The events of 25 May 2021
65 As mentioned, the present proceeding arises from the catastrophic events which occurred at the Callide C Power Station on 25 May 2021. It is appropriate to recite verbatim the parties' agreed facts regarding the events which gave rise to the admitted contraventions.
E THE EVENT ON 25 MAY 2021
E1 The battery charger replacement project
42. On 25 May 2021, CS Energy, the operator of Callide C4, was engaged in the procedure of replacing the C4 battery charger. The replacement procedure had been completed without incident in relation to the C3 and Station battery chargers by that date. The previous day, in the course of that procedure, the operator had configured Callide C4 so that DC power was supplied (via an interconnector switch on its main 220V DC switchboard) by the Station battery charger and battery. The effect of this was to combine the Station and Callide C4 DC system into a single electrical system.
43. By 25 May 2021, the C4 battery charger had been replaced and was ready to be brought into service by being reconnected to the C4 DC system. This involved a preplanned sequence of steps called a "switching sequence". The switching sequence involved:
(a) on 24 May 2021, connecting the battery charger to the existing C4 battery to bring it to a full state of charge overnight;
(b) on 25 May 2021, disconnecting the replacement battery charger from the existing battery;
(c) connecting the replacement battery charger to the C4 DC system;
(d) disconnecting the Station DC supply from the C4 DC system; and
(e) connecting the existing C4 battery to the C4 DC system.
44. The Callide C4 generating unit was not powered down while the switching sequence was undertaken. Rather, it continued generating at 278 MW.
45. By 13:32 on 25 May 2021, the first three steps of the switching sequence had been carried out successfully.
46. The events described in paragraphs [47] to [65] are referred to as the Event.
E2 The 13:33 faults
47. At about 13:33 on 25 May 2021, the operator switched Callide C4's DC power supply (via an interconnector switch on its main 220V DC switchboard) from being connected to the Station battery and battery charger to being connected to the C4 battery charger. The C4 battery was not connected to the system before the switching sequence began, as the design of the DC system did not permit the C4 battery and Station battery to be connected to the same electrical system at the same time.
48. The DC system included a "trapped key interlock system" that prevented two batteries being connected to the same DC system. Accordingly, the C4 battery could not be connected to the C4 system prior to the disconnection of the Station DC supply.
49. Prior to the interconnector being opened, the Station battery charger and C4 battery charger had been operating in parallel. When operating in parallel, the battery chargers did not share load and operated independently. This meant that the charger with the highest output voltage, the Station battery charger, provided all the load, while the C4 battery charger voltage decayed to 120 volts. When the interconnector was opened to initiate the switching sequence, the C4 battery charger failed to respond quickly enough to maintain the necessary DC voltage. The DC voltage then rapidly decayed to ~0 volts. Because the C4 battery was not yet reconnected, it was not available as an alternative source of DC power supply.
50. There was a drop in the voltage of the DC power supplied to the control circuits of the 6.6kV incomer circuit breakers. The circuit breakers tripped, and there was a loss of AC power supply to the 6.6kV system. There was also a loss of DC power supply to the generating unit's monitoring and control systems, and to the Callide C4 protection systems.
51. There was a loss of AC power supply to all 415V switchboards on Callide C4, including the 415V input supply to the C4 battery charger.
52. The C4 battery charger could not recover DC voltage and resume DC power supply.
53. There was a loss of AC power to the auxiliary plant, which ceased to function.
54. The Callide C4 generating unit lost steam, stopped generating and began motoring asynchronously. Relevantly:
(a) the C4 generating unit lost excitation - that is, the DC power supply used to ensure that the rotor and stator of the generating unit remain magnetically linked, ceased to function; and
(b) there was reverse power, where the C4 generating unit began motoring instead of generating - that is, it began to draw power into itself from the power system, rather than exporting power onto it.
(together, the 13:33 faults).
55. However, because there was no DC power supply, the Callide C4 protection systems failed to operate. Relevantly, at about 13:33, despite the events referred to in [54] above, the Callide C4 protection systems failed to cause the generator circuit breaker to disconnect the Callide C4 generating unit from the power system, as they should have done.
56. As a result of the matters in [47] to [55] above, the Callide C4 generating unit was operated asynchronously and without cooling, lubrication, protection or monitoring systems for an extended period of time, which ultimately led to critical short circuit faults and its catastrophic failure and destruction.
57. At 13:40, the operator informed AEMO of a possible fire at Callide C4.
58. At 13:44, the Callide C3 generating unit tripped from 417 MW and the operator contacted AEMO to confirm there was a fire in the Callide C turbine hall.
59. Between 13:49 and 14:04, CS Energy evacuated the Callide C PS, in light of risks to the personal safety of the operating staff.
60. Relevantly, in the period up to 14:06:
(a) Supervisory and Control and Data Acquisition (SCADA) data from Calvale substation indicated that Callide C4 was absorbing MW and MVAr, but the SCADA data from Callide C indicated that Callide C4 was still generating at approximately 278 MW. The operator's staff believed (incorrectly) that the generating unit had tripped and was offline;
(b) AEMO had multiple conversations with the operator and Powerlink staff respectively, seeking to confirm the status of Callide C4, and whether Powerlink should open the circuit breakers at Calvale substation in order to disconnect Callide C4;
(c) AEMO and Powerlink were not aware that Callide C4 was operating without DC and AC power supplies;
(d) The operator, Powerlink and AEMO were not aware that the Callide C4 protection systems were not operating; and
(e) The operator was still attempting to determine the situation and status of the Callide C4 generating unit - these attempts were impeded by the loss of certain operator systems as a result of the loss of DC power, and the inability to physically check on the generating unit.
E3 The 14:06 faults
61. At 14:06, the excessive wear caused by the operation of the generating unit in the manner described above caused the rotor to catch on the casing. This impact caused the rotor shaft to tear apart at nine locations. A piece weighing more than two tonnes was thrown five metres across the floor of the turbine hall. The force of the impact also caused remnants of coupling covers, bearings and sections of the shaft to be ejected.
62. After this occurred, the C4 generating unit was still connected to the grid for approximately 40 seconds. During that time, large electrical arcs started to form, vaporising the copper conductors, and causing the generating unit to draw 300 MW and over 1,400 MVars from the grid.
63. At 14:06, among other things, as a result of that electrical arcing, at Callide C4 there was:
(a) a two-phase short circuit fault at the generating unit;
(b) a three-phase short circuit fault at the generator stator; and
(c) a single phase-to-ground short circuit fault, followed by a double phase-to-ground short circuit fault, both within the 275kV system
(together, the 14:06 faults),
where each of the generating unit, generator stator and the 275kV system were elements within the protection zones of the Callide C4 protection systems.
64. However, because there was no DC power supply, the Callide C4 protection systems failed to operate. At about 14:06, the Callide C4 protection systems failed to disconnect the generating unit (and the 275kV plant, in respect of faults referred to in 63 above) from the power system in response to the short circuit faults referred to in [63] above, as they should have done.
65. Rather:
(a) all lines out of the Calvale 275kV substation tripped at the remote ends only; and
(b) Callide C4 disconnected from the power system only when the entire Calvale 275kV substation was disconnected, thus clearing the sustained fault.
66. By this stage, the Callide C4 generator and generator transformer had been destroyed. The operator's remaining staff on-site were then evacuated.
E4 Non-operation of the Automatic Changeover Switch
67. By way of additional context, on the day of the Event, an Automatic Changeover Switch (ACS), which was designed to transfer some DC systems automatically to the standby supply of DC power (i.e., the Station battery) upon a loss of the preferred supply (in this case, the C4 battery charger) of DC power, was available for manual operation but was not operated.
68. The ACS did not operate automatically as it had been rendered inoperable in automatic mode due to damage sustained in a dual unit trip incident in January 2021.
69. However, even if the ACS had operated, it may have only partially restored DC supply and not AC supply. This would not have prevented the significant damage caused by the loss of supply to the lubrication and cooling systems. However, on the restoration of DC supply, it is likely that the Y generator protection system (i.e. part of the 19.5kV plant protection system) would have responded and disconnected the C4 generating unit from the grid.
E5 Prior risk assessment
70. The operator had carried out an Operations Plant Risk Assessment on 18 January 2018 in respect of the replacement of the battery charger. However, that assessment examined only the risks associated with not replacing the Callide C4 battery charger, and did not assess the risks of carrying out the replacement itself.
E6 Compliance prior to the Event and the Deed of Service
71. As described in Part B2 above, CPT does not own or operate Callide C PS. At all relevant times, CPT traded electricity produced by the Callide C4 generating unit into the NEM, pursuant to two separate Market Trader Agreements between it and each of the JV Parties. CPT had no direct involvement in the operation of the Callide C PS at the time of the Event. The Callide Joint Venture appointed CPM as the manager of the Callide C4 generating unit and CPM, as agent for the JV Parties, separately appointed CS Energy as operator of Callide C4.
72. CPT was the Registered Participant with regulatory responsibility for compliance with r 4.15(a)(1) and cl 5.2.5(a)(1). Pursuant to a Deed of Service between CPT and CS Energy, CPT required CS Energy to undertake various steps (described in paragraph 14 above), designed to ensure the plant operated in compliance with the Callide Standards. In the present case, those steps were not sufficient to avoid the admitted contraventions.
66 CPT has admitted that it contravened r 4.15(a)(1) and cl 5.2.5(a)(1) of the NER in the above circumstances. The precise manner in which those contraventions occurred is set out in the declarations proposed by the parties (which are discussed further below). However, in broad terms, the plant and facilities did not comply with, meet or exceed cl 3.6 of the Callide Standards on 25 May 2021, by reason of the failure of the Callide C4 protection systems to disconnect the faulted elements from the power system during the battery charger replacement.