 (SCC), [1993] 1 S.C.R. 252; Zurich Insurance Co. v. 686234 Ontario Ltd. (2002), 2002 CanLII 33365 (ON CA), 62 O.R. (3d) 447; Parsons v. Standard Fire Insurance Co. (1880), 1880 CanLII 4 (SCC), 5 S.C.R. 233; Stevenson v. Reliance Petroleum Ltd., 1956 CanLII 27 (SCC), [1956] S.C.R. 936; Continental Insurance Co. v. Dalton Cartage Co., 1982 CanLII 13 (SCC), [1982] 1 S.C.R. 164; Poole‑Pritchard Canadian Ltd. v. Underwriting Members of Lloyds (1969), 1969 CanLII 1159 (AB SCTD), 71 W.W.R. 684; Homeco Investments Ltd. v. Canadian General Insurance Co., [1984] O.J. No. 920 (QL); Lakeland Development Co. v. Anglo Gibraltar Insurance Group (1993), 10 C.L.R. (2d) 17; Simcoe & Erie General Insurance Co. v. Willowbrook Homes (1964) Ltd., [1980] I.L.R. ¶ 1‑1236; Collavino Inc. v. Employers Mutual Liability Insurance Co. of Wisconsin (1984), 1984 CanLII 5963 (ON SC), 5 C.C.L.I. 94; B.C. Rail Ltd. v. American Home Assurance Co. (1991), 1991 CanLII 5713 (BC CA), 79 D.L.R. (4th) 729; Kier Construction Ltd. v. Royal Insurance (U.K.) Ltd. (1992), 30 Con. L.R. 45; Hitchens (Hatfield) Ltd. v. Prudential Assurance Co., [1991] 2 Lloyd’s Rep. 580; Algonquin Power (Long Sault) Partnership v. Chubb Insurance Co. of Canada (2003), 50 C.C.L.I. (3d) 107.

By Rothstein J. (dissenting)

Queensland Government Railways v. Manufacturers’ Mutual Insurance, Ltd., [1969] 1 Lloyd’s Rep. 214; Consolidated‑Bathurst Export Ltd. v. Mutual Boiler and Machinery Insurance Co., 1979 CanLII 10 (SCC), [1980] 1 S.C.R. 888; Pense v. Northern Life Assurance Co. (1907), 15 O.L.R. 131, aff’d (1908), 1909 CanLII 177 (SCC), 42 S.C.R. 242; Stevenson v. Reliance Petroleum Ltd., 1956 CanLII 27 (SCC), [1956] S.C.R. 936; Cornish v. Accident Insurance Co. (1889), 23 Q.B.D. 453; Non‑Marine Underwriters, Lloyd’s of London v. Scalera, [2000] 1 S.C.R. 551, 2000 SCC 24; British and Foreign Marine Insurance Co. v. Gaunt, [1921] 2 A.C. 41; Simcoe & Erie General Insurance Co. v. Willowbrook Homes (1964) Ltd., [1980] I.L.R. ¶ 1‑1236; Collavino Inc. v. Employers Mutual Liability Insurance Co. of Wisconsin (1984), 1984 CanLII 5963 (ON SC), 5 C.C.L.I. 94; B.C. Rail Ltd. v. American Home Assurance Co. (1991), 1991 CanLII 5713 (BC CA), 79 D.L.R. (4th) 729; Foundation Co. of Canada Ltd. v. American Home Assurance Co. (1995), 1995 CanLII 7102 (ON SC), 25 O.R. (3d) 36; Algonquin Power (Long Sault) Partnership v. Chubb Insurance Co. of Canada (2003), 50 C.C.L.I. (3d) 107; Triple Five Corp. v. Simcoe & Erie Group (1994), 1994 CanLII 9186 (AB QB), 159 A.R. 1; Mellon v. Federal Ins. Co., 14 F.2d 997 (1926).

Authors Cited

Brown, Craig. Insurance Law in Canada. Scarborough, Ont.: Carswell, 2002 (loose‑leaf updated 2008, release 1).

Koughan, James. The Collapse of the Tacoma Narrows Bridge, Evaluation of Competing Theories of its Demise, and the Effects of the Disaster of Succeeding Bridge Designs (1996) (online: http://web.archive.org/web/20010813084722/%20http:/www.me.utexas.edu/~uer/papers/paper_jk.html).

Oxford English Dictionary Online, “faulty”, “improper”, “state of the art” (http://dictionary.oed.com).

Withey, P. A. “Fatigue Failure of the de Havilland Comet I”, Engineering Failure Analysis, vol. 4, No. 2, June 1997, p. 147.

APPEAL from a judgment of the Ontario Court of Appeal (Rosenberg, Cronk and Lang JJ.A.) (2007), 2007 ONCA 209, 48 C.C.L.I. (4th) 161, 222 O.A.C. 129, 85 O.R. (3d) 186, 59 C.L.R. (3d) 169, [2007] I.L.R. ¶1‑4591, [2007] O.J. No. 1077 (QL), 2007 CarswellOnt 1706, 2007 ONCA 209, setting aside a judgment of Ground J. (2004), 2004 CanLII 33029 (ON SC), 15 C.C.L.I. (4th) 1, [2004] O.T.C. 851, [2004] O.J. No. 4086 (QL). Appeal allowed, Deschamps, Charron and Rothstein JJ. dissenting.

Guy Pratte, Richard H. Shaban and Sharon C. Vogel, for the appellants.

Earl A. Cherniak, Q.C., David Liblong and Kirk F. Stevens, for the respondents.

The judgment of McLachlin C.J. and Binnie, LeBel and Abella JJ. was delivered by

[1] Binnie J. — This appeal requires the Court to interpret an “all risks” policy of insurance negotiated by the appellants (collectively referred to as the “CNR”) with the respondent insurers in respect of the construction of a railway tunnel under the St. Clair River between Sarnia, Ontario, and Port Huron, Michigan, in the autumn of 1993. The CNR paid a premium of $890,000. The tunnel boring machine (“TBM”), a massive piece of machinery with a cuttinghead 32 feet (9.5 meters) in diameter and a body 278 feet (83 meters) long, was halted when dirt penetrated its cuttinghead and threatened the integrity of the main bearing that drove the machine forward. The project was delayed by 229 days and its costs thereby greatly increased. Repairs were done and eventually the tunnel boring was completed on December 8, 1994.

[2] The CNR had negotiated a builders’ risk policy with the insurers that insured them against “ALL RISKS of direct physical loss or damage . . . to . . . [a]ll real and personal property of every kind and quality including but not limited to the [TBM]” but excluding both “the cost of making good . . . faulty or improper design” and “inherent vice”.

[3] The design engineers anticipated that the TBM would have to withstand 6,000 metric tonnes of pressure from the weight of the soil and water above as it progressed under the river. The TBM was designed to accommodate those pressures. The trial judge found that despite its failure, the innovative design did “accommodate” within the then limits of the state of engineering knowledge all foreseeable risks encountered in the digging conditions in the tunnel ((2004), 2004 CanLII 33029 (ON SC), 15 C.C.L.I. (4th) 1, at para. 76). He acknowledged that the design proved in the result to be defective, but found that it was not “improper” or “faulty” according to the state of the art at the time the design was finalized. He concluded that the design not only addressed all reasonably foreseeable risks but all foreseeable risks however unlikely or remote. (He did not use the expression “state of the art” but that is how I interpret his reasons, as will be discussed.) He therefore held the insurers liable to the CNR for $29,582,638.90 including pre-judgment interest, plus $1,150,837.35 in costs.

[4] The Ontario Court of Appeal, by majority, allowed the appeal ((2007), 48 C.C.L.I. (4th) 161, 2007 ONCA 209). In its view, a design error may, but need not, depend upon designer negligence. A design must “‘take into account’, ‘accommodate’, ‘provide for’ and ‘withstand’ all foreseeable risks” (para. 62 (emphasis added)) however unlikely or remote. If, in these circumstances, there was a failure attributable to “design”, the exclusion applies. This conclusion, it seems to me, reads the qualifying words “faulty or improper” out of the exclusion, and greatly expands its scope.

[5] In my view, the “all risks” policy afforded the CNR greater protection than that which the majority in the Court of Appeal was prepared to allow. At the time of contracting, all parties realized that this was to be the largest earth-balance TBM ever built. Leading experts were enlisted to provide what was described as a “state of the art” machine (Exhibit 6, A.R., at p. 744). The “all risks” policy was written to cover physical damage to an innovative piece of equipment almost the length of a football field operating on a scale with which the state of the art had no previous experience. The policy did not exclude all loss attributable to “the design”, but only loss attributable to a “faulty or improper design”. The design exhausted the state of the art but left a residual risk. Failure is not the same thing as fault or impropriety. In my view, the insurers did not meet the onus of bringing the loss within the exclusion. I would allow the appeal.

I. Facts

[6] In the early 1990s, the CNR established an elaborate and sophisticated process to design and construct a customized TBM. A technical committee composed of expert tunnelling contractors and consultants was formed to advise on the conceptual design parameters. Its work was guided by a steering committee which provided general guidance. A technical review committee monitored, reviewed and advised the CNR on the project as a whole. The design of a suitable TBM was a major challenge.

A. The Tunnel Boring Machine

[7] The TBM is cylindrical in shape. At its forward end it cuts the hole in such a way as to prevent subsidence or heaving on the surface above while, at its rear end, it evacuates soil and other detritus from the tunnel and installs liner segments. The cuttinghead is of a “spider spoke” configuration. It houses a variety of cutting tools. When the TBM is in operation, the cuttinghead rotates while the forward shell remains stationary through the use of roller bearings.

[8] The main bearing generates a hydraulic thrust which drives the cutting tool through the earth. To shield it from damage from soil and other excavated material, the TBM employed an extensive and unique sealing system, the purpose of which was to prevent “contaminants” from getting into the main bearing and to stop the pressurized lubricants from leaking out. In the case of this TBM, the system consisted of 26 separate seals which were lubricated by the constant injection of pressurized grease. The 26 seals created a gauntlet: to get to the main bearing, dirt would have to get through all 26 seals. The best engineering advisors considered the configuration of the seals on this TBM to provide a margin of safety approaching redundancy. Each of the 26 seals operated independently of the others.

[9] The design tolerances were precise and demanding. To be effective, a gap of six (plus or minus three) millimetres had to be maintained between the rotating cuttinghead and the stationary bulkhead. If a larger gap (around 9 millimetres) opened up under operating conditions the opening would allow dirt to flow in and grease to flow out. Too small a gap (below 3 millimetres) could crush the seals. The deformed seals would be rendered ineffective as the gap fluctuated as the TBM continued to operate. The seal gap tolerance was minuscule in relation to the size of the cuttinghead (3 millimetres to 9,500 millimetres).

B. The TBM Builder

[10] Lovat Tunnel Equipment Inc., an experienced tunnel equipment manufacturer was selected by the CNR to construct the TBM. Lovat became responsible for the detailed design and engineering of the machine which was bigger by about 25 percent than the biggest TBM Lovat had constructed in the past. Indeed, at the time, it was the largest TBM of its kind in the world.

[11] Lovat retained Wardrop Engineering Inc. to conduct an analysis of the extent to which the steel components would deflect under the anticipated operating pressures, including the outer shell, the cuttinghead, the cuttinghead flange, the bearing assembly (including the seals) and the fixed bulkhead. The design presented unique problems because, although Lovat had designed and built 124 tunnel boring machines, each one was different and designed for a specific application.

[12] Wardrop’s computer analyses simulated and predicted how the elements of the TBM would react under anticipated load and stress conditions, including whether and to what extent critical components of the machine would deflect under assumed conditions and the impact any such deflection would have on its operating capacity.

[13] For over 300 years engineers have known about Hooke’s Law which says that structural steel deflects (i.e. bends) under load or pressure. Differential deflection will occur when two adjacent components (i.e. the moving cuttinghead and the static bulkhead) move towards or away from each other. This too is expected and, within the stated tolerances, is quite acceptable. The term excess differential deflection describes the movement away or towards one another of different structures beyond acceptable tolerances, leading to failure. (This proved to be the cause of the TBM problem.)

[14] After thorough analysis Wardrop provided an opinion that the TBM as designed was “capable of resisting the loads provided”. The components of the TBM would “deflect” under various loads, but would not break or deform. Wardrop did not model the anticipated relative deflection of all components as assembled because Wardrop and Lovat both anticipated, based on the available expertise, that such an analysis would show increased rigidity and thus reduced deflection. Wardrop wrote:

We anticipate the results of the more detailed analysis would reflect a reduced deflection of the bearing plate area because of the increased stiffness from the thrust bearing, cutting head, and bearing plate interface.

(Wardrop Report, at p. 4)

[15] In addition, Lovat and Wardrop performed an “overlay exercise” (overlaying calculations rather than images), which combined the deflection calculations for the various components to see whether the components would deflect differentially to an unacceptable level. They were satisfied from the results of this further analysis that there would be no excess differential deflection. The trial judge concluded in substance (although he did not use the term) that the TBM had been designed in accordance with the state of the art.

C. The Breakdown of the TBM

[16] The TBM began boring the tunnel in November 1993. Approximately two months later, after digging about 14 percent of the route, but before reaching the river, the engineers discovered that dirt had entered the main bearing chambers. Operations were halted. A vertical shaft was dug from the surface down to the level of the TBM. The TBM was driven into the middle of the space thereby created. Repairs were done. In addition to cleaning out the main bearing, Lovat made modifications to strengthen the TBM, including changing the configuration of the seals and adding a bronze “wear ring” to the bulkhead. The cost of the modifications was $742,685.87. After that, the machine completed the project without further entry of dirt.

D. Battle of the Experts

[17] The CNR’s expert, Dr. Leslie G. Hampson, characterized the excess differential deflection in the seal area as unforeseeable, unanticipated, outside previous experience, and evident only with the benefit of hindsight. The precise mechanism of failure had not been established. The external conditions had not been proven to be more severe than anticipated. Although differential deflection was inevitable and foreseeable, the risk of excess differential deflection sufficient to crush some of the seals and permit entry of soil was not. Dr. Hampson offered a couple of examples of previous engineering failures to prove his point about the limits of the state of engineering expertise at any particular moment in time.

Well-known examples of failures when moving technology forward include: Comet 1 aircraft whose structure failed by fatigue cracks starting from windows and the Tacoma Narrows bridge which failed because of massive structural oscillations driven by wind forces. Aircraft and bridge design took steps forward with such insights gained — but the failures had first to be experienced.

(Hampson’s Second Report, at p. 6)

[18] The insurers’ expert, Dr. Norbert K. Becker, disagreed. In his view, Lovat’s engineers knew or ought to have known that the machine’s sealing system was vulnerable to failure because of the “enormous loads” to be transmitted through the cuttinghead. The risk of seal failure from excess differential deflection could have been avoided by modifications to the sealing system at the outset (as was done when the TBM was repaired). He concluded that the structural engineering of the machine failed to accommodate readily foreseeable risks. The TBM design was in his view faulty and improper.

[19] After hearing extensive and conflicting evidence, the trial judge accepted the opinion of Dr. Hampson, and provided extensive reasons for his preference, including Dr. Hampson’s greater expertise in the matters at issue.

[20] The CNR’s claim against Lovat under the warranty was resolved by arbitration and settlement (trial reasons, at para. 169).

II. Relevant Provisions of the Insurance Contract

[20a] SECTION I – BUILDER’S RISK INSURANCE

1. INSURING AGREEMENT:

This Policy, subject to the limitations, exclusions, terms and conditions hereinafter mentioned, insures, in respect to occurrences happening during the period of this Policy against ALL RISKS of direct physical loss or damage, including general average and salvage charges to:

(a) All real and personal property of every kind and quality including but not limited to the [TBM] . . .;

3. EXCLUSIONS: This Policy does not insure:

(d) the cost of making good

(i) faulty or improper material;

(ii) faulty or improper construction or workmanship;

(iii) faulty or improper design

provided, however, to the extent otherwise insured and not otherwise excluded under this Policy, resultant loss or damage under any Section of this Policy shall be insured . . .:

(e) wear, tear, inherent vice, normal upkeep and normal making good; but this exclusion shall not apply to resulting loss not otherwise excluded by this Policy;

SECTION II ‑ DELAYED OPENING

1. INSURING AGREEMENT:

This Section of this Policy insures against the loss directly resulting from delay beyond the scheduled start-up in the use and/or occupancy of the construction operations caused by loss or damage by a peril insured against under Section I of this Policy to any property used or to be used in, a part of or incidental to, the construction operations . . . .

(Emphasis added.)

III. Judicial History

A. Ontario Superior Court of Justice (2004), 2004 CanLII 33029 (ON SC), 15 C.C.L.I. (4th) 1

[21] After a careful review of the jurisprudence, Ground J. concluded that “the law of Ontario is that the standard to be applied to determine whether a design was faulty or improper is that insured property must be designed so that it accommodates all foreseeable risks, even though such risks may be unlikely and remote” (para. 54). It was clear that the detailed design, engineering and structural integrity of the machine “were the sole responsibility of Lovat and that, with respect to deflection of components of the TBM, all detailed analyses and calculations were done by Wardrop on behalf of Lovat or by Lovat using the results of Wardrop’s finite element analyses” (para. 69). There was no evidence that the 124 tunnel boring machines previously built by Lovat had experienced similar failure, although many had used similar sealing systems.

[22] The trial judge did not agree with the insurers that, because the machine had failed in November 1993 and had then been modified successfully to preclude another such occurrence, the risk ought to have been foreseen and the problems solved at the outset. He found that,

[w]hen all of the evidence is consistent that none of the experts or other persons involved, who had substantial experience in the design and manufacture of TBMs and with tunneling projects, expressed no concern with respect to differential deflection adversely affecting the sealing system and when the design of the TBM and the analyses of the various components did not indicate the possibility of the failure which occurred, it seems to me to be making an unjustified logical leap to conclude that because a failure did occur and was remedied, it should have been foreseen initially. [para. 75]

B. Ontario Court of Appeal (2007), 48 C.C.L.I. (4th) 161, 2007 ONCA 209

(1) Majority (Rosenberg and Cronk JJ.A.)

[23] Rosenberg and Cronk JJ.A. allowed the appeal, finding that the design of the TBM had indeed been faulty within the meaning of the exclusion provision. They agreed that the onus was on the insurers to bring the loss within the policy exclusion. They substantially accepted the trial judge’s formulation of the legal test but not his application of it to the facts:

In our view, the trial judge’s formulation of the foreseeability standard properly recognized that satisfaction of this standard requires proof that all foreseeable risks have been identified and addressed in the design in question. Mere recognition of a foreseeable risk is insufficient. “Accounting” for a foreseeable risk contemplates both that the risk is identified and that provision or allowance is made in the impugned design to meet the identified risk. On the foreseeability standard, anything less will not establish a fault‑free and proper design. Nor, in our opinion, does designing against a foreseeable risk convert the risk into an unforeseeable one. It simply means that the applicable design provided for the risk, that is, the risk was identified and addressed in the design with a view to forestalling its occurrence, thus meeting the foreseeability standard. In this context, we agree that the foreseeability standard mandates that the relevant design “take into account”, “accommodate”, “provide for” and “withstand” all foreseeable risks. [Emphasis added; para. 62.]

(A crucial difference between their view and the trial judge’s formulation seems to be that whereas he held that “the TBM must be designed to withstand all foreseeable risks” (para. 174 (emphasis added)), the majority judgment of the Court of Appeal held that the design must in fact, with the benefit of hindsight, be shown to have succeeded in withstanding all foreseeable risks.) The Court of Appeal majority noted that the trial judge found little difference between the experts’ opinions on why the TBM failed. The controversial issue was whether or not the risk of excess differential deflection was foreseeable at the time the TBM was designed. The trial judge’s findings on foreseeability were tainted by reversible error in four respects, in their view. Firstly, in accepting Dr. Hampson’s expert opinion that excess differential deflection was not foreseeable, the trial judge failed to consider Lovat’s admission that he had known in advance that if the seal flanges of the TBM deflected at a different rate than the fixed bulkhead, differential deflection affecting the critical seal gap would occur. “[A]ccording to Rick Lovat, this type of risk was both known to and investigated by Lovat or its agents” (para. 89).

[24] Secondly, the trial judge relied upon the fact that the blue ribbon technical committee convened by the CNR had accepted Wardrop’s analyses and Lovat’s design. But the trial judge’s own findings showed that the design committee had asked very few questions about the sealing system or its potential for differential deflection.

[25] Thirdly, the trial judge failed to distinguish between the foreseeability of the risk of failure that occurred and the foreseeability of the precise mechanism by which that risk might manifest itself in physical damage to the machine. The trial judge conflated the foreseeability of the type of risk and the magnitude of that risk. The machine’s failure was not attributable to a cause external to the TBM but to the design itself.

[26] Fourthly, to allow recovery in a case where a known risk materialized would convert the insurance policy into a warranty. The insurance policy here was not intended to be a warranty that the machine would fulfill its purpose or a warranty to cover entrepreneurial design risk.

[27] As to the CNR’s alternate submission that even if the exclusion for faulty or improper design applied, the CNR could still recover for resultant loss or damage, the trial judge was correct that “the delayed opening insurance under Section II provides coverage for consequential economic loss only to the extent that the economic loss results from insured loss or damage to insured property” (para. 138). There being no recovery under Section I there could be no recovery under Section II for related losses. The trial judgment was set aside and the action was dismissed.

(2) Dissent (Lang J.A.)

[28] Lang J.A. held that even if she accepted that factual errors were made by the trial judge as asserted by her colleagues, the exception would still not apply in this case. The governing standard for foreseeability set out in Foundation Co. of Canada Ltd. v. American Home Assurance Co. (1995), 1995 CanLII 7102 (ON SC), 25 O.R. (3d) 36 (Gen. Div.), required the design to take all foreseeable risks into account. This was done. Unlike the Foundation test, however, the majority here required that the design succeed in accommodating all foreseeable risks. In her view, the majority’s test was objectionable because

if a design is required to succeed in accommodating all foreseeable risks, as my colleagues say it must, then the design is required to meet a standard of perfection with respect to those risks. [para. 194]

The insurers had called no evidence from an expert with credentials equal to the CNR’s expert, Dr. Hampson, to show that the key Wardrop analysis was based on faulty data or that a different overlay analysis would have revealed that the design was at risk of excess differential deflection (para. 200). There was no evidence accepted by the trial judge that any other designer would have undertaken more or different tests.

[29] Lang J.A. rejected any distinction between unforeseeable internal causes of loss and unforeseeable external causes. She would have dismissed the appeal and cross-appeal, apart from adjusting to March 31, 1995, the date upon which prejudgment interest was to commence, with costs to the CNR.

IV. Analysis

[30] Some general principles governing the interpretation of insurance policies were set out by Estey J. in Consolidated-Bathurst Export Ltd. v. Mutual Boiler and Machinery Insurance Co., 1979 CanLII 10 (SCC), [1980] 1 S.C.R. 888, at p. 901:

Even apart from the doctrine of contra proferentem as it may be applied in the construction of contracts, the normal rules of construction lead a court to search for an interpretation which, from the whole of the contract, would appear to promote or advance the true intent of the parties at the time of entry into the contract. Consequently, literal meaning should not be applied where to do so would bring about an unrealistic result or a result which would not be contemplated in the commercial atmosphere in which the insurance was contracted.

See also Reid Crowther & Partners Ltd. v. Simcoe & Erie General Insurance Co., 1993 CanLII 150 (SCC), [1993] 1 S.C.R. 252, at pp. 268-69, per McLachlin J., and Zurich Insurance Co. v. 686234 Ontario Ltd. (2002), 2002 CanLII 33365 (ON CA), 62 O.R. (3d) 447 (C.A.), at p. 458.

[31] What was insured here was “physical loss or damage” to property of “every kind and quality including but not limited to the [TBM]” plus any consequent economic loss occasioned by delay in the opening of the tunnel. The TBM suffered physical damage and the consequent delay occasioned substantial economic loss. The insurers are therefore liable under the policy unless they can show that the physical damage was caused by “faulty or improper design” or inherent vice. In other words, the loss may have been caused by the design, but unless the design is shown by the insurers to be “faulty or improper”, the exclusion does not apply to relieve the insurers of liability. Substantially the same difficulty confronted the insurers in establishing the “inherent vice” exception.

[32] The key question that divided the Court of Appeal majority and the trial judge was how to define the scope of the “faulty or improper design” exclusion within the context of an “all risks” insurance policy which must be read as a whole: Parsons v. Standard Fire Insurance Co. (1880), 1880 CanLII 4 (SCC), 5 S.C.R. 233, at p. 238; Consolidated-Bathurst, at p. 899. In Reid Crowther & Partners, McLachlin J. observed that “coverage provisions should be construed broadly and exclusion clauses narrowly” (p. 269).

[33] The CNR contends that the terms of the policy should also be read contra proferentem. However, while the language of the exception was fairly standard for an “all risks” policy, the entire policy had been negotiated between sophisticated parties. It was a “manuscript policy” rather than a policy of adhesion. The expression “faulty or improper design” requires interpretation but I do not think it is ambiguous. The contra proferentem principle applies, if at all, only “when all other rules of construction fail”: Stevenson v. Reliance Petroleum Ltd., 1956 CanLII 27 (SCC), [1956] S.C.R. 936, at p. 953. In this case other rules of construction are adequate.

[34] The insurers had the onus of bringing the loss within the language of the exception: Continental Insurance Co. v. Dalton Cartage Co., 1982 CanLII 13 (SCC), [1982] 1 S.C.R. 164. They claim to have done so. The design allowed dirt to penetrate the cuttinghead. There was no evidence that unforeseen operating conditions “external” to the TBM had been encountered in the tunnel. The TBM design “accommodated” and “took into account” foreseeable risks, but in the end failed “to withstand” them. The Court of Appeal majority concluded that the failure to “withstand” foreseeable (and foreseen) risks amounted to prima facie proof of a “faulty or improper design”. Critical to the Court of Appeal majority’s conclusion was the trial judge’s finding that the cause of physical damage to the TBM “was excess differential deflection between components of the TBM which the TBM could not accommodate and which resulted in damage to the sealing system permitting soil and other foreign material to enter the main bearing area of the TBM” (para. 66).

[35] However, the trial judge also adopted, at para. 75, the conclusion of Dr. Hampson, who wrote:

[It] is not realistic to suggest that all potential problems can and always should be identified nor that the issues spotlighted by hindsight should always have been picked-out. Dr. Becker [the defence expert] offers no evidence that the engineering approach from Lovat was not rigorous apart from the somewhat tautological contention that because a failure occurred they should have avoided it.

There are undoubtedly failures due to incompetence, ignorance, complacency, blind faith, mistakes and incorrect information. But there are also failures of components that could not have been foreseen and would not be focused on from the basis of information that was available at the time — it is my contention that the St Clair TBM is in this category. The value of hindsight after a problem cannot be over-emphasised — but this is far removed from forseeability [sic] in the real world. [Emphasis added; Hampson’s Third Report, at p. 5.]

I interpret these passages as saying that at any given time risks may be foreseeable but that in addressing those risks in an innovative project there is inevitably a gap between the then current state of the engineering art and omniscience, i.e. a state of perfect knowledge and technique. This gap conceals risks within risks that are not foreseeable on “the basis of information that was available at the time . . . in the real world”. As Lang J.A. pointed out, quite reasonably I believe, a design is not “faulty or improper” simply because it falls short of perfection in relation to all foreseeable risks (para. 194).

[36] The Court of Appeal majority faulted the trial judge for conflating the foreseeability of a type of risk with foreseeability of the particular mechanism by which the risk eventually manifested itself in physical damage to the TBM. It is true that the experts were unable to explain the “mechanism”, i.e. how did the dirt manage to penetrate a gauntlet of 26 seals (what they called, not without irony, the “Maginot Line”) while leaving some of the seals intact. But lack of proof of a precise mechanism, on my reading of the trial judge’s reasons, was not critical to his conclusions. His reasons (which the Court of Appeal itself said showed an “impressive command of the trial record” (para. 92)) demonstrated quite clearly that he realized perfectly well that the key issue was whether excess differential deflection was a foreseeable risk. The design team knew that failure to maintain the 3 millimeter tolerance could precipitate TBM failure. Much of the trial reasons were devoted to explaining how Lovat and Wardrop approached and dealt with that risk.

[37] The Court of Appeal majority dealt with “foreseeable risk” on a high level of generality. Engineers know that metal will bend under stress and such a risk is therefore foreseeable. The trial judge, on the other hand, took a more contextual approach, concluding that in the context of this particular project, given the state of the art, risk of failure on this job in the circumstances encountered was simply not a risk foreseeable (or foreseen) by the experts, even as a remote or unlikely possibility. His concern was with foreseeability of risk, as it should have been, not the particular mechanism of failure.

A. The Queensland Principle

[38] The argument was made that any time a loss is shown to be occasioned by the design, such failure is prima facie proof that the design was faulty or improper because the product, as designed, turned out to be unfit for the intended purpose. The exception is for a “faulty design” not “faulty designer”, as noted by the High Court of Australia in Queensland Government Railways v. Manufacturers’ Mutual Insurance, Ltd., [1969] 1 Lloyd’s Rep. 214. In that case three concrete piers of a railway bridge under construction were swept away by a flood. The insurance policy excluded “loss or damage arising from faulty design”. An arbitrator found the cause of the collapse to be the inability of the piers to withstand the transverse forces of the river current to which they became subject. He also found that it was reasonable for the designing engineer to rely on the fact that a previous bridge in that location had stood for 50 years, and that the design was in accordance with the then state of the art. On these facts, the High Court unanimously (5-0) reversed the arbitrator’s award and upheld the exception. Barwick C.J., for himself and three other justices, stated:

To design something that will not work simply because at the time of its designing insufficient is known about the problems involved and their solution to achieve a successful outcome is a common enough instance of faulty design. [p. 217]

Barwick C.J. did not rest his decision on the foreseeability of the risk of a flood “higher than any previously recorded” (p. 215), although Windeyer J., in a concurring judgment, considered such a flood to be a foreseeable risk (p. 219). Instead, Barwick C.J.’s target was the “state of the engineering art” issue. He wrote:

The learned arbitrator came to the conclusion that work done at the University of Queensland in investigating the cause of the collapse of the piers “operated as an enlargement of engineering knowledge” and that, when the bridge was designed,

. . . engineering knowledge and practice lacked a proper appreciation of the extent of the powerful forces which bridge piers may be required to withstand. [p. 216]

[39] In commenting on the Queensland case, Professor Craig Brown in Insurance Law in Canada (loose-leaf), vol. 2, states as follows:

In the Queensland case, the court also noted that “faulty” can mean either “caused by the inadequate conduct of someone” or “defective, no matter whether the defect is caused by someone’s inadequate conduct or not”. The court applied the latter definition. It has therefore been argued in other cases that where an insurable loss results, a prima facie inference is raised that the faulty workmanship or design exclusion applies. In other words, it is argued that if the design failed, it must be faulty. This would, however, effectively reverse the onus of proving that the exclusion applies, in the absence of any policy wording to that effect. Further, it would impose absolute liability on the contractor or designer and would significantly negate the coverage provided. There cannot be absolute liability because the exclusion is comparative. This requires a comparison to a standard and a finding that the design was below that standard. [pp. 20-32 and 20-33]

In effect, the Queensland court said that the fact of failure not only speaks for itself but, once it is attributed to the design, it discharges the insurers’ onus of proof.

[40] Respectfully, I do not agree with Queensland that a design can be said to be “faulty” if it conforms to the state of the art, as was found by the trial judge to be the case here. (Although the trial judge did not use the term “state of the art”, I believe that was the effect of the extracts of Dr. Hampson’s opinion, previously mentioned, which he adopted.)

[41] Canadian courts traditionally equated “faulty design” with designer negligence: Poole-Pritchard Canadian Ltd. v. Underwriting Members of Lloyds (1969), 1969 CanLII 1159 (AB SCTD), 71 W.W.R. 684 (Alta. S.C.); Homeco Investments Ltd. v. Canadian General Insurance Co., [1984] O.J. No. 920 (QL) (H.C.J.); Lakeland Development Co. v. Anglo Gibraltar Insurance Group (1993), 10 C.L.R. (2d) 17 (Ont. Ct. (Gen. Div.)). I agree, of course, with Queensland that the exception relates to faulty design, not designer fault, although the two concepts may be difficult on occasion to disentangle as every design must have a designer. Nevertheless the focus must remain on the design itself.

[42] Queensland was cited by the Alberta Court of Appeal in Simcoe & Erie General Insurance Co. v. Willowbrook Homes (1964) Ltd., [1980] I.L.R. — 1-1236. In that case, walls on a construction site had been braced in accordance with industry standards. Nevertheless, they collapsed under the stress of a windstorm. Windstorms were a foreseeable risk. Coverage was excluded because, despite the fact the design was shown to be in accordance with industry practice, such practice could not absolve the contractor from fault because “a contractor might decide to run the risk of not using any bracing at all. He could hardly expect in such a case that the ‘design’ or ‘workmanship’ would not be considered ‘faulty or improper’” (p. 882). What was done in Willowbrook Homes was certainly not state of the art.

[43] Queensland was also cited in Collavino Inc. v. Employers Mutual Liability Insurance Co. of Wisconsin (1984), 1984 CanLII 5963 (ON SC), 5 C.C.L.I. 94 (Ont. H.C.J.). In that case, a trestle bridge failed to withstand normal ice flows. Not only were the ice flows foreseeable but the design had been rejected by consulting engineers prior to construction because, inter alia, “[i]nvestigation of piles for ice pressure is required” (p. 96). Despite the engineer’s warning, the recommended investigation had not been carried out and the plans had not been modified. The insurer succeeded.

[44] Queensland was again cited in B.C. Rail Ltd. v. American Home Assurance Co. (1991), 1991 CanLII 5713 (BC CA), 79 D.L.R. (4th) 729 (B.C.C.A.). An embankment supporting a section of railway track collapsed. The collapse stemmed from a wrong assumption made by the designer about the nature of the underlying soil conditions. The court found that, as a result of the engineer’s erroneous assumption (which he failed to investigate by “soil tests, drill core tests, seismic tests or water level tests before proceeding with the design” (p. 738)), the design was faulty and the exclusion applied.

[45] Although Queensland was cited in the above cases they are all equally explicable on the basis of a negligence standard. In the present case there was no evidence of negligence. On the contrary, Lovat and Wardrop had performed according to the state of the art.

[46] Queensland has also been cited in the English courts; see Kier Construction Ltd. v. Royal Insurance (UK) Ltd. (1992), 30 Con. L.R. 45 (Q.B.), and Hitchens (Hatfield) Ltd. v. Prudential Assurance Co., [1991] 2 Lloyd’s Rep. 580 (C.A.), but the discussion in those cases does not shed much light on the particular questions at issue here.

[47] The insurers in this case do not take a pure Queensland approach. They acknowledge that the failure must not only occur but occur under conditions that were foreseeable, even though considered unlikely or remote. However, in their view, where the TBM failed (as it did here) under conditions that were foreseeable, failure plus foreseeability of the risk that resulted in the physical damage to the thing insured is enough to show that the design was prima facie “faulty”. It is not necessary for the insurers to show exactly how the failure occurred, or to demonstrate negligence on the part of the design team. The exception, they repeat, relates to a faulty design not a faulty designer.

[48] The insurers make a beguiling argument but I do not think it should prevail. The CNR was entitled to insure against the possibility that a design might fail even though not improper or faulty according to the state of the art. The insurers cannot rely simply on the benefit of hindsight to discharge their onus of proof.

B. The Foundation Standard

[49] In Foundation, the insurer invoked the “faulty design” exemption when a cofferdam (a watertight enclosure from which water is pumped to expose a river bed) collapsed in the course of constructing piers for a bridge. The cause of the collapse was a localized “blow-in”, or sudden collapse in the underlying river bed, caused by the unexpected mixing of gasses with soils containing a high proportion of swelling clays. The collapse could have been avoided by driving the pilings deeper but the need for this extra measure was not foreseen because the combined presence of gas and the particular soil conditions (slickensides) was unpredictable and undiscovered by pre-construction testing of the subsoil. The trial judge, Wilson J., concluded that it was unlikely that further tests such as a further borehole at each cofferdam “would have identified the potential problem” (p. 46). She cited but declined to apply Queensland. Instead, she emphasized the need for foreseeability of the precise risk and the need to measure the design against a known standard or comparator. The Ontario Court of Appeal, in a brief endorsement, dismissed the insurers’ appeal ([1997] O.J. No. 2332 (QL)). The cause of the collapse was known. The insurer had failed to show a “faulty design”.

[50] Foundation was applied by Lang J. (as she then was) in Algonquin Power (Long Sault) Partnership v. Chubb Insurance Co. of Canada (2003), 50 C.C.L.I. (3d) 107 (Ont. S.C.J.). In that case, a hydroelectric dam experienced structural failure when undermined by subsoil conditions that ought to have been (but were not) taken into account in the design. The trial judge found that the dam’s design had been based on wrong assumptions about underlying soil conditions that had not been adequately investigated. The risk was clearly foreseeable, the design was faulty and the insurer succeeded.

C. The Standard Is the State of the Art

[51] The concept of a “faulty or improper design” implies a comparative standard against which the impugned design falls short, as stated by Wilson J. in Foundation and Lang J.A., dissenting in the court below. I agree with Lang J.A. that a design is not faulty or improper simply because it does not meet a standard of perfection in relation to all foreseeable risks.

[52] The insurers take the view that a design that fails in circumstances of foreseeable risk would per se trigger the exemption. Thus, to take the examples given by Dr. Hampson (and noted by the trial judge), the insurers would say that the design of the de Havilland Comet I, the first commercial airliner to be powered by jet engines, was “faulty or improper” because of design failure revealed by a series of crashes in foreseeable flight conditions within a few years of its introduction in 1952. The cause turned out to be the failure of the design to accommodate stress-induced metal fatigue that the state of engineering art simply did not anticipate. It was only later that “[t]he use of fracture mechanics methods not used in 1954 . . . enabled the analysis of these fatigue cracks to be made” (P. A. Withey, “Fatigue Failure of the de Havilland Comet I”, Engineering Failure Analysis, vol. 4, No. 2, June 1997, p. 147).

[53] Dr. Hampson’s second example was the failure of the first Tacoma Narrows Bridge, a mile-long suspension bridge in the state of Washington, which collapsed four months after its opening in 1940 because of wind-induced vibrations or oscillations in the structure that produced a catastrophic effect not foreseen by the then state of the art: J. Koughan, The Collapse of the Tacoma Narrows Bridge, Evaluation of Competing Theories of its Demise, and the Effects of the Disaster of Succeeding Bridge Designs (1996). Obviously wind conditions are a foreseeable risk in the design of suspension bridges. The insurers’ interpretation of the policy exception, I take it, is that despite the fact that “engineering knowledge and practice lacked a proper appreciation of the extent of the powerful forces” encountered by both the Comet aircraft and the Tacoma suspension bridge, proof of such failure in conditions of foreseeable risk should enure to the benefit of the insurance company. In my opinion, this approach does not construe the all-risks coverage “broadly and exclusion clauses narrowly”: Reid Crowther & Partners, at p. 269. Given the then state of the respective engineering arts, these pioneering designs were not “improper” as that term would be understood in what Estey J. called “the commercial atmosphere in which the insurance was contracted”. The insurers’ interpretation would produce, I believe, an “unrealistic result” (Consolidated-Bathurst, at p. 901). In my view, the words “faulty or improper” require the insurers to go beyond simply showing a failure in circumstances of foreseeable risk. The words “faulty or improper”, and in particular the word “improper”, require the insurers to establish that the design fell below a “realistic” standard. Such a standard can require no more than that the design comply with the state of the art. A standard of perfection in relation to all foreseeable risks, in my view, was not required by the words used by the parties. It was for the insurers to demonstrate that the exclusion applies.

[54] The “industry” standard is too low, for the reasons mentioned in Willowbrook Homes. Contractors and designers sometimes cut corners to save costs. Vancouver’s epidemic of “leaky condos” illustrates the problem of tying the “all risks” policy exception to an “industry” standard.

[55] Queensland pointed out, and my colleague emphasizes, that what is in issue is a faulty or improper “design”, not an “at fault” designer. This is true so far as it goes, but it hardly clinches the insurers’ argument. It is quite possible to evaluate the design (as distinguished from the designer) as to whether it met the standard of an ordinary, reasonable, cautious and prudent design, having regard to what could be expected in the circumstances. However, a design that survives a negligence test is not, on that account, of a calibre sufficient to deny the insurers the benefit of the exception. The insurers are entitled to the benefit of the exemption unless the design met the very highest of standards of the day and failure occurred simply because engineering knowledge was inadequate to the task at hand. The Oxford English Dictionary Online defines “state of the art” as

the current stage of development of a practical or technological subject; freq. (esp. in attrib. use) implying the use of the latest techniques in a product or activity.

[56] I do not believe that where, as here, the risk is broadly defined (“metal deflects under stress”), and the design addresses that risk with state of the art diligence and expertise (as here), the insurers are entitled to the exclusion just because, with the benefit of hindsight, it turns out that “engineering knowledge and practice lacked a proper appreciation” (to quote Queensland again) of the design problem. A narrower interpretation of the exclusion, it seems to me, best accords with the intentions of the parties based on the plain meaning of the words used, namely “faulty or improper”. If the insurers wished to negotiate an exclusion of costs associated with simple “design failure” or “design failure in conditions of foreseeable risk”, it was open to them to have tried to do so but that is not the wording of the policy and this exclusion clause should not, in my opinion, be given that effect.

[57] In the result, the argument turned on the expert evidence regarding the state of the art. The trial judge preferred the evidence of the CNR expert, Dr. Hampson, that it “is not realistic to suggest that all potential problems can and always should be identified nor that the issues spotlighted by hindsight should always have been picked-out” (Hampson’s Third Report, at p. 5). More must be shown to classify a design as “faulty or improper”.

D. Application of the Standard to the Facts

[58] The trial judge found that the investigation and accommodation of the risk had been conducted in accordance with the state of the art. He accepted the view of the CNR expert that additional computer modelling and analysis would not have disclosed the risk. He noted that “[n]either of the experts can explain why all of the seals failed although all of the seals were not damaged” (para. 67). Nevertheless, the majority of the Court of Appeal stated that “the foreseeability standard mandates that the relevant design . . . ‘withstand’ all foreseeable risks” (para. 62). In my view, however, failure “to withstand” does not discharge the onus of establishing a “faulty or improper design”. The CNR purchased the “all risks” policy in recognition of the fact that, despite all efforts to achieve a successful design in accordance with the state of the art in a new and challenging situation, there was an inevitable element of risk with an innovative design that it wished to insure against. It thus purchased “all risks” insurance. I accept the view of the trial judge and Lang J.A., dissenting, that the loss fell within the coverage and was not excluded in the circumstances of this case.

[59] The insurers themselves acknowledged in their factum (at para. 58) that while a loss must arise out of a fortuitous event, “the fortuity principle has subsumed the requirement that a risk must be ‘external’ to the property [insured]”. Accordingly, the absence of unforeseeable “external” conditions does not establish that the design was “faulty or improper”. The “internal” elements of the design will always operate in “external” conditions. They are inextricably linked. All of the cases referred to above involved the “internal” failure of a design to accommodate “external” conditions, some of which were unforeseeable and some of which were foreseeable.

E. Alleged Errors of the Trial Judge

[60] The Court of Appeal majority accepted “the insurers’ contention that the trial judge’s forseeability findings are tainted by reversible error” (para. 81) in four respects, as previously mentioned. It is therefore necessary to address the four “errors”.

[61] Firstly, the majority faulted the trial judge for failing, in his reasons for judgment, “to consider Rick Lovat’s evidence on the foreseeability of the failure risk” (para. 82). In fact, the trial judge specifically noted the evidence that “Lovat knew that the structure of this TBM had to be rigid enough to maintain a proper separation of the fixed and rotating elements being sealed” (para. 22; Becker’s Second Report, at p. 11) and that “Lovat had properly tested (stand-alone) the essential machine element involved in the failure — the seals” (para. 21; Hampson’s Second Report, at p. 6). Much of the evidence at trial was directed to exploring whether or not the design testing had adequately evaluated whether and in what circumstances differential deflection would or would not become “excess”, i.e. would fail to maintain the permitted 3 millimetre tolerance. I believe the trial judge well understood the significance of Lovat’s evidence. The trial judge’s point, I believe, was that while differential deflection was a known risk in the design of a TBM sealing system, the risk had been properly explored in the design phase, and, based on the existing state of the art, it was not foreseeable that excess differential deflection was even a remote or unlikely risk with this design in these circumstances. The trial judge rejected the expert evidence called by the insurers to the contrary effect (para. 75).

[62] Secondly, the trial judge is said to have overstated the support of the technical committees for the assessment by Lovat and Wardrop of the risk of differential deflection (paras. 97-98). What the trial judge said was simply that

[a]t no time was the question of excess differential deflection rendering the sealing system dysfunctional raised as an issue by any of the committees as requiring further inspection or analysis. The finite element analyses conducted by Wardrop to determine the extent of differential deflection and the review of those analyses by Lovat appear to have been accepted by the committees as addressing any concerns with respect to differential deflection. [para. 75]

This observation was based on the evidence of Rick Lovat, who was vice-president of Lovat at the time, that the technical committee, the technical review committee, and the consulting engineers Hatch-Mott MacDonald (“Hatch”) reviewed the sealing system drawings of the TBM and raised no concerns. Hatch also reviewed Wardrop’s Report.

[63] It is true that the technical committees did not get involved in detailed design issues, as the trial judge acknowledged. Nevertheless, the technical committees had overall involvement in the design of the project. The fact that the committees did not identify excess differential deflection in the cuttinghead assembly as a particular problem justifying their involvement seems to reinforce rather than undermine the trial judge’s point that such a risk in the circumstances of this project was not foreseeable. His more general point, to reiterate, comes later in the paragraph cited by the Court of Appeal majority:

When all of the evidence is consistent that none of the experts or other persons involved, who had substantial experience in the design and manufacture of TBMs and with tunneling projects, expressed no concern with respect to differential deflection adversely affecting the sealing system and when the design of the TBM and the analyses of the various components did not indicate the possibility of the failure which occurred, it seems to me to be making an unjustified logical leap to conclude that because a failure did occur and was remedied, it should have been foreseen initially.

The trial judge’s point, as I understand it, was reminiscent of Sherlock Holmes: the significance of the evidence was that the watchdogs did not bark.

[64] Thirdly, the Court of Appeal majority stated, at para. 102, that the trial judge failed

to distinguish between the foreseeability of the type of risk of failure that occurred here and the foreseeability of the mechanism by which such risk might materialize. This error went to the heart of the trial judge’s foreseeability analysis.

However, at several points in his analysis the trial judge emphasized that “the law in Ontario is that the risk which caused the failure must be foreseeable, in the sense of foreseeable even if unlikely or remote” in order for the court to determine that the design was “faulty or improper” and cited Foundation for the proposition that “[a]ll foreseeable risks must be taken into account in a design” (paras. 67 and 49 (emphasis added)). The trial judge did find that the “mechanism” of the failure had never been satisfactorily explained, but the existence of that mystery was not essential to his conclusion on liability.

[65] Fourthly, the Court of Appeal majority concluded that the trial judge’s forseeability analysis converted the all-risks policy into a “warranty that the insured property — the TBM — would fulfill its intended purpose” and amounted to “a warranty of entrepreneurial design risk” (para. 118). I do not agree. The trial judge did not impose on the insurers the risk the TBM would fail to perform. Much of the loss occasioned to the insured was not covered. The insurers were only liable for physical damage to insured property — the TBM — and consequential loss due to delay. Liability did not turn on “fitness for the purpose” but whether, on the facts, the risk that materialized into physical damage was foreseeable. On that point, there was conflicting expert evidence. The trial judge preferred the evidence of the insured over that of the insurers. I do not agree with the Court of Appeal majority that the trial judge’s conclusion was tainted with palpable and overriding error.

F. The Inherent Vice Exception

[66] The trial judge held that “[t]he prima facie test which has now been rejected by our courts with respect to faulty or improper design should also be rejected with respect to inherent vice” (para. 61). The Court of Appeal majority agreed that the inherent vice exception did not apply, as did the dissent. There was no evidence led in support of “inherent vice” that is not discussed in connection with “faulty or improper” design. The point was not seriously pressed before our Court and I agree with the Court of Appeal (unanimous on this point) that it should be rejected.

G. The Resultant Loss or Damage Exception

[67] The CNR makes the alternative submission that even if its loss is not covered under Section I of the policy it can recover “resultant damage” under Section II. This submission was rejected by the courts below. In light of the finding of coverage under Section I, this issue is now moot.

V. Disposition

[68] The appeal is allowed, the judgment of the Court of Appeal is set aside, and the trial judgment is restored except for the substitution of March 31, 1995, as the date of commencement of pre-judgment interest (in accordance with the reasons of Lang J.A.). The appellants will have their costs in this Court and in the Ontario Court of Appeal. The trial costs in their favour will remain as fixed by the trial judge at $1,150,837.35.

The reasons of Deschamps, Charron and Rothstein JJ. were delivered by

Rothstein J. (dissenting) —

I. Introduction

[69] I have read the reasons of Justice Binnie allowing this appeal. In my respectful opinion, the appeal should be dismissed.

[70] In my opinion the term “faulty or improper design” does not imply the introduction of a “state of the art” standard against which an impugned design is to be compared, as held by Binnie J. As explained in Queensland Government Railways v. Manufacturers’ Mutual Insurance, Ltd., [1969] 1 Lloyd’s Rep. 214 (Aust. H.C.), the distinction that is relevant is between a design that is defective and design that is free from defect (p. 217). The question is whether or not the damage to the insured property was due to an inability of the design to fulfil its purpose in the foreseeable conditions of the property’s use.

[71] What is at issue in this case is a question of contractual interpretation. It is not a matter of balancing interest between insurers and insured; nor is it appropriate to create a test akin to negligence when nothing in the term “faulty or improper design” in the insurance contract implies the introduction of the law of torts.

[72] In this case, it was found that dirt and other debris were penetrating the cuttinghead and getting through the seals protecting the main bearing of the tunnel boring machine (“TBM”). The trial judge found that the cause was excess differential deflection of the cuttinghead over that provided for by the design ((2004), 2004 CanLII 33029 (ON SC), 15 C.C.L.I. (4th) 1, at para. 66). Work stopped and changes were made to solve the excess differential deflection problem. The TBM then completed the work. The insurance excluded coverage for the cost of making good “faulty or improper design”. The insurers demonstrated that the original design by which excess deflection of the cuttinghead permitted dirt and other debris to get through the seals protecting the main bearing was faulty or improper. The exclusion to coverage therefore applied.

II. Interpretation of Insurance Contracts

[73] In interpreting insurance contracts, like all contracts, effect must be given to the intention of the parties to be gathered from the words they have used. See Consolidated‑Bathurst Export Ltd. v. Mutual Boiler and Machinery Insurance Co., 1979 CanLII 10 (SCC), [1980] 1 S.C.R. 888, at p. 899, per Estey J., citing Pense v. Northern Life Insurance Co. (1907), 15 O.L.R. 131 (C.A.), at p. 137, aff’d (1908), 1908 CanLII 11 (SCC), 42 S.C.R. 246. In Consolidated‑Bathurst, Estey J. referred to this as step one in the interpretation of an insurance contract.

[74] Step two is the application, where ambiguity is found, of the contra proferentem doctrine. However, contra proferentem is only to be applied when other rules of construction fail to enable a court to ascertain the meaning of the words in question. See Consolidated-Bathurst, at pp. 900-901, citing Stevenson v. Reliance Petroleum Ltd., 1956 CanLII 27 (SCC), [1956] S.C.R. 936, at p. 953.

[75] Moreover, contra proferentem, when it is applicable, is applied only to remove doubt, not to create doubt or magnify an ambiguity when the circumstances raise no real difficulty. See Consolidated-Bathurst, at p. 889, citing Cornish v. Accident Insurance Co. (1889), 23 Q.B.D. 453 (C.A.), at p. 456. The same is true of other rules of construction: they do not apply to create ambiguity where none exists.

[76] In my opinion, this case is to be decided at step one. The term “faulty or improper design” is not ambiguous. It is not open to alternative interpretations. Where the words are unambiguous, the court should give effect to the chosen language, reading the contract as a whole: Non-Marine Underwriters, Lloyd’s of London v. Scalera, [2000] 1 S.C.R. 551, 2000 SCC 24, at para. 71.

III. “All Risks” Insurance Policies

[77] In this case, the onus is on the insured to prove that the loss falls under the coverage that the policy provides, without considering exclusions to coverage. Once this is done, the onus is on the insurer to prove that an exclusion applies. Therefore, before considering the exclusions in the policy, it is necessary to consider the relevant coverage it provides.

[78] Subject to the exclusions stipulated in Section I of the policy, the insuring agreement provides that the policy insures against “ALL RISKS of direct physical loss or damage . . . to . . . [a]ll real and personal property of every kind and quality including but not limited to the [TBM]”.

[79] The classic statement of the meaning of “all risks” in an all risks policy is British and Foreign Marine Insurance Co. v. Gaunt, [1921] 2 A.C. 41 (H.L.). At pp. 46‑47, Lord Birkenhead wrote:

In construing these policies it is important to bear in mind that they cover “all risk”. These words cannot, of course, be held to cover all damage however caused, for such damage as is inevitable from ordinary wear and tear and inevitable depreciation is not within the policies. There is little authority on the point, but the decision of Walton J. in Schloss Brothers v. Stevens, on a policy in similar terms, states the law accurately enough. He said that the words “all risks by land and water” as used in the policy then in question “were intended to cover all losses by any accidental cause of any kind occurring during the transit. . . . There must be a casualty.” Damage, in other words, if it is to be covered by policies such as these, must be due to some fortuitous circumstance or casualty.

[80] At p. 57, Lord Sumner added:

There are, of course, limits to “all risks.” They are risks and risks insured against. Accordingly the expression does not cover inherent vice or mere wear and tear or British capture. It covers a risk, not a certainty; it is something, which happens to the subject-matter from without, not the natural behaviour of that subject-matter, being what it is, in the circumstances under which it is carried.

[81] The insurers concede that an all risks policy might cover the risk of faulty or improper design. Indeed, where the design’s suitability is an uncertainty from the point of view of the parties when they enter into the contract, it can be considered a risk of damage to the property falling under the broad scope of an all risks policy. However, they say that where faulty or improper design is excluded, it must be treated as a risk not covered by the policy.

[82] I do not think this description of the way to view the coverage of an all risks policy is controversial. What is at issue is whether the “faulty or improper design” exclusion to coverage applies.

IV. The “Faulty or Improper Design” Exclusion

[83] It is then necessary to turn to the exclusion for “faulty or improper design”. The term “design” is not at issue, but the terms “faulty or improper” are. The Oxford English Dictionary Online defines “faulty” as:

1. Containing faults, blemishes or defects; defective, imperfect, unsound. a. of material things.

b. of immaterial things.

2. Of persons, their qualities, etc.: Having imperfections or failings; apt to do wrong or come short of duty.

“Improper” is defined as:

2. Not in accordance with the nature of the case or the purpose in view; unsuitable, unfit, inappropriate, ill‑adapted.

3. Not in accordance with good manners, modesty, or decorum; unbecoming, unseemly; indecorous, indecent. Also transf. of a person.

[84] Both “faulty” and “improper” have meanings that imply blameworthiness and meanings that do not. Here we are concerned with an inanimate thing, the design of the TBM, not a person’s conduct; the relevant definitions are the ones that do not suggest any notion of blame.

[85] The High Court of Australia made this point in Queensland in dealing with an exclusion for “loss or damage arising from faulty design”. In Queensland, a flood swept away the piers of a bridge over a river. Barwick C.J., for the majority, rejected the view that the “faulty design” exclusion would apply simply because the design engineers had failed to meet certain standards. He found that “faulty design” is a more comprehensive term than “negligent designing.” At p. 217, he stated:

We think it was an error to confine faulty design to “the personal failure or non‑compliance with standards which would be expected of designing engineers” on the part of the designing engineers responsible for the piers. To design something that will not work simply because at the time of its designing insufficient is known about the problems involved and their solution to achieve a successful outcome is a common enough instance of faulty design. The distinction which is relevant is that between “faulty”, i.e., defective, design and design free from defect. We have not found sufficient ground for reading the exclusion in this policy as not covering loss from faulty design when, as here, the piers fell because their design was defective although, according to the finding, not negligently so. The exclusion is not against loss from “negligent designing”; it is against loss from “faulty design”, and the latter is more comprehensive than the former.

[86] In my respectful view, the Queensland approach is the appropriate starting point. It teaches that the term “faulty or improper design” attaches to the thing that was designed, not to the work of the design engineers. Whatever standard their work meets or does not meet, the thing designed either works for its intended purpose or it does not.

[87] In this case, a “faulty design” is a design that contains faults, is imperfect or is unsound for its purpose and an “improper design” is a design that is unsuitable or ill‑adapted to its purpose. In other words, a design that is faulty and improper is one that does not work for the purpose for which it was intended to be used.

[88] Queensland has been cited in a number of Canadian cases. In Simcoe & Erie General Insurance Co. v. Willowbrook Homes (1964) Ltd., [1980] I.L.R. ¶ 1‑1236 (Alta. C.A.), a concrete wall of a building under construction fell during a severe windstorm. The insurer was able to establish that an exclusion clause for “faulty or improper design” applied because, regardless of whether or not the clause required an element of blameworthiness on the part of the designers, the bracing was not reasonably adequate for its intended purpose. The bracing had been subsequently doubled for the remainder of the project.

[89] In Collavino Inc. v. Employers Mutual Liability Insurance Co. of Wisconsin (1984), 1984 CanLII 5963 (ON SC), 5 C.C.L.I. 94 (Ont. H.C.J.), the 1979 ice flows on Labrador’s North West River damaged a trestle. At p. 97, the court found that:

From the happening of the damage it appears to me that the trestle was not designed to withstand the spring break up of ice. With some changes made it withstood the break up the following year. There is no evidence that the break up in 1979 was in any way unusual.

The court followed Queensland and Willowbrook in ruling that the trestle’s design excluded it from coverage under an exception for “error, omission or deficiency in design”.

[90] Queensland was also followed in B.C. Rail Ltd. v. American Home Assurance Co. (1991), 1991 CanLII 5713 (BC CA), 79 D.L.R. (4th) 729 (B.C.C.A.). In that case, an embankment supporting part of a railway track collapsed because the engineer responsible for its design made a wrong assumption about the underlying soil. While the exclusion clause in B.C. Rail excluded “error in design” rather than “faulty design”, the Court of Appeal followed Queensland and Willowbrook in noting that the exclusion applied to design, not designing. As a result, it was not necessary to find some element of blameworthiness in the work of the designer who made the wrong assumption. The issue, according to the court, was whether the design itself was flawed.

[91] Binnie J. writes that these cases are all explicable on the basis of a negligence standard (para. 45). However, none of the courts made findings of negligence.

[92] Another line of cases deals with the Queensland approach differently, starting with Foundation Co. of Canada Ltd. v. American Home Assurance Co. (1995), 1995 CanLII 7102 (ON SC), 25 O.R. (3d) 36 (Gen. Div.), in which a blow-in caused by “the unforeseeable and rare combination of a pocket of gas and slickenside” damaged a cofferdam (p. 47). The insurance policy in Foundation excluded the cost of making good “faulty or defective” design. According to the trial judge, Wilson J., the facts in Foundation brought into focus “the limits of the principles in Queensland” (p. 47). She noted that in Queensland, Willowbrook, and Collavino, the impugned designs were “inadequate to meet the demands of extreme, but foreseeable, circumstances” (p. 46). (In B.C. Rail, the design was inadequate to meet non extreme, foreseeable circumstances.) As a result, she ruled that, if a design does not take into account all foreseeable risks, the “faulty or deficient” design exclusion would apply.

[93] Wilson J. also found that the term “faulty design” required a comparison to a standard against which it falls short. At p. 47, she writes that “a finding of faulty or defective design is necessarily comparative. It means comparing the design in question to some standard, and requires a finding that the design was below that standard.” She rejected a comparison to the “industry standard” because this might be inappropriately low due to cost considerations. She cautioned about the effects on public safety of such a standard. She acknowledged that a design’s conformity to the industry standard may be “persuasive” to rebut allegations of “faulty or defective design”, but it would not be determinative of the issue. At p. 48, Wilson J. also finds the negligence standard too low, stating that requiring a design to meet only reasonably foreseeable risks “leaves too great a potential margin for error”. She concludes that all foreseeable risks must be taken into account. Notably, this is the test she had formulated before engaging in a discussion of a comparative standard.

[94] The Foundation approach was followed in Algonquin Power (Long Sault) Partnership v. Chubb Insurance Co. of Canada (2003), 50 C.C.L.I. (3d) 107 (Ont. S.C.J.). In that case, a dam was damaged when it was weakened by seepage in the bedrock on which it was built. The trial judge, Lang J. (as she then was), ruled that a faulty design exclusion would not apply if the impugned design was fit for its intended purpose and the designer had accounted for all potential foreseeable risks (para. 176). She also held that, unlike the risk of the blow‑in in Foundation, the risk of seepage was foreseeable and not an “unexpected, rare and unknown phenomenon” (para. 186).

V. The Courts Below on the Applicable Standard

[95] The trial judge in this case, Ground J., adopted the standard of Algonquin Power and Foundation whereby to not be faulty or improper, a design must accommodate all foreseeable risks, no matter how unlikely or remote (para. 54). Ground J. restated this standard throughout the judgment as requiring that the design “accommodate or provide for” (para. 68) or “withstand” (para. 174) all foreseeable risks.

[96] At the Ontario Court of Appeal, Rosenberg and Cronk JJ.A. held that the trial judge had correctly stated the standard:

In our view, the trial judge’s formulation of the foreseeability standard properly recognized that satisfaction of this standard requires proof that all foreseeable risks have been identified and addressed in the design in question. Mere recognition of a foreseeable risk is insufficient. “Accounting” for a foreseeable risk contemplates both that the risk is identified and that provision or allowance is made in the impugned design to meet the identified risk. On the foreseeability standard, anything less will not establish a fault‑free and proper design. Nor, in our opinion, does designing against a foreseeable risk convert the risk into an unforeseeable one. It simply means that the applicable design provided for the risk, that is, the risk was identified and addressed in the design with a view to forestalling its occurrence, thus meeting the foreseeability standard. In this context, we agree that the foreseeability standard mandates that the relevant design “take into account”, “accommodate”, “provide for” and “withstand” all foreseeable risks.

((2007), 48 C.C.L.I. (4th) 161, 2007 ONCA 209, at para. 62)

I note that the majority formulated Wilson J.’s foreseeability test from Foundation without making reference to the necessity of comparing an impugned design to a standard.

[97] In dissent, Lang J.A. argued that an impugned design only needed to “take . . . all foreseeable risks into account” (para. 195). She ruled that the comparative standard introduced in Foundation “calls for a comparative analysis, an analysis that considers the human component of the design, and asks what the designer anticipated, or should have anticipated” (para. 195). She goes on to support this formulation of the standard by pointing out that it is “more favourable to the insurer” and by arguing that it “strikes a fair balance in respect of allocation of risk” (paras. 197).

[98] Lang J.A. states that Foundation rejected the Queensland test (para. 176). However, in my respectful opinion, Wilson J. did not reject the Queensland approach in Foundation. In her conclusions, she explicitly states that she has applied the test enunciated in B.C. Rail and Queensland (p. 56). Her conclusions should be seen as refining the test for situations where a design encountered an “unforeseeable and rare” event, in which case the design would not be considered “faulty”.

VI. Analysis

[99] I agree with Binnie J. that the term “faulty or improper design” is not ambiguous (para. 33). Pursuant to Consolidated-Bathurst, in the absence of ambiguity we are not concerned with the contra proferentem rule, nor are we concerned with two interpretations, one which produces a reasonable result and the other not. And this is not a case in which application of the exclusion would mean that the insurer assumed no risk. The policy did cover the risks of external fortuities, such as fire, pockets of methane gas, and operator error among others.

[100] We are then left with the unambiguous term “faulty or improper design”. This exclusion requires that the design of a property be fit for its intended purpose. The judgment in Foundation and the majority judgment in this case at the Court of Appeal provide some guidance on the applicable test. The design must provide for and withstand all foreseeable risks. This means it must withstand extreme examples of foreseeable risks. While a design cannot be expected to withstand rare and unforeseeable conditions (Foundation, at p. 47), it must be able to meet foreseeable risks (C.A., at para. 62).

[101] In theory, one might say that anything or everything is foreseeable, in the sense of being imaginable. However, judges must consider the question of foreseeability in practical terms. Some conditions may be so rare and unexpected that in practice, it is not realistic to think that they were foreseeable. For instance, the insurers raised the example of an aircraft struck by a meteorite. In theory, it might be said that the design of the aircraft was faulty or improper because it did not have a meteorite deflector. However, in practical terms, such an event is so rare and unexpected in the context of a commercial airplane’s expected use, that it would fall into the unforeseeable category.

[102] The nature of a foreseeability analysis is that some conditions will be clearly foreseeable and others, e.g., the meteorite, clearly not. Difficulty will only arise at the margins. In such cases, the trial judge will have to determine whether or not the risk was foreseeable in the context of the property’s intended use. On the evidence in Queensland, a flood was foreseeable, as were the ice flows in Collavino. On the evidence in Foundation, a blow-in from a combination of slickenside and gas was not foreseeable.

[103] With that said, this case is not one at the margins. The risk of differential deflection of the cuttinghead had been identified and therefore was foreseeable.

[104] After only 14 percent of the tunnel had been completed, contamination was detected in inspection ports for the main bearing. Worn and destroyed seals were found. Inspection revealed damage to the seal system particularly in the outer areas of the seal ring due to metal to metal contact between the rotating components and the bulkhead. The cause was excess differential deflection of the cuttinghead in the area of the seal elements.

[105] The TBM was repaired in a manner aimed at making the seals less susceptible to excess differential deflection of the cuttinghead. The project was then completed without the same problem recurring. It was found after completion that there had again been excess differential deflection of the cuttinghead, but that the modifications that were made were sufficient to accommodate the excess deflection without damage to the seals.

[106] The trial judge ruled that “the design of the TBM was deficient in that it was not able to perform as specified under expected or normal conditions” (para. 67). Some differential deflection was expected, but there was greater differential deflection than provided for by the design.

[107] The potential for design failure to damage the TBM was a risk from the perspective of the parties at the moment of entering into the contract. The policy therefore covers it, subject to the applicability of the “faulty or improper design” exclusion.

[108] Here, it did not achieve its intended purpose because of an inability to cope with the expected, foreseeable conditions of its use. It could not, as originally designed, cope with the ground conditions it would foreseeably encounter. This type of risk was excluded from coverage under the “faulty or improper design” exclusion.

[109] Binnie J. says that the term “faulty or improper design” implies a comparative standard and that the appropriate standard is the state of the art. He says that “a design might fail even though not improper or faulty according to the state of the art” (para. 48). I cannot agree that the unambiguous term “faulty or improper design” implies that the design be measured against a standard of state of the art. I can find no basis for the introduction of a comparative standard of the state of the art in the term “faulty or improper design”. The only comparison that these words imply is between a design that is faulty or improper for its intended purpose having regard to all foreseeable risks and one that is not.

[110] Talk of comparative standards distorts the meaning of the terms used. For this reason, I must disagree with Lang J.A.’s formulation of the standard in her dissent at the Court of Appeal. Her formulation shifts the focus from the design to the designer. The question in this case is not whether the designer acted improperly or was at fault. The question is whether the design itself was faulty or improper.

[111] We are dealing here with a contract that by its words discloses the intention of parties. Introducing a comparative standard of the state of the art essentially turns a claim that must have its foundation in contractual terms into a claim in tort or something akin to a tort that is entirely foreign to the contract. This is clear from the justification given by Binnie J. for choosing the state of the art standard against which to measure the design: the “industry” standard is too low (para. 54), but the standard of perfection is too high (para. 51), so the standard should be “the state of the art” (para. 53).

[112] The comparative standard approach shifts the focus from the adequacy of the design of the TBM for its intended purpose, having regard to all foreseeable risks, to the adequacy of the work done by the design engineers. Did they design the TBM in accordance with the state of the art?

[113] Nowhere in the words of the exclusion is there any suggestion that the focus is on the adequacy of the work of the design engineers, let alone that the standard by which to measure their work is the state of the art. It excluded “faulty or improper design”, not “negligent, faulty or improper designing”.

[114] Binnie J. argues that his interpretation of the exclusion clause “best accords with the intentions of the parties” (para. 56). I respectfully disagree.

[115] The common intention first and foremost is to be ascertained from the words of the contract. Nothing in the words of the contract supports the view that the design being in accordance with the state of the art was in the parties’ contemplation when they agreed to the contract. Absent any other evidence there is no foundation for the inference that a state of the art standard was their common intention.

[116] When a contract of insurance unambiguously excludes coverage for “faulty or improper design”, introducing tort or tort‑like concepts to expand coverage beyond that contracted for has no legal foundation. This is especially the case when sophisticated commercial parties have deliberately negotiated coverage in a manuscript policy.

[117] The majority at the Court of Appeal set out the Foundation test without reference to a comparative standard. In my view, this is the right approach. The foreseeable risks test does not require introducing a comparative standard.

[118] It is important to observe that, at the time it was designed and constructed, the TBM was the largest earth pressure balance tunnel boring machine built in the world (trial judge’s reasons, at para. 6). As noted by Binnie J. (at para. 6), the CNR

established an elaborate and sophisticated process to design and construct a customized TBM. A technical committee composed of expert tunnelling contractors and consultants was formed to advise on the conceptual design parameters. Its work was guided by a steering committee which provided general guidance. A technical review committee monitored, reviewed and advised the CNR on the project as a whole. The design of a suitable TBM was a major challenge.

[119] I find it difficult to believe that, if it was the intention of the parties that the property insurers would warrant that the design of an innovative TBM requiring such extensive technical input would not be faulty or improper, the policy would not have explicitly provided for such coverage. Instead, such coverage was expressly excluded. In view of the express exclusion, the intention of the parties must have been that the CNR was the undertaking the risk involved in the development of the design of such an extraordinary piece of machinery.

[120] The approach of the majority turns the policy into a warranty. In other words, if the design engineers do everything in accordance with the state of the art, but the TBM does not work because they did not foresee the degree of differential deflection the cuttinghead would sustain, the design is not faulty or improper. However, as Rosenberg and Cronk JJ.A. noted for the Court of Appeal at para. 118, an all risks insurance policy is not a warranty of soundness or fitness for purpose. See also Triple Five Corp. v. Simcoe & Erie Group (1994), 1994 CanLII 9186 (AB QB), 159 A.R. 1 (Q.B.), at para. 297, and Mellon v. Federal Ins. Co., 14 F.2d 997 (S.D.N.Y. 1926), at p. 1002. Construing the policy as a warranty, in my view, is an “unrealistic result” given “the commercial atmosphere in which the insurance was contracted” (to quote Consolidated‑Bathurst, at p. 901).

[121] Binnie J. says that “a design is not faulty or improper simply because it does not meet a standard of perfection” (para. 51). This would be akin to the prima facie standard some have argued Queensland stood for.

[122] Professor Brown, in Insurance Law in Canada (loose‑leaf), at p. 20‑32, write that, following the ruling in Queensland,

[i]t has . . . been argued in other cases that where an insurable loss results, a prima facie inference is raised that the faulty workmanship or design exclusion applies. In other words, it is argued that if the design failed, it must be faulty. This would, however, effectively reverse the onus of proving that the exclusion applies, in the absence of any policy wording to that effect. Further, it would impose absolute liability on the contractor or designer and would significantly negate the coverage provided.

The author may well be correct to say that a finding that “if [a] design failed, it must be faulty” constitutes a reversal of the onus with respect to the application of the exclusion and imposes absolute liability. And Binnie J. may well be correct that this creates a standard of perfection. However, that is not the situation here.

[123] The foreseeability test applied above — one stemming from Foundation’s refinement of Queensland — is not a prima facie standard nor a standard of perfection. The foreseeability test does not mean that everything that can be designed for needs to be designed for. Some risks will be rare and unforeseeable; the insured cannot be expected to design for these.

[124] Binnie J. cites the examples of the de Havilland Comet I and the Tacoma Narrows Bridge as instances of designs which failed because of a lack of engineering knowledge about the problems they foreseeably faced and their solutions. The existence of such risks explains why insurers will want to include “faulty or improper design” exclusions. Once such a clause is included in the policy, such risks will be excluded on the foreseeability test.

[125] As explained above, the “faulty or improper design” exclusion did not mean that the TBM had to withstand all risks. The exclusion would not have applied to designs that were fit for their purpose, but failed due to rare and unforeseeable circumstances. However, the TBM did have to cope with the necessary and foreseeable incidents of its intended use.

[126] In order to invoke the exception, the onus on the insurer was to show that when the TBM failed, it did so due to faulty or improper design; that is, it failed to cope with foreseeable risks. There could have been other reasons for the failure — operator error, fire, or other risks. However, when, after investigation, it was determined that the failure was due to the original design’s inability to cope with the necessary and foreseeable incidents of its expected use, the insurers met their onus.

[127] The insurers proved there was a design problem: they showed the cause was differential deflection in excess of that provided for by the design. It must follow that the exclusion to coverage applied.

[128] I conclude that the exception providing for faulty or improper design applies and that there is no coverage under Section I of the policy for what occurred in this case.

VII. The Resultant Loss Clause

[129] The CNR says that if the faulty or improper design exclusion applies under Section I of the policy, the CNR is still entitled to recover its pure economic loss for delay in opening the tunnel under Section II of the policy. The CNR relies on words which it says exclude the exception for faulty or improper design. The relevant provision states:

SECTION I - BUILDERS RISK INSURANCE

3. EXCLUSIONS: This Policy does not insure:

(a) any loss of use or occupancy howsoever caused except as specifically stated;

(d) the cost of making good

(iii) faulty or improper design

provided, however, to the extent otherwise insured and not otherwise excluded under this Policy, resultant loss or damage under any Section of this Policy shall be insured; . . .

[130] I agree with the trial judge and the Court of Appeal that Section II of the policy does not provide coverage. Coverage under Section II only applies to economic loss for delay when the cause of the delay is physical loss covered under Section I of the policy. As there is no coverage under Section I for faulty or improper design, there can be no coverage under Section II for resultant damage or economic loss.

VIII. Conclusion

[131] I would dismiss the appeal with costs in this Court and the courts below.

Appeal allowed with costs, Deschamps, Charron and Rothstein JJ. dissenting.

Solicitors for the appellants: Borden Ladner Gervais, Toronto.

Solicitors for the respondents: Lerners, Toronto.

^* See Erratum [2009] 1 S.C.R. iv.