When a Turbine-Generator Protection Signal Stops the Reactor: What Plant Protection Interlocks Monitor First

At about 8:50 a.m. on August 19, 2026, the reactor at Hanul Unit 4 (1,000 MW class) in Uljin, Gyeongbuk, shut down automatically. According to Korea Hydro & Nuclear Power (KHNP), the turbine was stopped by a turbine-generator protection signal, the plant protection system actuated, and the reactor followed it into shutdown. There were no abnormal radiation monitor alarms and no external release, the plant is being held in a stable state, and the Nuclear Safety and Security Commission (NSSC) has dispatched an investigation team from the Korea Institute of Nuclear Safety (KINS) to the site to determine the detailed cause.

The conclusion first: the interlock design principle this event illustrates is clear — a single protection signal from the turbine-generator system cascading into a reactor trip, with nothing wrong in the reactor itself, is not a design flaw. It is the defense-in-depth principle working as intended, treating the turbine-generator as the final load in the core heat-removal path.

A turbine trip cascading into a reactor trip is not a malfunction. It is the design premise — that the turbine is the final load in the core heat-removal path — working as intended.

Preconditions: As of August 19, 2026, KHNP and the NSSC had not disclosed the detailed cause, including which turbine-generator protection signal was involved (overspeed, low vacuum, bearing vibration, generator differential protection, etc.), and the KINS investigation is ongoing. The checklist below is not the actual logic of Hanul Unit 4; it develops the general turbine-trip-to-reactor-trip coupling principles of a pressurized water reactor (PWR) plant on the basis of reactor protection system (RPS) design concepts. The actual trip signal source and logic setpoints are separated as items to verify until KINS publishes its findings.

Safety interlock check sequence (highest priority)

1. Turbine protection signal detected — if any of overspeed, low vacuum, excessive bearing vibration or generator differential protection (87G) is confirmed, close the turbine stop valves and open the generator circuit breaker (GCB)
2. Turbine-trip-to-reactor-trip coupling interlock (P-8 equivalent gating) — if a turbine trip occurs while reactor power is at or above the setpoint, a trip demand signal is sent to the reactor protection system (RPS). In the low-power range there is margin to handle residual heat, so this coupling may not engage automatically (setpoints differ by plant)
3. Reactor trip breakers (RTB) open — when the redundant logic (e.g., 2-out-of-4) is satisfied, the control rods drop (SCRAM)
4. Residual heat removal start interlock — after reactor shutdown, confirm the conditions for starting the auxiliary feedwater system (AFW) for decay heat removal and for monitoring steam generator level
5. EMO (emergency off) — the principle is that the hardwired manual reactor trip switch opens the RTBs directly without passing through RPS logic; designs that replace or bypass this function with software logic alone are not covered on this site.

Turbine-trip-to-reactor-trip coupling checklist (I/O map, general concept example)

The implication of this checklist is clear. AI403 (reactor power) must be wired as the gating signal that decides whether a trip from DI401 (generator protection signal) is valid. Not cascading a turbine trip into a reactor trip in the low-power range is not a relaxation of safety; it is a design optimization that reduces unnecessary reactor trips (spurious trips) under conditions where there is margin to handle residual heat.

PLC logic snippet (IEC 61131-3 Structured Text pseudocode, general concept example)

(* Turbine-trip-to-reactor-trip coupling logic (general concept example, not actual plant setpoints) *)
(* AI401: turbine bearing vibration, AI402: turbine low vacuum, DI401: generator differential protection (87G) *)
(* AI403: reactor power (%), DI402: reactor trip breaker (RTB) status *)
IF DI401 = 1 THEN
 DO_TURBINE_STOP_VALVE_CLOSE := TRUE; (* generator protection signal confirmed with top priority, stop turbine immediately *)
 DO_GENERATOR_BREAKER_OPEN := TRUE;
ELSIF AI401 > 125.0 OR AI402 < 20.0 THEN
 DO_TURBINE_STOP_VALVE_CLOSE := TRUE; (* vibration or vacuum abnormal *)
END_IF;

IF DO_TURBINE_STOP_VALVE_CLOSE = TRUE AND AI403 >= 15.0 THEN
 DO_REACTOR_TRIP_REQUEST := TRUE; (* couple to reactor trip only at 15% power or above, P-8 equivalent gating *)
ELSE
 DO_REACTOR_TRIP_REQUEST := FALSE; (* low-power range, residual heat margin available, no coupling *)
END_IF;

Boundary conditions — handling field variables

The actual type of turbine-generator protection signal at Hanul Unit 4, its setpoints, and the reactor power value used for reactor-trip coupling gating had not been disclosed in detail by KHNP or the NSSC as of August 19, 2026, and they are held as items to verify until KINS publishes its findings. The I/O addresses and setpoints above illustrate general PWR design concepts and are not the actual specifications of Hanul Unit 4 — this requires waveform analysis and field measurement. The selection criterion narrows to one: at the moment of the turbine trip, was reactor power above the reactor-trip coupling gating setpoint (P-8 equivalent)?

References

Herald Economy, “Hanul Unit 4 reactor shuts down automatically… stable state maintained” (2026.08.19)
Financial News, “NSSC launches investigation into Hanul Unit 4 ‘automatic reactor shutdown’… ‘stable state maintained'” (2026.08.19)
US11069450B2, NuScale Power LLC / Paragon Energy Solutions LLC, “Nuclear reactor protection systems and methods” (Google Patents)