Indeed, new electric immersion heaters must now have a limit stat in addition to the normal adjustable control stat. To prevent the water boiling if one thermostat fails.
In the tragedy to which I referred, the water in the hot water cylinder boiled and the resulting steam and boiling water were vented into the plastic cold water cistern. This was only intended for cold water and split when filled with boiling water.
The deluge of very hot water poured through a bedroom ceiling and scalded a young child who later died as a result.
Similar accidents had occurred previously but without loss of life.
Existing immersion heaters without the limit thermostat may continue in service, but many would consider it best practice to replace them. Especially if the feed and expansion tank is plastic.
I had an encounter with this in 1998. Early one Sunday morning I heard an unfamiliar rushing water sound, and found that the hot tank was very hot and water was "pumping over" - up the vent pipe into the header cistern, pushing slightly less hot water down into the tank. The water had not reached boiling point, and the cistern was over a stairwell, but it was still very worrying given that the cistern is made of PVC.
I'd replaced a failed immersion heater the year before, and the whole system was replaced by the end of the year. I think the replacement still had no safety cut-out, and I replaced it a few years later with one that did. I rarely used the immersion in the new system, but was now primed to spot news on the subject.
In 2003, CIPHE* put out a guidance note that started "On 30th May 2003, two occupants of a house in Penzance were scalded by a large quantity of high temperature water that poured through their bedroom ceiling. One later died from the injuries received." There was a public campaign to change the regulations from then, though that does not mean work in committees only started then (though such events usually do impact the work).
It identified two factors in this accident:
1. the immersion thermostat failed "on" (unsafe)
2. "The standard for the cold water cistern in the roofspace required that it be tested to withstand up to 500 hours without deforming, if fully supported across its entire base area." In this case the platform for a cistern 600 mm wide was only 400 mm.
That heat tolerance of PVC cisterns is a bit surprising, though you can never be sure that older ones would meet the current BS (which was probably not compulsory anyway). The requirement for full-width support was already in force but in the Water Regulations, for which there is even less enforcement than for the building regulations.
At that time thermostats with a cut-out (RDT type) existed but were not very common. In 2007 my local building control department put out a news item that started "Following the tragic death of a baby in Somerset", which I guess is the one in Taunton. This was based on advice from
HSE▸ , who don't have any direct role in safety in homes, to fit replacements of the new type.
The words Zoe quoted from requirement G3 were already in place long before - tightened up slightly in 1992. They related to unvented systems (which don't have a header cistern) then, and were widened to include vented ones in 2010 (the first version or 2009 draft). At the same time the reference to full support was added - presumably this was the revision that ellendune was involved in. Subsequently a further tightening has required non-resetting cut-outs for direct (e.g. immersion) heating but not indirect (e.g. solar) heat sources.
So there are several sources for such safety rules, none of them retroactive. Even for replacement, something fairly easy to do, the most effective enforcement is for shops not to stock the out-of-date ones. That can come from product sale regulations, from retailers' policy choices, from the trade not buying them (so they are not worth selling), and all that is prompted by building and water regulations and standards.
Or at least that was the case - now with online "shops", stocking things rarely bought (and never by the trade), and meeting no standard, can be worth doing. If you can offer an out-of-date part with a number that matches the failed one, it's likely to pick up quite a few hits from those with less expert knowledge.
*Institute of Plumbers at the time