Conclusion. At 3:01 p.m. on September 6, 2026, KHNP’s Saeul Nuclear Power Site manually shut down the reactor of Saeul Unit 3 (1,400 MW class), which is in commissioning. According to the Saeul site, a leak was found in the piping that drains condensate from the steam supplied to the turbine, and the reactor was manually shut down to stabilize the equipment and carry out maintenance. The Saeul site said there was no radiological impact and the plant remains in a stable state.
The conclusion from an electrical design standpoint is this: the event was not a primary-to-secondary boundary leak in the reactor coolant system (RCS) or steam generator tubes, but a mechanical leak in secondary-side condensate piping between the turbine and the condenser. That means it lies outside the detection range of the radiation monitoring system (RMS), which uses radionuclides as its indicator, and so this kind of piping needs level- and differential-pressure-based automatic interlocks installed independently of radiation monitoring in order to reduce reliance on operators’ visual checks and rounds.
Because the radiation monitoring system uses nuclides of primary-side origin as its indicator, a leak in secondary-side pure condensate piping, where no nuclides are mixed in, is outside its monitoring range to begin with. This blind spot can only be covered by separate level and differential-pressure interlocks.
Some background. Saeul Unit 3 is a 1,400 MW-class plant currently in the commissioning phase, going through system-by-system performance tests in sequence before commercial operation. Steam supplied to the turbine spins the generator, then is cooled and condensed in the condenser; this condensate returns through drain piping to the feedwater pumps and recirculates to the steam generator. The Saeul site said only that it had confirmed a leak in this condensate drain piping; the exact location of the leak, the pipe size, the leak rate, and the detection method (whether it was a level switch indication or a visual find during rounds) are not in the released materials. It is confirmed only that the detailed cause is under analysis. These points remain items to verify.
There is one counterintuitive observation from the field. When people think of leak monitoring at a nuclear plant, they usually think first of the radiation monitoring system (RMS) or steam generator tube leak monitoring (the primary-to-secondary boundary, using nuclide indicators such as Ar-41 and N-16). But a condensate piping leak in the pure secondary system downstream of the condenser, like this one, has nothing to do with radionuclides, so no matter how densely sophisticated radiation instruments are deployed, they will not detect it. The counterintuitive lesson of this event is that for exactly this kind of piping, interlocks based on mechanical signals such as level, differential pressure and flow mismatch need to be raised to the same priority as the radiation monitoring system.
Premise (based on an operating time chart). Only three facts are public: the shutdown time (15:01), the reason for the shutdown (a leak in condensate drain piping), and the outcome (no radiological impact, plant remains stable). When the leak started (T0), how long detection took, and whether an automatic alarm came first or operator judgment did, have not been disclosed. The logic and I/O map below are not the actual equipment logic of Saeul Unit 3; they are an illustrative reconstruction of interlock design principles generally applied to this type of condensate piping leak.
Normal operation (condenser hotwell level and pipe differential pressure normal) → T0 pipe leak occurs (unknown) → T1 level/differential-pressure anomaly signal, or visual find during rounds → T2 operator judgment and manual shutdown action (officially announced time 15:01) → T3 isolation valves closed, pipe drained → T4 cause analysis begins (in progress, completion date unknown).
Safety interlock verification order (top priority)
- Verify independence of hardware protection paths — turbine trip, the EMO (Emergency Off) circuit, and the reactor protection system (RPS) low-level and low-pressure trips must operate independently of any condensate pipe leak detection logic, and no software judgment may delay, block or bypass these hardware paths.
- Grade separation — minor anomalies in pipe differential pressure or level (diagnostic grade) and hotwell low level or loss of condenser vacuum (protection grade) are separated onto different output contacts. A diagnostic-grade alarm does not substitute for a protection-grade trip.
- Dual instrumentation check — a leak is not judged from a single level switch signal but cross-checked with two or more independent signals, such as a differential pressure gauge and flow mismatch (return flow versus feedwater pump inflow).
- Verify isolation valve redundancy — isolation valves on the leaking pipe must allow both remote and local manual operation, and a local operation procedure must be specified for when remote operation fails.
- Specify return conditions — the restart interlock must not release automatically until isolation, draining and inspection are complete and pipe integrity is confirmed. Restart requires a manual reset and an inspection sign-off.
Condensate pipe leak monitoring I/O map (example)
| Signal | I/O address | Type | Operating condition |
|---|---|---|---|
| Condenser hotwell level | LI701 | Analog In (mm) | Diagnostic-grade alarm when outside normal range |
| Condensate pipe differential pressure | PDI702 | Analog In (kPa) | Supports leak-suspect judgment on deviation from reference |
| Feedwater pump inflow | FI703 | Analog In (t/h) | Cross-compared with pipe return flow |
| Pipe return flow | FI704 | Analog In (t/h) | Shortfall versus FI703 is the leak estimate |
| Isolation valve remote status | DI705 | Digital In | OPEN/CLOSE status monitoring, read-only |
| Isolation valve remote close command | DO706 | Digital Out | Close after operator approval if diagnostic alarm persists |
| Condenser hotwell low-level trip | DI707 | Digital In (read-only) | Protection grade, no intervention by this diagnostic logic |
| Turbine trip status | DI708 | Digital In (read-only) | Protection grade, driven only by hardware path |
The takeaway from this I/O map fits in one line. However precise PDI702, FI703 and FI704 are, DO706 (isolation valve close) must be designed to go through an operator approval step, and this diagnostic logic must not intervene in any form in the DI707 and DI708 (protection grade) trip paths.
PLC logic snippet (IEC 61131-3 Structured Text pseudocode)
(* Condensate pipe leak diagnostic logic - diagnostic grade only, fully separated from protection grade (DI707/DI708) *)
(* Note: this is not the actual equipment logic of Saeul Unit 3; it illustrates general design principles *)
(* PDI702: pipe differential pressure kPa, FI703/FI704: inflow/return flow t/h, DO706: isolation valve close command *)
VAR
PDI702_DP_KPA : REAL; (* pipe differential pressure *)
FI703_IN_TPH : REAL; (* feedwater pump inflow *)
FI704_RET_TPH : REAL; (* pipe return flow *)
DI705_VALVE_OPEN : BOOL; (* isolation valve open status *)
DI707_HOTWELL_LOLO : BOOL; (* hotwell low-low level trip, read-only *)
OPERATOR_CONFIRM : BOOL; (* operator approval input *)
DO706_VALVE_CLOSE : BOOL;
LEAK_EST_TPH : REAL; (* estimated leak rate *)
DP_THRESHOLD : REAL := 5.0; (* example value, verify by field measurement per pipe spec *)
LEAK_THRESHOLD_TPH : REAL := 2.0; (* example value, verify by field measurement *)
T_HOLD : TON; (* anomaly persistence timer *)
END_VAR
(* 1. Estimate leak rate from flow mismatch *)
LEAK_EST_TPH := FI703_IN_TPH - FI704_RET_TPH;
(* 2. Diagnostic alarm only when differential pressure and flow both agree and persist for a set time *)
T_HOLD(IN := (PDI702_DP_KPA > DP_THRESHOLD) AND (LEAK_EST_TPH > LEAK_THRESHOLD_TPH),
PT := T#10000ms);
(* 3. Isolation valve close requires both a persistent diagnostic alarm and operator approval *)
IF T_HOLD.Q AND OPERATOR_CONFIRM THEN
DO706_VALVE_CLOSE := TRUE;
ELSE
DO706_VALVE_CLOSE := FALSE;
END_IF;
(* 4. Protection-grade paths are only read here; no branch in this logic intervenes *)
(* DI707_HOTWELL_LOLO and turbine trip (DI708) are handled independently by the hardware protection system *)
Boundary conditions: dealing with field variables
Where the advantage of this design principle flips is in the actual measured values. Set the pipe differential pressure and flow thresholds too low, and diagnostic alarms fire frequently on minor fluctuations during normal operation, which can train operators to ignore them; set them too high, and a leak may be detected only after it has progressed considerably, as in this Saeul Unit 3 case. Thresholds can be fixed only after the pipe specification and the normal operating fluctuation range have been measured in the field, and every figure given here is an example value. In addition, the actual cause, onset time and detection method of the Saeul Unit 3 leak remain items to verify until the Saeul site issues a follow-up announcement, and any unconfirmed details should be concluded only through waveform analysis and field measurement.
References
- Electric Times, “Saeul Unit 3 finds pipe leak during commissioning … reactor manually shut down” (2026-09-06, 21:27, citing a press release from KHNP Saeul Nuclear Power Site)
- Asia Economy, “Pipe leak during Saeul Unit 3 commissioning … reactor manually shut down” (2026-09-06, 19:42)
- KR100960787B1 (published as KR20090120305A), Korea Electric Power Corporation (rights transferred to KHNP and others), “Apparatus and method for detecting leakage in steam generators of nuclear power plants” — filed 2008-05-19, registered 2010-06-01; legal status per Google Patents: Ceased (lapsed 2022-05-06). This patent detects primary-to-secondary coolant leakage through steam generator tubes using gamma radiation (Ar-41), and its detection target and mechanism differ from the Saeul Unit 3 condensate drain pipe leak (a pure secondary-system event unrelated to radionuclides). It is cited only as background technology for nuclear plant leak monitoring in general.
