Saeul Unit 3 Reactor Trip from a Mis-Entered Position Limiter Setpoint: Which Operator Input Verification Interlock Comes First

A limiter put there to prevent a steam surge set off the protection system. Setpoint entry for a limiting function needs a verification interlock of the same grade as the protection function.

Conclusion. On September 4, 2026, the Nuclear Safety and Security Commission (NSSC) approved the restart of Saeul Unit 3 for its remaining commissioning. The cause of the automatic shutdown on August 11 was not an equipment failure but human error: during a commissioning test that disconnects transmission with the reactor at 80% power, while restoring output that had dropped to 33.9%, an operator entered the setpoint of the turbine control valve position limiter (Turbine Control Valve Position Limiter) in the direction that closes the valve.

KHNP’s recurrence prevention measures are procedure revision and special training. From the electrical and control design standpoint there is one thing to add: a procedure is a soft barrier (Soft Barrier), while direction verification, rate-of-change limiting and test mode locking at the setpoint entry stage are hard barriers (Hard Barrier). Only by putting the latter into the HMI and controller logic does the same mistake stop repeating in the same input field.

Note that this interlock does not replace or bypass the hardware trip of the reactor protection system (RPS, Reactor Protection System); it is a layer ahead of it that reduces the causes of trips.

According to the NSSC investigation results reported by E2News on September 4, 2026, the position limiter sets an upper limit on turbine control valve opening to prevent a sudden surge in the amount of steam entering the turbine. At the time, while entering a setpoint to limit an unexpected turbine generator output fluctuation, the operator entered a value in the direction that closes the valve. The investigation also confirmed that during the shutdown the emergency diesel generator (EDG, Emergency Diesel Generator) was connected to the safety bus and one of four essential chillers was started manually, and the regulator also checked whether KHNP’s actions were appropriate. KHNP revised the procedure to require re-confirmation when operating the turbine control valve position limiter and shared the case with operators at all nuclear plants.

There is one observation that is often overlooked in the field. The recovery period after power drops from 80% to 33.9% is a transient (Transient), and it is the period when operators are most in a hurry. Intuitively it seems that operations should be opened up for speed in such a period, but from a control design standpoint it is the opposite: the more transient the state, the stricter (and slower) setpoint entry verification must be. A mis-entry during normal operation ends in a gradual power change, but a mis-entry during a transient reaches protection system actuation conditions immediately.

Preconditions (based on an operating time chart): T0 transmission disconnection test starts at 80% reactor power → T1 power reaches 33.9% → T2 position limiter setpoint entered to restore power → T3 setpoint mis-entered in the closing direction → T4 automatic reactor shutdown → T5 EDG connected to safety bus, one essential chiller started manually. The time intervals between these points (ms or s), the measured valve opening (%) at the time, and the specific protection variable that triggered the shutdown (whether a turbine trip signal or a reactor thermal power mismatch) are not in the article and are therefore Items to verify. The interlock logic below covers only the T2-T3 interval of this time chart, that is, the setpoint entry stage.

Safety interlock check order (top priority)

• Confirm the RPS and turbine trip hardware paths are independent — None of the setpoint verification logic below may delay, block or bypass reactor protection system trip signals or the EMO circuit. The verification logic exists only at the input acceptance (ACCEPT) stage between the HMI and the turbine controller, and the protection system operates regardless of its result.
• Setpoint direction verification — If the new setpoint is lower than the current valve opening feedback (LVDT, Linear Variable Differential Transformer), set a “closing direction” flag, and accept only when both the operator confirmation pop-up and the two-person confirmation (Two-Person Confirmation) contact are present.
• Rate-of-change limit — Put upper limits on the allowable change in opening per entry (%) and the ramp rate (%/s). Specific values must be set by the manufacturer’s turbine control specification and the plant procedure; this post shows them only as example values.
• Test mode linkage (Permissive) — While a defined test mode such as the transmission disconnection test is active, lock out position limiter setpoint changes entirely, and enforce the sequence so that the test mode must be cleared first if a change is needed.
• Monitor the EDG safety bus connection signal — EDG automatic start and safety bus connection on reactor shutdown is separate safety-grade logic; this interlock only monitors its status (Read-Only).

Position limiter setpoint verification I/O map

The takeaway from this I/O map is clear. What caused the event was neither the valve nor the protection system but a single field, HMI_SP501, and simply attaching two existing signals, AI501 and DI501, to that field as comparison conditions filters out closing-direction mis-entries at the acceptance stage.

PLC logic snippet (IEC 61131-3 Structured Text pseudocode)

(* Turbine control valve position limiter setpoint verification interlock - HMI acceptance stage only *)
(* Caution: operates independently of RPS/turbine trip/EMO hardware paths, cannot bypass them *)
(* AI501: valve opening feedback %, AI502: reactor power %, DI501: test mode *)
(* DI502: two-person confirmation key switch, HMI_SP501: operator-entered setpoint % *)

VAR
  AI501_VALVE_POS_FB      : REAL;   (* current valve opening % *)
  AI502_RX_POWER          : REAL;   (* reactor power % *)
  DI501_TEST_MODE         : BOOL;   (* transmission disconnection test mode *)
  DI502_TWO_PERSON_KEY    : BOOL;   (* two-person confirmation contact *)
  HMI_SP501_LIMITER_REQ   : REAL;   (* operator entry % *)
  SP_LIMITER_ACTIVE       : REAL;   (* setpoint applied in controller % *)
  DO501_SP_ACCEPT         : BOOL;
  DO502_SP_REJECT_ALM     : BOOL;
  CLOSE_DIR_FLAG          : BOOL;
  DELTA_MAX_NORMAL        : REAL := 10.0;  (* example value, check manufacturer spec *)
  DELTA_MAX_TRANSIENT     : REAL := 3.0;   (* example value, tightened for transients *)
  DELTA_LIMIT             : REAL;
  TRANSIENT_FLAG          : BOOL;
END_VAR

(* 1. Transient detection: tighten rate limit if power has dropped sharply from rated *)
TRANSIENT_FLAG := (AI502_RX_POWER < 50.0);
IF TRANSIENT_FLAG THEN
  DELTA_LIMIT := DELTA_MAX_TRANSIENT;
ELSE
  DELTA_LIMIT := DELTA_MAX_NORMAL;
END_IF;

(* 2. Direction check: request below current opening means closing direction *)
CLOSE_DIR_FLAG := (HMI_SP501_LIMITER_REQ < AI501_VALVE_POS_FB);

(* 3. Accept conditions: test mode OFF, within change limit, two-person key required if closing *)
DO501_SP_ACCEPT := NOT DI501_TEST_MODE
  AND (ABS(HMI_SP501_LIMITER_REQ - AI501_VALVE_POS_FB) <= DELTA_LIMIT)
  AND (NOT CLOSE_DIR_FLAG OR DI502_TWO_PERSON_KEY);

(* 4. Update controller setpoint only on accept, otherwise raise reject alarm *)
IF DO501_SP_ACCEPT THEN
  SP_LIMITER_ACTIVE := HMI_SP501_LIMITER_REQ;
  DO502_SP_REJECT_ALM := FALSE;
ELSE
  DO502_SP_REJECT_ALM := TRUE;   (* rejection reason shown separately as HMI message *)
END_IF;

(* RPS trip (DI503) and EDG connection (DI504) are read-only in this logic - no branches on them *)

Boundary conditions: dealing with field variables

The point where this interlock’s advantage flips is clear. If closing-direction entry is designed as a “block”, then in a situation that genuinely needs a rapid load reduction (Load Runback), operator action is delayed and the design becomes more dangerous, not less. That is why the logic above does not block the closing direction but requires “confirmation”, and whether it conflicts with the automatic runback sequence already built into the manufacturer’s turbine controller must be confirmed by waveform analysis and field measurement during commissioning.

The details of Saeul Unit 3’s actual control logic, the measured valve opening at the time and the protection variable that triggered the shutdown have not been disclosed, so the figures in this post are examples and remain Items to verify. For reference, the NSSC plans to introduce a continuous inspection system that checks nuclear plant safety even during operation from January 2027 (Money Today, 2026-09-01), and this kind of setpoint verification history is a record item likely to be required under continuous inspection.

References
E2News, “Saeul 3 commissioning shutdown was operator error… NSSC approves restart” (2026-09-04) (Korean)
Money Today, “‘Next-generation SMR commercialisation on the line’: NSSC to invest KRW 303 billion next year” (2026-09-01) (Korean)
KR100575204B1, Korea Electric Power Corporation (all rights transferred to Korea Hydro & Nuclear Power in 2012), “Triple-redundant digital turbine control system for controlling the turbine system of a power plant” — filed 2004-07-30, registered 2006-04-28, term expired 2024-07-30 (per Google Patents). It claims a configuration that prevents operator errors in the operation monitoring and control GUI, with the valve opening control program controlling opening using the final selected value; it is cited here only as prior art for the interlock in this post.