NRC Reviewer Aid for 

Evaluating the HumanPerformance Aspects 

Related to the Design and 

Operation of Small 

Modular Reactors

Office of Nuclear Regulatory Research

NUREG/CR-7202

BNL-96809-2012
AVAILABILITY OF REFERENCE MATERIALS

IN NRC PUBLICATIONS

NRC Reference Material

As of November 1999, you may electronically access 

NUREG-series publications and other NRC records at 

NRC’s Library at www.nrc.gov/reading-rm.html. Publicly 

released records include, to name a few, NUREG-series

publications; Federal Register notices; applicant, 

licensee, and vendor documents and correspondence; 

NRC correspondence and internal memoranda; bulletins 

and information notices; inspection and investigative 

reports; licensee event reports; and Commission papers 

and their attachments.

NRC publications in the NUREG series, NRC regulations, 

and Title 10, “Energy,” in the Code of Federal Regulations

may also be purchased from one of these two sources.

1. The Superintendent of Documents

U.S. Government Publishing Office

Mail Stop IDCC

Washington, DC 20402-0001

Internet: bookstore.gpo.gov

Telephone: (202) 512-1800

Fax: (202) 512-2104

2. The National Technical Information Service

5301 Shawnee Rd., Alexandria, VA 22312-0002

www.ntis.gov

1-800-553-6847 or, locally, (703) 605-6000

A single copy of each NRC draft report for comment is

available free, to the extent of supply, upon written

request as follows:

Address: U.S. Nuclear Regulatory Commission

Office of Administration

Publications Branch

Washington, DC 20555-0001

E-mail: distribution.resource@nrc.gov

Facsimile: (301) 415-2289

Some publications in the NUREG series that are posted 

at NRC’s Web site address www.nrc.gov/reading-rm/

doc-collections/nuregs are updated periodically and may 

differ from the last printed version. Although references to 

material found on a Web site bear the date the material 

was accessed, the material available on the date cited 

may subsequently be removed from the site.

Non-NRC Reference Material

Documents available from public and special technical 

libraries include all open literature items, such as books, 

journal articles, transactions, Federal Register notices, 

Federal and State legislation, and congressional reports. 

Such documents as theses, dissertations, foreign reports 

and translations, and non-NRC conference proceedings 

may be purchased from their sponsoring organization.

Copies of industry codes and standards used in a

substantive manner in the NRC regulatory process are 

maintained at—

The NRC Technical Library

Two White Flint North

11545 Rockville Pike

Rockville, MD 20852-2738

These standards are available in the library for reference 

use by the public. Codes and standards are usually 

copyrighted and may be purchased from the originating 

organization or, if they are American National Standards, 

from—

American National Standards Institute

11 West 42nd Street

New York, NY 10036-8002

www.ansi.org

(212) 642-4900

Legally binding regulatory requirements are stated only in 

laws; NRC regulations; licenses, including technical specifications; or orders, not in NUREG-series publications. The 

views expressed in contractorprepared publications in this 

series are not necessarily those of the NRC.

The NUREG series comprises (1) technical and administrative reports and books prepared by the staff (NUREG–

XXXX) or agency contractors (NUREG/CR–XXXX), (2) 

proceedings of conferences (NUREG/CP–XXXX), (3) reports 

resulting from international agreements (NUREG/IA–XXXX), 

(4) brochures (NUREG/BR–XXXX), and (5) compilations of 

legal decisions and orders of the Commission and Atomic 

and Safety Licensing Boards and of Directors’ decisions 

under Section 2.206 of NRC’s regulations (NUREG–0750).

DISCLAIMER: This report was prepared as an account 

of work sponsored by an agency of the U.S. Government. 

Neither the U.S. Government nor any agency thereof, nor 

any employee, makes any warranty, expressed or implied, 

or assumes any legal liability or responsibility for any third 

party’s use, or the results of such use, of any information, 

apparatus, product, or process disclosed in this publication, 

or represents that its use by such third party would not 

infringe privately owned rights.
NRC Reviewer Aid for 

Evaluating the HumanPerformance Aspects 

Related to the Design and 

Operation of Small Modular 

Reactors

Manuscript Completed: April 2015

Date Published: June 2015

Prepared by

John O’Hara & Jim Higgins, BNL

Amy D’Agostino, NRC

Brookhaven National Laboratory 

Building 130 

Upton, NY 11973

Prepared for: 

Division of Risk Analysis 

Office of Nuclear Regulatory Research 

U.S. Nuclear Regulatory Commission 

Washington, DC 20555-0001

 

Amy D’Agostino, NRC Project Manager

Office of Nuclear Regulatory Research

NUREG/CR-7202

BNL-96809-2012

ABSTRACT

Small modular reactors (SMRs) are a potential approach to meeting future energy needs. 

Although the electrical output of an individual SMR is relatively small compared to that of typical 

commercial nuclear plants, they can be grouped to produce as much energy as a utility 

demands. Furthermore, SMRs can be used for other purposes, such as producing hydrogen 

and generating process heat. The design characteristics of many SMRs differ from those of 

current conventional plants and may require a distinct concept of operations (ConOps). The

U.S. Nuclear Regulatory Commission (NRC) conducted research to examine the human factors 

engineering (HFE) and the operational aspects of SMRs captured in Human-Performance 

Issues Related to the Design and Operation of Small Modular Reactors (NUREG/CR-7126). 

The research identified thirty potential human-performance issues that should be considered in 

the NRC’s reviews of SMR designs and in future research activities. While the main focus was 

on HFE, the analysis identified a number of issues in other areas, such as operational programs 

and probabilistic risk assessment. The work was intended to sensitize reviewers to potential 

new design aspects that may impact safety.

The main purpose of this report is to provide a supplemental document to NUREG/CR-7126 to 

support NRC HFE reviews. As noted above, it also contains information that may be useful to 

non-HFE reviewers. The document identifies questions that can be asked of applicants whose 

designs have characteristics identified in the issues. The questions for each issue were 

identified and organized based on the review elements and guidance contained in Chapter 18 of 

the Standard Review Plan (NUREG-0800), and the Human Factors Engineering Program 

Review Model (NUREG-0711).

iii

TABLE OF CONTENTS

ABSTRACT...............................................................................................................................iii

LIST OF TABLES.....................................................................................................................vii

ABBREVIATIONS .....................................................................................................................ix

1 INTRODUCTION.................................................................................................................. 1

2 ADDRESSING POTENTIAL HUMAN-PERFORMANCE ISSUES DURING SAFETY

 REVIEWS ............................................................................................................................ 3

2.1 New Missions............................................................................................................. 5

2.2 Novel Designs and Limited Operating Experience from Predecessor Systems .......... 7

2.3 Multi-unit Operations and Teamwork.......................................................................... 7

2.4 High Levels of Automation for All Operations and its Implementation......................... 9

2.5 Function Allocation Methodology to Support Automation Decisions ..........................11

2.6 New Staffing Positions ..............................................................................................12

2.7 Staffing Models .........................................................................................................13

2.8 Staffing Levels ..........................................................................................................14

2.9 Different Unit States of Operation..............................................................................16

2.10 Unit Design Differences.............................................................................................17

2.11 Operational Impact of Control Systems for Shared Aspects of SMRs........................18

2.12 Impact of Adding New Units While Other Units are Operating...................................19

2.13 Managing Non-LWR Processes and Reactivity Effects .............................................20

2.14 Load-following Operations.........................................................................................21

2.15 Novel Refueling Methods ..........................................................................................23

2.16 Control Room Configuration and Workstation Design for Multi-unit Teams ...............24

2.17 HSI Design for Multi-unit Monitoring and Control.......................................................26

2.18 HSIs for New Missions ..............................................................................................27

2.19 Safety Function Monitoring........................................................................................28

2.20 Potential Impacts of Unplanned Shutdowns or Degraded Conditions of One Unit on 

Other Units................................................................................................................29

2.21 Handling Off-normal Conditions at Multiple Units ......................................................30

2.22 Design of Emergency Operating Procedures (EOPs) for Multi-unit Disturbances......31

2.23 New Hazards ............................................................................................................32

2.24 Passive Safety Systems............................................................................................33

2.25 Loss of HSIs and Control Room................................................................................35

2.26 Probabilistic Risk Assessment Evaluation of Site-wide Risk......................................36

2.27 Identification of Important Human Actions when One Operator/Crew is Managing 

Multiple SMRs...........................................................................................................37

2.28 Modular Construction and Component Replacement ................................................38

2.29 New Maintenance Operations ...................................................................................38

2.30 Managing Maintenance Hazards...............................................................................39

3 CONCLUSION....................................................................................................................41

4 REFERENCES ...................................................................................................................43

APPENDIX A QUESTIONS FOR SMR APPLICANTS ORGANIZED BY NUREG-0711

 ELEMENT .....................................................................................................A-1

v

LIST OF TABLES

Table 2-1 NUREG-0711 Elements Impacted by Potential SMR Issues ..................................... 4

Table 2-2 Levels of Automation................................................................................................10

vii

ABBREVIATIONS

AC alternating current

ANS American Nuclear Society

BNL Brookhaven National Laboratory

BOP balance of plant

CBP computer based procedure

CD core damage

CFR Code of Federal Regulations

CONOPS concept of operations

DC direct current

DOE Department of Energy

EOP Emergency Operating Procedure

EP emergency planning

FA function allocation

FRA functional requirements analysis

GDC General Design Criteria

GT-MHR Gas Turbine-Modular Helium Reactor 

HA human action

HFE human factors engineering

HPM Hyperion Power Module

HRA human reliability analysis

HSI human-system interface

HTGR High-temperature Gas-cooled Reactor

IAEA International Atomic Energy Agency

I&C instrumentation and control

ICU intensive care unit

IHA important human actions

INL Idaho National Laboratory

IRIS International Reactor Innovative and Secure 

LMR liquid-metal reactor

LWR light water reactor

MCR main control room

NPP nuclear power plant

NRC Nuclear Regulatory Commission

NUREG NRC technical report designation

NUREG CR NUREG contractor report

OER operating experience review

PBMR Pebble Bed Modular Reactor

PD procedure development

PPE personal protective equipment

PRA probabilistic risk assessment

PRISM Power Reactor Innovative Small Module

RB refueling bridge

RCP 

RG

RIHA

RO

reactor coolant pumps

regulatory guides

risk important human action

reactor operator

SA situational awareness

SG steam generators

SMR small modular reactor

ix
SPDS safety parameter display system

SRO senior reactor operator

SRP standard review plan

STA shift technical advisor

S&Q staffing and qualifications

TA task analysis

T&E testing and evaluation

TPD training program development

UAV unmanned aerial vehicle

V&V verification and validation

x
1 INTRODUCTION

Small modular reactors (SMRs) are a potential approach to meeting future energy needs. 

Although the electrical output of an individual SMR is relatively small compared to that of typical 

US commercial nuclear plants (NPPs), they can be grouped to produce as much energy as a 

utility demands. Furthermore, SMRs can be used for other purposes, such as producing 

hydrogen and generating process heat. While much information on concept of operations 

(ConOps) aspects of SMRs is in the preliminary stages, there are key differences between 

SMRs and current NPPs that have the potential to impact human performance.

To address these differences, the U.S. Nuclear Regulatory Commission (NRC) conducted 

research to examine the design and operation of SMRs and identify potential issues that may 

impact human performance. In Human-Performance Issues Related to the Design and 

Operation of Small Modular Reactors (NUREG/CR-7126), an HFE- focused model to identify all 

information needed to understand SMR ConOps was developed. The model dimensions 

include: plant mission, agents’ roles and responsibilities, staffing qualifications and training, 

management of normal operations, management of off-normal conditions and emergencies and 

management of maintenance and modifications1

. We identified a set of 30 potential humanperformance issues that fall into the model dimensions to be considered in research and 

regulatory reviews of SMRs (NUREG/CR-7126,O’Hara, Higgins, & Pena, 2012). Since 

individual SMR designs differ from each other, not all issues described below pertain to all 

designs. Additionally, some of the issues identified are not solely related to SMRs (e.g., passive 

systems, non-LWR technology) however, they were included because they will have to be 

addressed in SMR licensing reviews.

One general conclusion from the research was that the identified issues have implications for 

the NRC’s HFE regulations and design review guidance. For example, the HFE review 

guidance for integrated system validation may need to be modified to address SMRs by 

including multi-unit simulation. Until additional guidance is available, NRC technical staff can 

use existing information about the potential human-performance issues to support their safety 

evaluations. 

The staff’s HFE reviews are guided by the following documents:

- Chapter 18, HFE, of the Standard Review Plan (SRP), NUREG-0800 (NRC, 2007)

- Human Factors Engineering Program Review Model , NUREG-0711, Rev 3 (O’Hara et 

al., 2012)

- Human-system Interface Design Review Guidelines, NUREG-0700, Rev 2(O’Hara et al., 

2002)

The review process can accommodate the evaluation of novel technology and new operational 

approaches using a variety of strategies until enhanced review guidance becomes available. 

For example, knowledge of key SMR issues provides reviewers with information about what 

questions to ask SMR design applicants. Knowing what questions to ask is one vital aspect of 

conducting a design review. The selection of such questions is typically guided by the NRCs 

primary HFE guidance documents listed above. However, knowledge of important aspects of 

the design that might impact performance can also provide a basis for seeking information 

1 For more information about the HFE-focused ConOps model, see NUREG/CR-7126

1

 
about it. The human-performance issues identified in NUREG/CR-7126 provide some of these 

information needs for SMRs. 

The information provided by applicants in response to the NRC staff’s questions can be 

evaluated by:

• adapting existing criteria, e.g., from NUREG-0711 and NUREG-0700

• extrapolating best practices from general HFE principles, such as are presented in 0700, 

Appendix A 

• examining an applicant’s tests and evaluations (T&E) that demonstrate the acceptability of a 

new technology or operational approach (T&E is built into the NUREG-0711 HFE review 

process; test results can be a good substitute for deterministic review criteria.)

• ensuring the integrated system validation (ISV) addresses all issues for which limited 

guidance is available, so they are evaluated in an integrated-systems manner using 

comprehensive performance measurement

The purpose of this report is to support staff reviews2 of SMR applications by identifying some of 

the questions that can be asked of applicants whose designs have characteristics identified in 

the issues. It is intended as a supplemental document to NUREG/CR-7126.

2 While the main focus was on HFE, the analysis identified a number of issues in other areas, such as 

operational programs and probable risk assessment.

2

 
2 ADDRESSING POTENTIAL HUMAN-PERFORMANCE ISSUES

 DURING SAFETY REVIEWS

In this section, each of the SMR related human-performance issues is described, followed by its 

implication for HFE safety reviews using NUREG-0711. The issue descriptions come directly 

from NUREG/CR-7126, with some slight modifications to better suit the purpose of this report. 

For each of the issues, we identify the NUREG-0711 elements impacted; and, where possible, 

suggest the questions and information that may be needed to better understand how the 

applicant’s design addresses the issue. We identified questions for the following NUREG-0711 

elements:

- Operating Experience Review (OER)

- Functional Requirements Analysis and Function Allocation (FRA/FA)

- Task Analysis (TA)

- Staffing and Qualifications (S&Q)

- Treatment of Important Human Actions (IHA)

- Human-system Interface Design (HSI)

- Procedure Development (PD)

- Training Program Development (TPD)

- Human Factors Verification and Validation (V&V)

These elements address considerations that are related to SMR issues. Note that no specific 

questions were identified for the HFE Program Management element. This element addresses 

overall program management and, therefore, is not technology specific. Thus it applies to 

SMRs just as it would to any other application. There are also no questions for the Design 

Implementation and Human Performance Monitoring elements. These elements are similarly 

technology independent and are only related to post design factors. As such, the guidance 

applies to SMRs, just like it would to any other plant. 

Table 2-1 provides an overview of the relationship between the HFE-focused ConOps model

described above, potential SMR human-performance issues and the NUREG-0711 elements. 

An “x” indicates that there are questions associated with the SMR issue identified in the row that 

pertain to the NUREG-0711 element listed in the column. We could have generated questions 

for each review element for many, if not all, of these issues. For example, for the SMR issue of 

New Hazards, one can ask what the operating experience relative to that hazard is, how tasks

would be handled for the hazard, what new qualification (if any) are needed to deal with the 

hazard, etc. We felt many of these types of questions would be routinely picked up in the HFE 

review. Thus, we instead focused on the key aspects of the issues and identified questions 

accordingly. 

We note that the issues vary in their degree of abstraction. Some, like New Missions, are 

higher-level. These types of issues tend to be cross-cutting and impact many NUREG-0711 

review elements. Others, such as Safety Function Monitoring, are more specifically focused on 

a detailed aspect of the design. Such issues tend to impact fewer elements. 

3
There are also recurring themes in the questions when one looks across the issues, such as the 

need to address an issue in validation. Thus there is some redundancy in the questions.

Table 2-1 NUREG-0711 Elements Impacted by Potential SMR Issues

While section 2 of the report presents the questions organized by SMR issue, all of the 

questions are reorganized by NUREG-0711 elements in Appendix A. Since HFE reviews are 

organized by the NUREG-0711 elements, the appendix may be more useful to reviewers than 

the issue organization presented in this Section. The appendix cross references the SMR issue 

associated with each question should the reviewer need additional information. 

The questions are intended to support NRC technical review staff in applying the information 

gained from the SMR research documented in NUREG/CR-7126. The questions identified 

herein are not intended to be comprehensive, e.g., an issue may have implications for a 

NUREG-0711 element or other guidance documents that is not identified. Further, it is possible 

that an implication we identify is not applicable to a specific design due to its unique 

characteristics. Thus the reviewer should use this information with these caveats in mind. 

Further, we emphasize that this document does not contain HFE review guidance. Where we 

suggest that information be obtained in connection with a specific NUREG-0711 review criterion, 

it is only a suggestion to be used at the discretion of the reviewer.

OER FRA/FA TA S&Q IHA HSI PD TPD V&V

ConOps Model Dimension SMR Issue

New Mission x x x x x x x x

Novel Design and limited OE x

Multi-Unit Operations and Teamwork x x x x x

High Levels of Automation x x x x

Function Allocation Methodology x

New Staffing Positions x x

Staffing Models x x

Staffing Levels x x

Different Unit States of Operation x x x x

Unit Design Differences x x x

Control System for Shared Aspects of SMRs x x

Impact of Adding New Units on Operations x x

Non-LWR Processes and Reactivity Effects x x x x x

Load-following Operations x x x x x x x

Novel Refuleing Methods x x x x x x x

Control Room Configuration and Workstation Design x x

HSI Design for Multi-unit Monitoring and Control x x

HSIs for new missions x x

Safety Function Monitoring x x x

Unplanned Shutdowns and Degraded Conditions x x x x x

Handling Off-normal Conditions at Multiple Sites x x x x x

Design of EOPsfor Multi-unit Disturbances x x

New Hazards x x x x x

Passive Safety Systems x x x x x

Loss of HSIs and Control Room x x x x

PRA evaluation of Site-wide Risk x

Identification of RIHAs x x x x x

Modular Concturctions and Replacement x

New Maintenance Operations x x x x x

Managing Novel Maintenance Hazards

Management of Off-normal 

Conditions and Emergencies

Management of Maintenance 

and Modifications

NUREG 0711 Element

Agent's Roles and 

Responsibilities

Plant Mission

Staffing, Qualifications and 

Training

Management of Normal 

Operations

4
2.1 New Missions

Issue Description

The primary mission of current U.S. NPPs is to safely generate electrical power. Some SMRs 

are designed to accomplish additional missions, such as producing hydrogen and steam for 

industrial applications, e.g., heating or manufacturing. Demick (2010) describes new missions 

for high-temperature, gas reactors (HTGRs) as follows:

These applications include supplying process heat and energy in the forms of steam, electricity and 

high temperature gas to a wide variety of industrial processes including, for example, petro-chemical 

and chemical processing, fertilizer production, and crude oil refining. In addition to supplying process 

heat and energy the HTGR [high-temperature gas reactor] can be used to produce hydrogen and 

oxygen which can be used in combination with steam and electricity from the HTGR plant to produce, 

for example, synthetic transportation fuels, chemical feedstock, and ammonia, from coal and natural 

gas.

Achieving these missions will necessitate having new systems and personnel tasks, and 

possibly, added workload. 

Currently, the NRC staff reviews hazards of nearby facilities, such as natural gas. For SMR 

licensing reviews, these hazards may now be onsite and be a mission of the plant. The 

operators must deal with these new hazards along with reactor-related hazards.

NUREG-0711 Implications and Questions for Applicants

This issue impacts the NRC staff’s evaluation of most HFE elements, including an applicant’s 

operating experience review (OER), functional requirements analysis and function allocation, 

task analysis, staffing and qualifications, treatment of important human actions, human-system 

interface (HSI) design, procedure development, training program development, and verification 

and validation (V&V). Information about how an applicant has considered this issue can be 

obtained using the following questions.

Operating Experience Review

What operating experience is available for predecessor systems associated with the new 

missions?

Functional Requirements Analysis and Function Allocation

How are functions associated with new missions addressed in the functional requirements 

analysis and function allocation?

If pertinent, do the functions and systems associated with new missions interact with those 

associated with the safe generation of electrical power?

Are systems shared between the various missions that may be implemented at the site?

Describe the level of automation associated with new missions and the personnel roles and 

responsibilities for them.

5
If process-heat applications are envisioned for multi-unit sites, are multiple applications

allowed at the same facility, e. g., hydrogen production, steam production, desalination, 

refining, and electricity production?

Will the new processes associated with these missions create new hazards and safety 

issues, such as fires and explosions from hydrogen, methane, or natural gas?

Task Analysis

What tasks do personnel have to perform for the new missions?

How are the new mission tasks related to those performed for the safe generation of 

electrical power?

Staffing and Qualifications

Will new process applications use the same or different operators as those used for the 

generation of electrical power?

Will new staffing positions be created?

How do new missions impact overall staffing?

Treatment of Important Human Actions

Are there important human actions associated with the new missions?

How will the important human actions for new missions be identified?

Human-system Interface Design

The impact of new mission on HSI design has been identified as its own issue; see Section

2.18, HSIs for New Missions. 

Procedure Development

What new procedures will have to be developed to address the new missions?

How do these procedures relate to those used for the safe generation of electrical power

mission; will there be integrated procedures addressing tasks for multiple missions?

Training Program Development

Describe the training requirements and demands for new missions.

Will plant operators be trained in dealing with upset conditions in process-heat applications, 

and other interfacing requirements? 

Depending on number of process applications the nuclear facility services, how will these 

new responsibilities complicate operator training since they must be familiar with all 

application interfaces? 

6
2.2 Novel Designs and Limited Operating Experience from Predecessor

Systems

Issue Description

Commercial NPPs evolved gradually, with new designs improving upon prior ones. Using 

operating experience from predecessor plants has been an important aspect of plant design, 

licensing reviews, and operational improvements for years. By contrast, SMRs represent a new 

category of plant design, and consequently, for many, there is little operating experience. We 

may have to address and assess the need for operating experience by considering the 

experience of similar designs and non-nuclear systems. The impact of this information gap and 

compensatory approaches should be evaluated. 

There are two general implications for HFE reviews regarding this issue. The first implication of 

this issue is that enhancement of the staff’s review guidance on operating experience are 

needed to accommodate a greater diversity of experiences (both nuclear and non-nuclear) at 

predecessor plants that likely contribute to SMR design more than the plant designs reviewed to 

date. Current guidance is based on the way in which large light water reactors (LWR) were 

designed, viz., small evolutionary changes from specific predecessor plants. 

The second implication is that operating experience may be generally lacking for predecessor 

designs (both nuclear and non-nuclear) in comparison with other, more evolutionary, new 

reactors that underwent design-certification reviews. Addressing how to deal with this dearth of 

information should be a priority for the HFE program, e.g., will additional test and evaluations be 

needed in lieu of operational experience; here, input from SMR vendors may be a valuable 

source of information.

NUREG-0711 Implications and Questions for Applicants 

This issue mainly impacts the NRC staff’s evaluation of an applicant’s OER. Information about 

how an applicant has considered this issue can be obtained using the following questions.

What are the sources of operating experience contributing to the design of the SMR? 

Applicants should describe all relevant sources, including those sources that may come 

from non-nuclear systems. 

What information will be used as a substitute for operating experience for those aspects of 

the design for which operating experience is unavailable?

How has operating experience been used in the design?

2.3 Multi-unit Operations and Teamwork

Issue Description

For many systems we examined, both nuclear and non-nuclear in NUREG/CR-7126, a single 

crew/operator simultaneously monitored and controlled multiple units from one control room. 

Key issues in effectively and reliably accomplishing this task will be teamwork, situation 

awareness (SA), control room and HSI design, and the operator’s workload. Maintaining 

sufficient awareness of the status of multiple SMRs may tax crews and individual operators. For 

example, unmanned aerial vehicle (UAV) studies found that operators sometimes focus on a 

7
particular unit and may neglect others, or fail to notice important changes to them (change 

blindness). 

When operators are focused on a particular problem in current plants, other operators 

undertake their tasks. Such cooperation may be problematic when each operator is responsible 

for multiple units. In an oil refinery facility examined in NUREG-7126, this situation was 

resolved by augmenting the crew with additional staff during times of high workload or special 

evolutions. This is a different operational practice than that in present-day control rooms where 

the on-shift crew manages all aspects of the plant’s condition (except accidents). 

Maintaining SA may be further challenged when other situational factors intervene (separately 

identified as issues below):

- individual units can be at different operating states, e.g. different power levels or different 

states such as shutdown, startup, transients, accidents, refueling and various types of 

maintenance and testing (see Section 2.9) 

- unit design differences often exist (see Section 2.10) 

Shift turnovers occur two to three times a day when a new crew relieves the old crew. An 

effective way is needed to convey the status of each plant, ongoing maintenance, and trends in 

operation from one crew to another, particularly because more than one plant is involved, and 

one operator will be operating multiple plants. 

An understanding of the contribution of situational factors such as these to multi-unit monitoring 

and control tasks will be important in safety reviews. 

Multi-unit monitoring and control is a new type of operation in the commercial nuclear-power 

industry, with a limited technical basis for developing review guidance for multi-unit operations. 

Therefore, research is needed to address the issue and identify the considerations that must be 

accounted for in evaluating applicant submittals for multi-unit operations. We recommend that 

this research include an extended, in-depth study of multi-unit operations in other industries, 

similar to our use of surrogate systems in NUREG/CR-7126. Since there is limited publically 

available literature to draw on in many industries, site visits may be the best way to obtain data. 

Having a fuller technical basis rests on identifying the enabling technologies, operational 

strategies for both normal and off-normal situations, control room and HSI design, and lessons 

learned. The findings should be compared with NPP research to verify that their technical basis 

is appropriate for resolving NPP-specific issues. 

Revisions may be needed, for example, to portions of the regulations in 10 CFR: 50.34(f)(2)(i) 

on simulators; 50.54(i) - (m) on staffing; and Appendix A, General Design Criterion (GDC), 

Criterion 19 on control room design. Regulatory guidance may need updating: RG 1.114, 

guidance to operators at the controls; RG 1.149 and the related ANS 3.5 on simulators; the SRP 

NUREG-0800 Chapters 13 and 18; and NUREG-1791, guidance for staffing exemptions. Like 

many issues discussed in this section, the guidance developed likely will impact NUREG-0711 

and NUREG-0700.

Related issues are discussed below in Sections 2.7, Staffing Models, and 2.21, Handling of Offnormal Conditions at Multiple Units.

NUREG-0711 Implications and Questions for Applicants

8
This issue primarily impacts the NRC staff’s evaluation of an applicant’s OER, HSI design, 

procedure development, training program development, and V&V. Information about how an 

applicant has considered this issue can be obtained using the following questions.

Operating Experience Review

What operating experience for multi-unit operations has been collected?

Staffing and Qualifications

How will multiple units responsibly be assigned to staff?

How will teamwork be assured for multi-unit operations?

Human-system Interface Design

The impact of multi-unit operations on HSI design has been identified as its own issue; see 

Section 2.17, HSI Design for Multi-unit Monitoring and Control.

Procedure Development

What impact does multi-unit operations have on overall procedure structure and the design 

of individual procedures?

See also Section 2.22, Design of EOPs for Multi-unit Disturbances.

Human Factors Verification and Validation

How will integrated system validation methodology validate multi-unit operations?

2.4 High Levels of Automation for All Operations and its Implementation 

Issue Description

The findings from the surrogate facilities3 we studied in NUREG/CR-7126 emphasized 

automation as key enabling technology for multi-unit operations. As crews are assigned more 

units to manage, automation must undertake tasks traditionally performed by operators. SMRs 

are no exception, and their degree of automation will likely be high as both normal and safety

operations are projected to be automated. The “automate all you can automate” philosophy 

often dominates programs for developing advanced reactors to improve their performance and 

decrease operational costs. However, as we noted earlier, there is a complex relationship 

between automation and human performance, which often fails to confirm common-sense 

expectations. For example, it is generally expected that high levels of automation will lower 

workload; instead, it shifts workload and creates other human-performance difficulties, including

(O’Hara & Higgins, 2010):

- change in the overall role of personnel that does not support human performance

- difficulty understanding automation

3 A surrogate facility is one whose operation involves managing multiple units that make similar demands 

on human performance as SMRs.

9

 
- low workload, loss of vigilance, and complacency

- out-of-the-loop unfamiliarity, and degraded situation-awareness

- difficult workload transitions when operators must assume control when automation fails

- loss of skills since automated tasks are seldom performed

- new types of human error, such as “mode” error4

The design of SMRs and their operations must address these potential problems. 

Concerns about the negative effects of over-automation have increased the practice of 

exploring automation at various levels (see Table 2-2) and implementing automation in more 

flexible ways. For example, in adaptive automation, the level of automation is flexible and can 

change either automatically based on situation characteristics or upon operator request. 

Therefore, this approach may assist operators in managing changing attention and workload 

demands in supervising multiple plants. 

Table 2-2 Levels of Automation 

 Note: Adapted from O’Hara & Higgins, 2010, Table 3-3.

The reliability of automation is also an important consideration. As automation’s reliability 

declines, operator’s performance and trust in the automation is degraded. However, when 

operator’s trust in automation is excessive, they may over rely on it in situations for which it is 

unsuited and not monitor it sufficiently to verify its performance.

SMR designs must find the right balance between automation and human involvement to 

provide reasonable assurance of safe operation. Determining the right levels and flexibility of 

automation to support operators in maintaining multi-unit SA and managing workload demands

is central to achieving this balance. In addition, the design of SMR automation should strive to 

mitigate the types of human performance issues that are associated with high-levels of 

automation. Licensing reviews of SMRs must determine whether the applicant has reasonably 

assured the effective integration of automation and operators, and whether the design supports 

safe operations.

4

 Automated systems often have a variety of modes in which the inputs used and output provided differ. 

Operator inputs might have different effects, depending upon each mode’s characteristics. Errors result 

when operators make inputs thinking the system is in one mode when it is in another.

Level Automation Functions Human Functions

1. Manual 

Operation

No automation Operators manually perform all functions 

and tasks

2. Shared 

Operation

Automatic performance of some 

functions/tasks

Manual performance of some 

functions/task

3. Operation by 

Consent

Automatic performance when directed 

by operators to do so, under close 

monitoring and supervision

Operators monitor closely, approve 

actions, and may intervene with 

supervisory commands that automation 

follows

4. Operation by 

Exception

Essentially autonomous operation 

unless specific situations or 

circumstances are encountered

Operators must approve of critical 

decisions and may intervene

5. Autonomous 

Operation

Fully autonomous operation. System 

or function not normally able to be 

disabled, but may be manually started

Operators monitor performance and 

perform backup if necessary, feasible, 

and permitted

10

 
The pitfalls of high-levels of automation for human performance are well known, as are some of 

the design characteristics that generate them. The NRC published guidance (O’Hara & Higgins, 

2010) on human-automation interactions that should support HFE reviewers in addressing 

automation in SMR designs. The guidance was incorporated into NUREG-0711 Rev. 3 and will 

be incorporated in the next revision of NUREG-0700. 

See also the related issues in Section 2.5, Function Allocation Methodology to Support 

Automation Decisions; and Section 2.11, Operational Impact of Control Systems for Shared 

Aspects of SMRs. 

NUREG-0711 Implications and Questions for Applicants

This issue mainly impacts the NRC staff’s evaluation of an applicant’s Functional Requirements 

Analysis and Function Allocation, Task Analysis, and Human-system Interface Design. 

Information about how an applicant has considered this issue can be obtained using the 

following questions.

Functional Requirements Analysis and Function Allocation

How has the applicant’s HFE program addressed the human performance issues associated 

with high-levels of automation?

Task Analysis

How were personnel tasks identified and analyzed for personnel responsibilities with regard 

to automatic functions?

Human-system Interface Design

How are HSIs designed to support the performance of personnel tasks associated with their 

responsibilities for interacting with automatic systems?

Human Factors Verification and Validation

How is the level of automation and the associated personnel tasks validated to ensure 

successful performance and to ensure that the human performance concerns associated 

with high-levels of automation are addressed?

2.5 Function Allocation Methodology to Support Automation Decisions

Issue Description

Under the issue of “High Levels of Automation for All Operations and its Implementation,” we 

discussed various levels of automation and the flexibility in how automation can be 

implemented. Making design decisions on when and how to apply new types of automation

generally is called allocation. An issue facing designers and reviewers is that current allocation 

methods do not offer specific analytic tools for deciding. SMR designers also noted this 

problem. In discussing automation for the PBMR, Hugo and Engela (2005) observed that most 

methods of function allocation are “...subjective and prone to error and in projects where human 

and environmental safety is a concern, it is necessary to use more rigorous methods.”

11
NUREG-0711 gives general guidance for reviewing function allocation in Section 4, Functional 

Requirements Analysis and Function Allocation. However, modern applications of automation 

have much more flexibility, such that operators face many different types of tasks and 

interactions (as discussed earlier). The NRC’s characterization of automation identified six 

dimensions: functions, processes, modes, levels, adaptability, and reliability (O’Hara and 

Higgins, 2010). These dimensions can be combined to design automation for a specific 

application. However, designers lack methodologies to back-up their decisions as to what 

combinations are appropriate, i.e., current function-allocation methods do not address such 

choices; and reviewers lack guidance to evaluate them. Additional research is needed on 

function allocation; that is, selecting the types of automation and levels of operator involvement 

to implement for specific applications. The resulting guidance should be included in NUREG0711.

See also the related issue in Section 2.4, High Levels of Automation for All Operations and its 

Implementation. 

NUREG-0711 Implications and Questions for Applicants

This issue mainly impacts the NRC staff’s evaluation of an applicant’s Functional Requirements 

Analysis and Function Allocation. Information about how an applicant has considered this issue 

can be obtained using the following question:

What function allocation methodology, rules, or criteria were used to determine the 

appropriate level of automation for SMR functions?

2.6 New Staffing Positions

Issue Description

In discussing “New Missions” above, we noted that the industry identified SMR missions beyond 

safe production of electricity; hence, management may require new staffing positions. As well 

as the new missions, new positions may be needed to manage the new operator tasks brought 

about by design differences between current plants and SMRs, such as reactor transfer and online refueling.

The allocation of responsibilities for new missions and new operational activities to shift crew 

members, either in terms of new positions or new personnel responsibilities must be a part of 

staffing and qualifications analyses, training program development, and regulatory reviews to 

determine their potential impact on safety.

This issue has potential impact on 10 CFR 50.54, Staffing, and 50.120, Training.

See also the related issues in Section 2.7, Staffing Models, and Section 2.8, Staffing Levels.

NUREG-0711 Implications and Questions for Applicants

This issue mainly impacts the NRC staff’s evaluation of an applicant’s Staffing and 

Qualifications, and Training Program Development. Information about how an applicant has 

considered this issue can be obtained using the following questions.

12
Staffing and Qualifications

What staffing positions will be responsible to perform tasks associated with new missions 

(insert specific new SMR mission relevant to the review) and new operational activities 

(insert new activities relevant to the review)?

Training Program Development

How are the new mission and operational responsibilities addressed in the training 

program?

2.7 Staffing Models

Issue Description

The concept of “staffing model” addresses the general approaches to fulfilling the organizational 

functions necessary to operate a NPP, including operations, maintenance, engineering, 

administration, and security (O’Hara et al., 2008).

5

 To meet these responsibilities, utilities 

employ a combination of on-site staff and off-site personnel. The staffing model chosen is a 

very significant design decision as it drives many other aspects of the plant’s design, including

degree of automation, the HSI design, and personnel training. 

Current U.S. NPPs have many on-site personnel organized into functional groups. Operations 

are performed by shifts of reactor operators who the NRC licenses to manage reactor and 

balance of plant systems. Each shift is expected to manage all phases of plant operations 

including normal (e.g., startup, changing power levels, and shutdown) and off-normal conditions 

(e.g., equipment failures, transients, and accidents). In certain emergencies, additional staff is 

brought in to assist. While day-to-day maintenance is handled by on-site staff, outside 

organizations often come on-site during outages to undertake major maintenance. 

However, the same model is not employed worldwide. For example, in many European NPPs, 

the operations shift crew divides responsibilities between a reactor operator who manages the 

reactor systems, and the balance-of-plant operator who manages the rest of the plant, an 

approach analogous to the UAV and refinery operations we examined in NUREG/CR-7126. 

UAV crews split duties between flying/navigating the vehicle, and payload operations. In the 

refinery, four units were managed, with each operator being responsible for a part of the 

process for all four units. 

The staffing models needed for SMRs may differ from those in currently operating plants. For 

example, we noted in our discussion in Section 2.3, Multi-unit Operations and Teamwork, that

the crews in some of our surrogate systems where operators monitor multiple units are 

augmented with additional staff when dealing with units under high-workload situations (such as 

during startup or emergencies). Crew flexibility is a key to managing off-normal situations. 

Thus, at refineries and tele-intensive care units (ICUs), significant organizational changes are

needed to manage these situations. In both, additional staff is brought in for off-normal units, 

and during transitions at the refinery (unit startup or shutdown). Being able to transfer 

responsibilities for reactors in off-normal states to a person or team specialized in dealing with 

them may benefit SMR operations. 

5

 Our use of the term “staffing models” should not be confused with “human performance models.” The 

latter refers to models that are (1) mathematical, programmable, and executable rather than purely 

explanatory; and, (2) applied in the engineering design and evaluation of complex systems.

13

 
After defining personnel responsibilities for a particular SMR design, the associated tasks must

be assigned to specific staff positions for both normal operations and off-normal/emergency 

conditions. Depending on the use of automation, these tasks may include the monitoring and 

control of multiple individual units, shared systems, reactor transfer, online refueling, new 

missions, and monitoring and backing-up the automation. SMR designers will have to 

determine the allocation of operator roles that best support overall system performance and 

safety, and consider the impact on teamwork, e.g., on the peer-checking process. 

Changes to staffing models that deviate from current practices are likely to have implications for 

10 CFR 50.54 and the various staffing guidance documents, including NUREG-0711, as further 

discussed next in Section 2.8, Staffing Levels.

See also the related issues in Section 2.6, New Staffing Positions, and Section 2.8, Staffing 

Levels.

NUREG-0711 Implications and Questions for Applicants

This issue mainly impacts the NRC staff’s evaluation of an applicant’s Staffing and 

Qualifications and V&V. Information about how an applicant has considered this issue can be 

obtained using the following questions.

Staffing and Qualifications

Will staffing models (general approaches to fulfilling the organizational functions necessary 

to operate a NPP, including operations, maintenance, engineering, administration, and 

security6

) be employed that deviate from models used previously in NPPs?

If so, describe the new staffing model and how it differs from previously used or 

conventional models.

Human Factors Verification and Validation

How will integrated system validation methodology validate the new staffing model?

2.8 Staffing Levels

Issue Description

10 CFR 50.54(m) governs the minimum staffing levels for licensed operators in current plants; it

has a table establishing the numbers of operators for one-, two- and three-unit sites. For a oneunit site, one senior reactor operator (SRO), two reactor operators (ROs), and a shift supervisor 

(second SRO) are required for an operating reactor. For a two-unit site, two SROs and three 

ROs are needed. A three-unit site needs three SROs and five ROs. The table does not cover 

sites with more than three units.

Most SMRs for which staffing information is available, plan to propose staffing levels below 

these requirements and, therefore, an exemption from this staffing regulation will be needed. 

6 Current HFE staffing guidance is directed toward operations staffing and does not provide specific 

information regarding staffing levels and qualifications needed in areas such as maintenance, 

engineering, administration, and security. 

14

 
For example, one SMR design anticipates assigning one reactor operator to monitor and control 

four units, each consisting of a fully integrated reactor and turbine generator. Drivers supporting 

this approach include the reactor’s small size, its simple design, high-degree of automation, 

modern HSIs, and its slow response to transients. Control-room staffing for the baseline 

configuration of another SMR design consisting of 12 units encompasses three ROs, one SRO

control-room supervisor, one SRO shift manager, and one shift technical advisor (STA). Thus,

the staffing levels needed to safely and reliably monitor and control SMR units must be 

determined and reviewed, possibly addressing new positions and staffing models, as described 

above.

Staffing levels are identified in 10 CFR 50.54(m); hence, a change in this regulation or an 

exemption is needed to permit SMRs to deviate from the established minimum requirement. 

SMR staffing level was recognized in Issue 4.1, Appropriate Requirements for Operator Staffing 

for Small or Multi-Module Facilities of SECY-10-0034 (NRC, 2010) “...as a potential policy issue 

that may require changes to existing regulations.” Also, staffing levels must be considered in 

the broader context of new staffing positions and models that might differ from those used in 

currently operating plants and must be reflected in NRC regulations and review guidance.

Until such regulatory changes are made, NUREG-1791 (Persensky, et. al, 2005) provides 

guidance for reviewing staffing exemptions. NUREG-1791 guidance reflects the NUREG-0711 

HFE review process, and addresses multi-unit operations. So far, the guidance has not been

used to evaluate an exemption request. Research is underway at the NRC to verify the 

approach and, if necessary, to update the guidance to more comprehensively address the SMR 

staffing issues in light of the new design developments and human-performance considerations 

that have arisen since its publication. 

See also the related issues in Section 2.5, Staffing Models, and Section 2.6, New Staffing 

Positions.

NUREG-0711 Implications and Questions for Applicants

This issue mainly impacts the NRC staff’s evaluation of an applicant’s Staffing and 

Qualifications and V&V. Information about how an applicant has considered this issue can be 

obtained using the following questions.

Staffing and Qualifications

Will staffing levels will be employed that deviate from those used previously in NPPs?

Human Factors Verification and Validation

How will integrated system validation methodology validate the staffing levels?

15
2.9 Different Unit States of Operation

Issue Description

Individual SMR units may be in different operating conditions, e.g., different power levels or 

different states, such as shutdown, startup, transients, accidents, refueling and various types of 

maintenance and testing. Depending on the staffing model used and the allocation of SMR 

units to individual operators, the effects of these differences on operators’ workloads and SA

must be evaluated. 

See also the related issues in Section 6.20, Potential Impacts of Unplanned Shutdowns or 

Degraded Conditions of One Unit on Other Units, and Section 2.21, Handling Off-normal 

Conditions at Multiple Units.

NUREG-0711 Implications and Questions for Applicants

This issue mainly impacts the staff’s evaluation of an applicant’s Staffing and Qualifications, HSI 

Design, Procedure Development, and Training Program Development. Information about how 

an applicant has considered this issue can be obtained using the following questions.

Staffing and Qualifications

As a team, how will crews manage units in different states, e.g., will one operator continue 

to monitor multiple units in different states, or will units in states other than at-power be 

transferred to a different operator or crew?

What analysis or data are available to demonstrate that operators and crews maintain 

situation awareness of units in different states and that they will properly respond to 

unplanned changes in a unit’s state and to off-normal conditions?

Human-system Interface Design

How will the HSI be designed to ensure operator awareness of each unit’s status?

Procedure Development

How will different unit states be addressed in procedures?

Training Program Development

How are unit differences addressed in operator training?

16
2.10 Unit Design Differences

Issue Description

The effect of SMR unit differences (heterogeneity) is unresolved. Every surrogate facilities we 

studied deal with unit differences, some of which were significant (see NUREG/CR-7126). At 

the oil refinery, these differences aided monitoring by helping operators to distinguish between 

the units, but for tele-ICU- and UAV-operators, differences complicate operations. There may 

be differences between the individual units at a given site, between units at different sites, or 

both. 

Since many SMRs are designed to be scalable, units can be added while other units of the plant 

are operating. Although a licensee may plan to have all identical units at a particular site, this 

may not be achievable due to changes made to improve reliability, lower cost, or to deal with 

obsolescence issues, so impacting crew and operator reliability. Thus, we need to understand 

and address the effect of unit differences on SMRs operations. 

The research questions stemming from this issue may be qualifying the extent to which 

differences impact performance and identifying which aspects of performance are affected. Unit 

differences may support the operator’s ability to distinguish between them when monitoring 

workstation displays; yet, the difference may make situational assessment and response 

planning more difficult. For example, if the disparities in the units lead to a different 

interpretation of their status based on parameter displays, it may impair the operator’s 

recognition of performance that deviates from what it should be. Further, if the differences 

between units lead to the need for different responses, then they may compromise the 

operator’s response and present an opportunity for operator error; for example, the operator 

may respond to a disturbance in Unit 2 that is appropriate to Unit 1, but inappropriate to Unit 2. 

The results of research addressing this issue affect the review of procedures as well as HSIs. 

For HSIs, we need guidance on whether and how these differences should be depicted in 

control room HSIs. NUREG-0700 needs enhanced guidance on this issue. Depicting 

differences with no import on operator’s performance could needlessly complicate displays; 

failing to depict those that impact operator performance may engender difficulty in situation 

assessment, and operator error. 

Furthermore, once the effects on performance of unit differences are determined, the results 

may help resolve the needs for standardization, for evaluating unit differences using the 50.59 

process, or for ways to address it, such as specific HSI design techniques. There are 

implications also in how to address these unit differences in procedures and training. Should 

the procedures be common for all units with the differences noted in the appropriate places, or 

should the procedures be completely separate and different for each unit? Operators must be 

thoroughly trained in recognizing the differences between units. 

NUREG-0711 Implications and Questions for Applicants

This issue mainly impacts the NRC staff’s evaluation of an applicant’s HSI Design, Procedure 

and Training Program Development. Information about how an applicant has considered this 

issue can be obtained using the following questions.

Human-system Interface Design

17
Are there unit differences that can impact operator performance? If so, how are they 

depicted on the HSIs used by operators?

How was it determined what unit differences should be depicted in plant HSIs?

Procedure Development

How are unit differences addressed in plant procedures?

Training Program Development

How are unit differences addressed in operator training?

2.11 Operational Impact of Control Systems for Shared Aspects of SMRs

Issue Description

In today’s typical plants, the control systems manage a single unit. For SMRs, the control 

systems may manage multiple units in an integrated fashion. This could include systems that 

the units share in common, such as for circulating water, for the ultimate heat sink for removing 

decay heat, and systems for instrument air, service-water cooling and AC and DC electric 

power. It may also include common control of systems that are similar but not shared between 

units, such as balance-of-plant (BOP) systems. Clayton and Wood (2010) noted that “Multi-unit 

control with significant system integration and reconfigurable product streams has never before 

been accomplished for nuclear power, and this has profound implications for system design, 

construction, regulation, and operations” (p. 146). The integrated control of multiple SMRs and 

their shared systems can be an operational challenge, as well as an I&C challenge. The 

challenge to operators lies in monitoring such a control system to confirm that individual units 

and shared system are performing properly, and that there are not degradations of the I&C 

system.

A few additional considerations enhance the challenge. The first is that SMR scalability can 

make multi-unit operations even more complex as new units are added to the control system. 

Wood et al. (2003) noted that “...this may result in a control room that is less optimal for human 

factors at all levels than would otherwise be possible if all the modules simultaneously 

completed construction” (p. 59).

The second is that SMRs may serve multiple missions. That is, systems must be flexibly 

reconfigured to meet electricity production and other objectives, such as hydrogen production. 

For example, the operators may need to switch some SMR units that are, at the moment, 

dedicated to producing electricity over to generating hydrogen. Designing operational practices 

and control rooms to effectively support operators is an important issue to address in design 

and licensing multi-unit SMRs.

The HFE implications of this issue pertain mainly to HSI design. While NUREG-0700 has 

guidance on controls, it does not consider how multi-unit and shared system controls should be 

implemented at operator’s workstations and represented in the HSI. There may also be 

increased opportunities for wrong-unit/wrong-train types of errors that need resolution. 

18
Additional implications include the impact of degraded control systems on the operator’s 

situational awareness of the status of multiple units and shared systems, including the detection 

of malfunctions. 

NUREG-0711 Implications and Questions for Applicants

This issue mainly impacts the NRC staff’s evaluation of an applicant’s HSI Design and 

Procedure Development. Information about how an applicant has considered this issue can be 

obtained using the following questions.

HSI Design

How will shared systems be depicted in the HSIs and how do operators determine that they

are performing properly?

How do operators identify degradations of the I&C system; how are they identified in the 

HSIs?

Will different operators be able to control systems shared between units; if so, how is the 

control managed?

Procedure Development

What procedures will be available to support operators in the management of degraded I&C 

conditions?

How do procedures address the operators’ interaction with the control systems for multiple 

units as well as for shared systems for plant configurations that have different missions?

2.12 Impact of Adding New Units While Other Units are Operating

Issue Description

Most SMRs are scalable; that is, multiple units can be grouped at a site to meet a utility’s 

specific power needs. Current construction plans are to have ongoing installation of additional 

units while earlier units operate at power, in contrast to current practices at multi-unit sites

where a Unit 2 under construction is clearly separated from operating Unit 1. The impact of 

adding new units on a site with existing units must be addressed. 

Another consideration is the need to add workstations to a control room to accommodate new 

units. For current plants, the practice typically involves the erection of a stout wall between the 

operating control room and the control room being built. The wall controls access to the new 

unit, and limits noise, interruptions, fumes, dust, the potential for construction-related fires and 

electromagnetic interference from radios, along with other construction work and tests. The 

shared or common systems typically are included in the operating control room’s boundaries.

If construction activities on subsequent units cannot be completely separated from operating 

units, they might distract operators. Even if separated, there likely will be mechanical and I&C 

tie-in activities that could cause trips or other operational problems for the operating units. This 

may be a particular issue in designing the workstation and HSI displays that will be used to 

monitor and control existing operating units and the new ones under construction. 

19
NUREG-0711 Implications and Questions for Applicants

This issue mainly impacts the NRC staff’s evaluation of an applicant’s HSI Design and 

Procedure Development. Information about how an applicant has considered this issue can be 

obtained using the following questions.

Human-system Interface Design

Will any changes to HSIs be needed during the time period when new units are added to the 

plant?

How will a new unit’s HSIs be added to an existing workstation that is being used to monitor 

and control current units?

How will new workstations that support the operation of new units be introduced in a manner 

that does not distract or disrupt the monitoring and control of existing units?

Procedure Development

How will the installation of new units impact procedures? Will special procedures be used 

during this time?

2.13 Managing Non-LWR Processes and Reactivity Effects

Issue Description

Non-LWR SMR designs incorporate the unique systems and features of their processes, and 

may have reactivity effects that differ from LWRs. For example, the presence of lead in the core 

area of Hyperion Power Module (HPM), a lead-cooled fast reactor, will involve different reactivity 

effects from those in light-water reactors. The HPM design will exhibit little neutron 

thermalization, have lower Doppler effects, the temperature coefficient of reactivity will be less 

negative, and the neutron lifetime shorter. These features all quicken the dynamics of core 

power and transient operations. The operator’s control of both reactivity effects and overall 

reactor safety depends on their understanding of these effects.

To understand these differences, operators familiar only with LWRs, but transitioning to nonLWR plants, will require special training both in the classroom and on simulators. The 

acceptability of the operator’s performance must be specifically tested as part of a thorough and

integrated system validation program. 

NUREG-0711 Implications and Questions for Applicants

This issue mainly impacts the NRC staff’s evaluation of an applicant’s Functional Requirements 

Analysis and Function Allocation, HSI Design, Procedure Development, Training Program 

Development, and V&V. Information about how an applicant has considered this issue can be 

obtained using the following questions.

Functional Requirements Analysis and Function Allocation

What are the non-LWR processes and systems and what missions do they support?

20
What is the operator’s role in controlling reactivity effects?

Human-system Interface Design

What HSIs are available for reactivity monitoring and control of non-LWRs processes?

Procedure Development

How is reactivity monitoring and control for non-LWRs addressed in plant procedures?

Training Program Development

How are non-LWR processes addressed in operator training?

How is the control of reactivity effects addressed in operator training?

Human Factors Verification and Validation

How will the performance of non-LWR tasks be addressed in Human Factors V&V?

How will reactivity control performance be validated?

2.14 Load-following Operations

Issue Description

Current day NPPs typically operate at 100% power and provide a base load to the utility’s 

electrical distribution system, i.e., the plants produce electricity for the grid and other producers 

of electricity compensate for changes in demand. Clayton and Wood (2010) suggested that a 

base-load mode of operation may not be appropriate for SMRs; they may have to cooperate 

with other sources of renewable energy whose production is variable (e.g. solar power, wind 

power).

Load following is an operating procedure that allows the power output generated by the NPP to 

vary up or down as determined by the load demanded by the distribution system. It entails 

more transients, so the plant can increase or decrease both reactor- and turbine-power in 

response to the external demand. In turn, this requires more actions from operators, and more 

vigilant monitoring of the response of the automatic systems. In addition, for a multi-unit site, 

load following may entail the startup and shutdown of units to meet large changes in load 

demand. Hence, there is more opportunity for equipment failures and operator errors. 

If load following becomes acceptable practice, vendors and plant owners, in conjunction with the 

NRC, will need to decide on the method to implement load following, e.g.: 

Method A – A load dispatcher contacts the NPP’s shift supervisor for all changes.

Method B – A load dispatcher dials in requested change, and the NPP automatically 

responds, while the load dispatcher and RO/SRO monitor for the proper 

response.

21
Each of the two approaches has its own issues. Method A creates a greater workload and more 

distractions for the operators. While manual control of a single unit is well within an operator’s 

capability, simultaneously controlling multiple units may be much more difficult and lead to 

errors. 

Method B permits a person not trained in NPP systems and not licensed to change reactivity 

and power level in the reactor to do so. The NRC has not permitted plants to be operated by an 

automatic load-following scheme. 

Once an acceptable approach is determined, designers will need to define the needed operator 

tasks to properly manage load-following operations, and to provide HSIs, procedures and 

training to support them. 

Such a change in operating methods might increase risk due to a higher frequency of transients, 

and should be evaluated via probabilistic risk assessment (PRA) techniques. 

NUREG-0711 Implications and Questions for Applicants

This issue mainly impacts the NRC staff’s evaluation of an applicant’s Functional Requirements 

Analysis and Function Allocation, Staffing and Qualifications, Treatment of Important Human 

Actions, HSI Design, Procedure Development, Training Program Development, and V&V. 

Information about how an applicant has considered this issue can be obtained using the 

following questions.

Functional Requirements Analysis and Function Allocation

How is load following accomplished and what are the relative roles of: a) NPP personnel, b) 

non-plant personnel (e.g. external load dispatcher); and c) automation?

Staffing and Qualifications

How are load-following operations staffed and what qualifications are needed?

How do load-following duties impact other personnel duties?

Treatment of Important Human Actions

Are load-following failures modeled in the PRA and are risk-important human actions 

accurately accounted for in the model?

Human-system Interface Design

What HSIs are needed for load-following operations and how are they integrated into the 

overall control room design?

Procedure Development

What procedures are needed for load-following operations and how are they implemented in

the control room? Will there be procedures for off-site load dispatchers?

22
Training Program Development

What training is necessary for operators to perform load-following operations? Will load 

dispatchers be trained together with plant operators?

Human Factors Verification and Validation

How will the design of the integrated system for load-following operations be validated?

2.15 Novel Refueling Methods

Issue Description

Several SMR designs refuel the reactor on-line or continuously. While there is international 

experience with such refueling operations, it will represent a new practice in the United States. 

Further, in some circumstances, specific approaches to refueling will be novel. 

Consider the NuScale approach. Based on information we obtained about the current NuScale

refueling concept, there will be online refueling operations where the reactor to be refueled is 

detached from its mounting position and connected to a crane. The crane then moves the 

reactor to a refueling bay for disassembly and refueling. The reactor instrumentation is 

monitored through the entire process. There are four channels of instrumentation and control 

(I&C). When preparing to move the reactor, first one channel’s cable connector is removed 

from the reactor and attached to the refueling bridge (RB). When the channel on the RB is 

verified to be reading properly, the second I&C channel is similarly transferred, and then in turn 

the 3rd and 4th channels are transferred. Control of this reactor is the responsibility of an SRO 

in the refueling area, not the main control room. One concept under consideration is having a 

13th reactor, which would then be moved to replace the one being refueled. Then the reactor 

could be refueled while the other 12 are still maintaining the full power output of the station.

It is likely that a refueling crew will manage this operation. However, there still are interfaces 

with the operators of the primary reactor that should be considered, as well as the operations of 

the refueling crews. The effects of such novel approaches on human performance and plant 

safety need to be assessed.

Vendors will have to define the methods by which reactors will be refueled, and their impacts on 

operator performance assessed through HFE analysis and research, particularly by operators 

responsible for other operating units at the same time. A key policy question here is whether 

the NRC will allow one operator simultaneously to control both an operating unit and one 

undergoing refueling. 

Depending on the effects of refueling on the operator’s performance, enhanced review guidance 

may be needed to the review the associated HSIs, procedures, and training. See also, the 

discussion in Section 2.9, Different Unit States of Operation.

NUREG-0711 Implications and Questions for Applicants

This issue mainly impacts the NRC staff’s evaluation of an applicant’s Functional Requirements 

Analysis and Function Allocation, Staffing and Qualifications, Treatment of Important Human 

Actions, HSI Design, Procedure Development, Training Program Development, and V&V. 

23
Information about how an applicant has considered this issue can be obtained using the 

following questions.

Functional Requirements Analysis and Function Allocation

How is refueling accomplished and what are the relative roles of NPP personnel and 

automation?

Staffing and Qualifications

How are refueling operations staffed and what qualifications are needed?

How do refueling duties impact other personnel duties?

Treatment of Important Human Actions

Are refueling failures modeled in the PRA and are risk-important human actions accurately 

accounted for in the model?

Human-system Interface Design

What HSIs are needed for refueling operations and how are they integrated into the overall 

control room design?

Procedure Development

What procedures are needed for refueling operations and how are they implemented in the 

control room?

Training Program Development

What training is necessary for operators to perform refueling operations?

Human Factors Verification and Validation

How will the design of the integrated system for refueling operations be validated?

2.16 Control Room Configuration and Workstation Design for Multi-unit Teams

This section and the next several address HSI design. In this section, we address the overall 

layout and design of the control room and its workstations. In subsequent sections other issues 

pertaining to details of HSI design are identified:

- Section 2.17, HSI Design for Multi-unit Monitoring and Control

- Section 2.18, HSIs for New Missions

- Section 2.19, Safety Function Monitoring

Issue Description

24
The control room’s configuration and layout is an important human factors issue. For a single 

reactor and its secondary systems, modern computer-based control rooms typically have a 

large overview display, several operator workstations, a supervisor’s workstation, and 

supplemental workstations for engineering and maintenance work. The question is how to 

design a single control room to support SMR operations encompassing multiple reactors where 

a single person may be responsible for a reactor and its secondary systems for up to four 

complete units. The answers partly depend on the allocation of the crew’s responsibilities. 

While it may be demanding to design a single workstation to monitor one unit alone in light of 

the HSI resources needed for operating today’s single unit control room; escalating that to four 

units may prove more challenging. 

One SMR designer’s very preliminary concept suggested that eight monitors are needed to 

display the alarms, displays, procedures, and controls for a single unit. Thus, for four units a 

total of 32 monitors would be needed. It is unclear whether a single operator could effectively 

monitor such a large amount of information. Moreover, the chances of missing important data 

might well increase.

As well as considering multi-unit operations, the design will need to accommodate new tasks, 

such as moving reactors for refueling, as well as new missions, such as hydrogen production.

Another question is whether the individual unit control stations should be located in one room or 

in different ones close together. In a single control room, situational factors associated with a 

single unit, such as alarms and using emergency procedures, may impact the operators 

monitoring other units. However, accommodating operational staff in one room, allows them to

help each other more easily, and they will be easier to supervise. If individual unit-control 

stations are in separate control rooms, overall supervision, teamwork, and the transitions 

needed in high workload situations may be more difficult to manage. Also, operations at each 

unit will be undisturbed by what happens at the others. 

While there are some exceptions, operating multiple units from a single control room is 

generally considered to be a new practice. Therefore, research into the workstation design and 

control room configuration is needed to determine appropriate approach to ensure the final 

design supports situation awareness and teamwork. As noted earlier, one aspect of this 

research is to gather experience from other industries on multi-unit operation. In our research to 

date, we observed both single control rooms and multiple ones.

See also the sections identified at the beginning of this section and Section 2.3, Multi-unit 

Operations and Teamwork. 

NUREG-0711 Implications and Questions for Applicants

This issue mainly impacts the NRC staff’s evaluation of an applicant’s HSI Design and V&V. 

Information about how an applicant has considered this issue can be obtained using the 

following questions.

Human-system Interface Design

Explain how the overall control room layout supports:

- multi-unit operations, including reactor operations, BOP systems, shared systems, 

refueling

25
- other personnel responsibilities, for new missions, such as hydrogen production

- maintenance activities performed from the control room

How does the control room configuration and workstation design support the minimal, 

nominal, and maximum staffing levels?

How does the design of the control room support teamwork and supervision tasks?

How are workstations designed/configured to support the responsibilities of individual 

operators?

Human Factors Verification and Validation

How will the design of the control room and workstations for multi-unit teams be validated?

2.17 HSI Design for Multi-unit Monitoring and Control

Issue Description

The detailed design of HSIs (alarms, displays, and controls) to enable a single operator to 

effectively manage one or more SMRs is an important feature. HSIs must enable monitoring 

the overall status of multi-units, as well as easy retrieval of detailed information on an individual 

unit. This need raises several questions. For example, should the HSIs for each unit be 

separate from those of other units, or should they be integrated to help operators maintain highlevel awareness of the status of all units for which they are responsible. If the units are 

separated, and an operator is focusing on one of them, awareness of the status of the other 

units may be lost. If the information is integrated, it might be a challenge to ensure that 

operators do not confuse information about one unit with that of another. Related to this is the 

problem of how to address unit differences in designing HSIs, as discussed earlier in Section 

2.10, Unit Design Differences. 

Alarm design is especially important in ensuring that operators are aware of important 

disturbances, so minimizing the effects of change blindness and neglect.

SMR personnel may also require more advanced I&C and HSI capabilities to support their 

tasks. For example, systems that provide diagnostics and prognostics to support monitoring 

and situation awareness may be available. How personnel manage and understand these 

capabilities is an important consideration in overall personnel and plant performance.

The organization of information in supporting teamwork is another important HSI factor e.g., 

deciding what information crew members need to have access to individually, and as a crew, to 

promote teamwork. A key aspect to be researched is employing a large overview display in a 

control room with multiple operators, each controlling more than one unit. Its value here may 

not be so clear-cut and obvious as it is for a single unit’s control room. 

Another problem is the HSIs needed for shifting control for one unit from one operator to 

another.

Research should be undertaken to define more clearly the requirements imposed by multi-unit 

monitoring and control on all HSI resources, and to delineate how they should be integrated into 

workstations, overview displays, and control room layouts to support multi-unit control rooms. 

26
See also the sections identified at the beginning of Section 2.16, Control Room Configuration 

and Workstation Design for Multi-unit Teams, and Section 2.3, Multi-unit Operations and 

Teamwork. 

NUREG-0711 Implications and Questions for Applicants

This issue mainly impacts the NRC staff’s evaluation of an applicant’s HSI Design and V&V. 

Information about how an applicant has considered this issue can be obtained using the 

following questions.

Human-system Interface Design

Describe the concept of use and provide an HSI overview for the HSIs for multi-unit 

operations

How are the alarms for multiple units presented in the control room and on the 

workstations? How is operator awareness of all high-priority alarms assured?

What HSI features are used to support operator/crew SA for all units the operators are 

assigned?

How are controls designed for operators to interact with different units from a single 

workstation?

What design features are implemented to minimize wrong unit errors?

From an HSI standpoint, how is control for one unit transferred from one operator to 

another?

Human Factors Verification and Validation

How will the HSI design for multi-unit monitoring and control be validated?

2.18 HSIs for New Missions

Issue Description

HSIs are needed to help monitor and control new missions, such as hydrogen production, or the 

industrial use of steam, thus, the question of how to design and integrate them into the control 

room needs to be addressed. 

Note that the NRC design review of the new HSIs themselves likely can use the guidance in 

NUREG-0700, but it may need to be expanded to guide the interplay between these new 

missions and the reactor controls. Before researching this issue, more detailed data are 

needed from SMR designers on how personnel manage new missions, and how their 

operations are staffed and integrated into the rest of SMR operations.

See also the sections identified at the beginning of Section 2.16, Control Room Configuration 

and Workstation Design for Multi-unit Teams, and Section 2.3, Multi-unit Operations and 

Teamwork. 

27
NUREG-0711 Implications and Questions for Applicants

This issue mainly impacts the NRC staff’s evaluation of an applicant’s HSI Design and V&V. 

Information about how an applicant has considered this issue can be obtained using the 

following questions.

Human-system Interface Design

Will HSIs for new missions be available in the main control room; if so, how are they related 

to the HSIs for the safe generation of electrical power?

Describe the concept of use and provide an HSI overview for the HSIs for new missions?

How will alarms, displays, and control for new missions be integrated with those for reactor 

and BOP operations?

Human Factors Verification and Validation

How will the HSI design for new missions be validated?

2.19 Safety Function Monitoring

Issue Description

One action taken by the NRC after the accident at the Three-Mile Island NPP was to improve 

the operating crews’ ability to monitor critical safety functions by requiring each plant to install a 

safety-parameter display system (SPDS) through 10 CFR 50.34(f)(2)(iv). The NRC also 

published guidance on the characteristics of SPDS in NUREG-0835 (NRC, 1981)), NUREG1342 (Lapinsky et al., 1989), NUREG-0737 (Supplement 1) (NRC, 1983), and NUREG-0700, 

Section 5). The specific safety functions and parameters identified in these documents are 

based on conventional LWRs. However, SMR designs, using HTGRs and liquid metal reactors

(LMRs), may require different safety functions and parameters to help operating crews 

effectively monitor the plant’s safety.

Improving safety-function monitoring is a post-TMI item required by 10 CFR 50.34(f)(2)(iv). A 

change in this regulation is needed for some SMRs, such as HTGR and LMRs, to address the 

identification both of the safety functions appropriate for these designs and the important safety 

parameters that operators will use to monitor them. The new guidance will affect both NUREG0711 and NUREG-0700. While the guidance must be updated, new research is unlikely to be

needed to support the formulation of new guidance.

See also the sections identified at the beginning of Section 2.16, Control Room Configuration 

and Workstation Design for Multi-unit Teams, Section 2.2, Design of EOPs and Section 2.3, 

Multi-unit Operations and Teamwork. 

NUREG-0711 Implications and Questions for Applicants

This issue mainly impacts the NRC staff’s evaluation of an applicant’s HSI Design, Procedure 

Development and V&V. Information about how an applicant has considered this issue can be 

obtained using the following questions.

28
Human-system Interface Design

What are the critical safety functions and what parameters do operators monitor to 

determine their status?

How is the critical safety function information presented in the control room?

If operators monitor the safety functions for multiple units, how is the information for 

individual units presented in the control room and how is operator awareness of each unit 

assured?

Procedure Development

Describe how procedures will be developed to address the critical safety functions and 

monitored parameters.

Human Factors Verification and Validation

How will the HSI design for safety function monitoring be validated?

2.20 Potential Impacts of Unplanned Shutdowns or Degraded Conditions of One

Unit on Other Units

Issue Description

Unplanned shutdowns or degraded conditions of one unit may affect other units, especially 

those sharing systems. Operators must be able to detect and assess these impacts; therefore, 

HSIs are needed to support their managing the situation. Clear criteria should signal the 

conditions under which additional personnel must be brought in or the affected unit is 

transferred to another operator or crew. Further, the design of the main control room (MCR) and 

the HSI must support the effective transfer of a unit to other operators. 

While this is clearly a broad safety issue of interest to many NRC technical disciplines, more 

research is needed on the operator’s tasks, HSIs, procedures, and training essential to 

successfully manage such situations. The research should reflect approaches proposed by 

SMR applicants. Guidance is needed for HFE reviews of the proposed approach to handle 

unplanned shutdowns and degraded conditions.

See also the related issues in Section 2.9, Different Unit States of Operation, and Section 2.21, 

Handling Off-normal Conditions at Multiple Units.

NUREG-0711 Implications and Questions for Applicants

This issue mainly impacts the NRC staff’s evaluation of an applicant’s Staffing and 

Qualifications, HSI Design, Procedure Development, Training Program Development, and V&V. 

Information about how an applicant has considered this issue can be obtained using the 

following questions.

Staffing and Qualifications

Will there be a change in the staff members responsible for the affected unit?

29
Human-system Interface Design

How will operators detect and monitor the unplanned shutdowns or degraded conditions of 

one unit while monitoring multiple units?

Procedure Development

How will operating crews handle unplanned shutdowns or degraded conditions of one unit 

while the others are operating normally?

How will the units operating normally be affected if one unit shuts down or degrades?

Training Program Development

How will the handling of unplanned shutdowns or degraded conditions of one unit while the 

others are operating normally be addressed in training?

Human Factors Verification and Validation

How will the management of unplanned shutdowns or degraded conditions of one unit while 

the others are operating normally be validated?

2.21 Handling Off-normal Conditions at Multiple Units

Issue Description

Evaluations (e.g. applicant testing, research) are needed of the crew’s ability to handle offnormal conditions and emergencies7 in a control room with multiple units, as we commented on 

earlier in Sections 2.3 and 2.7. The evaluations should consider the potential for common-cause 

initiating events that could affect multiple onsite units, or even all of them. Examples are a loss 

of off-site power and “external events” such as fire, flood, and earthquakes.

As with current plants, changes in the crew, including their augmentation, may be needed to 

handle off-normal situations. Most SMRs propose having operators/crews monitoring and 

controlling multiple units. 

This issue affects 10 CFR’s staffing and emergency-planning regulations and guidance. SMR 

vendors stated that emergency planning zones might be reduced, potentially lowering the 

staffing requirements for Emergency Preparedness (EP) crews.

The resolution of this issue can have a significant impact on staffing, since any increase per 

SMR unit is multiplied by the number of reactors on site. 

See also the related issues in Section 2.9, Different Unit States of Operation, and Section 6.20, 

Potential Impacts of Unplanned Shutdowns or Degraded Conditions of One Unit on Other Units.

NUREG-0711 Implications and Questions for Applicants

7 Transients occur more frequently than accidents, and are less severe. Examples of transients are 

reactor or turbine trips, and loss of offsite power, while those of accidents are a stuck-open primary 

relief valve, and a loss of coolant accident.

30

 
This issue mainly impacts the NRC staff’s evaluation of an applicant’s Staffing and 

Qualifications, HSI Design, Procedure Development, Training Program Development, and V&V. 

Information about how an applicant has considered this issue can be obtained using the 

following questions.

Staffing and Qualifications

Will there be a change in the staff members responsible for the affected units?

- With operators controlling multiple reactors, do they need relief if a transient occurs in 

one of their units? If so, how will it be provided, on-shift or on-call?

- Will the designated transient relief be for the site or per unit? 

- Will this relief be an operator or a crew?

How is the number of EP staff determined for off-normal conditions at multiple units?

- Is the number of on-shift EP staff at current plants, adequate for multi-unit SMR plants? 

- Will it apply to the site or does each unit need a designated emergency crew?

Human-system Interface Design

How will operators detect and monitor the handling of off-normal conditions in multiple units?

Will the off-normal units be handled at the same workstation as the normally operating units

and with the same or different staff?

Procedure Development

How will operating crews handle off-normal conditions at multiple units?

How will the units operating normally be affected if there are off-normal conditions at 

multiple units?

Training Program Development

How will the handling of off-normal conditions at multiple units be addressed in training?

Human Factors Verification and Validation

How will the handling of off-normal conditions at multiple units be validated?

2.22 Design of Emergency Operating Procedures (EOPs) for Multi-unit

Disturbances

Issue Description

The potential for disturbances at multiple units, particularly those sharing systems, may 

necessitate developing emergency operating procedures (EOPs) that consider strategies for 

responding to multi-unit emergencies from external events, such as loss of grid, earthquakes, 

high winds, and floods, or from failures of shared systems, such as the ultimate cooling or the 

31
switchyard. Responses must be evaluated carefully to account for unit interactions and 

procedures must ensure the critical safety functions of each unit. 

Most new reactor designs have computer-based procedure (CBP) systems to support crews in 

managing emergency conditions. Their use in managing multi-unit emergencies must ensure 

the operators’ awareness of all units. The procedures likely will have to support use by multiple 

crew members. CBPs are relatively new operator-support systems in NPPs; the many new 

demands imposed by multi-unit EOPs will require new functionalities necessitating regulatory 

review.

The NRC reviews the design and content of EOPs and also their implementation as computerbased procedures under SRP Chapter 13 and 18 reviews. This guidance might need updating 

if EOPs are modified to cover multi-unit disturbances. In addition, NUREG-0700 contains 

detailed design review guidelines for CBPs that also may need upgrades to address multi-unit 

applications.

NUREG-0711 Implications and Questions for Applicants

This issue mainly impacts the NRC staff’s evaluation of an applicant’s Procedure Development 

and V&V. Information about how an applicant has considered this issue can be obtained using 

the following questions.

Procedure Development

Will each unit have independent procedures or will they be integrated? 

How will the execution of common procedures be managed?

Will an EOP be used by more than one crew member; if so, how is that managed?

Will EOPs be implemented as CBPs; if so, how will the CBP address multi-unit 

disturbances?

Human Factors Verification and Validation

How will EOPs for multi-unit disturbances be validated?

2.23 New Hazards

Issue Description

Two classes of SMR designs are based on non-light water technology: HTGRs, and LMRs. In 

contrast to LWR designs, they involve new technology-associated hazards, for example, 

hydrogen, liquid-metal (such as sodium and lead), much higher operating temperatures and 

pressures, the use of high temperature gas, and graphite in the core. Under some 

circumstances, graphite cores are flammable and could create radiologically hazardous fumes. 

The hazards must be understood, and then addressed in those safety systems that monitor and 

mitigate the hazards, in the HSIs that personnel employ to monitor the plant, the procedures 

they use to address hazards, and in operator training.

32
Vendors will need to address new hazards and the NRC will likely review them as part of the 

licensing process. Review guidance will be needed for monitoring the HSIs of systems that 

detect hazards, procedures identifying appropriate operator actions, and training in the overall 

management of hazards. 

NUREG-0711 Implications and Questions for Applicants

This issue mainly impacts the NRC staff’s evaluation of an applicant’s Task Analysis, HSI 

Design, Procedure Development, Training Program Development, and V&V. Information about 

how an applicant has considered this issue can be obtained using the following questions.

Task Analysis

What hazards exist for non-LWR technology aspects of the design and what human actions 

are needed to manage them?

Human-system Interface Design

How does the HSI alert operators to the presence of (or potential for) upsets associated with 

each new hazard?

Procedure Development

What procedures are available for use in managing new hazards?

Training Program Development

What training is provided for managing new hazards?

Human Factors Verification and Validation

How will personnel management of new hazards be validated?

2.24 Passive Safety Systems

Issue Description

Like some new reactor designs, SMRs employ passive safety systems to respond to transients 

and accidents that depend on physical processes rather than active components, such as 

pumps. For example, should an excessively high temperature be reached, the temperature 

gradient increases natural circulation. Many passive systems use one or two valves to initiate 

the process; the valve(s) must be highly reliable.

The IAEA (2009) has expressed concerns about passive systems based on the limited 

experience with reactor designs using such systems: 

• The reliability of passive safety systems may not be understood as well as that of active 

ones.

• There might be undesired interaction between active and passive safety systems.

• It may be difficult to ‘turn off’ an activated passive safety system after it was passively 

actuated.

33
We note that passive safety systems dependent on physical processes are not as amenable to 

routine testing as are active ones. There are no components to easily test, e.g., no pumps to 

start. For passive systems with valves, operating them would not fully test the process in the 

absence of the physical condition that initiates it. Thus, operators may not become as familiar 

using them as they are with current-generation active systems, nor know from operational 

experience how to verify the system’s proper automatic initiation and operation in a real event. 

For example, there may not be the same observable initiation signals to start systems. Flow 

rates and temperatures typically are much lower, and perhaps not as easily verified. 

Operational aspects of monitoring and verifying the success of passive systems must be 

defined, along with any operator’s actions needed to initiate or back them up should they fail to 

operate as designed.

Active safety systems must be tested periodically, giving operators the opportunity to become 

familiar with them. However, there may not be an equivalent opportunity with passive safety 

systems. Thus, higher reliance on simulators may be needed to assure the operators’ familiarity 

with, and training on, passive safety systems. 

Procedures must be written to carefully specify the operator’s actions for monitoring, backingup, and securing passive systems. NRC’s guidance must be enhanced to address these new 

review areas including the control room V&V program. 

NUREG-0711 Implications and Questions for Applicants

This issue mainly impacts the NRC staff’s evaluation of an applicant’s Task Analysis, HSI 

Design, Procedure Development, Training Program Development, and V&V. Information about 

how an applicant has considered this issue can be obtained using the following questions.

Task Analysis

How are passive features tested?

Are any operator actions needed to initiate passive features?

Are any operator actions needed as back-up, if passive features fail to operate as designed?

Human-system Interface Design

How do operators monitor the status and verify the success of passive systems?

Procedure Development

What procedures are available to guide operator actions for monitoring, backing-up, and 

securing passive systems?

Training Program Development

How will training enable operators to become familiar with passive systems?

34
Human Factors Verification and Validation

How will operator interaction with passive systems be validated?

2.25 Loss of HSIs and Control Room 

Issue Description

The design of a multi-modular SMR control room should consider the potential loss of HSIs and 

the entire MCR, taking into account (1) NRC I&C requirements and guidance, and (2) 10 CFR 

50 Appendix A, GDC 19, Control Room, and NUREG-0800 Section 9.5.1. Also, for the sitewide PRA (discussed in Section 2.26 below), the impact of loss of control room and HSIs might 

consider the following:

- potential loss of the main control room and how to use back-up facilities

- operator errors at one operator workstation may affect multiple units rather than just one

- potential loss of one operator workstation that impacts multiple units

- a site-wide initiating event that likely will impact all units similarly

Using a single MCR for multiple units has implications for various aspects of MCR requirements, 

guidance, and analyses, including design, PRA and failure analysis, HRA, GDC 19 compliance, 

MCR evacuation, NUREG-0800 Section 9.5 and remote shutdown. 

NUREG-0711 Implications and Questions for Applicants

This issue mainly impacts the NRC staff’s evaluation of an applicant’s HSI Design, procedure 

development, training development program and V&V. Information about how an applicant has 

considered this issue can be obtained using the following questions.

Human-system Interface Design

How are losses of the HSIs addressed in the HSI design, including:

- degradations or loss of the alarm system

- degradations or loss of the information system

- degradations or loss of the controls

- degradations or loss of the computer-based procedure system

- degradations or loss of an operator workstation

- degradations or loss of multiple workstations

- degradations or loss of the overview display

- loss of I&C

- degradations or loss of the entire MCR

35
Procedure Development

What procedures are available to guide operator actions on loss of the HSIs and the MCR? 

Training Program Development

How will training enable operators to respond to loss of the HSIs and the MCR?

Human Factors Verification and Validation

How will the response to loss of HSIs and the MCR be validated?

2.26 Probabilistic Risk Assessment Evaluation of Site-wide Risk

Issue Description

Current PRAs in the United States address two or three unit sites. However, SMR sites may 

have many more units. Therefore, modeling SMRs, especially those with shared systems, 

probably will require new models for PRAs. A single-unit PRA considers common or site-wide

systems such as offsite power, AC power on site, the ultimate heat sink, and various crossconnections between units, such as air- and cooling-water-systems. They also cover the effect 

on individual units of site-wide initiating events, such as loss of offsite power, station blackout, 

seismic events, and external floods. 

PRAs may need upgrading to encompass site-wide risk for multiple units. A PRA may evaluate

potential core damage (CD) at multiple units caused by site-wide initiating events and the 

influences of common systems and a common control room as potential common- cause 

failures. This site-wide PRA may result in CD at multiple units, but at a lower frequency than for 

a single unit. However, the PRA level 2 releases could be potentially higher due to CD at 

multiple units.

The overall issue of site-wide PRAs is a policy issue for the NRC. From an HFE perspective, 

calculating risk-important human actions (RIHAs) for a site-wide PRA may generate further 

actions than does a single-unit PRA. These RIHAs will be addressed as part of the applicant’s 

HFE program to ensure they can be reliably performed by plant staff. The treatment of RIHAs is 

already addressed in HFE reviews via NUREG-0711, so that new guidance for the HFE reviews 

may be unnecessary. However, additional HRA considerations might be required to identify 

these RIHAs. 

See the discussion in Section 2.27, Identification of RIHAs when One Operator/Crew is 

Managing Multiple SMRs.

NUREG-0711 Implications and Questions for Applicants

This issue mainly impacts the NRC staff’s evaluation of an applicant’s Treatment of Important 

Human Actions. Information about how an applicant has considered this issue can be obtained 

using the following questions:

Does the PRA consider the risks associated with multiple units and their shared systems? If 

so, are there important Human Actions (HAs) associated with the multi-unit models?

36
2.27 Identification of Important Human Actions when One Operator/Crew is 

Managing Multiple SMRs

Issue Description

An area where new techniques may be needed is the identification of HAs important to safety.

This issue originally focused on RIHAs that are identified as part of the HRA element within 

NUREG-0711. Subsequent to the identification of this SMR issue, NUREG-0711 was modified 

to broaden the scope of the HAs considered in the HRA element to include those that are 

identified deterministically, as well as those identified with the PRA. The NUREG-0711 element 

name was changed to “Treatment of Important Human Actions.” and the more general name for 

these actions is “important HAs.” Thus, we discuss this issue with the broader context of 

important HAs. 

Plant designers often identify and address important HAs in their HFE programs. For SMRs, 

this is more challenging since there will be new/unfamiliar systems and hence, little or no 

operating experience. If the PRA is more troublesome to quantify, it will be harder to accurately 

identify RIHAs. Similar difficulties may be encountered when the applicant performs 

deterministic analyses.

Even when the units themselves are deemed independent; i.e., no shared systems and the 

units are separated physically, there is the potential for human error if the same operator/crew 

monitors them. For example, the potential for human error for one unit may increase if the 

operator’s attention is directed to another unit. 

Modifications may be needed to deterministic analyses, as well as PRA and HRA methods, to

account for these effects. 

See also the discussion in Section 2.26, PRA Evaluation of Site-wide Risk.

NUREG-0711 Implications and Questions for Applicants

This issue mainly impacts the NRC staff’s evaluation of an applicant’s Treatment of Important 

Human Actions. Information about how an applicant has considered this issue can be obtained 

using the following questions.

Do the deterministic engineering analyses and probabilistic analyses consider the effects on 

HAs associated with:

- operators monitoring multiple units

- new and unfamiliar systems and their potential impact on human error

If so, are there risk-important HAs and deterministically important HAs associated with these 

aspects of operations?

37
2.28 Modular Construction and Component Replacement

Issue Description

Many SMRs are designed for modular construction and component replacement. Some SMR 

designs will be fabricated at the factory, transported to the plant site, and assembled there. 

Previously, plant personnel participated in the on-site construction, component-level testing of 

installed components, and pre-operational testing; hence, they gained a thorough knowledge of 

structures, systems, and components. Fabricating plants at factories will necessitate changing 

how personnel obtain knowledge of systems and components that historically was gained (at 

least partially) via the construction process.

The implications on safety of this approach are unknown, but should be discussed with industry 

and vendors to determine their plans to resolve this issue.

NUREG-0711 Implications and Questions for Applicants

This issue mainly impacts the NRC staff’s evaluation of an applicant’s Training Program. 

Information about how an applicant has considered this issue can be obtained using the 

following questions.

How is personnel knowledge of plant systems impacted by modular construction and 

modular component replacement?

How will the training program address these impacts?

2.29 New Maintenance Operations

Issue Description

Some SMRs will require new maintenance operations whose impact on safety must be 

assessed. They include operations such as disconnecting a reactor and moving it past other 

operating reactors to a maintenance location, which will involve decoupling the reactor from all 

the electrical and mechanical systems while continuously monitoring the reactor throughout the 

entire process. 

In addition, current practices take on new meaning in applying them to SMRs. Current 

operating practices led to the increase in capacity factors from about 63% several decades ago,

to the industry’s current 93%. These practices include on-line maintenance. The next 

generation of plants is similarly likely to employ on-line maintenance practices because the 

same working fluids (steam and water) and similar components and equipment (pumps, motors, 

valves, piping, and heat exchangers) will be used. Consequently, the SMRs can be expected to 

be maintained on line, just like their current larger counterparts. 

One outcome of continuous on-line maintenance is that the operator will be faced with several 

units, each in a different configuration due to normal maintenance and surveillance. Research 

is required to develop displays to show operators the important differences in the configurations 

of the units they are monitoring, and the acceptable operations. The operator requires an 

accurate situational awareness of each unit’s status. The displays are likely to differ from the 

current alarm and display strategies.

38
Plant operators are responsible for the plant and its safe operation including establishing and 

maintaining it in a condition that is safe for maintenance personnel. Operators take a system 

out of service, ensure it is safely isolated during maintenance, and return it to service. The 

process is difficult enough with one operating crew per unit; it must be evaluated for multiple 

units. Systems are taken out of, and returned to service under the direction of the control room, 

typically through a system of locks and tags that signal to maintenance personnel and others 

when the component and system cannot be operated. Additional research is required into the 

ways by which operators can maintain safe configuration of multiple units during maintenance.

NUREG-0711 Implications and Questions for Applicants

This issue mainly impacts the NRC staff’s evaluation of an applicant’s Treatment of Important 

Human Actions, HSI Design, Procedure Development, and Training Program Development. 

Information about how an applicant has considered this issue can be obtained using the 

following questions.

Treatment of Important Human Actions

What are the impacts of maintenance of one unit on the safety of other units?

Human-system Interface Design

How are maintenance operations and their impact on safety monitored with the HSI?

Procedure Development

What procedures are available to guide personnel in the performance of maintenance 

operations? 

Training Program Development

How will training enable operators to perform maintenance operations?

2.30 Managing Maintenance Hazards

Issue Description

We identified several potential challenges in human factors associated with maintaining each 

specific design we examined. These challenges include:

- The International Reactor Innovative and Secure (IRIS) design has eight in-vessel 

reactor coolant pumps (RCPs). Pump seals are replaced in-vessel, likely considered as 

a confined space, with work on contaminated and activated components that are personrem intensive. This arrangement may increase the difficulty of maintenance and create 

the potential for delays in needed maintenance, errors in completing the work, and 

higher exposures to workers. 

- IRIS’s in-vessel electrical wiring, such as to the RCPs and internal control rods, may 

require specially qualified staff, and/or periodic testing for enhanced aging, because it 

will be operating in a very harsh radiation environment. 

39
- The operations and the maintenance staffs of the Gas Turbine-Modular Helium Reactor 

(GT-MHR) and the Pebble Bed Modular Reactor (PBMR) need extensive training on the 

hazards of helium leaks and their detection.

- Sodium is the primary coolant in the Super Safe, Small and Simple (4S) reactor and the 

Power Reactor Innovative Small Module (PRISM) designs; accordingly, maintenance on 

the two external steam generators (SGs) is hazardous, and will entail specific training 

because operators must wear specialized personal protective equipment (PPE) and 

work in an inert atmosphere. 

- Lead/bismuth is the primary coolant in the Hyperion Power Module (HPM), so working 

on the external SGs may be hazardous, requiring specialized training and the use of 

particular PPE.

These new maintenance practices should be analyzed carefully to ensure personnel and plant 

safety.

NUREG-0711 Implications and Questions for Applicants

This issue can most likely be addressed by industry research, and vendors’ HFE programs 

addressing maintenance design and planning, rather than by the NRC; thus we have not 

identified specific questions to address it.

40
3 CONCLUSION

The purpose of this report is to supplement the research in NUREG/CR-7126 and support NRC 

HFE reviews of SMR applications by identifying questions that can be asked of applicants 

whose designs contain characteristics identified as potential human-performance issues. As 

noted in Section 1, knowledge of key issues provides reviewers with information about what 

questions to ask SMR design applicants; and knowing what questions to ask is a vital aspect of 

conducting a design review. 

Until enhanced review guidance becomes available for these issues, the information provided 

by applicants in response to the NRC staff’s questions can be evaluated in a number of different 

ways, as outlined in Section 1. 

Flexibility is essential in a safety-review process to accommodate the applicant’s design 

innovations that may impact safety. Review strategies, such as we described above, provide a 

means for an HFE reviewer to address such innovations and applications of new technologies 

and operational strategies.

41

4 REFERENCES

Beck, J., Garcia, C. & Pincock, L. (2010). High Temperature Gas-Cooled Reactors Lessons 

Learned Applicable to the Next Generation Nuclear Plant (INL/EXT-10-19329). Washington, 

D.C.: DOE.

Clayton, D. & Wood, R. (2010). The role of Instrumentation and Control Technology in Enabling 

Deployment of Small Modular Reactors. In Proceeding of the Seventh American Nuclear 

Society International Topical Meeting on Nuclear Plant Instrumentation, Control, and 

Human-Machine Interface Technologies (NPIC&HMIT 2010). La Grange Park, Illinois: 

American Nuclear Society, Inc.

Copinger, D. & Moses, D. (2004). Fort Saint Vrain Gas Cooled Reactor Operational Experience 

(NUREG/CR-6839). Washington, D.C.: U.S. Nuclear Regulatory Commission.

Demick, L. (2010). Transforming the U.S. Energy Infrastructure (IN/EXT-09-17436). 

Washington, DC: U.S. Department of Energy.

Hugo. J. & Engela, H. (2005). Function allocation for industrial human-system interfaces. In 

Proceedings of CybErg 2005. Johannesburg, South Africa: International Ergonomics 

Association Press.

IAEA (2009). Design Features to Achieve Defense in Depth in Small and Medium Sized 

Reactors (IAEA Nuclear Energy Series Technical Report No. NP-T-2.2). Vienna, Austria: 

International Atomic Energy Agency.

Lapinsky, G., Eckenrode, R., Goodman, P. & Correia, R. (1989). A Status Report Regarding 

Industry Implementation of Safety Parameter Display System (NUREG-1342). Washington, 

D.C.: U. S. Nuclear Regulatory Commission.

NRC (2010). Potential Policy, Licensing, and Key Technical Issues For Small Modular Nuclear 

Reactor Designs (SECY-10-0034). Washington, D.C.: U.S. Nuclear Regulatory 

Commission. 

NRC (2007) Standard Review Plan, Chapter 18 - Human Factors Engineering. Washington, 

D.C.: U. S. Nuclear Regulatory Commission.

NRC (1983). Clarification of TMI Action Plan Requirements (NUREG-0737 and supplements). 

Washington, DC: U.S. Nuclear Regulatory Commission.

NRC (1981). Human Factors Acceptance Criteria for the Safety Parameter Display System

(NUREG-0835). Washington, D.C.: U. S. Nuclear Regulatory Commission

O'Hara, J., Brown, W., Lewis, P., & Persensky, J. (2002). Human-system Interface Design 

Review Guidelines (NUREG-0700, Rev 2). Washington, D.C.: U.S. Nuclear Regulatory 

Commission.

O’Hara, J, & Higgins, J. (2010). Human-System Interfaces to Automatic Systems: Review 

Guidance and Technical Basis (BNL Technical Report 91017-2010). Upton, NY: 

Brookhaven National Laboratory.

O'Hara, J., Higgins, J., Brown, W. & Fink, R. (2008). Human Factors Considerations with 

Respect to Emerging Technology in Nuclear Power Plants: Detailed Analyses (BNL 

Technical Report No: 79947-2008). Upton, NY: Brookhaven National Laboratory.

43
O’Hara, J., Higgins, J., & Pena, M. (2011). Human-Performance Issues Related to the Design 

and Operation of Small Modular Reactors(NUREG/CR-7126). Washington, D.C.: U. S. 

Nuclear Regulatory Commission.

O'Hara, J., Higgins, J., Persensky, J., Lewis, P. & Bongarra, J. (2004). Human Factors 

Engineering Program Review Model (NUREG-0711, Rev.2). Washington, D.C.: U.S. 

Nuclear Regulatory Commission.

Persensky, J., Szabo, A., Plott, C., Engh, T. & Barnes, A. (2005). Guidance for Assessing 

Exemption Requests from the Nuclear Power Plant Licensed Operator Staffing 

Requirements Specified in 10 CFR 50.5(m) (NUREG-1791). Washington, D.C.: U.S. 

Nuclear Regulatory Commission.

Wood, R., Antonescu, C., Arndt, S., Britton, C., Brown-VanHoozer, S. Calvert, J. Damiano, B., 

Easter, J., Freer, M. , Mullens, J., Neal, J., Protopopescu,V., Shaffer, R., Schryver, J., 

Smith, C. Tucker, R., Uhrig, R., Upadhyaya, B., Wetherington, G., Wilson, T., White, J., & 

Whitus, B. (2003). Emerging Technologies in Instrumentation and Controls (NUREG/CR6812). Washington, D.C.: U.S. Nuclear Regulatory Commission.

44
APPENDIX A QUESTIONS FOR SMR APPLICANTS ORGANIZED BY

 NUREG-0711 ELEMENT

In this appendix, the questions identified in Section 2 for each issue are reorganized by 

NUREG-0711 review element. Following each question, the Section 2 issue associated with the 

question is identified in parentheses. Reviewers needing additional information about the 

question should consult the originating issue in Section 2.

A.1 Operating Experience Review

What are the sources of operating experience contributing to the design of the SMR? Applicants 

should describe all relevant sources, even those that may come from non-nuclear systems. 

(Novel Designs and Limited Operating Experience from Predecessor Systems)

What operating experience is available for predecessor systems associated with the new 

missions? (New Missions)

What operating experience for multi-unit operations has been collected? (Multi-unit Operations 

and Teamwork)

What information will be used as a substitute for operating experience for those aspects of the 

design for which operating experience is unavailable? (Novel Designs and Limited Operating 

Experience from Predecessor Systems)

How has this operating experience been used in the design? (Novel Designs and Limited 

Operating Experience from Predecessor Systems)

A.2 Functional Requirements Analysis and Function Allocation

New Mission Considerations

How are functions associated with new missions addressed in the functional requirements 

analysis and function allocation? (New Missions)

If pertinent, do the functions and systems associated with new missions interact with those 

associated with the safe generation of electrical power?

If process-heat applications are envisioned for multi-unit sites, are different ones allowed at the 

same facility, e. g., hydrogen production, steam production, desalination, refining, and electricity 

production? (New Missions)

Are systems shared between the various missions that may be implemented at the site? (New 

Missions)

Describe the level of automation associated with new missions and the personnel roles and 

responsibilities for them? (New Missions)

Will the new processes associated with these missions create new hazards and safety issues, 

such as fires and explosions from hydrogen, methane, or natural gas? (New Missions)

New Operational Considerations

A-1
What are the non-LWR processes and systems and what missions do they support? (Managing 

Non-LWR Processes and Reactivity Effects)

What is the operator’s role in controlling reactivity effects? (Managing Non-LWR Processes and 

Reactivity Effects)

How is load following accomplished and what are the relative roles of NPP personnel; non-plant 

personnel, such as an external load dispatcher; and automation? (Load-following Operations)

How is refueling accomplished and what are the relative roles of NPP personnel and 

automation? (Novel Refueling Methods)

Automation Considerations

How has the applicant’s HFE program addressed the human performance issues associated 

with high-levels of automation? (High Levels of Automation for All Operations and its 

Implementation)

What function allocation methodology, rules, or criteria were used to determine the appropriate 

level of automation for SMR functions? (Function Allocation Methodology to Support Automation 

Decisions)

A.3 Task Analysis

New Mission Considerations

What tasks do personnel have to perform for the new missions? (New Missions)

How do the new mission tasks relate to those performed for the safe generation of electrical 

power? (New Missions)

New Operational Considerations

How are passive features tested? (Passive Safety Systems)

Are any operator actions needed to initiate passive features? (Passive Safety Systems)

Are any operator actions needed as back-up, if passive features fail to operate as designed.

(Passive Safety Systems)

Automation Considerations

How were personnel tasks identified and analyzed for personnel responsibilities with regard to 

automatic functions? (High Levels of Automation for All Operations and its Implementation)

Degraded and Off-normal Conditions Considerations

What hazards exist for non-LWR technology aspects of the design and what human actions are 

needed to manage them? (New Hazards)

A-2
A.4 Staffing and Qualifications

New Mission Considerations

Will new process applications use the same or different operators as the safe generation of 

electrical power? (New Missions)

How do new missions impact overall staffing? (New Missions)

New Operational Considerations

How are load-following operations staffed and what qualifications are needed? (Load-following 

Operations)

How do load-following duties impact other personnel duties? (Load-following Operations)

How are refueling operations staffed and what qualifications are needed? (Novel Refueling 

Methods)

How do refueling duties impact other personnel duties? (Novel Refueling Methods)

Multi-Unit Considerations 

As a team, how will crews manage units in different states, e.g., will one operator continue to 

monitor multiple units in different states, or will units in states other than at-power be transferred 

to a different operator or crew? (Different Unit States of Operation)

What analysis or data are available to demonstrate that operators and crews maintain situation 

awareness of units in different states and that they will properly respond to unplanned changes 

in a unit’s state and to off-normal conditions? (Different Unit States of Operation)

How will multi-unit responsibly be assigned to staff? (Multi-unit Operations and Teamwork)

How will teamwork be assured for multi-unit operations? (Multi-unit Operations and Teamwork)

Staffing Considerations

What staffing positions will be responsible to perform tasks associated with new missions and 

new operational activities? (New Staffing Positions)

Will staffing models (general approaches to fulfilling the organizational functions necessary to 

operate a NPP, including operations, maintenance, engineering, administration, and security, 

see Section 2.7) be employed that deviate from current practice? (Staffing Models) 

If so, describe the new staffing model and how it differs from previously used or conventional 

models.

Will staffing levels will be employed that deviate from those previously used in NPPs? (Staffing 

Levels)

A-3
Degraded and Off-normal Conditions Considerations

Will there be a change in the staff members responsible for the affected units?

- With operators controlling multiple reactors, do they need relief if a transient occurs in 

one of their units? If so, how will it be provided, on-shift or on-call?

- Will the designated transient relief be for the site or per unit? 

- Will this relief be an operator or a crew? (Handling Off-normal Conditions at Multiple 

Units and Potential Impacts of Unplanned Shutdowns or Degraded Conditions of One 

Unit on Other Units)

How is the number of EP staff determined for off-normal conditions at multiple units?

- Is the number of on-shift EP staff at current plants adequate for multi-SMR plants? 

- Will it apply to the site or does each unit need a designated emergency crew? (Handling 

Off-normal Conditions at Multiple Units)

A.5 Treatment of Important Human Actions

New Mission Considerations

How will important human actions for new missions be identified? (New Missions)

Are there important human actions associated with the new missions? (New Missions)

New Operational Considerations

Are load-following failures modeled in the PRA and are human actions contained in the model?

(Load-following Operations)

Are refueling failures modeled in the PRA and are risk-important human actions accurately 

accounted for in the model? (Novel Refueling Methods)

What are the impacts of maintenance of one unit on the safety of other units? (New 

Maintenance Operations)

Multi-Unit Considerations

Does the PRA consider the risks associated with multiple units and their shared systems? If so, 

are there important HAs associated with the multi-unit models? (Probabilistic Risk Assessment 

Evaluation of Site-wide Risk)

Do the deterministic and PRA analyses consider the effects on HAs associated with:

- operators monitoring multiple units

- new and unfamiliar systems and their potential impact on human error? 

If so, are there important HAs associated with these aspects of operations? (Identification of 

Important Human Actions when One Operator/Crew is Managing Multiple SMRs)

A.6 Human-system Interface Design

A-4
New Mission Considerations

Will HSIs for new missions be available in the main control room; if so, how are they related to 

the HSIs for the safe generation of electrical power? (HSIs for New Missions)

Describe the concept of use and provide an HSI overview for the HSIs for new missions? (HSIs 

for New Missions)

How will alarms, displays, and control for new missions be integrated with those for reactor and 

BOP operations? (HSIs for New Missions)

New Operational Considerations

What are the critical safety functions and what parameters do operators monitor to determine 

their status? (Safety Function Monitoring)

How is the critical safety function information presented in the control room? (Safety Function 

Monitoring)

If operators monitor the safety functions for multiple units, how is the information for individual 

units presented in the control room and how is operator awareness of each unit assured?

(Safety Function Monitoring)

How do operators monitor the status and verify the success of passive systems? (Passive 

Safety Systems)

What HSIs are available for reactivity monitoring and control of non-LWR processes?

(Managing Non-LWR Processes and Reactivity Effects)

What HSIs are needed for load-following operations and how are they integrated into the overall 

control room design? (Load-following Operations)

What HSIs are needed for refueling operations and how are they integrated into the overall 

control room design? (Novel Refueling Methods)

How are maintenance operations and their impact on safety monitored with the HSI? (New 

Maintenance Operations)

Multi-unit Considerations

How will the HSI be designed to ensure operator awareness of each unit’s status? (Different 

Unit States of Operation)

Are there unit differences that can impact operator performance? If so, how are they depicted 

on the HSIs used by operators? (Unit Design Differences)

How was it determined what unit differences should be depicted in plant HSIs? (Unit Design 

Differences)

How will shared systems be depicted in the HSIs and how do operators determine that they are 

performing properly? (Operational Impact of Control Systems for Shared Aspects of SMRs)

A-5
How do operators identify degradations of the I&C system; how are they identified in the HSIs? 

(Operational Impact of Control Systems for Shared Aspects of SMRs)

Will different operators be able to control systems shared between units; if so, how is the control 

managed? (Operational Impact of Control Systems for Shared Aspects of SMRs)

Will any changes be needed to HSIs during the time period when new units are added to the 

plant? (Impact of Adding New Units While Other Units are Operating)

How will a new unit’s HSIs be added to an existing workstation that is being used to monitor and 

control other units? (Impact of Adding New Units While Other Units are Operating)

How will new workstations that support the operation of new units be introduced in a manner 

that does not distract or disrupt the monitoring and control of existing units? (Impact of Adding 

New Units While Other Units are Operating)

Explain how the overall control room layout supports:

- multi-unit operations, including reactor operations, BOP systems, shared systems, 

refueling, etc.

- other personnel responsibilities for new missions, such as hydrogen production

- maintenance activities performed from the control room (Control Room Configuration 

and Workstation Design for Multi-unit Teams)

How does the control room configuration and workstation design support the minimal, nominal, 

and maximum staffing levels? (Control Room Configuration and Workstation Design for Multiunit Teams)

How does the design of the control room support teamwork and supervision tasks? (Control 

Room Configuration and Workstation Design for Multi-unit Teams)

How are workstations designed/configured to support the responsibilities of individual 

operators? (Control Room Configuration and Workstation Design for Multi-unit Teams)

Describe the concept of use and provide an HSI overview for the HSIs for multi-unit operations? 

(HSI Design for Multi-unit Monitoring and Control)

How are the alarms for multiple units presented in the control room and on the workstations? 

How is operator awareness of all high-priority alarms assured? (HSI Design for Multi-unit 

Monitoring and Control)

What HSI features are used to support operator/crew SA for all the units operators are 

assigned ? (HSI Design for Multi-unit Monitoring and Control)

How are controls designed for operators to interact with different units from a single 

workstation? (HSI Design for Multi-unit Monitoring and Control)

What design features are implemented to minimize wrong unit errors? (HSI Design for Multi-unit 

Monitoring and Control)

A-6
From an HSI standpoint, how is control for one unit transferred from one operator to another?

(HSI Design for Multi-unit Monitoring and Control)

Automation Considerations

How are HSIs designed to support the performance of personnel tasks associated with their 

responsibilities for interacting with automatic systems? (High Levels of Automation for All 

Operations and its Implementation)

Degraded and Off-normal Conditions Considerations

How will operators handle the unplanned shutdowns or degraded conditions of one unit while 

monitoring multiple units? (Potential Impacts of Unplanned Shutdowns or Degraded Conditions 

of One Unit on Other Unit)

How will operators detect and monitor the handling of off-normal conditions at multiple units? 

(Handling Off-normal Conditions at Multiple Units)

Will the off-normal units be handled at the same workstation as the normally operating units and 

with the same or different operators? (Handling Off-normal Conditions at Multiple Units)

How does the HSI alert operators to the presence of (or potential for) upsets associated with 

each new hazard? (New Hazards)

How are loss of the HSIs and the MCR addressed in the HSI design, including:

- degradations or loss of the alarm system

- degradations or loss of the information system

- degradations or loss of the controls

- degradations or loss of the computer-based procedure system

- degradations or loss of an operator workstation

- degradations or loss of multiple workstations

- degradations or loss of the overview display

- loss of the I&C system

- degradations or loss of the entire MCR? (Loss of HSIs and Control Room)

A.7 Procedure Development

New Mission Considerations

What procedures will govern new missions? (New Missions)

How do these procedures relate to those used for the safe generation of electrical power 

mission; will there be integrated procedures addressing tasks for multiple missions? (New 

Missions)

A-7
New Operational Considerations

What procedures are available to guide operator actions for monitoring, backing-up, and 

securing passive systems? (Passive Safety Systems)

How is reactivity monitoring and control for non-LWRs addressed in plant procedures? 

(Managing Non-LWR Processes and Reactivity Effects)

What procedures are needed for load-following operations and how are they implemented in the 

control room? Will there be procedures for off-site load dispatchers? (Load-following 

Operations)

What procedures are needed for refueling operations and how are they implemented in the 

control room? (Novel Refueling Methods)

What procedures are available to guide personnel in the performance of maintenance 

operations? (New Maintenance Operations)

Multi-unit Considerations

How will the installation of new units impact procedures? Will separate procedures be used 

during this time? (Impact of Adding New Units While Other Units are Operating)

What impact does multi-unit operations have on overall procedure structure and the design of 

individual procedures? (Multi-unit Operations and Teamwork)

How will different unit states be addressed in procedures? (Different Unit States of Operation)

How are unit differences addressed in plant procedures? (Unit Design Differences)

How do procedures address the operators interaction with the control systems for multiple units 

as well as for shared systems for plant configurations that have different missions? (Operational 

Impact of Control Systems for Shared Aspects of SMRs)

Degraded and Off-normal Conditions Considerations

Describe how procedures will be developed to address the critical safety functions and 

monitored parameters. (Safety Function Monitoring)

Will each unit have independent EOPs or will they be integrated? (Design of Emergency 

Operating Procedures (EOPs) for Multi-unit Disturbances)

How will the execution of common EOPs be managed? (Design of Emergency Operating 

Procedures (EOPs) for Multi-unit Disturbances)

Will an EOP be used by more than one crew member; if so, how it that managed? (Design of 

Emergency Operating Procedures (EOPs) for Multi-unit Disturbances)

Will EOPs be implemented as CBPs; if so, how will the CBP address multi-unit disturbances?

(Design of Emergency Operating Procedures (EOPs) for Multi-unit Disturbances)

A-8
How will operating crews handle unplanned shutdowns or degraded conditions of one unit while 

the others are operating normally? (Potential Impacts of Unplanned Shutdowns or Degraded 

Conditions of One Unit on Other Units)

How will the units operating normally be affected if one unit shutdown or degrades? (Potential 

Impacts of Unplanned Shutdowns or Degraded Conditions of One Unit on Other Units)

How will operating crews handle off-normal conditions at multiple units? (Handling Off-normal 

Conditions at Multiple Units)

How will the units operating normally be affected if there are off-normal conditions at multiple 

units? (Handling Off-normal Conditions at Multiple Units)

What procedures are available for use in managing new hazards? (New Hazards)

What procedures will be available to support operators in the management of degraded I&C 

conditions? (Operational Impact of Control Systems for Shared Aspects of SMRs)

What procedures are available to guide operator actions on loss of the HSIs and the MCR? 

(Loss of HSIs and Control Room)

A.8 Training Program Development

New Mission Considerations

Describe the training requirements and demands for new missions? (New Missions)

Will plant operators be trained in dealing with upset conditions in process-heat applications, and 

other interfacing requirements? (New Missions)

Depending on number of process applications the nuclear facility services, how will these new 

responsibilities complicate operator training since they must be familiar with all application 

interfaces? (New Missions)

New Operational Considerations

How will training enable operators to become familiar with passive systems? (Passive Safety 

Systems)

How are non-LWR processes addressed in operator training? (Managing Non-LWR Processes 

and Reactivity Effects)

How is the control of reactivity effects addressed in operator training? (Managing Non-LWR 

Processes and Reactivity Effects)

What training is necessary for operators to perform load-following operations? Will load 

dispatchers be trained together with plant operators? (Load-following Operations)

What training is necessary for operators to perform refueling operations? (Novel Refueling 

Methods)

A-9
How will training enable operators to perform maintenance operations? (New Maintenance 

Operations)

How is personnel knowledge of plant systems impacted by modular construction and modular 

component replacement? (Modular Construction and Component Replacement)

How will the training program address these impacts? (Modular Construction and Component 

Replacement)

Multi-unit Considerations

How are unit differences addressed in operator training? (Different Unit States of Operation and

Unit Design Differences)

Degraded and Off-normal Conditions Considerations

How will the handling of unplanned shutdowns or degraded conditions of one unit while the 

others are operating normally be addressed in training? (Potential Impacts of Unplanned 

Shutdowns or Degraded Conditions of One Unit on Other Units)

How will the handling of off-normal conditions at multiple units be addressed in training? 

(Handling Off-normal Conditions at Multiple Units)

What training is provided for managing new hazards? (New Hazards)

How will training enable operators to respond to loss of the HSIs and the MCR? (Loss of HSIs 

and Control Room)

Staffing Considerations

How are the new mission and operational responsibilities addressed in the training program? 

(New Staffing Positions)

A.9 Human Factors Verification and Validation

New Mission Considerations

How will the HSI design for new missions be validated? (HSIs for New Missions)

New Operational Considerations

How will operator interaction with passive systems be validated? (Passive Safety Systems)

How will the performance of non-LWR tasks be incorporated into Human Factors V&V?

(Managing Non-LWR Processes and Reactivity Effects)

How will reactivity control performance be validated? (Managing Non-LWR Processes and 

Reactivity Effects)

A-10
How will the design of the integrated system for load-following operations be validated? (Loadfollowing Operations)

How will the design of the integrated system for refueling operations be validated? (Novel 

Refueling Methods)

How will the HSI design for safety function monitoring be validated? (Safety Function 

Monitoring)

Multi-unit Considerations

How will integrated system validation methodology validate multi-unit operations? (Multi-unit 

Operations and Teamwork)

How will the design of the control room and workstations for multi-unit teams be validated? 

(Control Room Configuration and Workstation Design for Multi-unit Teams)

How will the HSI design for multi-unit monitoring and control be validated? (HSI Design for Multiunit Monitoring and Control)

How will EOPs for multi-unit disturbances be validated? (Design of Emergency Operating 

Procedures (EOPs) for Multi-unit Disturbances)

Automation Considerations

How is the level of automation and the associated personnel tasks validated to ensure 

successful performance and to ensure that the human performance concerns associated with 

high-levels of automation are addressed? (High Levels of Automation for All Operations and its 

Implementation)

Staffing Considerations

How will integrated system validation methodology validate the new staffing model? (Staffing 

Models)

How will integrated system validation methodology validate the staffing levels? (Staffing Levels)

Degraded and Off-normal Conditions Considerations

How will the management of unplanned shutdowns or degraded conditions of one unit while the 

others are operating normally be validated? (Potential Impacts of Unplanned Shutdowns or 

Degraded Conditions of One Unit on Other Units)

How will the handling of off-normal conditions at multiple units be validated? (Handling Offnormal Conditions at Multiple Units)

How will personnel management of new hazards be validated? (New Hazards)

How will the response to loss of HSIs and the MCR be validated? (Loss of HSIs and Control 

Room)

A-11





NUREG/CR-7202 NRC Reviewer Aid for Evaluating the Human-Performance Aspects Related to 

the Design and Operations of Small Modular Reactors