Trumpy,
I suspect the switches drawn as LS1, LS2, and LS3 are actually over temperature switches. I would expect to see them on the line side of the heating elements instead of the common. I am also surprised the contactor is not a three pole device. The lack of the third contact enables the bottom heater to be always on if the common gets grounded.
Assuming the system got approved by the relevant authorities, we can only offer opinions on a safer design.
