A series of unfortunate events combined to cause catastrophe at a Queensland power station, but an expert investigation found deeper safety concerns.
Words by Jonathan Bradley
“It looks like a bomb’s gone off,” was CFMEU district president Shane Brunker’s impression in the 2021 aftermath of an explosion at the Callide C power station in the central Queensland town of Biloela.
“There’s shrapnel everywhere,” he told the Australian Financial Review after gaining access to the scene of a catastrophic failure at the coal-fired plant, which caused blackouts across the state. “There was a piece of metal in the roof. We didn’t know what it was, but it weighed 300 kg.”
Three years later, forensic engineer Dr Sean Brady FIEAust CPEng of Brady Heywood delivered his report on the disaster, damning plant operator CS Energy as an organisation that “did not value or practise effective process safety”.
Although there were no deaths from the explosion and subsequent fire, the catastrophic failure suffered by Unit C4 of the plant destroyed its turbine and generator. The unit did not return to service until August 2024.
Four faults
Brady found that a confluence of four technical faults over the course of 34 minutes led to the turbine generator’s destruction at 2:07p.m. on 25 May 2021. If any of these faults had been averted, the system would likely have avoided catastrophic failure.
The first of these technical causes originated 18 months earlier, when the plant launched an upgrade program for its three battery chargers. Callide C consists of two electrical systems: an alternating current (AC) system that is connected to the grid and allows the plant’s turbines to generate electricity, and the battery charger, which is part of a direct current (DC) system that powers control, monitoring and protection systems, as well as the emergency backup.
In February 2021, the plant began upgrading the Unit C4 battery charger, the final one to be replaced. This process, known as a “switching sequence”, involved taking the battery out of service and drawing on an alternative DC current supply.
On the day of the disaster, the plant prepared to begin operating the unit with its new battery, but rather than taking it offline while it switched the replacement DC system on, it allowed it to continue operating. Since the new battery charger couldn’t provide DC power until it had been connected, the plant had to draw on its alternative supply, with no redundant backup source available.
That led to the second failure: the new battery charger. Designed to maintain a system’s voltage at a specific level, it had not been tested to the requirements of the switching sequences. When it did not respond instantly after being connected – and with the alternative DC source then disconnected – the unit’s voltage collapsed from approximately 243 V to 120 V.
This happened over 74 seconds. In Brady Heywood’s investigation, however, it found that it should have recovered within seconds. Instead, with the new battery still dependent on the AC supply, and the AC supply now lost due to the collapse in system voltage, the new battery couldn’t do its job of restoring the system to 243 V.
The AC supply’s failure was the third thing to go wrong – and, ironically, it happened when the system detected a fault that had not occurred. A safeguard known as arc flap protection, perceiving a voltage collapse, operated as if there were a problem with the AC system and disconnected it in response.
This had some major effects. Steam stopped entering the plant’s turbine because the hydraulic oil system that operated the steam valves lost power. The lubrication oil that allowed the bearings around the turbine’s shaft to move smoothly stopped flowing. A hydrogen coolant escaped because the oil seal that kept it in lost the power it needed to operate.
The final fault lay with the unit’s automatic changeover switch, which was not operating on the day of the incident. The switch could have restored power to the system from an alternative source if it had been working.
However, it had been switched off since an incident four months earlier, when an electrical fault led to two of the plant’s units shutting down and disconnecting from the grid. A maintenance notification to address this issue was classified as “low consequence” and the switch was still not operating on the day of the disaster.
Out of control
The unit now had no power to keep its protection systems functioning and no steam to drive its turbine, but it was still connected to the grid, from which it could draw electricity. As a result, it stopped supplying power and instead began acting as an electric motor, its rotor spinning at about 3000 rpm.
This had all happened in a matter of seconds, and to shut it down before it got further out of hand, the unit’s control room operators monitoring the equipment would have had to recognise the problem. Their screens, however, suffered the same power loss as the rest of the system, and the control room did not have the information needed to manually shut down the processes.
In the meantime, the generator was spinning rapidly around on a shaft whose bearings were no longer being properly lubricated. The heat from the resulting friction caused the shaft to warp, the bearings to melt and the rotor to begin wobbling out of alignment. Hydrogen coolant likely caused fires.
After 34 minutes, the out-of-control system exerted more force than it could bear on the rotor shaft, which tore apart in nine places. A two-tonne piece was ejected five metres across the floor, and a 300 kg barring gear was propelled into the roof – the mysterious object Brunker identified in his initial tour of the site.
After 40 further seconds, an electrical fault caused the generator to draw more than twice as much power from the grid as it usually exported, and protection systems kicked in and disconnected the substation. The disaster was over, but the turbine generator was destroyed and the Queensland power supply experienced widespread destabilisation.
Organisational failures
Brady did not confine his findings to the technical processes underlying the incident. He was sharply critical of plant operator CS Energy’s processes, which he described as “deficient”.
“No evidence has been sighted that CS Energy understood or formally considered the risks posed by this lack of redundancy, particularly combined with carrying out the switching sequence with the unit online and exporting power,” Brady wrote in the report.
“CS Energy’s processes, however, did not require any form of formal risk assessment when planning or executing switching sequences. Its processes only required consideration of the personal safety risk posed to those personnel undertaking the work, not of any risks posed to the wider plant.
“While formal risk assessments would not necessarily have led to avoidance of the incident, they could have increased the likelihood of identifying the risks associated with proceeding with the switching sequence with the unit online and without DC redundancy.”
Noting that CS Energy is a government-owned corporation, he observed that shareholder mandates required cost savings, while the shared ownership structure of the Callide C power station led to complexity in its management.
“The key organisational factor related to the incident can be summarised as a failure to implement effective process safety practices,” Brady wrote. “CS Energy had substantive and longstanding issues with systems that are critical for process safety.
“Its [efforts] to embed process safety within the organisation lost key resources and funding, and did not materially impact the management of process safety risk.”
After Brady’s report was released, CS Energy Chair Adam Aspinall released a statement apologising to the company’s employees, the government and the people of Queensland.
“I acknowledge that in recent times CS Energy has not consistently achieved these world-class standards in all its operations,” he said. “CS Energy has experienced two significant incidents, with the catastrophic failure of the C4 turbine in May 2021 and the partial collapse of the C3 cooling tower in October 2022.
“Despite no-one being injured as a result of these incidents, these are unacceptable outcomes for the people of Queensland, who trusted CS Energy to manage these assets on their behalf.”
This article was originally published in the May 2025 issue of create with the headline “Power out”.
Further reading
