When the safeguard has a delay built in: lessons from the Callide C3 clinker report

CS Energy’s investigation report into the Callide Unit C3 clinker incident resurfaced in industry feeds this week. The report is not new — the incident occurred on 4 April 2025 and CS Energy published its findings later that year — and Callide is a coal-fired power station, not a chemical process plant. But the failure architecture it describes is one any HAZOP team will recognise, and one of its findings goes straight to the heart of how a study room credits a safeguard.

What happened

On 4 April 2025, a large clinker — a mass of hardened ash — detached from the boiler wall of Unit C3 at the Callide C Power Station in central Queensland. The event took the unit out of service and was serious enough that CS Energy notified Workplace Health and Safety Queensland the same day. The company commissioned both an internal root-cause analysis and an independent external investigation.

The conclusion was blunt. In CS Energy’s own words, the incident “was not isolated or unforeseeable, but the result of long-standing and systemic weaknesses in technical safeguards, operational controls, leadership oversight and safety governance.” The report identified ineffective clinker management — particularly around deloading — as the root of the physical event, with contributing factors that read like a process-safety-management checklist run in reverse: design flaws in the control-system logic, inadequate risk control, poor planning and governance, operator shortages, and gaps in process-safety training. It also concluded that progress in embedding process safety across the organisation had, to that point, been inadequate.

The finding worth carrying into a HAZOP

The detail most relevant to facilitators is the control logic. The report describes timing delays that had been built into the flame-scanner control logic — delays that slowed the protective shutdown of the unit. As part of the corrective actions, CS Energy states those timing delays have been removed.

That is a safeguard that existed, was credited, and yet did not act when it needed to — because of how it had been configured, not whether it was present. It is the single most transferable lesson here. A PHA team can tick a trip or interlock as an independent protection layer and move on, but the protection lives in the behaviour of that function: the trip settings, the voting arrangement, the time delays, the bypass and defeat provisions, and the maintenance and testing that keep it honest. A delay quietly inserted for operability reasons can defeat the very scenario the layer was credited against, and it will not show up unless someone asks how the function actually behaves.

Two other threads generalise cleanly. The clinker-and-deloading story is the familiar pattern of a known operational nuisance managed by workaround until the workaround runs out of margin — the kind of routine deviation that deserves a hard look on any node where a fouling, buildup or accumulation mechanism is in play. And the report’s headline recommendation — “operationalising process safety,” meaning frontline critical-control tools, signal awareness, reporting and execution — names the gap between a closed-out action item and a control that actually works on shift. Revalidation teams see that gap whenever a safeguard is credited on paper while the testing and maintenance behind it have drifted.

The primary source is CS Energy’s incident findings release and its earlier detail on the incident; secondary coverage with additional analysis is at The Chemical Engineer and Energy Source & Distribution.