Human-Performance Issues 

Related to the Design and 

Operation of Small Modular 

Reactors

Office of Nuclear Regulatory Research

NUREG/CR-7126

BNL-NUREG-96654-2011
DISCLAIMER: This report was prepared as an account of work sponsored by an agency of the U.S. Government. 

Neither the U.S. Government nor any agency thereof, nor any employee, makes any warranty, expressed or

implied, or assumes any legal liability or responsibility for any third party’s use, or the results of such use, of any

information, apparatus, product, or process disclosed in this publication, or represents that its use by such third

party would not infringe privately owned rights.

AVAILABILITY OF REFERENCE MATERIALS

IN NRC PUBLICATIONS

NRC Reference Material

As of November 1999, you may electronically access

NUREG-series publications and other NRC records at

NRC’s Public Electronic Reading Room at 

http://www.nrc.gov/reading-rm.html. Publicly released

records include, to name a few, NUREG-series

publications; Federal Register notices; applicant,

licensee, and vendor documents and correspondence;

NRC correspondence and internal memoranda;

bulletins and information notices; inspection and

investigative reports; licensee event reports; and

Commission papers and their attachments.

NRC publications in the NUREG series, NRC

regulations, and Title 10, Energy, in the Code of

Federal Regulations may also be purchased from one

of these two sources.

1. The Superintendent of Documents

 U.S. Government Printing Office

 Mail Stop SSOP

 Washington, DC 20402–0001

 Internet: bookstore.gpo.gov

 Telephone: 202-512-1800

 Fax: 202-512-2250

2. The National Technical Information Service

 Springfield, VA 22161–0002

 www.ntis.gov 

 1–800–553–6847 or, locally, 703–605–6000

A single copy of each NRC draft report for comment is

available free, to the extent of supply, upon written

request as follows:

Address: U.S. Nuclear Regulatory Commission

 Office of Administration 

 Publications Branch

 Washington, DC 20555-0001

E-mail: DISTRIBUTION.RESOURCE@NRC.GOV 

Facsimile: 301–415–2289 

Some publications in the NUREG series that are 

posted at NRC’s Web site address

http://www.nrc.gov/reading-rm/doc-collections/nuregs 

are updated periodically and may differ from the last

printed version. Although references to material found

on a Web site bear the date the material was accessed,

the material available on the date cited may

subsequently be removed from the site.

Non-NRC Reference Material

Documents available from public and special technical

libraries include all open literature items, such as

books, journal articles, and transactions, Federal

Register notices, Federal and State legislation, and

congressional reports. Such documents as theses,

dissertations, foreign reports and translations, and

non-NRC conference proceedings may be purchased

from their sponsoring organization.

Copies of industry codes and standards used in a

substantive manner in the NRC regulatory process are

maintained at—

The NRC Technical Library 

Two White Flint North

11545 Rockville Pike

Rockville, MD 20852–2738

These standards are available in the library for 

reference use by the public. Codes and standards are

usually copyrighted and may be purchased from the

originating organization or, if they are American

National Standards, from—

American National Standards Institute

11 West 42nd Street

New York, NY 10036–8002

www.ansi.org 

212–642–4900

Legally binding regulatory requirements are stated

only in laws; NRC regulations; licenses, including

technical specifications; or orders, not in 

NUREG-series publications. The views expressed

in contractor-prepared publications in this series are

not necessarily those of the NRC.

The NUREG series comprises (1) technical and

administrative reports and books prepared by the

staff (NUREG–XXXX) or agency contractors

(NUREG/CR–XXXX), (2) proceedings of

conferences (NUREG/CP–XXXX), (3) reports

resulting from international agreements

(NUREG/IA–XXXX), (4) brochures

(NUREG/BR–XXXX), and (5) compilations of legal

decisions and orders of the Commission and Atomic

and Safety Licensing Boards and of Directors’

decisions under Section 2.206 of NRC’s regulations

(NUREG–0750).
Human-Performance 

Issues Related to the 

Design and Operation of 

Small Modular Reactors 

Manuscript Completed: January 2012

Date Published: June 2012

Prepared by: 

John O’Hara, Jim Higgins, and Michael Pena

Brookhaven National Laboratory

Building 130

Upton, NY 11973

Prepare for:

Division of Risk Analysis

Office of Nuclear Regulatory Research

U.S. Nuclear Regulatory Commission

Washington, DC 20555-0001

Office of Nuclear Regulatory Research

NUREG/CR-7126

BNL-NUREG-96654-2011

iii

ABSTRACT

Small modular reactors (SMRs) are a promising approach to meeting future energy needs. 

Although the electrical output of an individual SMR is relatively small compared to that of typical 

commercial nuclear plants, they can be grouped to produce as much energy as a utility 

demands. Furthermore, SMRs can be used for other purposes, such as producing hydrogen 

and generating process heat. The design characteristics of many SMRs differ from those of 

current conventional plants and may require a distinct concept of operations (ConOps). In this 

U.S. Nuclear Regulatory Commission (NRC) research project, we examined the human factors 

engineering (HFE) and the operational aspects of SMRs. Our main objective was to identify 

potential issues in human performance related to the design and operations of SMRs. For our 

purposes, the term “issue” refers to (1) an aspect of SMR development or design for which 

information suggests a negative impact on human performance; (2) an aspect of SMR 

development or design that may degrade human performance, but additional research and/or 

analysis is needed to better understand and quantify the effect; and (3) a technology or 

technique that will be used in designing new plants or implementing them for which there is little 

or no review guidance. To accomplish this objective, we first developed a six-dimensional 

ConOps model that we then used to obtain information about SMRs. Since there is little 

detailed information about the operational and HFE aspects of SMRs, we also examined several 

“surrogate facilities,” such as petroleum refineries, wherein operators manage multiple units in a 

manner similar to what might be expected of SMR operators. We used this information to 

identify a set of potential human-performance issues that might be considered in the NRC’s

reviews of SMR designs and future research activities.

v

CONTENTS

ABSTRACT...............................................................................................................................iii

CONTENTS............................................................................................................................... v

LIST OF FIGURES ..................................................................................................................viii

LIST OF TABLES....................................................................................................................viii

LIST OF ACRONYMS ...............................................................................................................ix

1 INTRODUCTION.................................................................................................................. 1

1.1 Background................................................................................................................ 1

1.2 Objective.................................................................................................................... 2

1.3 Methodology .............................................................................................................. 2

1.4 Organization of this Report......................................................................................... 3

2 MODEL OF A CONCEPT OF OPERATIONS ...................................................................... 5

2.1 Use of Concept of Operations in Systems Engineering .............................................. 5

2.2 Concept of Operations in NRC HFE Regulatory Reviews........................................... 6

2.3 Model Dimensions...................................................................................................... 6

2.4 Concept of Operations Questionnaire ........................................................................ 9

2.5 Conclusions ..............................................................................................................10

3 DESIGN AND OPERATIONS OF SMALL MODULAR REACTORS ..................................11

3.1 Integral Pressurized Water Reactors.........................................................................12

3.2 High-Temperature, Gas-Cooled Reactors .................................................................17

3.3 Liquid-Metal Reactors ...............................................................................................20

3.4 Insights for SMR ConOps from SMR Design and Operations....................................24

4 GENERAL SMR LITERATURE ..........................................................................................31

4.1 Plant Mission.............................................................................................................31

4.2 Agents’ Roles and Responsibilities ...........................................................................31

4.3 Staffing, Qualifications, and Training.........................................................................32

4.4 Management of Normal Operations...........................................................................35

4.5 Management of Off-Normal Conditions and Emergencies.........................................37

4.6 Management of Maintenance and Modifications .......................................................37

4.7 Insights for SMR ConOps from General SMR Literature ...........................................37

5 MULTI-UNIT OPERATIONS IN SURROGATE FACILITIES...............................................41

5.1 Unmanned Aircraft Systems......................................................................................41

5.1.1 Introduction..........................................................................................................41

5.1.2 Method.................................................................................................................43

5.1.3 Review of the Pertinent Literature........................................................................43

5.1.3.1 Automation and Team Size...........................................................................43

5.1.3.2 Adaptive Automation.....................................................................................47

5.1.3.3 Automation of Vehicle-Coordination Tasks ...................................................48

5.1.3.4 Vehicular Differences....................................................................................49

5.1.3.5 Human-System Interface Design ..................................................................49

5.1.4 Summary of Results..................................................................................................51

5.1.5 Pertinent Challenges for Modular Reactor Operations ..............................................55

5.2 Oil Refineries ............................................................................................................56

5.2.1 Introduction..........................................................................................................56
vi

5.2.2 Methodology ........................................................................................................57

5.2.3 Results.................................................................................................................57

5.2.4 Pertinent Challenges for Modular Reactor Operations .........................................59

5.3 Tele-Intensive Care Units..........................................................................................60

5.3.1 Introduction..........................................................................................................60

5.3.2 Methodology ........................................................................................................61

5.3.3 Results.................................................................................................................61

5.3.4 Pertinent Challenges for Modular Reactor Operations .........................................63

5.4 Insights for SMR ConOps from Surrogate Facilities ..................................................64

6 POTENTIAL HUMAN-PERFORMANCE ISSUES...............................................................67

6.1 Plant Mission.............................................................................................................68

6.1.1 New Missions.......................................................................................................69

6.1.2 Novel Designs and Limited Operating Experience from Predecessor Systems ....70

6.2 Agents’ Roles and Responsibilities ...........................................................................70

6.2.1 Multi-Unit Operations and Teamwork...................................................................70

6.2.2 High Levels of Automation for All Operations and its Implementation ..................72

6.2.3 Function Allocation Methodology to Support Automation Decisions .....................73

6.3 Staffing, Qualifications, and Training.........................................................................73

6.3.1 New Staffing Positions .........................................................................................74

6.3.2 Staffing Models ....................................................................................................74

6.3.3 Staffing Levels .....................................................................................................75

6.4 Management of Normal Operations...........................................................................76

6.4.1 Different Unit States of Operation ........................................................................76

6.4.2 Unit Design Differences .......................................................................................77

6.4.3 Operational Impact of Control Systems for Shared Aspects of SMRs ..................78

6.4.4 Impact of Adding New Units While Other Units are Operating..............................79

6.4.5 Managing Non-LWR Processes and Reactivity Effects........................................79

6.4.6 Load-Following Operations ..................................................................................80

6.4.7 Novel Refueling Methods.....................................................................................81

6.4.8 Control Room Configuration and Workstation Design for Multi-Unit Teams .........81

6.4.9 HSI Design for Multi-unit Monitoring and Control .................................................82

6.4.10 HSIs for New Missions.........................................................................................83

6.5 Management of Off-Normal Conditions and Emergencies.........................................83

6.5.1 Safety Function Monitoring ..................................................................................84

6.5.2 Potential Impacts of Unplanned Shutdowns or Degraded Conditions of One Unit 

on Other Units .....................................................................................................84

6.5.3 Handling Off-Normal Conditions at Multiple Units ................................................85

6.5.4 Design of Emergency Operating Procedures (EOPs) for Multi-Unit Disturbances 86

6.5.5 New Hazards .......................................................................................................86

6.5.6 Passive Safety Systems ......................................................................................87

6.5.7 Loss of HSIs and Control Room...........................................................................88

6.5.8 PRA Evaluation of Site-Wide Risk........................................................................88

6.5.9 Identification of Risk-Important Human Actions when One Operator/Crew is 

Managing Multiple SMRs.....................................................................................89

6.6 Management of Maintenance and Modifications .......................................................89

6.6.1 Modular Construction and Component Replacement...........................................90

6.6.2 New Maintenance Operations..............................................................................90

6.6.3 Managing Maintenance Hazards..........................................................................91

6.7 Conclusions ..............................................................................................................91
vii

7 DISCUSSION......................................................................................................................93

8 REFERENCES....................................................................................................................97

APPENDIX: CONCEPT OF OPERATIONS QUESTIONS .....................................................A-1
viii

LIST OF FIGURES

Figure 1-1 Evolution of nuclear-powered technology................................................................. 1

Figure 2-1 Concept of operations in systems engineering......................................................... 5

Figure 2-2 Top-down design considerations.............................................................................. 7

Figure 3-1 Multiple SMR missions............................................................................................19

Figure 5-1 Unmanned aircraft system (UAS) - Predator UAV and control station.....................42

Figure 5-2 Oil refinery ..............................................................................................................56

Figure 5-3 Layout of the refinery control room..........................................................................58

Figure 5-4 Tele-ICU control room.............................................................................................62

LIST OF TABLES

Table 3-1 SMR Reactor Class and Designs .............................................................................11

Table 3-2 Comparison Between Current Plants and SMRs on Dimensions That May Influence 

Human Performance................................................................................................24

Table 4-1 SMR Licensing and Technical Challenges Identified in Recent Industry Meetings ...39

Table 5-1 Levels of Automation................................................................................................44

Table 5-2 Comparison of the Operational Contexts of the Actual Systems and the Studies 

Reviewed.................................................................................................................54

Table 6-1 Potential Human-Performance Issues......................................................................68
ix

LIST OF ACRONYMS

Abbreviation/ 

Acronym

Definition

AA adaptive automation

ABWR Advanced Boiling Water Reactor

ADAMS Agency Wide Document Access and Management Systems

ADS automatic depressurization system

AIAA American Institute of Aeronautics and Astronautics

ANS American Nuclear Society

AP 1000 Advanced Plant 1000

AP 600 Advanced Plant 600

ARL Army Research Laboratory

ARP alarm response procedure

ATR automation target recognition

ATWS anticipated transient without scram

BNL Brookhaven National Laboratory

BOP balance of plant

CBP computer based procedure

CCR centralized control room

CFR Code of Federal Regulations

CNSG consolidated nuclear steam generator

CONOPS concept of operations

CV containment vessel

CVCS chemical and volume control system 

DCD design control document

DCS distributed control system

DOE Department of Energy

DOT Department of Transportation

EBR Experimental Breeder Reactor

ECCS emergency core cooling system

EM Electromagnetic

EOF

EOP

emergency offsite facility

emergency operating procedures

FAA Federal Aviation Administration

FCC fluid catalytic cracker

FFTF Fast Flux Test Reactor

GDC

GE

GO

General Design Criteria

General Electric

gas oil

GT-MHR Gas Turbine-Modular Helium Reactor 

iPWR integrated pressurized water reactors

HFAT Human Factors Assessment Tool

HFE human factors engineering

HP human performance

HPM Hyperion Power Module

HRA human reliability analysis

HSI human-system interface

HTGR High-temperature Gas-cooled Reactor

HVAC heating, ventilating, and air conditioning
x

Abbreviation/ 

Acronym

Definition

IAEA International Atomic Energy Agency

IAI intelligent adaptive interfaces

ICU intensive care unit

IEEE Institute of Electrical and Electronics Engineers 

IHTS

IHX

intermediate heat transport system

intermediate heat exchanger

IMPRINT Improved Performance Research Integration Tool

INL Idaho National Laboratory

IRIS International Reactor Innovative and Secure 

ISI in-service inspection 

IST in-service testing 

LFR Lead-cooled Fast Reactor 

LMR liquid-metal reactor

LOA levels of automation

LOCA loss of coolant accident

LOOP loss of offsite power

LWR light water reactor

MASLWR Multi-application Small Light Water Reactor

MCR main control room

MHR Modular Helium Reactor

MO main operator

MWe megawatts electric

MWt megawatts thermal

NAS National Academy of Sciences

NERI Nuclear Energy Research Initiative

NGNP Next Generation Nuclear Plant

NPP nuclear power plant

NRC Nuclear Regulatory Commission

NSSS nuclear steam supply system

OBC operation by consent

OBE operation by exception

OM operation and maintenance

OJT on-the-job training 

OPAS Operator Performance Assessment System

OSU Oregon State University

PBMR Pebble Bed Modular Reactor

PCS power control system

PL process lead

PORV power-operated relief valve

PPE personal protective equipment

PRA probabilistic risk assessment

PRISM Power Reactor Innovative Small Module

PS production specialists

PWR pressurized water reactors

RB refueling bridge

RCCS reactor cavity cooling system

RCP

RG

RO

reactor coolant pumps

regulatory guides

reactor operator
xi

Abbreviation/ 

Acronym

Definition

RPS reactor protection system

RPV reactor pressure vessel

RSF remote shutdown facility

SA situational awareness

SG steam generators

SMR small modular reactor

SRO senior reactor operator

STA shift technical advisor

THTR Thorium High-Temperature Reactor 

TLX Task Load Index

TOO target of opportunity

TR technical report

TSC technical support center

UAS unmanned aircraft systems

UAV unmanned aerial vehicle

UGV unmanned ground vehicle

UPS uninterruptable power supply

UV unmanned vehicle

1

1 INTRODUCTION

1.1 Background

The designs of commercial nuclear power plants (NPPs) have evolved over several generations

(Figure 1-1). Following the experience gained from early prototype reactors, the first reactors 

for the commercial production of energy were developed, viz., the Generation II plants that 

include the NPPs currently operating in the United States. The state-of-the-art commercial 

nuclear plant today is referred to as a Generation III plant. These plants combine decades-old 

reactor technology with simplified or passive safety-features, digital instrumentation and control 

(I&C) systems, and computer-based control rooms. 

Figure 1-1 Evolution of nuclear-power technology

(source: U.S. Department of Energy – http://nuclear.energy.gov/genIV/neGenIV1.html)

Looking to the longer-term, the United States participated in the International Generation IV 

reactor initiative1 (DOE, 2002, 2003) to identify and develop the next generation of commercial 

nuclear power plants, and also through the U.S. Department of Energy’s (DOE) Nuclear Energy 

Research Initiative (NERI). NERI was established to address and help overcome the principal 

technical- and scientific-issues affecting the future use of nuclear energy.2

Small modular reactors (SMRs) are one category of the new designs. They are smaller than 

typical current U.S. nuclear plants that may generate over 1000 megawatts electricity (MWe). 

By contrast, SMRs generate far fewer MWes per unit, many producing less than 100 MWe.

According to the classification adopted by the International Atomic Energy Agency (IAEA), a 

“small reactor” is one with a total possible electrical power of 300 MWe or less; those delivering 

between 300-700 MWe are called “medium sized reactors” (IAEA, 2005, 2006).

3

 

 1 Current information about DOE's Generation IV Program can be found at: 

http://www.ne.doe.gov/geniv/neGenIV7.html; retrieved March 31, 2011.

2 Current information about DOE’s NERI Program can be found at: 

http://nuclear.energy.gov/neri/neNERIresearch.html; retrieved March 31, 2011.

3 The IAEA uses the abbreviation “SMR” to mean small and medium reactors.
2

Thus, while SMRs are small compared to typical plants operating in the United States today, 

they are “scalable;” that is, multiple SMR units can be grouped at a site to meet a utility’s 

specific power-needs. For example, if an SMR produces 100 MWe, a utility needing 200 MWe 

can install two units at a site, while a second one needing 400 MWe can install four, and so on. 

As future electrical demands change, additional units can be added as needed, thereby scaling 

their number to meet the needs of different communities. Another characteristic separating 

SMRs from current U.S. plants is that they can serve purposes other than power generation, 

e.g., hydrogen production.

SMRs are “modular.” They can be fabricated in a factory and transported to the plant site for 

assembly. (We compare SMRs and current reactors more thoroughly in Section 3.)

Thus, SMRs are quite different to current plants. Accordingly, the U.S. Nuclear Regulatory 

Commission (NRC) initiated research to examine the human-factors aspects of SMR designs

and operations to better understand the potential effects on human performance and the need 

for enhanced guidance to support human factors engineering (HFE) safety reviews.

1.2 Objective

The main objective of our research was to delineate how the design and operations of SMRs

differ from current plants and to identify potential human-performance issues. In this report, the 

term “issue” refers to the following:

• an aspect of the SMR development or design for which information suggests that it may 

negatively impact human performance

• an aspect of SMR development or design that may degrade human performance, but 

additional research and/or analysis is needed to better understand and quantify the effect

• a technology or technique that may be used for a plant’s design or implementation for which 

there is little or no review guidance

The information and insights developed in this report will provide NRC reviewers with a 

technical basis for better understanding the human performance, and hence, the safety 

implications of SMR designs for licensing reviews.

1.3 Methodology

Our methodology consisted of the following activities.

Develop a Model of Concept of Operations

According to the Institute of Electrical and Electronics Engineers (IEEE), a “concept of 

operations” (ConOps):

...describes system characteristics of the to-be-delivered system from the user’s viewpoint. The 

ConOps document is used to communicate overall quantitative and qualitative system characteristics 

to the user, buyer, developer, and other organizational elements (e.g., training, facilities, staffing, and 

maintenance). It describes the user organization(s), mission(s), and organizational objectives from 

an integrated systems point of view. (IEEE, 2007, p. 1)
3

While this is a good definition, we developed it further into a ConOps model that delineated key 

ConOps dimension. The model was used to collect information about various SMR designs. To

facilitate the model’s use, we developed a set of questions pertaining to each dimension of the 

model. 

Identify Potential Issues Related to Multi-unit Operations

Using the ConOps model, we evaluated information about SMR designs and operations to 

identify potential human-performance issues. The design of many SMRs is incomplete and, 

therefore, information is limited on how the plants will be operated. In addition, there is a lack of 

operating experience for SMRs. To supplement our knowledge of design, we visited the site of 

one SMR vendor to better understand the anticipated ConOps and operational challenges. In 

this report we described the SMR designs as they were when we were conducting the work. 

Some of this information will be out-of-date after the report is published. 

In view of the scarcity of this information, we considered experience with “surrogate facilities” to 

gain a more thorough knowledge of potential human-performance issues at SMRs. We 

considered as surrogate facilities ones in which operators manage multiple units in a manner 

similar to what we might expect from SMR operators. The systems we examined were 

unmanned vehicles, petroleum refineries, and remote intensive-care medical centers. Although

there are important differences between SMRs and these surrogates, there are similarities that 

afforded us an opportunity to learn about the design and operations of multiple units, and the 

resulting demands on human performance. We also visited selected facilities to observe and 

discuss with their staff the challenges of multi-unit operations. 

We assessed the implications of the SMR human-performance issues identified by human 

reliability analysis (HRA). Because SMR operations likely will differ from those in traditional 

nuclear plants, we sought insights into the aspects of modular operation that impact human 

reliability, and how the HRA might address them. 

From our information on SMRs and surrogate facilities, we identified a set of possible humanperformance issues to include in research and regulatory reviews of SMRs. Because our 

different sources of information often identified the same issues, there is some redundancy in 

the various sections of this report. Nevertheless, it increases our confidence in the validity of 

the potential issues we identified. 

Evaluate Current NRC Regulation and Guidance 

We used the information about SMR design and operations, and human- performance issues, to 

evaluate the NRC's HFE regulations and regulatory-review guidance to determine the following: 

(1) Whether they suitably address issues of human performance in SMRs; (2) what 

modifications of the regulations and guidance might be needed; and (3) which issues will 

necessitate developing new HFE guidance to support SMR licensing reviews. We detailed our 

findings in an earlier report (Higgins & O’Hara, 2010).

1.4 Organization of This Report

In Section 2, we describe the multi-dimensional ConOps model and its development, and 

discuss its role in systems engineering, and in the NRC’s HFE review process. 
4

Section 3 describes the design and operation of selected SMRs. We obtained information on 

them from the following categories of reactor designs: Integral pressurized water reactors; gascooled reactors; and liquid-metal reactors. We then evaluated the information for each type of 

reactor and identified pertinent issues. In contrast to the focus on specific designs in Section 3, 

in Section 4 we reviewed the general literature pertaining to SMRs. 

We present the results of our evaluations of the surrogate facilities in Section 5, viz., the 

unmanned vehicles, petroleum refineries, and remote intensive-care centers. For each system, 

we discuss the operational considerations that pertain to SMR operations. 

In Section 6, we integrated the issues identified in Sections 3, 4, and 5 into a set of potential 

human-performance issues, and then organized them according to the dimensions of our 

ConOps model. Section 7 offers our insights for reviewing the HFE aspects of SMRs. 

All cited references are listed in Section 8. 

The report has an appendix that lists the questions developed to obtain ConOps information. 
5

2 MODEL OF A CONCEPT OF OPERATIONS 

In this section, we discuss the use of ConOps in systems engineering, and in the NRC’s review 

of an applicant’s HFE program. We then propose a new HFE-focused ConOps model that we 

used to support our acquisition and structuring of information for this project.

2.1 Use of Concept of Operations in Systems Engineering

Developing a ConOps is a fundamental component of the systems engineering process for any 

complex system (Fairley & Thayer, 1977; IEEE, 2007). It is recommended practice in the 

aerospace industry (AIAA, 1992) and military projects (DoD, 1995, 2000). Examples of the use 

of ConOps documents include the Federal Highway Administration’s ConOps for transportation 

management systems (DOT, 2004), and the FAA’s next-generation air-traffic-control system 

(FAA, 2007).

The definition of the ConOps for a new system begins before the design work starts, and often 

is used in the early design stages to identify goals and expectations relative to human 

performance (Pew & Mavor, 2007). A ConOps covers all facets of the interactions of personnel 

with a complex system, so affording a good organizational framework for defining the inputs to 

system development. A ConOps established early in system development will be stated in highlevel terms that can be made more specific and detailed as the system is refined. Design 

guidance recommends using a ConOps document to guide the formulation of requirements, the 

details of design, and the evaluation of the system. Increasingly, industries are employing a 

system ConOps to assure their vision of how personnel are integrated into a new system design 

or major modification (Thronesbery et al., 2009). 

Figure 2-1 illustrates the relationship between a ConOps and system design. Design 

organizations refine and more precisely define the ConOps through analyses, specifying 

requirements, and evaluations. 

Figure 2-1 Concept of operations in systems engineering

(adapted from DOT, 2009)

Time

Definition

and

Decomposition

Integration

Verification

and

Validation

Concept

of Operations

High Level

Requirements

Detailed

Requirements

High Level

Design

Detailed

Design

Implementation

Operations &

Maintenance

System

Verification

Subsystem

Verification

Integration &

Test

System

Validation
6

2.2 Concept of Operations in NRC HFE Regulatory Reviews

A ConOps document plays an important role in the NRC's review of the HFE aspects of NPPs.

Persensky et al. (2005) defined ConOps as a “...description of how the design, systems, and 

operational characteristics of a plant, such as an advanced reactor, relate to a licensee’s or 

applicant’s organizational structure, staffing, and management framework.” Although ConOps

documents are employed by design organizations for developing systems, the NRC uses them 

as an information source for reasonably assuring that the intended human-system integration 

can properly support safe operations. 

NUREG-0711 contains detailed HFE review guidance for an applicant’s HFE program (O’Hara 

et al., 2004). Review criterion 1 of Section 8.4.2, Concept of Operations, states:

A concept of operations should be developed indicating crew composition and the roles and 

responsibilities of individual crew members based on anticipated staffing levels. The concept of 

operations should: 

• Identify the relationship between personnel and plant automation by specifying the responsibilities 

of the crew for monitoring, interacting, and overriding automatic systems and for interacting with 

computer-based procedure systems and other computerized operator support systems.

• Provide a high-level description of how personnel will work with HSI [human-system interface] 

resources. Examples of the types of information that should be identified are the allocation of 

tasks to the main control room or local control stations, whether personnel will work at a single 

large workstation or individual workstations, the types of information each crew member will have 

access to, and what types of information should be displayed to the entire crew.

• Address the coordination of crew member activities, such as the interaction with auxiliary 

operators and coordination of maintenance and operations.

Using the IEEE definition of ConOps (see Section 1.3) as a start, we expanded the use of

ConOps in 2008 in support of research addressing HFE issues associated with new and 

emerging technology (O’Hara et al., 2008). In this project, we further extend the 2008 ConOps

model to encompass SMR design and operational considerations.

With the new model (described below), we obtained and structured information on the HFErelevant aspects of SMR operations. The model also allowed us to organize the humanperformance issues and ensure that all important topics were addressed. 

2.3 Model Dimensions

We developed an HFE-focused ConOps model to identify all information needed to understand 

SMR ConOps. The model has six dimensions:

• Plant Mission

• Agents’ Roles and Responsibilities

• Staffing, Qualifications, and Training

• Management of Normal Operations

• Management of Off-normal Conditions and Emergencies

• Management of Maintenance and Modifications 

Each dimension is described below. We developed the questions, set out in the Appendix, for 

each dimension to support data collection. 
7

Plant Mission

A ConOps reflects top-down and bottom-up design considerations (Figure 2-2). From the top, 

ConOps reflects the plant’s mission and the high-level goals. From the bottom, it reflects the 

technological infrastructure needed to support the mission and those goals. 

Figure 2-2 Top-down and bottom-up design considerations

The plant mission can be described in terms of the following:

• Goals and objectives - The purposes for which the plant was designed, e.g., for current 

NPPs, electrical generation and safety.

• Evolutionary context – The design of the predecessor plant(s) and the operating experience 

that set the foundation for the new design, as well as the technological- and operationalchanges and improvements that the new plant seeks to achieve.

• High-level functions – The functions, e.g., reactivity control, that must be undertaken 

(regardless of the performing agent) to achieve the plant’s goals and objectives.

• Boundary conditions – The conditions that clearly identify the operating envelope of the 

design, i.e., the general performance characteristics within which the design is expected to 

operate, such temperature and pressure limits. Clearly identifying boundary conditions 

helps define the design’s scope and interface requirements.

• Constraints – A constraint is an aspect of the design, e.g., a specific staffing plan or the use 

of specific technology. These constraints influence the design.4

 

Agents’ Roles and Responsibilities

This dimension clarifies the relative roles, responsibilities, and relationship of a system’s agents, 

namely, personnel and automation. Modern approaches to automation emphasize the value of 

multi-agent teams of human-, software-, and hardware-elements monitoring and controlling 

 4 NUREG-0711 recognizes the importance of identifying constraints in the HFE Program Management 

review, Section 2.4.1, General HFE Program Goals and Scope, Review Criterion 2.

High-level mission and goals

Define functions necessary to achieve the goals

Allocate functions to human and system resources

Decompose functions into tasks

Analyze tasks to define performance requirements

Design detailed HSI, procedures, and training
8

complex systems (O’Hara & Higgins, 2010). The teams share and shift responsibilities to 

assure the plant’s overall production and safety goals. Here, the term "agents" generically 

refers to who or what is performing an activity; i.e., agents are entities that perform functions. 

An agent will monitor the system to detect conditions indicating that a function or task must be 

performed. An agent will assess the situation and plan a response, and having established the 

response plan, will implement it. The agent will monitor the activity to assure that the function is 

being accomplished, and to plan again if it is not. Finally, the agent must decide when the 

function is completed satisfactorily. Human or machine agents can undertake any one or all of 

these roles. 

Defining human roles and responsibilities is the first step toward integrating humans and 

systems, from which should flow all other aspects of the ConOps and design. This dimension 

usually is specified to some level before beginning design work, based on the operating 

experience from earlier systems, and the goals for developing the new one. These roles then 

are refined though the HFE program. 

Staffing, Qualifications, and Training 

This dimension addresses the number and capabilities of staff needed to accomplish the human

roles and responsibilities. Staffing should consider organizational functions, including

operations, maintenance, and security. Staff positions and the qualifications necessary for each 

should be defined. The ways must be identified in which teams will be structured and the types 

and means of interaction between their members and other organizational functions identified, 

including the coordination of crew member activities, how peer-checks and supervision are 

accomplished, and how the control-room crews coordinate work with other plant personnel. 

The training needed to meet qualification requirements and to perform the human roles and 

responsibilities should be specified. 

Management of Normal Operations 

This dimension encompassed three main considerations: Identifying key scenarios; identifying

the tasks needed to perform them; and establishing the HSIs and procedures essential to

supporting the tasks.

Key scenarios herein include those reflecting the plant’s normal evolutions, such as start-up, low 

power, full power, refueling, and shutdown. For each one, the tasks personnel must accomplish 

to fulfill their roles and responsibilities are identified, as are the ways in which personnel interact 

with the plant’s functions, systems, and components to complete them, along with the support of 

automation in monitoring and controlling the plant through these evolutions. Also included is job 

design, i.e., the integration of tasks into jobs that specific crew members undertake. 

The design of HSIs and procedures should support personnel with their task and job 

assignments. For example, the following concepts for how personnel interact with HSI 

resources may be specified:

• information distribution, e.g., the types of information that individual crew member access,

and the types that are displayed to the entire crew

• the determination of the location of particular HSIs, either in the main control room or at

local control stations
9

• configuration of personnel workplaces, such as a single large workstation, individual ones, 

or large overview displays

Management of Off-normal Conditions and Emergencies 

This dimension addresses many of the same considerations (key scenarios, tasks, and 

supporting HSI resources) as does normal operations, except the conditions are atypical. 

Considerations include:

• degraded I&C and HSI conditions (such as a faulty sensor, loss of an aspect of automation, 

or degradation of a workstation)5

• failed equipment, such as pumps and valves

 

• loss of plant systems for which compensation is needed , such as the failure of a coolingwater system

• emergencies that may impact safety, such as a loss of coolant accident (LOCA)

Identifying off-normal and emergency conditions and developing ways to resolve them are 

significant considerations affecting the planning and design of operations. For example, if a 

major digital I&C failure should cause a loss of the control room’s HSIs, designers must decide 

whether personnel should (1) shut the plant down until the condition is fixed, (2) maintain the 

plant in its current state, or (3) do something else. Their decisions significantly influence the 

types of backup resources that must be provided, the procedures that must be developed, and 

the training that personnel must receive. Handling off-normal conditions often requires crews to 

transition to a means of working together that differs from that of normal operations (O’Hara, 

Gunther & Martinez-Guridi, 2010). 

Management of Maintenance and Modifications 

This dimension looks at the concepts underlying the installation of new systems, plant upgrades, 

maintenance, and configuration management. Like the previous two dimensions, the staff’s 

tasks and how the HSIs and procedures support their work must be considered. For example, 

much of the maintenance of advanced systems typically occurs at a workstation through 

changes in software. Such activities will be more extensive in new reactor designs relying

heavily on digital systems and automation.

2.4 Concept of Operations Questionnaire

We developed the questionnaire in the Appendix to gather information about a facility’s ConOps, 

and tailored the questions to fit each type of facility surveyed. 

 5 Digital I&C systems and automation support operators in their monitoring, decision making, and control 

tasks. Even though digital systems typically are highly reliable, their potential for degradation or failure 

significantly could affect the operators’ performance and, consequently, jeopardize system safety. I&C 

degradations may affect the user interfaces. For example, deterioration of sensors can complicate the 

operators’ interpretation of displays, and sometimes may mislead them by making it appear that an 

actual emergency has occurred (O’Hara, Gunther & Martinez-Guridi 2010). 
10

2.5 Conclusions

Developing a ConOps for a new system or system modification is an accepted and 

recommended practice in systems engineering. Evaluating an applicant’s ConOps is an 

important aspect of the NRC’s safety review of an applicant’s HFE program for new and 

advanced reactors. We noted that ConOps documents often are especially useful in the early 

stages of new system development by forcing consideration of aspects of system design, 

staffing, and operations. 

In designing a new plant such as an SMR, elaborating a ConOps will help define the goals and 

expectations for the new system, the role personnel will play, and the staffing required. Once 

the roles of personnel roles are understood, designers can develop concepts for how the HSIs, 

procedures, and training will support them in performing their tasks. The ConOps also forces

debate on how to manage off-normal conditions and system degradations, and to upgrade and 

improve systems. Thus, the ConOps will begin to define high-level considerations to address as 

the detailed design evolves. 

The six-dimensional ConOps model we developed allowed us to obtain and organize 

information in the project activities described in the rest of this report. 
11

3 DESIGN AND OPERATIONS OF SMALL MODULAR REACTORS

We earlier noted that SMRs are small relative to typical U.S. plants, modular, scalable and may 

serve purposes in addition to generating electricity. In this section, we take a closer look at the 

general design and operational characteristics of SMR comparing their characteristics with 

those of current U.S. plants, and identifying key differences between them. In addition, we will 

identify their potential human-performance issues.

The IAEA estimated that more than 45 SMR designs are being developed (IAEA, 2009). Thus,

we selected a sample of designs representative of the major SMR technology classes: 

• integral pressurized water reactors (iPWRs)

• high-temperature, gas-cooled reactors (HTGRs)

• liquid-metal reactors (LMRs)

Table 3-1 depicts the specific SMR designs included within each class. One consideration in 

our choosing the specific designs to examine was our expectation of NRC licensing activities 

over the next decade. However, based on economic factors and others , the SMR landscape is 

changing rapidly; already, there have been some changes in the NRC’s long-range planning

from the time our study began. We have noted these changes where appropriate in the

discussion.

Table 3-1 SMR Reactor Class and Designs

Reactor Class and Design Size, 

MWe

Vendor

Integral PWRs (iPWRs)

NuScale 45 NuScale Power, Inc.

International Reactor Innovative and Secure (IRIS) 335 Westinghouse Electric Corp.

mPower 125 Babcock & Wilcox

High-temperature, Gas-Cooled Reactors (HTGRs)

Gas Turbine-Modular Helium Reactor (GT-MHR) 300 General Atomics

Pebble Bed Modular Reactor (PBMR) 165 PBMR (Pty.), Ltd.

Liquid-Metal Reactors (LMRs)

4S (super-safe, small and simple) Reactor 10 Toshiba Corp.

Hyperion Power Module (HPM) 25 Hyperion Power Generation, Inc. 

Power Reactor Innovative Small Module (PRISM) 415 GE Hitachi Nuclear Energy

In this section, we briefly describe each class of SMRs, giving publicly available information 

about their specific designs. We sought information for each SMR class pertaining to the

ConOps dimensions discussed in Section 2 of this report. Much of the detailed information 

about the SMRs came from the following reports:

• NRC Advanced Reactors: iPWRs (Belles et al., 2010)

• NRC Advanced Reactors: Modular HTGRs (Ball et al., 2010) 

• NRC Advanced Reactors: LMRs (Flanagan et al., 2010)

Other information sources were used and are noted. In addition to reviewing documentation,

we visited the site of one SMR design organization to discuss their plans for ConOps. This 

information discussed in this section was gathered in 2010 and early 2011. Most designs and 

operations characteristics of these SMRs still were under development and may change as
12

the design process continues. Accordingly, we note that information on our ConOps 

dimensions generally is in its preliminary stages.

The information on iPWRs, HTGRs, and LMRs, respectively, is discussed in Sections 3.1, 3.2, 

and 3.3. Section 3.4 presents our assessment of the potential human-performance issues 

gained from the information we obtained about SMR design and operations.

3.1 Integral Pressurized Water Reactors

The iPWRs are moderated and cooled with light water. They are typical somewhat of PWR 

technology, e.g., the fuel is similar to that used in present day LWRs. An exception is that their

design eliminates external primary piping and components, thereby reducing the size of the

containment and overall plant and also most of the piping that is susceptible to a LOCA. The 

nuclear steam- supply system (NSSS) includes the reactor core, steam generators (SGs), and a 

pressurizer inside one large reactor pressure vessel (RPV). Reactor coolant circulation may be 

via reactor coolant pumps (RCPs), also inside the RPV, or via natural circulation. 

We examined three iPWR designs: 

• NuScale Power’s NuScale SMR

• Westinghouse’s International Reactor Innovative and Secure (IRIS) SMR

• Babcock & Wilcox’s mPower SMR

NuScale

Each NuScale unit comprises a reactor and balance-of-plant (BOP) systems able to generate

45 MWe. In its baseline configuration, a NuScale site will consist of up to 12 units in a common 

reactor pool. The pool has a three-day passive cooling capacity during a reactor accident 

before operators must act. The reactor is cooled via natural circulation to two SGs located 

inside the RPV. The design employs passive safety-features such as natural circulation to 

prevent fuel damage for postulated accidents. The NSSS is fabricated offsite and will be 

shipped by rail, truck, or barge to the plant site.

The NuScale concept initially was developed as the Multi-application Small Light Water Reactor 

between 2000 and 2003 under the DOE’s Nuclear Energy Research Initiative (NERI) program. 

Oregon State University (OSU) improved the design thereafter, and filed concept patents in 

2007. OSU built a non-nuclear prototype plant that was used for experiments on, and testing of 

design concepts.

IRIS6

The IRIS SMR has a 335 MWe capacity, although it can be scaled down to approximately 100 

MWe. It has an integral primary coolant system and forced circulation using eight in-vessel 

RCPs, and internal SGs. Passive safety features prevent fuel damage for postulated accident 

scenarios. It does not have a pressurizer power-operated relief valve (PORV) nor a spray valve 

for controlling the reactor vessel’s pressure, although the non-safety chemical and volume

control system (CVCS) offers an auxiliary spray capability. 

 6 In February 2011, Westinghouse announced a new SMR design based on the AP1000 plant: 

http://www.westinghousenuclear.com/smr/index.htm; retrieved March 1, 2011.
13

The original IRIS design was conceived in the early 1990s, as part of the DOE’s NERI program,

by an international consortium led by Westinghouse Electric Co.

mPower

A B&W mPower SMR generates 125 MWe per reactor. This SMR basically is a PWR with an 

integral primary coolant system and forced circulation afforded by up to 12 in-vessel RCPs 

feeding a single once-through internal steam generator. The reactor core uses 17x17 pin array 

fuel assemblies with UO2 pellet fuel. The fuel, clad in zircoloy, is less than 5% enriched. Two 

feedwater and two steam lines penetrate the reactor vessel. The pressurizer is integrated into 

the upper head of the reactor vessel with heater rods and a surge path. Normal pressurizer 

spray, driven by the PCP pressure, is provided through piping with a valve. The charging 

system provides auxiliary spray. Automatic depressurization system (ADS) valves are 

connected to the pressurizer, but there is no manual PORV function. The reactor is shut down 

safely by multiple control-rod assemblies. No boron is used in the primary coolant for reactivity 

control during normal operations. The containment is a tall cylinder with a domed top located 

entirely below grade. Equipment access is through a hatch in the containment dome. A polar 

crane and the refueling water-storage tank are located within containment. The NSSS is 

designed for offsite fabrication and shipping by rail, truck, or barge to the plant site.

The mPower concept has its roots in a Babcock & Wilcox (B&W) design of a small reactor for 

the NSSS on the commercial ship NS Savannah, launched in 1959. The NS Savannah NSSS 

was funded by the U.S. government as a demonstration project for the “Atoms for Peace” 

initiative. After designing the Savannah reactor, B&W began developing a design for a 

consolidated nuclear steam generator (CNSG). Its first iteration, including a helical coil SG, was 

used in the German ship Otto Hahn from 1968 until 1979. The CNSG design was revised 

several times and the current mPower design evolved from this concept.

Plant Mission

The primary mission of all three iPWR designs is producing electricity. The multi-unit IRIS 

configuration can provide process heat for industrial applications, such as hydrogen generation 

or the production of synthetic fuels. It is unclear from the documentation whether a processheat application would be used in a single-unit configuration.

While the NuScale baseline configuration does not include additional missions, their website7

discusses secondary uses, such as steam for industrial applications or district heating for 

communities and large facilities, or for use producing synthetic fuels. The site indicates that “It's 

also possible to configure a NuScale system to produce steam as its primary purpose with the 

option of switching to electricity generation in an emergency, and used for a range of low 

temperature, low pressure applications requiring heated water.”

There is no reference to additional missions in the mPower literature.

Agents’ Roles and Responsibilities

The high-level functions for iPWRs largely are the same as those for current PWRs. All three 

designs will be highly automated, but precise details are undetermined. Westinghouse’s goal 

 7 Information about NuScale applications appears in http://www.nuscalepower.com/ot-Applications-ForScalable-Nuclear-Technologies.php; retrieved June 29, 2011.
14

for the IRIS is that reactor startup and shutdown largely will be automated, requiring only minor

manual actions by the operator. Other operational tasks, such as surveillances, likely will be 

automated. 

Similarly, NuScale’s designers intend to support many operational tasks, such as using partial 

automation during startup, shutdown, and reactivity control to keep operators aware of the 

reactor’s status. For example, the startup process is divided into several sequences with a 

checkpoint at the end of each for the operator to verify that it was performed correctly and 

startup is progressing normally. When it is, the operator initiates the next sequence until the 

next checkpoint. Thus, both automation and operators have a role in the partially automated 

process.

In light of NuScale’s high levels of automation, Weaver, Harris, and Blomgren (2010, p. 351)

identified the following main tasks of the operators:

• initiate unit start-up

• initiate unit shutdown

• provide oversight and permission for automatic controls (e.g., reactivity manipulations) to 

continue past predefined hold-points

• set or correct process-control parameters to control operating state or plant functions

• initiate corrective action if plant systems fail to operate properly

Most of these actions involve supervising automatic systems; very few human actions will be 

associated with normal plant operations. Thus, NuScale is investigating potential issues of 

operators’ low workload (discussed in effects on human performance of high levels of 

automation, Section 3.4, Conclusions). 

Staffing, Qualifications, and Training

NuScale anticipates that for a twelve-unit site, the staff will comprise three reactor operators 

(ROs), a control room supervisor (senior RO), a shift manager, and a shift technical advisor 

(STA); a profile that will require a staffing exemption request from Title 10, Section 50.54(m), of 

the Code of Federal Regulations (10 CFR 50.54(m)). NuScale plans to follow the methods 

described in NUREG-1791 (Persensky et al., 2005) and NUREG/CR-6838 (Plott et al., 2004) to 

detail the technical basis to support the exemption request (NuScale, 2010). They determined 

that their approach is justifiable because (1) NuScale systems are slow-acting in transients, so 

operators have time to gain situation awareness (SA) and no rapid actions are needed; and (2) 

automation will be used extensively. 

NuScale designers currently are studying the operator’s workload. To determine the maximumand minimum-values, they are exploring the best ways to measure workload. The methodology 

will include simulator testing of staffing concepts.

All shifts will include auxiliary operators, and personnel for maintenance, health physics (HP),

and chemistry, but their numbers have yet to be determined. In addition, there will be a 

refueling crew. 

At present, NuScale designers expect personnel qualifications to be based on current NPPs. 

However, some new considerations may have to be made for new missions and novel
15

operations, such as the way a NuScale reactor is refueled (discussed in the “Normal Operations”

subsection). 

Training requirements have yet to be determined.

Management of Normal Operations

In their multi-unit configurations, all three iPWR SMRs will be monitored and controlled from one 

control room. NuScale operations will cover up to 12 units. Each RO will manage multiple units

from a workstation (discussed below); a significant departure from current practice of assigning 

a shift crew to each reactor. The high level of automation is one basis for this change. There 

are times when a second operator will be needed, e.g., when one unit is being started up or 

shut down; then, one RO will monitor the unaffected units, while the other RO will manage the 

startup/shutdown operation. Both will work at the workstation. 

Because the iPWR SMR designs are scalable, new units can be added while others are 

continuing operating; so far, this arrangement has not been designed.

A consequence of having a multi-unit site where modules are added over time is that the units 

are likely to differ; the differences will have to be addressed by personnel.

Refueling a NuScale reactor entails detaching it from its mounting position and connecting it 

after manually unbolting four large diameter pipes (two steam and two feedwater lines) from the 

containment vessel. Because the turbine is above the reactor, the steam and feedwater lines 

will contain water. So far, it is unclear how or to where these pipes will be drained before they 

are unbolted. NuScale noted that these details will be part of the design for these systems. The 

crane then moves the reactor to a refueling bay for disassembly and refueling. Operators 

monitor the reactor’s instrumentation through the entire process. There are four channels of 

I&C. When preparing to move the reactor, operators first remove one channel’s cable 

connector from the reactor and attached it to the refueling bridge (RB); after verifying that it is 

reading properly, the second I&C channel similarly is transferred. NuScale designers have not 

yet determined whether two or four channels will be transferred to the RB. Control of this 

reactor is the responsibility of an SRO. One concept NuScale is considering is having a 13th 

reactor that then would be moved to replace the one being refueled. Meanwhile, the other 12 

still would maintain the station’s full power output. 

Some information was available on IRIS refueling. The containment is an 82-ft diameter sphere 

with a top hat allowing access to the reactor vessel; this part of the containment and the reactor 

vessel’s head are removed during refueling. The refueling cavity is located above containment. 

The gap between the cavity floor and reactor vessel flange must be sealed during refueling.

The mPower design has the core below the SG, so that the SG must be removed for refueling.

The containment portion of the plant is fully below grade.

The NuScale main control room (MCR) will have three RO workstations, a control room 

supervisor workstation, and a workstation for an STA, (who will be an SRO). Each RO 

workstation contains the HSIs for each of the multiple reactors being monitored and controlled. 

NuScale’s current concept is that the information presented will not be integrated across 

reactors; each reactor will have its own set of monitors. The preliminary estimate is that each 

reactor will require eight monitors to display its alarms, displays, and controls. NuScale still is 
16

uncertain about using a large overview display. Operating procedures have not been developed 

yet. 

NuScale described the process that will be used to design the NuScale control room and HSI

(Weaver, Harris, & Blomgren, 2010). Specifically, a work-domain analysis (Vicente, 1999) will 

be completed to allocate functions and identify task requirements. Tests and evaluations using 

a simulator will support their staffing plan and HSI design. Weaver et al. noted:

An HSI will be designed and verified to allow the operator to monitor more than one unit. It is 

expected that this operational strategy will require a high level of automation and a proven 

method for transfer between operators of monitoring and control of affected modules during offnormal or accident conditions. (p. 349)

Little information is available on normal operations, control room design, or HSI design for the 

IRIS and mPower designs. 

Management of Off-normal Conditions and Emergencies

NuScale units are designed such that they do not need an operator to respond rapidly to 

transients and accidents. Instead, the design relies on passive safety systems that require an 

automatic valve alignment to function. The passive features rely on the reactor pool for cooling; 

it can function for three days without an operator’s action. In response to an event, initially 

operators will observe the unit’s status, and will be unable to take control actions to affect the 

circulation of coolant. The design also requires each operator to implement and monitor the 

safe shutdown of multiple units.

NuScale’s current plan for handling an event (transient/accident) at one unit is for one RO to 

monitor the normally operating units, while another RO monitors the affected unit at one control 

station. However, their designers will establish and verify the capability to transfer control of 

one unit to another operator if necessary. The supervisor will manage the use of the emergency 

operating procedures (EOPs). 

As we noted earlier, one NuScale unit is designed for a power output of 45 Mwe. About 20- to 

25-Mwe will be needed for house loads at a 12-unit station; thus, one unit has the capacity to 

supply the entire site. Current nuclear plants often operate with house loads supplied from 

offsite power feeds; NuScale likely will follow the same practice. A loss of offsite power 

transient will affect all 12 units, but then, a unit can operate in an “island mode,” with the 

reactor/turbine generator supplying in house loads for the site. Additionally, each reactor is 

designed for 100% steam bypass without a scram, thereby allowing a unit to continue operation 

during a loss of off-site power event.

The overall plant design basis is for only one “accident” (e. g., LOCA) per site, i.e., the NuScale 

design-basis accident analysis assumes an accident affecting only one unit. 

All mPower ECCS functions are passive in the current concept, and no operator actions are 

required to mitigate design-basis accidents. mPower has two emergency boron injection tanks 

that force borated water into the core, driven by pressurizer steam; the purpose of these tanks is 

mitigating an ATWS. Since vessel/core injection time depends on the in-vessel pressure, and 

most ATWS events involve high pressure in the reactor vessel, it is unclear whether sufficient 

boron will enter the core to mitigate the ATWS-generated reactivity insertion in a timely fashion,
17

based on pressurizer steam pressure alone. Hence, ATWS mitigation may require operators to 

ensure there is a sufficient driving pressure available to these injection tanks.

The documentation we examined indicated that steam from multiple reactors may go to a single 

turbine. This may complicate an operator’s diagnosis of potential BOP-induced upset conditions 

in a particular reactor.

Little information is available on IRIS operations during off-normal conditions. However, on loss 

of AC power, the MCR heating, ventilating, and air conditioning (HVAC) will shut down. The 

habitability of the control room must rely on a three-day supply of compressed air. Because the 

control room’s HVAC also cools the battery and DC equipment rooms needed to monitor safe 

shutdown of the plant, it is unclear if the planned three-day compressed air supply is sufficient to 

cool these rooms as well. 

Management of Maintenance and Modifications

As the design of the iPWRs is incomplete, information on maintenance and modification 

practices was sparse.

We noted the NuScale refueling operation of moving the reactor to a refueling bay, an operation

also used to maintain the reactor. NuScale is looking into remote maintenance, for example, 

trouble-shooting by experts not physically located at the plant’s site. 

The IRIS design has eight in-vessel RCPs and SGs. Pump seal replacement and SG 

maintenance/repair will be performed in-vessel.

3.2 High-temperature, Gas-cooled Reactors

HTGRs use helium as the coolant, and graphite as the neutron reflector and moderator. The 

fuel has a ceramic cladding, supporting very high-temperature operation and serving as a 

primary barrier against the release of radionuclides from the fuel. These reactors have an 

increased thermal efficiency because the primary coolant, Helium, operates at very high 

temperatures (~1000° Celsius). These reactors have passive safety characteristics, an 

inherently slow response to transients, and large safety margins.

The DOE selected a gas-cooled reactor as the Next Generation Nuclear Plant (NGNP).

8

 The 

NGNP reactor has two potential designs, the prismatic type, and the pebble bed type. We 

examined one of each type:

• General Atomics’ Gas Turbine Modular Helium Reactor (GT-MHR) (a prismatic-type reactor)

• PBMR Ltd’s Pebble Bed Modular Reactor (PBMR)

We briefly describe each below, before discussing our ConOps dimensions. 

GT-MHR

The GT-MHR is a helium-cooled, graphite-moderated, prismatic core, high-temperature reactor 

that produces 300 MWe. As a commercial power reactor, this design uses uranium dioxide 

 8 For information on DOE’s NGNP program see http://www.nextgenerationnuclearplant.com/; retrieved 

March 8, 2011.
18

(UO2 ) particles, enriched to a 19.9% uranium-235 (U-235) content, and are encased in graphite 

to form a fuel rod. The energy in the heated helium coolant is converted directly into electricity 

in a gas turbine. 

The GT-MHR’s low power density and geometry assures the passive dissipation of decay heat 

by conduction and radiation; it will never reach a temperature that can threaten the integrity of 

the ceramic-coated fuel particles, even with a total loss of coolant. Using a direct cycle and 

advanced gas-turbine technology will improve thermal efficiency from the mid 30 percent of 

current NPPs, to nearly 50 percent.

Both the reactor and the BOP are designed to be located below grade level. The GT-MHR has 

two active diverse heat-removal systems: the power conversion system, and a shutdown 

cooling system. Should neither of these active systems be available, an independent passive 

means removes core decay heat. The reactor-cavity cooling system (RCCS) surrounding the 

reactor vessel affords sufficient cooling to contain the radionuclides within the coated fuelparticles without needing active safety systems or operator intervention. 

The design is based on the standard General Atomics reactor built and operated at Peach 

Bottom Unit 1 (1967–1974) and at Fort St. Vrain (1976–1989); both were helium-cooled 

demonstration plants with graphite block fuel (DOE, 2010).

PBMR

The PBMR is a helium-cooled, graphite-moderated high-temperature reactor generating 165 

MWe. It consists of a vertical steel pressure-vessel, lined with a layer of graphite bricks that

serves as an outer reflector for the neutrons generated in the nuclear reaction, and as a 

passive-heat transfer medium. This graphite reflector encloses the reactor core. A fully loaded

core would contain a bed of 456,000 fuel spheres (pebbles). Each sphere consists of ceramiccoated, low-enriched (less than 20%) UO2 particles, encased in graphite to form a 60-mm 

diameter fuel sphere (about the size of a tennis ball). The geometry of the fuel region is annular

(ring shaped) and located around a central graphite column that serves as an additional nuclear 

reflector. The nuclear reaction takes place in this fuel annulus or “pebble bed.” Helium flowing 

through the pebble- bed core removes the heat generated by the nuclear reaction. This helium 

then is cycled through a power-conversion unit to directly produce electricity via a gas turbine.

or indirectly through an external SG, which drives a steam turbine. 

The graphite in the fuel sphere and the silicon-carbide coating on the fuel particles form the 

main barrier preventing the release of radioactivity from the fuel. Due to the vendor’s high 

degree of confidence in the fuel-fabrication process, a pressure-retaining containment may not 

be required; similarly, because there is no change of phase in the coolant to produce large 

pressure spikes, high-pressure-engineered safety features are unnecessary. The

documentation we reviewed stated no physical process in the reactor’s design can produce a 

radiation hazard outside the site’s boundary mainly due to the reactor’s low power- density, and 

the graphite’s large heat capacity. Core cooling is maintained even in a loss of all forced 

convective cooling. Therefore, the PBMR does not require any of the traditional nuclear-safety 

systems that actively protect the current generation of reactors against a radiation release. 

The pebble-bed reactor is based on a previous German test reactor, the Advanced Burner 

Reactor (ABR), and the Thorium High-temperature Reactor (THTR) (DOE, 2010).
19

Plant Mission

In addition to generating electricity, the NGNP program identified other missions (Figure 3-1). 

Demick (2010) recently discussed them in a report on the U.S. energy infrastructure: 

Because it [a high-temperature gas-cooled reactor] operates at a much higher temperature than an 

LWR (typically operating temperatures of a light water reactor (LWR) are in the range of 3000C), it

can be used in commercial applications other than for generation of electricity; the principal 

application of LWRs to-date. These applications include supplying process heat and energy in the 

forms of steam, electricity and high temperature gas to a wide variety of industrial processes including, 

for example, petro-chemical and chemical processing, fertilizer production, and crude oil refining. In 

addition to supplying process heat and energy the HTGR can be used to produce hydrogen and 

oxygen which can be used in combination with steam and electricity from the HTGR plant to produce, 

for example, synthetic transportation fuels, chemical feedstock, ammonia, from coal and natural gas. 

Studies performed to the date of this writing and discussions with potential end users have 

investigated the characteristics of the HTGR that best fit these applications. These studies have 

concluded that reactor module sizes in the range 200 to 600 MWt operating in the temperature range 

of 700 to 8000C can satisfy most of the energy needs of these applications. (p. 26).

Figure 3-1 Multiple SMR missions

(Illustration courtesy of Idaho National Laboratory)

Agents’ Roles and Responsibilities

The HTGR SMRs will be highly automated; details about the level of automation are yet 

undetermined.

Staffing, Qualifications, and Training

A preliminary estimate of the requirements for operations and maintenance staffing for the 

PBMR is approximately 150 for a 10-unit site (Kadak, 2000); however, staffing in the MCR may 

be impacted when installing new units. Staffing requirements for the GT-MHR were not 

discussed in the information we reviewed. 
20

Management of Normal Operations

The GT-MHR design can have up to 10 units located in underground silos with a common 

control room. The PBMR’s current concept is to have a 10-unit configuration. Multiple units will 

be monitored and controlled from one control room. As yet, no detailed information about the 

design of the control room is available. 

The GT-MHR will be refueled on site every 250 days. The PBMR reactor will be refueled 

continuously thus, plant availability is higher than LWRs. Furthermore, continuous refueling 

precludes there being a large amount of excess reactivity within the core. Refueling operations 

will be completely automated, with an automated pneumatic system continuously handling the 

fuel.

Accordingly, only 30 days of outage is envisaged every six years. This plan demands greater 

emphasis on controlling plant configuration because most routine maintenance repairs and inservice inspections likely will likely be done at power. Additionally, to compensate for any small 

helium leakages, helium will be added to the reactor’s coolant system.

The PBMR also is designed for load-following operation within specified limits, meaning that the 

amount of electrical power output can be varied to match the existing power demand. This is 

very different from the typical base-load NPP. Additionally, the PBMR will withstand a 100% 

load rejection without a reactor trip. 

Management of Off-normal Conditions and Emergencies

There was little information about handling off-normal conditions and emergencies in the 

documentation for either design. However, their low excess reactivity lowers the safety 

significance of reactivity control and reactor shutdown systems compared with typical NPPs. 

Although the reactor protection system will bring the reactor into a hot shutdown during a normal 

shutdown, the decay of xenon (Xe135) might cause the core to become re-critical after one or two 

days. Then, the operator might have to actuate additional reserve shutdown systems to reach 

cold shutdown. In a depressurization accident, rapid cooling could produce a similar reactivity 

effect.

Management of Maintenance and Modifications

No information was available. 

3.3 Liquid-metal Reactors

The LMRs are liquid-metal-cooled using either sodium or lead-bismuth as a primary coolant: 

hence, they have high thermal-conductivity and high boiling-points. The primary system uses 

electromagnetic (EM) pumps or natural circulation to circulate the liquid-metal. An intermediate 

cooling system is employed between the primary-coolant system and the SGs. The LMRs are 

fast neutron-reactors (rather than thermal) and therefore do not need a neutron moderator. 

They are designed to use the full energy-potential of uranium, rather than the approximately one 

percent used by conventional power reactors. They operate at or near atmospheric pressure, 

thereby greatly reducing the need for active safety features.
21

We examined three LMR designs, each of which we describe below, with a discussion of our 

ConOps dimensions: 

• Toshiba’s 4S (super-safe, small, and simple) SMR

• Hyperion Power Generation’s Hyperion Power Module (HPM) SMR

• GE’s Power Reactor Innovative Small Module (PRISM) SMR

4S Reactor

This small, liquid-sodium-cooled 4S reactor, with a thirty-year lifespan, produces 10MWe. The

4S NSSS is designed for offsite fabrication and shipping by rail, truck, or barge to the plant site. 

The entire NSSS, comprising a reactor vessel, containment guard vessel, SG, and equipment 

compartments or cells, is located below grade. 

Inside the reactor vessel are the core, a single control rod, two 50% capacity electromagneticpumps, an intermediate heat exchanger, and movable radial reflector. The reflectors control 

reactivity and power of the plant by moving vertically. The core consists of 18 hexagonal metalfuel assemblies made up of U-10%Zr Alloy rods enriched with 19.9% U-235. The SG, part of 

the secondary sodium loop, is separate from the reactor vessel and connected to it by a belowgrade pipe way. Its own electromagnetic pump circulates liquid sodium between the in-vessel 

intermediate heat exchanger (IHX) and the shell side of the SG. Steam is on the tube side of 

the SG, which flows to the turbine. A sodium dump-tank containing argon cover-gas is 

connected to the shell side of the SG to drain liquid sodium from it should the pressure increase 

from water/sodium interacting (due to a SG tube leak). The BOP equipment (turbine, generator, 

and steam-cycle support equipment) is located above grade.

The designs of the 4S and PRISM SMR (discussed below) are based on older LMRs, such as 

the French-designed Phenix and Super Phenix plants. Their design also is influenced by the 

experience gained from the U.S. test reactors, viz., the Experimental Breeder Reactor (EBR) 1, 

EBR 2, and the Fast Flux Test Reactor (FFT). 

HPM

The HPM is a small, lead/bismuth eutectic-cooled reactor producing 25MWe. The HPM NSSS 

is designed for offsite fabrication and shipping to the plant site by rail, truck, or barge. The 

entire NSSS is located below grade, and consists of a reactor vessel, a superheater, evaporator, 

pre-heater, and equipment cells. Internal to the reactor vessel are the core, two boron carbide 

(B4C) control rods, and a quartz radial reflector. The core, of stainless-steel-clad uranium 

hydride (UH3) fuel rods, has less than a 20% U-235 enrichment. The BOP equipment (turbine, 

generator, and steam-cycle support equipment) is located above grade. 

The Hyperion SMR design uses nitride fuel, with which the industry has very little experience. 

Also, it uses lead-bismuth cooling which is new and different; thus, experience with it is sparse. 

However, there is a Pb-Bi test loop at Los Alamos National Laboratory, and the reactors in 

Soviet submarines were Pb-cooled.

PRISM

The PRISM reactor is a small, sodium-cooled reactor. The standard plant design consists of 

three identical “power blocks”, each of 415 MWe, and with three reactors. Each reactor is 

located in its own below-grade silo, and is connected to its own intermediate heat-transport
22

system (IHTS) and SG system. The SG and secondary-system hardware sited in a separate 

building are connected by a below-grade pipe way. Each power block shares a sodium-service 

vault containing sodium-purification-process equipment. Each reactor has its own SG, 

combined with the two others in each power block by a common header to feed a single turbine

generator. All the reactors on the site share a common control center, reactor maintenance 

facility, remote shutdown and radwaste facility, and assembly facility.

The reactor enclosure consists of the reactor vessel, the containment vessel, and the reactorclosure head. There is a diametrical gap filled with argon gas between the reactor vessel and 

the containment vessel; it is designed to permit in-service inspection (ISI) and contain a primarycoolant leak without uncovering the core. The reactor’s closure head is common to the reactor 

and containment vessels. Its head has a rotatable plug for refueling and penetrations for the 

primary coolant pumps, piping to the intermediate heat exchanger system, instrumentation and 

other hardware. All containment penetrations pass only through the closure head.

The PRISM core is designed to use metallic rather than oxide fuel. Six control rods modulate 

reactivity and power. An ultimate shutdown system in the center of the core offers the ability to 

reach cold shutdown if the control rods cannot be inserted.

Four EM pumps, powered by non-1E9 power supplies, force primary coolant through the core. 

However, four motor-generator sets supply power to coast down the EM pumps. Heat from the 

core is transferred to an intermediate sodium loop heat exchanger, then to a sodium/steam 

heat-exchanger, and finally a steam turbine. 

Each of the nine reactors has an independent reactor protection system (RPS) located in the 

reactor vault, but isolated from the reactor. The RPS, a quad-redundant protection system, is a

digital system entirely independent from the power control system (PCS). 

As mentioned above, the predecessors to the PRISM and 4S are based on older LMRs, such as 

the French-designed Phenix and Super Phenix plants. Their design also is influenced by the 

experience gained from the U.S. test reactors, viz., the Experimental Breeder Reactor (EBR) 1, 

EBR 2, and the Fast Flux Test Reactor (FFT). 

Plant Mission

The primary mission of these designs is producing electricity. The missions of the 4S and HPM 

additionally consider district heating; although this capability will entail design modifications, the 

documentation did not specify what they are. Additional missions for the PRISM design were 

not discussed in the literature. 

Agents’ Roles and Responsibilities

The documentation provided little information on agents’ roles and responsibilities. All three 

designs will be highly automated, but the precise levels are undetermined as yet.

The 4S documentation stated that the plant’s computer will automatically sequence normal 

startup and shutdown, with predetermined hold points where the operator’s permission is 

 9 The safety classification of the electrical equipment and systems that are essential to emergency reactor 

shutdown.
23

needed to continue the sequence. This arrangement is similar to NuScale’s partial automation 

approach described earlier.

PRISM operations from 0 to 25% power are partially automated; but between 25 to 100% power, 

they are fully automated, although operators can intervene.

Staffing, Qualifications, and Training

The designs of the 4S and HPM SMRs did not discuss staffing, qualifications, and training 

requirements. The PRISM design can be expanded up to three power blocks (nine reactors). 

For this configuration, the common main control room is expected to have four licensed 

operators (one SRO, and three ROs). 

Management of Normal Operations

All three HTGR designs can be organized in a multi-unit configuration and monitored and 

controlled from one control room. As noted above, as many as nine PRISM reactors may be 

operated at a site. Then, each RO would control three reactors. However, the documentation 

we reviewed for the 4S and HPM designs lacked information on the design of the control room. 

The HPM is designed to operate for 7- to 10-years, at which time the entire reactor is removed 

from service and returned to the factory, eliminating the need for on-site refueling.

The 4S is designed to operate for 30 years with no refueling. The PRISM design requires 198 

days of refueling in a year for the maximum plant configuration of nine reactor units. However, it 

is unclear who operates the refueling machine, and how; similarly, this is not stated for the 

auxiliary liquid-metal processing systems, (e.g., the Primary Sodium Processing Subsystem) in 

each plant. 

Management of Off-normal Conditions and Emergencies

The 4S reflectors provide the main shutdown reactivity and, on a scam, are dropped below the 

core. The one control rod is for backup shutdown only. Cooling is by natural convection on loss 

of pumping power.

PRISM has a remote shutdown facility (RSF), and the RPS vaults contain safety-related 

instrumentation powered by a Class 1E source. For emergencies involving toxic gases or 

smoke, it is not clear how the PRISM operators will access the RSF or RPS vaults. 

The fire brigades of the PRISM and 4S reactors are of particularly importance because of the 

potential therein for sodium/water fires. Thus, the personnel manning the brigade need 

specialized training. Also, staffing the fire brigade may impact overall shift staffing levels.

Management of Maintenance and Modifications

HPM’s and PRISM’s primary coolant is sodium; hence, any maintenance on the SGs is 

hazardous. Furthermore, the HPM’s primary coolant is lead/bismuth, so that maintenance on 

any external equipment containing the primary coolant can also be precarious. Work must be 

done in an inert atmosphere, thus, necessitating specialized training (in hazards associated with 

liquid sodium), and specialized personal protective equipment (PPE). 
24

When a reactor is removed from service in a multi-unit HPM configuration to be returned to the 

factory, its instrumentation is disconnected from the main control room. Additionally, any piping 

containing liquid lead/bismuth is disconnected. The potential impact on other operating units 

remains to be determined. 

The documentation did not address the handling of any of the residual liquid-metal from the 

operational maintenance of 4Ss and HPMs, or from the disconnected primary coolant pipes 

when the reactor is to be shipped back to the factory for refueling. 

Because the 4S and HPM reactors come sealed from the factory and there is no design 

provision for opening the reactor vessel, it is uncertain how any ISI or maintenance will be 

performed on the radial reflector or in-core sensors.

3.4 Insights for SMR ConOps from SMR Design and Operations

Much of the information available to us on ConOps aspects of SMRs was in the preliminary 

stages. In this Section we described the SMR designs as they were when we were conducting 

the work. Some of this information will be out-of-date after the report is published.

We nonetheless can identify key design differences between SMRs and current NPPs them 

may be influence human performance. By current plants, we mean Generation II plants 

operating in the United States, and the Generation III and III+ designs that the NRC currently 

reviewing. Table 3-2 shows these comparisons (note that not every item listed applies to all 

SMR designs). We next discuss the implications of these differences. 

Table 3-2 Comparison Between Current Plants and SMRs on Dimensions That May 

Influence Human Performance

ConOp 

Dimension

Current Plants SMRs

Plant Mission Electrical production Electrical production and, potentially,

process-heat applications

Current designs are 

incremental evolutions from 

previous designs with

extensive operating 

experience

Many SMR designs are based on new 

technology with minimal predecessor plant 

experience

Roles and 

Responsibilities

Crew responsible for electrical 

production

Crew may be responsible for electrical 

production and collateral missions. such as 

hydrogen production

Crew responsible for a single 

unit

Crew or individual operator responsible for 

multiple units

Automation, often simple,

mainly applied to safety 

systems

Extensive use of automation, sometimes 

complex, for operations

Staffing Staffing levels meet 

10 CFR 50.54(m)

Staffing levels typically are below 

10 CFR 50.54(m)

Normal 

Operations

Plants are based on LWRtechnology with well-known 

operational requirements 

Many SMR designs use non-light-water 

reactor technology that might pose new 

operational requirements 

Large plants that typically can 

produce 1000+ MWe

Smaller, simpler designs with electricalgeneration capacity typically less than 400 
25

ConOp 

Dimension

Current Plants SMRs

MWe

Plants are built on-site Modular approach to constructing plants

Limited use of shared systems Some SMR designs use shared systems; 

some are shared across many units. An 

example is the NuScale reactor pool used by 

all 12 units

Base-load operations Load following as well as base-load 

operations

A shift crew manages a single 

reactor unit from a control 

room

A single crew or operator may manage 

multiple units and additional missions from a 

single control room 

HSIs provided for plant 

evolutions

HSIs provided for plant evolutions of multiple 

units, and also for monitoring and control or 

other missions 

A single reactor can be in a 

variety of states

Individual reactors may be in a variety of 

states (e.g., shutdown, startup, or refueling,

and various types of maintenance and 

testing) and running at various power levels

Additional reactors are 

introduced as separate plants

Additional units can be added when needed

and while other units are operating

Refueling is performed during 

outages

Novel approaches to refueling, such as online refueling, and relocating reactor modules 

to a dedicated servicing area for refueling

Off-normal 

Operations

Plants are based on LWRtechnology with well-known 

hazards

Many SMR designs use non-light water 

reactor technology that might pose new 

hazards

Currently operating plants use 

active safety systems; some 

new designs employ some 

passive systems

Safety systems mainly are passive

Maintenance Major maintenance performed 

during outages

Novel approaches to maintenance, such as 

moving reactor module to a dedicated 

location in the plant or to the factory for 

servicing

Maintenance practices and 

hazards are well-defined

There are many new maintenance practices 

and potential hazards 

The differences between current U.S. plants and SMR design and operations lead to new 

challenges and potential human-performance issues. They are summarized below, and 

organized by the ConOps dimensions to which they apply.

Plant Mission

1. New missions create new systems, personnel tasks, and workload. Questions that may be 

associated with the multi-mission operations include the following:

• If process heat applications, viz., hydrogen production, desalination, and refining are 

envisioned for multi-unit sites, will different ones be allowed at the same facility 

generating electricity? 
26

• If so, must plant operators be trained in dealing with upset conditions in process heat 

applications and other interfacing requirements. 

• Will this complicate the operator’s training because they will have to know all application 

interfaces?

2. Commercial NPPs evolved slowly, with new designs improving upon prior ones. Through 

the years, using operating experience from predecessor plants has been an important 

aspect of plant design, licensing reviews, and operational improvements. SMRs are a new 

category of plant design, and consequently, there are few or no predecessor plants affording 

operating experience. Some operating experience may be available from the experience of 

similar designs and non-nuclear systems. However, less operating experience can mean 

that design problems have not been worked out and may cause operational problems, 

events, or accidents. Vendors and regulators will have to address the impact of this 

information gap on design and licensing of plants. 

Agents’ Roles and Responsibilities

3. SMRs will be highly automated. High levels of automation were associated with difficulties 

in human performance in many types of complex systems (O’Hara & Higgins, 2010). Some 

of these issues include:

• change in the overall role of personnel that does not support human performance

• difficulty understanding automation

• low workload, loss of vigilance, and complacency

• out-of-the-loop unfamiliarity, and degraded situation-awareness

• difficult workload transitions when operators must assume control when automation fails

• loss of skills since automated tasks seldom are performed

• new types of human error, such as ”mode” error10

The design of SMRs and their operations must address these potential problems. 

Staffing, Qualifications, and Training

4. 10 CFR 50.54(m) governs staffing levels in current plants, requiring one SRO, two ROs, and 

a shift supervisor (second SRO) per reactor. In those SMRs with staffing information, levels 

were below this; therefore, an evaluation of, and exemption from the staffing regulation will 

be needed. 

5. After defining human responsibilities, the tasks associated with them must be assigned to 

specific staff positions for both normal operations, and off-normal/emergency conditions. 

Depending on the use of automation, these tasks may include monitoring and controlling

multiple individual units, shared systems, new missions, and monitoring and backing up the 

automation. SMR designers must determine the allocations that best support overall 

 10 Automated systems often have a variety of modes in which the inputs used and output provided differ. 

Operator inputs might have different effects, depending upon each mode’s characteristics. Errors result 

when operators make inputs thinking the system is in one mode when it is in another.
27

system-performance and safety, and consider the impact on teamwork, e.g., such as the 

effect on supervision and the peer-checking process.

6. SMR operating crews have the added responsibility of monitoring and controlling multiple 

units. Situational awareness and workload are key considerations in assessing the ability to 

effectively and reliably accomplish these tasks: Maintaining sufficient awareness of the 

status of multiple SMRs may tax crews and individual operators. Maintaining SA may be 

further challenged when individual units are at different operating power levels and different 

states (e.g., shutdown, startup, transients, accidents, refueling, and maintenance and 

testing).

7. While the training requirements for SMRs are yet undetermined, there will be new 

considerations. For example, in current PWRs, a PORV or the pressurizer spray are the 

mitigation function to primary system pressure spikes. Because the NuScale and IRIS 

SMRs do not have either, the design will require a change in operator training on controlling 

the primary system’s pressure for various upset conditions. Also, chemical shim (boron) is 

used to make operational adjustments for reactivity control for fuel burn-up. Because 

mPower controls reactivity via a control rod movement only, this design will require changing 

the training for operational reactivity control.

Management of Normal Operations

8. Some designs incorporate unique features entailing reactivity effects that differ from those in 

light-water reactors. For example, the HPM is a lead-cooled fast reactor, and the presence 

of lead in the core involves different reactivity effects from those in light-water reactors; it 

exhibits little neutron thermalization and has lower Doppler effects. In addition, the 

temperature coefficient of reactivity will be less negative and the neutron lifetime shorter. 

These features all tend to quicken the dynamics of core power and transient operations. 

The operators’ control of reactivity effects and overall reactor safety depends on their 

understanding of them; an incomplete understanding by operators may lead to incorrect 

actions, particularly during upsets.

9. Current-day NPPs typically operate at 100% power and provide a base load to the utility’s 

electrical distribution system. Load following is an operational method that allows the NPP’s 

power output to vary up or down as determined by the load demanded by the distribution 

system. Thus, both the reactor and turbine power change in response to the external 

demand; raising the demand on operators to monitor the automation and plant response,

and to take any needed actions. In addition, for a multi-unit site, load following may 

engender the startup and shutdown of multiple units in response to large changes in load 

demanded, affording additional opportunity for equipment to fail. Further, load following will 

create new tasks that are not currently undertaken in U.S. plants and they will open new 

chances for personnel errors. 

10. Refueling operations for some SMRs are different from current practices in the United 

States, for example, several designs refuel the reactor on-line or continuously. Multi-unit 

plants may encompass units undergoing refueling while others are in shutdown or operation. 

The need to manage this concurrent activity while the plant is operating must be included as 

part of the operator’s tasks. As another example, every 250 days, the GT-MHR is refueled 

on-site; hence greater emphasis must be placed on controlling overall plant configuration 

because of possible overlaps in refueling operations at a multi-unit reactor site. Since 

coolant pressure varies with power level in the GT-MHR, a single operator monitoring 
28

multiple reactors may have to make different compensating manual adjustments to the 

reactivity control system, which might lead to potential errors. Additionally, since any small 

helium leakages must be compensated for by adding helium to the reactor-coolant system, 

such adjustments to the coolant pressure/power level will be complicated further. In the 

literature we reviewed, it was unclear whether this would be a manual or automated

function.

11. Most SMRs are scalable; that is, multiple units can be grouped at a site to meet a utility’s 

specific power needs, yielding various power outputs. Also, units share common support 

systems in some designs. Construction and installation of 2nd, 3rd, or later units may be 

ongoing while earlier ones operate at power, a very different situation from the current 

practice wherein a second unit under construction is clearly separated from operating units. 

Ongoing construction might distraction the operators of working units.

12. The effect on personnel of differences in SMR units is unknown. While a licensee may plan 

to have identical units at a particular site, this may not be achievable due to modifications 

that improve reliability, reduce cost, or deal with problems of obsolescence, thereby 

impacting the reliability of the crew and operator. For example, should the units’ differences 

lead to a different interpretation of status based on parameter displays, it may impair the 

operator’s recognition of deviant performance. Further, if the unit differences necessitate 

distinct responses, such differences may complicate the operator’s response; this might 

entail operator error when, for example, operators respond to a disturbance in Unit 2 in a 

way that is appropriate for Unit 1 but inappropriate for Unit 2. Unit differences will affect the 

review of procedures as well as HSIs. Thus, the effect of unit differences on SMRs 

operations must be understood and addressed. 

13. The design of the control room is very important. For a single reactor and its secondary 

systems, modern computer-based control rooms typically have a large overview display, 

several operator workstations, a supervisor’s workstation, and supplemental workstations for 

engineering and maintenance. The plan is managed by a crew of three or more people.

The principal question centers round the design of the control room to support SMR 

operations when a single control room serves multiple reactors, and a single operator may 

be responsible for the reactor and secondary systems of up to four complete units. The 

answer partly depends on the allocation of the crew’s responsibilities. Nevertheless, it might 

be challenging to develop a single workstation to monitor even one reactor in light of the 

HSIs presently needed for control room monitoring of a single reactor; expanding that knowhow to four units may prove difficult.

One SMR designer’s preliminary concept suggested that eight monitors are needed to show 

the alarms, displays, procedures, and controls for a single unit; thus, 32 monitors would be 

needed for four units. The ability of a single operator to monitor so much information may 

be problematic, and, compared with current NPPs; the likelihood of missing important 

information might well increase.

In addition to considering multi-unit operations, some designers will need to accommodate 

new tasks in the HSIs, such as moving reactors for refueling, and new missions, such as 

hydrogen production. These could increase the operator’s workload and complicate 

navigation through the information screens.

14. A vital aspect is assuring the optimum design of controls, displays, and alarms such that a 

single operator effectively can manage one or more SMRs. Thus, should separate HSIs be 
29

associated with each unit, or should an integrated representation be used to help operators 

maintain high-level awareness of the status of all units for which they are responsible. If the 

units are separately displayed, and the operator is focusing on one of them, then he/she 

might lose awareness of the status of the others. However, with an integrated display of 

multiple units, it might be challenging to ensure that operators do not confuse information 

about one, with that about the others. Furthermore, there is the problem of unit differences 

(discussed earlier) and how to resolve this in HSI design. 

Management of Off-normal Conditions and Emergencies

15. One of the NRC’s actions after the accident at the Three-Mile Island NPP was to improve 

the operating crews’ ability to monitor critical safety functions by requiring each plant to 

install a safety-parameter display system (SPDS) through 10 CFR 50.34(f)(2)(iv). The NRC 

also published guidance on the characteristics of SPDSs in NUREG-0835, NUREG-1342, 

NUREG-0737 (Supplement 1), and NUREG-0700, Section 5. The specific safety functions 

and parameters identified in these documents are based on conventional LWRs. SMR 

designs may require different safety functions and parameters, especially for HTGRs and 

LMRs, to support operating crews in effectively monitoring plant safety. 

16. Two of the classes of SMR designs are based on non-light water technology: Gas-cooled;

and liquid-metal ones. In contrast to LWR designs, these classes of designs encompass 

new hazards associated with the reactor’s technology. These include hydrogen, helium, 

liquid-metal (such as sodium and lead), and much higher operating temperatures/pressures, 

along with the use of high-temperature gas, and graphite in the core. Sometimes, graphite 

cores are flammable and could create radiologically hazardous fumes. Such hazards must 

be understood and addressed in the safety systems used to monitor and mitigate the 

hazards, in the HSIs through which staff monitor the plant, in the procedures they use to 

resolve hazards, and in operator training.

Management of Maintenance and Modifications

17. Many SMRs are designed for modular construction and maintenance consists of

replacement of modular components.

11 Previously, plant personnel participated in the onsite construction, component-level testing of installed components, and pre-operational 

testing; hence, they were thoroughly knowledgeable of plant structures, systems, and 

components. Therefore, fabricating plants in factories rather than on the site demands

changes in how plant personnel gain a comprehensive knowledge of systems and 

components since they may well have less understanding of the plant and equipment. 

18. During our review, we noted several new maintenance operations with potential safety 

implications: 

• The NuScale design has only one bay that is used for refueling and maintenance. 

Hence, one reactor may be refueling when another develops a problem requiring invessel access. It is unclear how operators will manage this situation because the 

reactor pool is the ultimate heat sink for the operating reactors and cannot be drained.

 11 For describing maintenance, a module is an assemblage of two or more interconnected parts or 

components that comprise a single physical entity with a specific function. NUREG-0700, Section 13 

has examples of replacing modular components in digital systems.
30

• mPower’s core is located below the SG, so that the latter must be removed during 

refueling, adding extra work and complexity. 

• The 4S and HPM reactor vessels are sealed; thus, it is unclear how in-vessel SI or 

maintenance will be undertaken. 

19. During our review, we noted new potential hazards for off-normal conditions and 

emergencies that also might impact maintenance. Also, we identified several maintenance 

hazards for the various SMR designs.

• The IRIS design has eight in-vessel RCPs. Pump seals are replaced in-vessel, likely 

considered as a confined space, with work on contaminated- and activated-components 

that are person-rem intensive. This arrangement may increase the difficulty of 

maintenance and create the potential for delays in needed maintenance, for errors in 

completing the work, and higher exposures to workers doing it. 

• IRIS’s in-vessel electrical wiring, such as to the RCPs and internal control rods, may 

require specially qualified staff, and/or periodic testing for enhanced aging, because it 

will be operating in a very harsh radiation environment. 

• The operations and the maintenance staffs of the GT-MHR and the PBMR need 

extensive training on the hazards of helium leaks and their detection.

• Sodium is the primary coolant in the 4S and PRISM designs; accordingly, maintenance 

on the two external SGs is hazardous, and will entail specific training because operators 

must wear specialized PPE and work in an inert atmosphere. 

• Lead/bismuth is the primary coolant in the HPM, so working on the external SGs may be

hazardous, requiring specialized training and the use of particular PPE.

Our main conclusion is that more information is needed on the ConOps aspects of SMRs. SMR 

ConOps are preliminary as yet, but continue to evolve as the plants’ designs are refined, and 

the vendors prepare for licensing activities. 

From the information available, we identified significant differences between SMRs and current 

designs, and the potential human-performance issues that may require resolution.
31

4 GENERAL SMR LITERATURE

There are very few general publications about the operational and HFE aspects of SMR designs; 

we reviewed them below, organized by the dimensions of our ConOps model. In addition, the 

nuclear industry has hosted meetings between the NRC, the DOE, and SMR vendors to identify 

licensing and technical issues/challenges that must be addressed to support the design, design 

review, and licensing of SMRs. Such meetings included the NRC’s Regulatory Information

Conference, Commission Briefing on Reactor Issues - Design Certifications, and the Workshop 

on Small- and Medium-sized Nuclear Reactors. At them, several presentations covered HFE 

and operational considerations (Kinsey, 2010; Mallett, 2010; Mays & Williams, 2010; Reckley, 

2009; Smith, 2009).12 However, while these presentations identified human-performance 

challenges, they were not described in detail. In Table 4-1, we summarize those challenges, 

organizing them by the dimensions in our ConOps model presented in Section 4.7.

4.1 Plant Mission

Several SMR plant designs envision additional missions beyond electrical generation, including 

co-generation, hydrogen production, industrial-heat production, district heating, desalination, oil 

extraction, and vessel propulsion (Clayton & Wood, 2010; IAEA, 2001). A study by the National 

Academy of Sciences (NAS, 2008) of NGNP technology reached the following conclusions:

The potential need to couple two diverse processes (electric power generation and hydrogen 

production) complicates the mission of the NGNP. Differing dynamic responses of the reactor 

to the hydrogen production plant or an electricity generating plant must be carefully assessed 

for NGNP’s single mission project. Design and analytical studies are needed to investigate 

possible configurations and control schemes. (p. 38)

Also, the topic was identified as Issue 4.4, Industrial Facilities Using Nuclear-Generated 

Process Heat, in SECY-10-0034 (NRC, 2010):

The NRC staff has identified potential policy and licensing issues for those facilities used to provide 

process heat for industrial applications. The close coupling of the nuclear and process facilities 

raises concerns involving interface requirements and regulatory jurisdiction issues. Effects of the 

reactor on the commercial product of the industrial facility during normal operation must also be 

considered. For example, tritium could migrate to a hydrogen production facility and become a 

byproduct component of the hydrogen product. (p. 15)

This concern applies to all SMRs with multiple purposes.

4.2 Agents’ Roles and Responsibilities

As we discussed in Section 3, SMRs are expected to be highly automated plants. Clayton and 

Wood (2010) suggested that automation likely will manage all aspects of operations, from 

startup to shutdown, and responses to anticipated events. Innovative technologies, such as 

intelligent automation and prognostics, must accompany the reduced staffing of SMRs. 

According to Clayton and Wood, “Highly automated intelligent control involves more than simple 

automation of routine functions. It implies the detection of conditions and events, determination 

of appropriate response based on situational awareness, adaptation to unanticipated events or 

 12 The NRC hosts many meeting to discuss SMR issues that include presentations from the NRC, the 

DOE, industry groups such as the NEI, and vendors. The presentations are at 

http://www.nrc.gov/reactors/advanced/public-meetings.html; retrieved April 26, 2011.
32

degraded/failed components, and reevaluation of operational goals” (p. 149). They further 

emphasize that these types of controls were not tested in the nuclear plants, and there is limited 

experience from other industries. 

Tran et al. (2007) identified the high level of SMR automation as a potential HFE concern. This 

is supported by the NRC’s research on the effects of high levels of automation on operator 

performance (O’Hara & Higgins, 2010), including the following:

• change in the overall role of personnel that does not support satisfactory human 

performance

• difficulty understanding automation

• monitoring failures, loss of vigilance, and complacency

• out-of-the-loop unfamiliarity, and degraded SA

• difficult workload transitions when operators assume control on loss of automation

• loss of skills since automated tasks seldom are performed manually

• new types of human error

Passive safety systems are one type of automation employed in SMR design. The IAEA 

identified the following potential concerns related to passive systems based on the limited 

experience available (IAEA, 2009): 

• The reliability of passive safety systems may not be understood as well as that of active 

ones.

• There may be a potential for undesired interactions between active- and passive-safety 

systems; for example, injection by an active pump easily will overwhelm passive natural 

circulation.

• It may be difficult to ‘turn off’ an activated passive safety system, after it was passively 

actuated.

• Implications must be proven of incorporating passive safety features and systems into 

advanced reactor designs to achieve the target safety goals; the supporting regulatory 

requirements must be formulated and established. 

These IAEA concerns and their associated uncertainties may challenge operators of plants 

utilizing passive systems. 

4.3 Staffing, Qualifications, and Training

Plant staffing seemingly is the most frequently identified HFE issue in SMR design. Staffing 

levels in U.S. plants are governed by regulations in 10 CFR 50.54(m); the NRC recognized that 

SMR staffing levels might deviate from them. Issue 4.1, Appropriate Requirements for Operator 

Staffing for Small or Multi-Module Facilities, in SECY-10-0034 (NRC, 2010) identified staffing 

“...as a potential policy issue that may require changes to existing regulations.” The NRC has 

written general guidance for reviewing staffing exemptions in NUREG-1791 (Persensky, et. al, 

2005); however, this guidance has not been applied yet. 
33

In 2001, the IAEA published the staffing requirements for small- and medium-reactors, defined 

as 700 MWe or less (IAEA, 2001). As noted earlier, IAEA defines small reactors as 300 MWe 

or less (IAEA, 2005). While not addressing multi-unit, modular reactors, the IAEA recognized 

that the staffing demands in small plants may differ from those in larger plants. Developing 

countries favor small plants; staffing is the most costly component of their operation and 

maintenance. Thus, reducing staffing costs offers economic advantages in these countries and 

elsewhere. The IAEA convened a workshop for operators of small plants, at which it was 

concluded that while staffing levels for current small plants is similar to those of larger ones, the 

designs of new small plants will incorporate features likely to reduce staffing demands. These 

features include simplified design, simplified maintenance, use of computerized support 

systems for personnel tasks, and increased control room functionality. The latter covers greater 

employment of automation for routine tasks, and HSIs that will lower the workload of plant 

operations. The IAEA study considered that specific staffing requirements will reflect the plant’s 

design and its intended use, which may include co-generation. A limitation of this study for our 

present purposes is that it does not consider staffing in multi-unit plants.

A special committee of the American Nuclear Society (ANS, 2010) evaluated the staffing of 

SMRs. Grenci and Haemer (2010) assessing these needs for SMRs concluded that staffing 

levels can be reduced below current regulations. In addition, they determined that the collateral 

duties of operators can be increased. Their analysis was not based on any single SMR design; 

rather it considered generic SMR design features. Compared to typical operating U.S. LWRs, 

SMRs have a smaller core inventory, and the plants have a smaller, simpler design that 

incorporates advances, such as passive safety-systems. Consequently, they should experience 

less core damage and release frequencies, and longer times to release. In addition, since SMR 

designs incorporate greater levels of automated operations, the operators’ workloads will be 

“significantly reduced.” Nevertheless, we particularly are concerned that such an analysis often 

fails to consider that increasing automation does not simply mean fewer tasks for the operators. 

Rather, increases in automation shift the operator’s work to supervisory control, thereby

increasing the monitoring workload, a shift that can be very challenging (O’Hara & Higgins, 

2010).

Grenci and Haemer (2010) conclude that these differences from current designs lead to fewer 

needed human actions and increased time availability. Thus, fewer staff are needed, collateral 

duties can be increased, and operators will be able to monitor and control more than one 

reactor. Should additional staff be needed, the longer times to damage or release should 

suffice, in most cases, to get them on-site. Supporting their argument, these authors 

considered the experience in other industries, wherein increases in automation led to reductions 

in staffing; they offered, as an example, the reduction in flight-deck crew from three to two in 

modern airliners. Grenci and Haemer (2010) noted that their general conclusions need to be 

confirmed for individual designs.

Some support for staffing reductions stemming from applying improvements in plant design 

comes from an NRC-funded study at the Halden Reactor Project (Hallbert et al., 2000). It 

examined the crew’s performance in normal- and minimum-staffing configurations while 

operating either a conventional plant or an advanced plant with passive safety features. This 

study did not look at multiple units. The control rooms for each plant design differed, and were 

representative of conventional- and advanced-plants. The former met the requirements of 10 

CFR 50.54(m) while the latter had fewer operators. Eight crews of professional operators, four 

for each plant type, managed five scenarios: (1) SG tube rupture, with a stuck-open SG safety 

relief valve in the affected SG, followed by a fire in the turbine hall; (2) interfacing systems 

LOCA compounded by instrument failures; (3) sustained total loss of feedwater; (4) loss of off-
34

site power with a single SG safety relief valve stuck-open; and (5) SG overfill. A wide range of 

performance measures were used including plant performance, team performance, SA, and 

workload. 

The results across the measures were not completely consistent, but the general finding was of 

a correspondence between crew size and plant type: The conventional staffing configuration 

performed better in the conventional plant than the reduced staffing configuration, while, for the 

advanced plant, the smaller crew performed better than did conventional staffing. The authors 

partly attributed the results to the relationship of the plant and control room design, and the 

allocation of functions and tasks between the two different designs. 

Several nuclear plant sites in Canada operate four-reactor units from a single control room 

(Lane & Davey, 2007). Each individual reactor has its own control boards and there are 

additional ones for common services such as fire protection, instrument air, heating and 

ventilation, and on-line refueling.13 The crew is structured with teams of approximately three for 

each reactor, along with a shift supervisor and shift manager. Separate operators are used for 

common services and refueling. Thus, during normal operations, each reactor has its own crew 

and its own control area. During unit upsets, shift assignments change; the shift supervisor 

focuses on the upset unit, and operators from unaffected units are reassigned to work with the 

crew of the upset reactors. The shift manager oversees the other three units and they are put in 

a “quiet mode”, viz., any evolutions are stopped and nonessential activity is ceased, so 

minimizing the likelihood of another unit upset. Thus, a significant transition occurs in the 

operation of all units, and in operator roles and responsibilities to manage the upset unit. The 

transitions are marked by “turnovers” at each unit to bring “new staff” up-to-date on the unit’s 

current condition and coordinate the activities of individual staff members. Lane and Davey 

emphasize the importance of the design of the control center in supporting normal operations 

and unit upsets when staffing transitions occur, and the latter has additional staff relative to 

normal operations. 

Tran et al. (2007) identified a staffing model as a key HFE issue for SMRs, noting that 

increasing automation is likely to reduce staffing size and may lead to new staffing models. The 

NRC’s research on emerging technologies identified the concept of alternative “functional 

staffing models” (O’Hara et al., 2008). Current plants have a large number of on-site personnel 

organized into functional groups including operations, maintenance, engineering, administration, 

and security. Many designs slated for near-term deployment in the United States do not involve 

fundamentally different plant-staffing concepts; accordingly, changes to the current approaches 

to staffing are not anticipated. However, SMR designs and the longer-term goals for economy 

and safety for Generation IV plants14 (DOE, 2002) likely will entail a trend toward different 

operating concepts and different approaches to staffing. In anticipating such new approaches, 

we use the term "functional staffing models" to refer to general approaches to fulfilling these 

human roles. 

Some staffing models depart from those typically used in current plants; for example, one with a 

decentralized functional groups may be considered. In this model, SMRs may be staffed with a 

very few on-site personnel. The on-site crew is made up of technicians who oversee the highly 

 13 Personnel refuel the CANDU plants while they are operating. 14 The international nuclear-community is cooperating in developing new reactor design- concepts to 

meet energy needs thirty years from now and beyond under the so-called Generation IV initiative. The 

vision for Generation IV plant designs includes ambitious goals for sustainability, economics, safety and 

reliability, and physical protection (DOE, 2002).
35

automated operation and occasionally undertake minor operations and maintenance tasks. Offsite specialists are responsible for other activities, and either come to the site when needed 

(such as for maintenance) or perform their tasks remotely. Highly trained crisis- management 

teams may handle significant disturbances; since they handle only crises, their level of expertise 

would be superior to what is attained when a single crew is responsible for normal- and 

emergency-operations (today’s model). Due to the low probability of such an accident, the 

teams are available to resolve emergencies at many sites, a role that will be supported by 

increased plant standardization. This is one example; many alternatives models can be 

proposed. 

The staffing model chosen is a very significant design decision that will drive many other 

aspects of the plant design, including degree of automation, HSI design, and personnel training. 

Eitrheim et al. (2010) examined the operation of more than one reactor by an NPP crew, 

exploring the effects on performance when three-operator crews simultaneously controlled two 

nuclear units compared to one. The simulated plants were highly automated BWRs with 

advanced HSIs. The one-unit configuration had standard staffing, consisting of a reactor 

operator, a BOP operator, and a supervisor. In the two-unit configuration, a main operator (MO) 

monitored Unit A (reactor and balance of plant systems) from one control room, and a second 

assistant operator monitored Unit B from another control room adjacent to the first one. A work 

manager supervised both operators. When Unit A was in an upset condition, the assistant 

operator from Unit B came to assist the MO under the direction of the work manager.

Meanwhile, the Unit B simulator was put in a frozen state. 

Nine professional crews participated in eight scenarios, all involving Unit A and the transition 

from start-up to 50% power. Performance measures included the following: Operators’ task 

performance as measured by the Operator Performance Assessment System (OPAS); SA 

based on operators’ reports on the state of specific parameters while the parameters were not in 

view; operators’ self-assessment of performance using a rating scale; and workload using a 

version of the NASA’s Task Load Index (TLX) and a subjective task complexity scale. 

We found the findings difficult to interpret. Both groups demonstrated similar task performance 

during easy periods of the scenarios. However, while the performance of all crews fell when the 

scenario became difficult, that of the two-unit crews dropped significantly more than the one-unit 

crews. There were no differences between one- and two-unit crews in their self assessments of 

performance. However, although there were no workload differences between the groups, the 

two-unit crews achieved better SA than the other crew. The study’s authors suggested that the 

results tend to favor the more traditional, one-unit staffing approach, concluding that “Reduced 

staffing levels might be sufficient during normal operation, but specialized support teams and 

roles may be necessary to handle disturbances and upset situations.” However, generalizations 

are hard to make due to inconsistencies in the results. Another aspect of this study limiting 

generalizations is that when the assistant operator left Unit B to assist the MO in Unit A, Unit B 

was put in a frozen state and left unattended; this would not happen in actual NPPs. 

 

4.4 Management of Normal Operations 

Several authors identified the demands of monitoring and controlling multiple units, each in a 

different operating mode, as a potential problem in plant design and operations (Clayton & 

Wood, 2010; O’Hara et al., 2008; Tran et al., 2007; Wood et al., 2003). Also, the NRC denoted 

this topic as Issue 4.3, Installation of Reactor Modules during Operation for Multi-Module 

Facilities, in SECY-10-0034 (NRC, 2010). 
36

SMR plant scalability and the possibility of shared systems can make multi-unit operations more 

complex than current plant operations, as Wood et al. (2003) stated: 

The challenge is to address operability issues of the shared and common systems when the first 

module is declared operational and the follow-on modules are still under construction. Because of the 

advances in l&C technology, common data networks that transmit and utilize large amounts of 

information will serve as integrated data links rather than the traditional direct point-to-point wiring. 

Thus, the control and monitoring operations of these modules must be fully operational and not 

susceptible to interference from construction and testing activities in the non-operational modules. 

Research is needed to address basic guidelines that may include modifications to the data highway 

and control room design to optimize the construction sequencing. This may result in a control room 

that is less optimal for human factors at all levels than would otherwise be possible if all the modules 

simultaneously completed construction. In addition to licensed operation, an option to consider is the 

use of a dedicated commissioning room in which a module would be commissioned and then 

"transferred" to the shared control room. (p. 59)

In addition to multiple units complicating control, the need to serve multiple missions also must 

be considered. That is, there is a need to flexibly reconfigure the secondary portion of the plant 

to meet electricity production and other objectives (Clayton & Wood, 2010). For example, 

operators may have to change the SMR units driving a turbine to produce electricity so they can 

generate hydrogen.

Clayton and Wood (2010) suggest that SMR operations will require a “new paradigm” in reactor 

controls. In the United States, nuclear plants are operated in base-load mode. The plants 

produce electricity for the grid, and other producers of electricity compensate for changes in 

demand. The authors believe that a base-load mode may be insufficient for SMRs that may 

have to cooperate with, and compensate for variability from other sources of renewable energy 

whose production depends on the vicissitudes of factors, such as sun and wind for which SMRs 

may have to compensate. 

Considering the challenge of controlling multiple units (in various states), shared systems, 

multiple missions, and grid needs, Clayton and Wood noted that “Multi-unit control with 

significant system integration and reconfigurable product streams has never before been 

accomplished for nuclear power, and this has profound implications for system design, 

construction, regulation, and operations” (p. 146). Research is underway to develop control 

strategies to meet these situations (Perillo & Upadhyaya, 2010).

These challenges carry significant implications for personnel who will monitor and supervise 

these operations. Tran et al. (2007) identified as a potential HFE concern the stress imposed 

on single crews in monitoring multiple plants. Included in this issue is HSI design, i.e., how they 

should be contrived to support multi-unit monitoring and control, including monitoring of the 

SMR automation. Crews watching multiple units may encounter additional occasions to make 

the "wrong unit/train" errors that persistently were noted over the years at dual-unit NPP sites

(O’Hara et al., 2008). 
37

4.5 Management of Off-normal Conditions and Emergencies 

The way in which a particular plant with a unique design manages off–normal conditions and 

emergencies is assessed using risk analysis. Risk analysis was identified as a potential SMR 

HFE issue (Tran et al., 2007) because the complexity of a multi-unit plant may encumber the 

identification of human contributions to risk. These authors consider that in a complex system it 

is difficult to determine all the ways systems interact, so “...solving one problem may introduce 

another somewhere else.” They suggest that standard approaches to human reliability analysis 

(HRA) may not be fully suitable for risk analyses of SMR plants. 

This issue takes on even greater importance in light of the Memorandum from Commissioners 

Apostolakis and Jaczko (2010) entitled, “Use of Risk Insights to Enhance Safety Focus of Small 

Modular Reactor Reviews” that encourages the increased use of risk information in design 

reviews. The use of probabilistic risk assessment (PRA) was also identified as Issue 3.2, Use of 

Probabilistic Risk Assessment in the Licensing Process for SMRs, in SECY-10-0034 (NRC, 

2010). 

4.6 Management of Maintenance and Modifications

Reduced numbers of maintenance staff may cause the transition of maintenance practices from 

preventative/periodic maintenance to predictive/condition-based maintenance, encompassing 

the usage of more advanced diagnostic- and prognostic-systems than at present (Clayton & 

Wood, 2010). 

4.7 Insights for SMR ConOps from General SMR Literature 

From our reviewing the general SMR literature, we identified the following new challenges and 

potential human-performance issues.

1. The HFE and operational characteristics of SMRs are influenced by the smallness of the 

plants (relative to most reactors now operating in the United States), their possible

groupings, and their use of advanced technologies, such as passive systems, digital I&C, 

and computer-based HSIs and support systems. Some challenges emerging from this type 

of ConOps include:

• simultaneously monitoring and controlling multiple reactor units via a single crew from 

one control room, which may require formulating new staffing models

• coping with scalability, i.e., operating with new units coming online

• managing non-LWR processes, e.g., liquid-metal and high-temperature gas-cooled 

designs

• integrating electrical production with the other missions, e.g., hydrogen production

• managing individual units that simultaneously are in various operating modes, such as 

starting up, full power, and shutdown

• handling additional responsibilities, such as online refueling

• managing units that share secondary and/or support systems

• coping with transients or emergencies in one unit while other units are operational
38

2. Control room and HSI design is another important consideration. For example, should all 

the individual unit-control stations be located in one room or in different, closely located 

ones? Thus, in a single control room, an operator’s activities related to one unit, such as 

responding to alarms and using emergency procedures, may affect operators monitoring 

other units. However, one room physically encompassing all operations staff increases the 

ease with which they can help each other, and facilitates their supervision. If individual 

units’ control stations are in separate control rooms, then overall supervision, teamwork, and 

the transitions demanded in high workload situations all become more unmanageable. 

However, operations at each unit will be undisturbed by what happens at others. 

The HSI will have new capabilities, such as systems that support diagnostics and 

prognostics. Knowing how people manage and understand these advanced I&C and HSI

capabilities is an important consideration in overall personnel- and plant-performance.

3. As noted in the introduction to this section, the nuclear industry hosted meetings to 

encourage dialog between the NRC, the DOE, and SMR vendors to identify licensing and 

technical issues/challenges that must be resolved to support SMR design, design reviews, 

and licensing. Table 4-1 summarizes the challenges highlighted in these meetings. We 

organized them by the dimensions of our ConOps model.
39

Table 4-1 SMR Licensing and Technical Challenges Identified in Recent Industry 

Meetings

ConOps Dimension Licensing and Technical Challenges Ref

Plant Mission How can the limited operating experience for some SMR designs be 

addressed?

3, 4

How will other shared facilities affect operations? 5

Agents’ Roles and 

Responsibilities

What is the effect of the extent to which control is automated? 3

What is the potential impact of the increased range of responsibilities, 

including online refueling or the installation and maintenance of other 

units?

3, 5

Staffing, Qualifications, 

and Training 

What are the operator staffing requirements and the potential impact of a 

smaller sized staff?

2, 3, 

5

How many operators are needed on a per-unit basis? 5

What are the requirements for supervision and reserve staff (staff 

available on-call)?

5

What is the effect of shared staffing with other connected industrial 

facilities?

5

What are the training/simulator requirements for SMR personnel 3, 5

Management of 

Normal Operations 

How many units may be simultaneously operated at a single control 

station?

2, 3, 

5

Can an operator reliably and safely control multiple units? 5

What is the effect of site expandability (scalability); e.g., the construction 

or removal of units on other currently operating units?

2, 3, 

5

How are cross-cutting responsibilities coordinated with other facilities to 

which the units provide process heat?

5

How are shared resources managed, e.g., what difficulties arise with two 

or more modules tied to a common turbine or energy output?

5

How will control system architectures be implemented for multiple units 

and secondary facilities?

3

How will digital I&C, diagnostics and prognostics be used in SMR 

designs?

3

How will digital I&C for advanced multi-unit control rooms affect operator 

reliability?

5

How will the control room be configured, designed, and laid out for SMR 

operations?

1, 3

Management of Offnormal Conditions and 

Emergencies 

What are the impacts of unplanned shutdowns on the other units? 3

Management of 

Maintenance & Mods

How will operational programs be impacted by SMR designs, e.g., inservice inspection (ISI) and in-service testing (IST) of systems and 

components?

5

Sources: 1=Kinsey (2010), 2=Mallett, (2010), 3=Mays & Williams (2010), 4=Reckley (2009), 5=Smith 

(2009)

41

5 MULTI-UNIT OPERATIONS IN SURROGATE FACILITIES

In this section, we will review the lessons learned from surrogate facilities to gain a fuller 

understanding of potential HFE issues related to SMRs. A surrogate facility is one whose 

operation involves managing multiple units that make similar demands on human performance. 

Although there are important differences between SMRs and these surrogates, their similarities 

afford us an opportunity to learn from their design, operations, and experience. 

Accordingly, we examined unmanned aircraft systems, petroleum refineries, and remote 

intensive-care centers. Information about the surrogates came from a variety of sources 

including published literature, site visits, and conference calls. We identify the specific sources 

of information for each surrogate facility within their discussions. 

5.1 Unmanned Aircraft Systems

5.1.1 Introduction

Unmanned aircraft systems (UASs) consist of an unmanned aerial vehicle (UAV) and the 

operators located in a remote control room to undertake meeting the goals of flight and mission 

operations. Perhaps the best known UAS to the general public is the Predator (Figure 5-1) 

used in recent military activities. The first modern UASs were flown during the Vietnam War, 

equipped with small night-vision cameras and sensors. During the Gulf War, the Predator was 

introduced, beginning the modern era of UASs usage. The Predator, equipped with various 

sensors and payloads, is used extensively in military operations.

Many different types of UASs can serve a variety of missions, as detailed in the U.S. 

Department of Defense (DoD) roadmaps for future UAS systems (DoD, 2005 & 2009). UASs 

are members of a broader class of teleoperated (remotely operated) robotic systems employed 

for a spectrum of purposes. 

Although some UASs are fully autonomous (flown without human intervention), most of them 

are flown remotely by crews of varying sizes from control rooms where the vehicle is monitored 

and controlled at workstations (Figure 5-1) that support mission planning, navigation, aircraft 

control, and manage systems. A two-person crew operates the Predator. 

The numerous benefits of unmanned operations include:

• crew safety

• more flexible manning compared with manned aircraft (crew members are only needed 

when their tasks must be performed)

• use of smaller, lighter, and more economical aircraft

UASs can conduct missions that human crews could not do, such as remaining in 

environmentally dangerous areas for extended times. For example, a variety of UAVs flown 

around the Fukushima Daiichi Nuclear Plant took videos, high-resolution photos, and sensor 

readings.
42

Figure 5-1 Unmanned aircraft system (UAS) - Predator UAV and control station

(Aircraft source is http://www.links999.net/robotics/robots/robots_introduction.html)

(Control Station source is http://www.google.com/images)

In 2005, the DoD published a UAS Roadmap (DoD, 2005) offering their vision of UAS 

operations over the next 25 years; the overall goal is to expand their use to new missions and 

identify the capability infrastructure needed to accomplish them. One such future direction 

therein is “multi-vehicle control.” Thus, the goal for future UASs is to change the ratio of crew 

members to vehicles from many-to-one to that of a single person controlling multiple aircraft 

(one-to-many). The DoD (2009) generalized this staffing goal to all unmanned systems (air, 

ground, and marine):

Performance should evolve from today’s controller to platform ratio of many to one or at best one 

to one, to a single controller being able to monitor multiple unmanned systems performing across 

domains as collaborating teams. (p. 28)

The Roadmap (DoD, 2009) notes that accomplishing this change in crew staffing “...would 

migrate operational responsibility for tasks from the ground station to the aircraft, the aircraft 

gaining greater autonomy and authority, the humans moving from operators to supervisors, 

increasing their span of control while decreasing the manpower requirements to operate the 

UAS” (DoD, 2005). In addition to increased automation and aircraft autonomy, the Roadmap 

emphasizes the importance of the HSI in accomplishing this goal via communicating the UA’s 

“intent” and the decision logic underlying it, so to develop the operator’s trust. Trust is important 

to an operator’s appropriate use of automation (O’Hara & Higgins, 2010). When operators lack 

it, they are reluctant to use automation; when they do, they spend too much time verifying its 

performance. When operator’s trust in automation is excessive, they may overly rely on it in 

situations for which it is unsuited and not monitor it sufficiently to verify its performance.

In general, the DoD’s goals for UASs, and unmanned systems is analogous to those of SMR 

designers: To reduce staffing requirements, in part, through increased automation. The DoD 

initiated a research program to address the technological developments needed to change the 

operator-vehicle ratio, and to detail its impact on mission and human performance. The 

approach being taken to meet this goal may offer lessons-learned for SMR operations. 
43

5.1.2 Method

We reviewed the UAS literature, concentrating on the DoD’s efforts to achieve their vision for 

UASs. Although UASs were our primary focus, we included some papers related to unmanned 

ground vehicles (UGVs). The UAS literature is extensive; therefore, our review is not 

exhaustive. Rather, it centered on highlighting issues and findings pertinent to SMR operations, 

especially the operator-vehicle ratio.

We supplemented the research literature with information gleaned from discussions with DoD 

personnel. A telephone conference call was held with researchers from the U.S. Army 

Research Laboratory (ARL) to discuss their unmanned-vehicle research, developmental efforts, 

and field experience. The team has published many articles, and two have noteworthy 

summaries (Barnes & Jentsch, 2010; Barnes, Jentsch, Chen, Haas & Cosenzo, 2010).

5.1.3 Review of the Pertinent Literature

We divided our findings into the following topics: 

• automation and team size

• adaptive automation

• automation of vehicle-coordination tasks

• vehicular differences

• human-system interface design

5.1.3.1 Automation and Team Size

Automation is one key to changing the operator-vehicle ratio (DoD, 2009). According to ARL 

researchers, their approach is to identify performance bottlenecks and create automation 

solutions to improve the operator’s performance. Their goal is for automation to become

another member of the team, and have the following characteristics:

• Automation should be sufficiently autonomous to function without constant human 

supervision.

• Automation and its HSIs should be designed so operators understand how automation 

works, e.g., how it comes to decisions. 

• Operators should be able to take over the automation’s tasks at any time. 

• The design of automation should be such that it is easy to transfer control to other operators 

in the same facility or different facilities. 

• Over the longer term, automation should be “intuitive” (know the intentions of the human 

operators).

Research underway at ARL and elsewhere aims to identify what tasks should be automated in 

future systems, and how it can be implemented to enable crews to manage multiple unmanned 

aerial and ground vehicles. Many studies vary the level or type of automation and “team size,” 

i.e. the number of vehicles operators must manage. Operators engage in tasks simulating realworld missions, such as search and rescue, or identifying hostile targets; typically, they obtain 

one or more measures of task performance, along with cognitive variables, such as workload 

and SA, to support the investigator’s understanding of the overall system’s performance. 
44

Cummings et al., (2007) analyzed the requirements for controlling multiple aircraft using a 

supervisory control model. The model for each UAS had three high-level tasks: Aircraft control;

aircraft navigation; and mission management. The first task involves local control of the aircraft, 

such as pitch, yaw, and airspeed, to maintain stable flight. The second task is navigating the 

aircraft to its target locations. The third task covers managing the mission’s objectives. The 

tasks are hierarchal in that the first task is necessary for the success of the other two, while the 

second task is necessary for the success of the third, viz., to complete the mission.

Reducing crew size requires automating these tasks or aspects of them. Manual performance 

of the first task requires considerable attention and workload. However, it is one most 

amenable to automation. The second task also can be automated. However, the third task 

depends upon decision making, judgment, and experience; therefore, it is more difficult to 

automate. This finding is consistent with assessment of ARL researchers that successfully 

automating higher-level cognitive tasks such as decision-making is problematic. 

Cummings and colleagues extended the supervisory control model to controlling multiple UAVs, 

indicating that for this to occur, the first two tasks have to be almost fully automated, leaving 

operators to manage the mission. How and to what degree the first two tasks should be 

automated is a major consideration. The authors acknowledge the concerns about human 

performance generally identified with high-levels of automation; we summarize them in Section 

3.4, Item 3. Such decisions must balance technological capability to automate and its benefits 

on human performance and overall accomplishment of mission.

The recognition that high levels of automation affect human- and system-performance led many 

system designers to explore and improve the ways that personnel and automation interact, 

thereby, obtaining the benefits of automation, while minimizing the negative impacts to 

operators (O’Hara & Higgins, 2010). Accordingly, developers of the DoD’s UAS system are 

examining different levels of automation (LOA). We briefly describe these concepts, and 

discuss the research on using automation in UASs. 

Table 5 compares differing LOAs with respect to the functions of automation and operators; the 

transition from Level 1 to 5 represents increased levels of autonomy in the automatic system.

Table 5-1 Levels of Automation 

Note: Adapted from O’Hara & Higgins, 2010, Table 3-3.

Level Automation Functions Human Functions

1. Manual 

Operation

No automation Operators manually perform all functions 

and tasks

2. Shared 

Operation

Automatic performance of some 

functions/tasks

Manual performance of some 

functions/task

3. Operation by 

Consent 

(OBC)

Automatic performance when directed 

by operators to do so, under close 

monitoring and supervision

Operators monitor closely, approve 

actions, and may intervene with 

supervisory commands that automation 

follows

4. Operation by 

Exception

(OBE)

Essentially autonomous operation 

unless specific situations or 

circumstances are encountered

Operators must approve of critical 

decisions and may intervene

5. Autonomous 

Operation

Fully autonomous operation. System 

or function not normally able to be 

disabled, but may be manually started

Operators monitor performance and 

perform backup if necessary, feasible, 

and permitted
45

Using these LOA definitions, we discuss the findings from studies to automate various UAS 

functions and tasks. Many of them also varied team size as well, i.e., the number of vehicles the 

operators manage. 

Calhoun et al. (2009) studied U.S. Air Force participants controlling the routes of multiple 

automated UAVs, supported by a route-planning aid. The participants managed team sizes of

one and three UAVs. The LOA of the aid was varied across three levels: (1) The aid identified 

flight plan options (low LOA); (2) the aid identified flight-plan options, suggesting one that the 

participant could accept (OBC - medium LOA); and (3) the aid identified an optimal plan and 

executed it unless the operator rejected it within a prescribed time (OBE - high LOA). The 

primary-task performance measures included completion time for route planning, and its 

optimization (percentage of routes the participant inspected to verify the best one). Participants 

undertook a secondary task of responding to questions about the UAV’s health status, but were 

instructed to do so only when they had free time from the primary tasks. Participant ratings of 

task difficulty/workload were obtained. The results indicate that both team size and LOA 

affected the time to compete route planning; it was significantly longer for the three UAV teams 

than the one. Furthermore, it was significantly longer for the low- and medium-LOAs (they did 

not differ significantly) compared to the high LOA. Optimum route planning was significantly 

better for the low LOA as compared with the other two LOAs; team size has no effect on this 

parameter. Secondary task performance was better for single UAV teams than three, indicating 

a higher workload burden in multi-UAV teams. There was no effect of LOA on secondary task 

response to health status questions. Finally, for subjective data, participants in the three-UAV 

team condition rated tasks more difficult and workload higher than under the single UAV

condition. Again, there was no effect of changes in LOA. This finding is consistent with 

secondary task performance. In general, researchers demonstrated that increasing the LOA led 

to better task performance, but had little effect on workload. Decreasing team size also entailed

better performance and lower workload. 

Dixon et al (2005) similarly examined the effect of LOA and team size. There were three LOAs: 

Manual (pilots completely controlled their UAVs without any automation); auto-alert (pilots flew 

the UAVs, but had auditory alerts for system failures, route changes, and other updates for the 

mission with 100% reliability); and autopilot (pilots selected coordinates, after which the 

autopilot flew the UAV towards that point). There were either one or two UAVs. Each of the 36 

licensed pilots flew 10 legs of a gaming area. At the end of each leg, they inspected a target 

and responded to questions about it (e.g., what weapons are located on the south side of the 

building?). During the flight legs, there was a chance that a target of opportunity (TOO) would 

be presented, and pilots were instructed to report what was seen (e.g., number of tanks there). 

Participants also had to attend to four system gauges during flight, and if they noticed a system 

failure, they were to press a button identifying the gauge, and then to type the current 

coordinates of the UAV. Performance measures included response time to target detection, 

TOO detection rate, and failure detection response time and accuracy. The researchers found 

that the first task did not vary significantly across LOAs or team size. However, TOO detection 

rate was significantly higher in the autopilot condition, and in the one-UAV teams. Pilots were 

significantly faster in detecting failure under the auto-alert and single-UAV conditions; however, 

there was no difference in accuracy.

In a follow-up study (Dixon & Wickens, 2006), the reliability of the auto-alert system was varied: 

100% detected (15 correct alarms); 67% detected (10 correct alarms, 5 false ones); and 67%

detected (10 correct alarms and 5 that the alert system missed). A manual condition (no autoalert system) was included. They found that detection accuracy and response time were 

worsened with the automation’s declining reliability. 
46

In summary, the Dixon studies (Dixon et al., 2005; Dixon & Wickens, 2006) demonstrated that 

(1) increasing the LOA supported some but not all aspects of task performance; and (2) 

performance declines with increasing UAV team size and lower reliability of the automation. 

The effect of automation’s reliability on performance also was examined by DeVisser & 

Parasuraman (2007) and Ruff (2004). In the former, 12 student participants performed a 

simulated target recognition task with UGV teams of three or six. An automated target 

recognition system (ATR) with three levels of reliability was used: Low, medium, and high.

They employed a variety of performance measures, including target detection, SA, workload, 

and trust in the automation. For comparison, they assessed the target recognition performance 

of the user alone and the ATR alone. Here, the performance of the joint human-ATR system 

was better than performance of either agent by themselves. Thus, even under the condition of 

low reliability, the ATR supported overall task performance. Looking at joint performance, 

performance was worse in the low reliability condition and the six-UGV teams. Workload was 

higher for the six-UGV teams than for the three-UGV teams. The reliability of the automation 

did not affect workload ratings, but did negatively affect trust that fell as reliability decreased. 

Thus, increasing the team size lowered task performance and increased workload, but had no 

effect on trust. Decreasing the automation’s reliability lowered task performance and trust, but 

had no effect on workload. No significant effects on SA were apparent under any conditions.

Ruff (2004) explored the impact on task performance, workload, and trust in automation of UAV 

team size with two different LOAs. Sixteen participants controlled UAV teams of two or four in a 

planning and targeting task. Reliability of the automation also varied (low and high). The 

automation planned new routes and identified targets, then either waited for user input to 

proceed (OBC), or waited for a time and then continued unless the participant gave a stop 

command (OBE). Performance measures included targeting task performance, workload, and 

trust. Although performance between LOAs differed little, task performance was better for the 

smaller teams compared with larger teams. The four UAV teams also reported higher workload. 

Low reliability of the automation decreased task performance and trust, but had no effect on 

workload.

In a simulated search and rescue task Lee et al. (2010) evaluated the effect of LOA on target 

location; team size was not manipulated. Sixty crews, each of two operators, controlled 24 

UGVs at a time. UGV maneuvering was performed manually or automated using OBE. In the 

manual condition, participants set waypoints for the UGVs to follow. In the OBE condition, the 

UGVs moved in a maze using an autopilot. If a UGV got stuck, the operator could manually

control and turn it around. A second factor probed task allocation under two conditions. In the 

“assigned” condition, each operator in the crew was assigned 12 UGVs, but did not receive any 

information on the 12 UGVs assigned to the other crewmember. In the “shared” condition, both 

operators saw video feeds from all 24 UGVs, and each crewmember could control any of the 24. 

Performance measures included targets found, total search area explored, and workload. OBE 

led to significantly better target location than did the manual condition. With respect to search 

area explored, an interaction was found with task assignment. Significantly less area was 

explored in the manual LOA-shared control condition than the other three. Workload was higher 

for the assigned teams compared with the shared teams, but there was no affect of LOA. Thus, 

automation improved task performance yet had no significant impact on workload. Task 

allocation also affected performance, proving better in the assigned condition even though it 

entailed a higher workload. The authors postulated that the shared condition diffused 

responsibility, so underutilizing some UGVs (UV neglect); i.e., each crew member thought the 

other was responsible. This hypothesis was supported by post hoc analysis revealing that the 

number of robots neglected were higher for the shared team than the assigned teams.
47

The finding that crews in the shared condition performed worse might suggest the operators 

were not effectively functioning as teams to clearly allocate their tasks and to be aware of each 

other’s responsibilities. For example, Burke et al. (2004) found that UGV operators with higher 

SA working in teams were significantly better at search and rescue than their low SA 

counterparts. They asked more mission-oriented questions and less situational- or status-ones. 

By communicating with their teammates, operators created a “goal directed mental model” to 

assist them in identifying problems and solutions while piloting.

5.1.3.2 Adaptive Automation

In the studies we discussed above, the LOA of the task was “static,” i.e., never changed.

Alternatively, a task can be performed either by automatic systems or by personnel based on 

situational considerations, such as personnel’s overall workload (Lee, 2006; Miller &

Parasuraman, 2007). For example, automation may assume control over lower priority tasks 

when the operator’s workload increases to a level where it would be difficult to complete all their 

current work. This approach ensures that operators focus their attention on high priority tasks 

by maintaining their workload within acceptable levels. This constitutes adaptive automation 

(AA), i.e., where the LOA is flexible and can change. 

A key consideration for AA is the “triggering” condition, i.e., who/what decides when, and on 

what basis the responsibility for a task changes from human to machine or vice versa. In some 

cases, the triggering condition is the operator’s decision to change the LOA. In others, the 

automation automatically adjusts based on some detected condition related to operator factors 

(Prinzel, 2003), such as:

• psycho-physiological measures 

• dynamic workload assessment

• task-performance measures

Triggering conditions also can be set based on the presence of critical events or reaching a 

setpoint(s) of measured parameter(s) (DeVisser et al., 2008). Thus, a change in the LOA can 

be initiated by the operator or by some other predefined condition based on operator’s or 

system’s status.

AA is being explored for use in controlling unmanned vehicles. Parasuraman et al. (2009) 

examined the effect of different types of automation for supervising multiple UAVs and UGVs. 

University students performed tasks requiring identifying targets, planning routes, and 

communications. There were three different implementations of automation: Manual; static LOA;

and AA. In the first, participants controlled the vehicles without the aid of automation. In the 

static LOA condition, an ATR system helped participants. In the AA condition, participants’

performance in a change-detection task was monitored; if it fell below 50%, the ATR system 

was initiated, but above 50%, the ATR system was unavailable. Thus, participants’

performance was the triggering condition. 

Performance measures included identifying targets, detecting change, SA, and workload. The 

measure of change detection was intended to evaluate the difficulty operators may have 

detecting changes when controlling multiple UVs (such as when anomalies arise), the so-called

“change blindness.” To measure this, participants were asked to press a spacebar if the 

location of a previously identified target moved a map. SA and workload were measured using 

questionnaires given to participants after each trial. 
48

The results indicated that although the type of automation did not affect target identification, it 

significantly affected the detection of change that was far better under both automation 

conditions compared with the manual one; furthermore, detection was better in the AA condition 

than in the static condition. The type of automation also significantly affected SA and workload. 

SA scores were significantly higher in both automation conditions than in the manual condition, 

although the two automation conditions did not differ significantly from each other. Workload 

was highest in the manual condition, followed by that under static automation, and lowest in the 

adaptive condition. Thus, the results show that the type of automation affected performance. 

Compared to the manual condition, both automation conditions improved task performance and 

SA, and lowered workload. Compared to the static LOA condition, the adaptive implementation 

of automation improved performance and lowered workload. 

The trigger in the Parasuraman et al. (2009) study was a change in the operator’s performance. 

Another approach used by Shaw et al. (2010) for changing the LOA in AA was a request from 

operators. Student participants controlled three UAVs; the task was to use unarmed UAVs to 

identify hostile targets, and pass the information to the armed UAV. Waypoints set by either the 

participants or the automation, depending on the LOA, navigated the UAVs. There were three 

AA conditions:

• Manual condition, wherein the operator sets waypoints, targets weapons, and launches

them 

• AA1 condition, in which the operator chooses between two LOA options: Manual, and 

partial automation that initiates “scripts”, such as a targeting script, and the task is performed 

automatically

• AA2 condition, where the operator chooses between three LOA options: Manual, partial 

automation, and fully autonomous operations (in the latter, operators must approve 

weapons launch)

The researchers collected performance measures: One was the percent of targets successfully 

tracked; a second was the time participants took to handle an unexpected event that that 

automation could not deal with. Overall, the results showed that operators performed much 

better as more LOA choices were provided; AA2 offered the greatest number, yielding the best 

performance. Dealing with unexpected event performance did not differ significantly across 

conditions. Parasuraman et al. suggested that increasing the automation options available to 

operators helps them manage their workload. In managing unexpected happenings, operators 

would increase the automation of unaffected aspects of UAV control, while assuming manual 

control of those affected. 

5.1.3.3 Automation of Vehicle-Coordination Tasks

Automation can be applied to the tasks performed to supervise multiple vehicles. Chen et al. 

(2010a & 2010b) developed an intelligent agent, “RoboLeader”, to coordinate route planning for 

multiple UGVs. Its support was tested by having operators control a team of four or eight UGVs 

either with or without RoboLeader in a target-detection mission. There were no differences in 

detecting targets between operators with RoboLeader compared to those without it, but 

operators with RoboLeader completed the mission in significantly less time. Target detection 

was better and workload was lower when operators managed teams of four in comparison with 

eight UGVs. This study suggests that automation can be applied to higher-level supervisory 

functions by supporting mission planning tasks associated with multi-vehicle coordination.
49

5.1.3.4 Vehicular Differences

In addition to the number of UAVs, another factor affecting performance is the extent to which 

the UAVs differ from each other, i.e., their degree of heterogeneity, compared with their 

homogeneity when all vehicles in a team have the same design. ARL researchers indicated 

that operators find it harder to manage heterogeneous teams. The difficulty was noted by other 

researchers (Nehme & Cummings, 2007; Nehme et. al., 2008; Wang, Wang, & Lewis 2008). 

Heterogeneity causes a loss of SA, partly due to the demands of switching tasks between the 

different types of vehicles.

5.1.3.5 Human-system Interface Design

Several authors suggested that HSI design is important to UAV command and control (e.g., 

Calhoun et al., 2009; DoD, 2005; Shaw et al., 2010). The goal of HSI design is to provide the 

information and controls needed for operators to perform their tasks while minimizing the 

workload from interacting with the HSI. 

Research is beginning to examine what types of displays support operators to gain UAV SA. 

Cook et al. (2010) evaluated the design of a situation display to support route planning tasks. 

They found that an augmented 2-D display that displayed goal information and used colorcoding to communicate important data led to better performance than either an unaugmented 

one (similar to those currently used) or a 3-D display. 

Cummings and Mitchell (2005) evaluated the use of a “Timeline” display that displays crucial 

information conveying the status of progress of a UAV’s current mission. Using a timeline 

approach, operators can better estimate waypoint arrival time, and can thus make any needed 

adjustments. 

As noted earlier, ARL researchers considered that the design of the HSIs should inform 

operators of how the automation works, e.g., how it makes decisions. Roth et al. (2004)

evaluated the extent to which UAV operators understood the plans developed by automated 

controllers, finding that humans and automatons cooperated as a team in planning and 

executing missions. These findings emphasized the need to communicate the rationale used by

the automaton and offer a means for operators to modify the automaton’s operations, without 

which operators cannot properly assess the appropriateness of automation’s actions and

whether changes are needed. Thus, HSIs should support automation-human communication so 

operators can determine and understand how the automation performs its tasks. 

Another aspect of automation-human communication is the prompts made by the machine to 

operators; how they are made impacts task performance and workload (Maere et al., 2010). 

When prompts come too quickly, they add to workload and degrade performance. When they 

are not frequently enough, again, the operator’s performance is negatively impacted because 

they do not get necessary information. Maere et al. (2010) showed that allowing operators to 

control the rate of automation prompts helps to mitigate these effects.

The operator’s workload is an important consideration in HSI design because they may fail to 

use automation properly if too much effort is required to do so. This is especially important with 

AA where operators’ interaction with automation is more frequent because of the changes in 

LOA.
50

Miller and colleagues examined the issue of minimizing workload associated with operator 

interactions with automation, developing a “delegation interface” for interacting with automation 

levels (Miller & Parasuraman, 2003, 2007; Miller et al., 2005). The approach is modeled on 

work delegation in human teams. Delegation is the process of assigning specific roles and 

responsibilities for the subtasks of a parent task for which the delegating agent retains authority 

and responsibility. As supervisory controllers, operators select tasks for automation to perform,

and set procedures for how it must accomplish them. Communication between agents is 

expressed in terms of goals, methods, constraints, and resource utilization. The underlying 

concept is that operators can delegate predefined tasks to automation, thereby giving them a 

flexible approach to completing tasks and an efficient means of changing the level of automation. 

“Playbook” is the HSI that supports the delegation approach; its name is based on the metaphor 

of a sports team’s use of a “playbook,” i.e., a set of specific plays that all team members 

understand. The plays, based on a hierarchal task model, reflect the system’s levels of 

automation. Groups of predefined tasks are organized into plays, with the relevant task 

parameters identified (or specified when operators call a particular play), such as times and 

locations, thereby establishing a common understanding for all team members of what each 

individual agent will do. However, although the more the operator has to specify in real time, 

the more effort is involved in communicating with the automation, an advantage may be that the 

“play” can be better tailored to a specific situation. 

Playbook contains a planning function to develop a specific plan for a current situation. The 

planner has access to information, such as resources available (e.g., fuel), and can adjust the 

tasks accordingly. It alerts the operator about any constraints that would compromise success. 

Control algorithms for executing actions are specified in the plan. Finally, if necessary, an 

event-handling function makes fine adjustments during the execution of the plans. 

Parasuraman, Galster, Squire, Furukawa, and Miller (2005) compared the effect of Playbook on 

the performance of UV tasks with a restricted interface with only one level of control. The 

success rate and time to completion were better with Playbook, although the benefits fell as the 

number of vehicles simultaneously controlled increased. The HSIs enabled operators to identify 

goals and instruct automation agents; also, they better adapted and responded to the 

automation’s ineffective behavior.

The lessons learned from these studies is that providing operators with “set plays,” i.e., 

predetermined definitions of a set of roles and responsibilities of human and machines can 

reduce the operator’s workload in interacting with the automation. 

While “plays” offer one effective means of controlling the operators’ workload from interacting 

with automation via the HSI, another is to automate aspects of HSI interaction. Again, as above, 

we primarily focused on automating UAV control and supervisory tasks. Interface management 

is another task that can be automated. This term describes the actions taken by the operator in 

interacting with the HSI, rather than monitoring and controlling the system. Interfacemanagement tasks include navigating to find and retrieve displays, and adjusting display 

windows. These tasks compete with the primary monitoring and control tasks for the operator’s 

attention, and can distract and disrupt performance (O’Hara & Brown, 2002). Automating 

interface management tasks potentially can lower the workload associated with them. 

Hou, Kobierski, and Brown (2007) developed an intelligent adaptive interface (IAI) that selects a 

display based on current situational factors involving mission changes and operator states 

similar to the triggering conditions discussed earlier. They investigated the efficacy of IAIs in a 
51

multi-UAV mission. The IAI was modeled as part of the UAV tactical workstations in maritime 

patrol aircraft. They used a performance model to compare the difference in mission activities 

with and without IAI agents. A prototype IAI experimental environment was implemented for a 

human-in-the-loop empirical investigation. Both the simulation and the experiments revealed 

that although multiple UAV control is a cognitively complex task with high workload, IAIs 

significantly reduced workload and improved SA, allowing operators to work under high time 

constraints. 

The longer term DoD goal to use natural communication mechanisms is another way of easing 

the interface management load during multi-UAV interactions:

The focus of human interface with the machine should evolve from today’s current physical interfaces 

such as joysticks, touch screens, etc., to interaction such as hand signals, and ultimately to natural 

language understanding in order to be tasked for missions. (DoD, 2009, p. 27)

Thus, providing automation support for interface management, and advancing the means by 

which operators and systems interact, may lower the workload associated with these tasks.

5.1.4 Summary of Results

In summary, these studies we described examined the following aspects of UAS design and 

performance:

• UAV team characteristics

• automation design

• task allocation to crew members

• HSI design

In addition to discussing UAS design features, we also will consider the importance of 

performance measures and HFE methods and tools. We conclude this section by generalizing 

the research findings to real-world systems.

UAV Team Characteristics

A principal objective of much of the research was to investigate the size of the UAV team (i.e. 

number of UAVs), its impact on performance, and technologies for enabling operators and 

crews to manage large teams of UAVs. This is a major factor of interest to our work since team 

size is analogous to number of SMR units that an operator manages. 

Nearly all studies found notable effects of team size. As the size of the UAV team increased, 

task performance declined and workload rose. It also impacted other factors such as UAV 

neglect, which rose as team size increased. 

Another important characteristic of teams is their degree of homogeneity; generally, 

heterogeneous teams are more difficult for operators to manage. 

Automation Design

Automation is deemed a key enabling technology for increasing team size. The aspects of 

automation examined encompassed 
52

• functions automated

• LOA

• static versus flexible LOA 

• transparency of automation’s processes

• automation’s reliability

The studies reviewed examined, and verified the successful application of automation to a 

variety of UAS functions:

• vehicle monitoring and control functions 

• mission coordination (supervision) functions

Many studies considered the LOA; in general, increasing the LOA led to better task 

performance, although one study failed to find an effect of LOAs (Ruff, 2004). However, the 

effects were not universal for all measures (discussed further under performance measures 

below).

LOAs can be implemented statically or flexibly; the latter is called AA. Static LOA frequently did 

not significantly impact workload or SA, though most studies did not evaluate SA. AA was 

associated with better task performance and lower workload. Increasing the automation options 

available to operators may have helped them manage their workload.

Increasing the transparency of the processes of automation proved an important factor 

supporting the ability of operators to understand its workings. To assure its optimization, 

communication features should be an inherent part of the HSI allowing operators to interact with 

automation to better understand its behavior.

The final aspect of automation we examined was its reliability. In general, lower reliability led to 

declines in task performance, and a lower level of operator trust in the automation. Because the 

reliability of real-world systems is imperfect, their effect on operator- and system-performance is 

a major consideration. 

Cummings et al. (2007) cautioned against over-automation; namely, it is not a good strategy to

automate anything that can be due to human-performance concerns associated with high 

degrees of automation. Determining when and how to automate is the key consideration to 

success. ARL researchers echoed this same consideration, stating that their experience shows 

that some higher-levels of automation may be difficult to achieve. Cummings expressed the 

same concern about automating mission-planning functions that depend on decision making, 

judgment, and experience. Thus, there are both technical concerns (difficulty automating a 

function) and HFE concerns (negative effects on operators of high-levels of automation) that set 

constraints on the achievable crew-vehicle ratio. 

Task Allocation to Crew Members

Performance was affected by task allocation between crew members. It was better when UAVs 

were assigned to specific crew members rather than shared between them. Lee et al. (2010)

postulated that sharing diffused responsibility, leaving some UGVs underutilized (neglected); i.e., 

each crew member thought the other was responsible. However, we suggested instead that, in 

the sharing condition, the operators were not effectively functioning as human teams, and did 

not clearly allocate their tasks or maintain awareness of each other’s responsibilities. 
53

HSI Design

The design of the HSI is a key factor. As discussed under automation above, the HSI should 

incorporate communication features enabling operators to better understand the automation’s 

processes. Other important considerations for HSI design include:

• providing HSI features so operators can effectively monitor multiple UVs and gain accurate 

SA

• managing the workload for coordinating and controlling multiple UVs, e.g., via using 

intelligent agents and of set plays

• managing the interface management workload because a high one can lead to the 

operators’ disuse of automation and can distract them, thereby impairing their performance

Performance Measures

The studies reviewed illustrated the value of performance measures. Measures of primary task 

performance must be selected carefully. Many studies recorded effects on one performance 

measure but not another. Thus, important aspects of the primary task should be measured to 

avoid the possibility of committing a Type 2 error, i.e., failing to identify significant effects when 

they exist. 

Researchers should carefully choose measures that are sensitive to the expected variations in 

performance. That is, the measures selected should avoid floor and ceiling effects. For 

example, in a search and rescue task, primary task measures might include number of targets 

retrieved, and response time. If under the task constraints, most operators retrieve all the 

targets, then that measure will not be sensitive to changes in automation. Thus the measure 

will exhibit a ceiling effect, in which case, response time may be a more sensitive one. 

The studies also illustrate the need for comprehensive performance measures that encompass 

primary task measures, and measures of SA, workload, and trust. These cognitive measures 

were found to be viable constructs essential to understanding and predicting human-system 

performance in complex systems, especially those employing extensive automation 

(Parasuraman, Sheridan, & Wickens, 2008). For example, Wickens et al. (2010) noted that SA 

was a critical factor in dealing with automaton failure, and tended to mitigate the poor handling 

of disturbances often associated with high LOAs. They indicated that designers need to focus 

on increasing the operators’ SA for automation by finding its right level for tasks, improving the 

HSI for automation and training. Furthermore, the benefits of automation can be offset when 

operators do not trust it. Then, they may not use it, or it may increase their workload 

significantly by overly verifying the automation’s behavior. Similarly, failures of automation can 

remain undetected if operators trust it too much and hence, become complacent. Thus, 

constructs such as these are important to assess as part of developing and evaluating a system. 

These studies reviewed above also illustrated some additional measures that are important 

considerations for multi-unit operations: Neglect time (Crandall & Cummings (2007), and 

change detection/blindness (Parasuraman et al., 2009). The latter refers to the phenomenon of 

failing to see large, salient changes in the environment (Simons & Ambinder, 2005). 
54

HFE Methods and Tools

In addition to using traditional HFE methods and tools in developing future UASs, human 

performance modeling and simulation methods are playing an increasing role, consistent with 

the DoD’s overall goal of increasing the use of these methods (DoD, 2003).

Generalizing of the Research Findings to Real-world Systems

The research undertaken constitutes an important technical basis for developing future UASs. 

Like any research findings, a major consideration lies in generalizing the results to the 

applicable operational systems. In this development, the DoD’s research is focused on a target 

operational context, characterized along the dimensions illustrated in Table 5-2. Research 

findings are generalized most easily to this operational context when they closely match the 

target’s operational context. Table 5-2 illustrates that the main difference between the studies 

we reviewed and the systems to which they will be generalized is complexity of the operational 

environment, as we discuss next. 

Typically, the systems and HSIs used in these studies were simplified representations of actual 

UASs, as were the tasks participants performed. Further, participants in most studies were 

relatively inexperienced with limited training. Domain experts and naïve participants differ in 

their cognitive approaches to task performance and decision making; ultimately, research 

findings must be confirmed with domain experts and in real-world settings (de Greef, 

Arciszewski, & Neerincx, 2010; Zsambok & Klein, 1999). Thus, the results must be interpreted 

with these differences in mind.

Table 5-2 Comparison of the Operational Contexts of the Actual Systems and the 

Studies Reviewed

Generalization 

Dimension

Target Operational Context Typical Study Reviewed

Application 

Domain

UAS systems designed for 

various military missions

While the domains varied, the simulated 

systems usually were very simple and did 

not involve the complexity of real-world 

operations

Functions and 

Tasks

Mission planning, UAV 

coordination, and vehicle 

control loops identified by 

Cummings et al. (2007)

Simplified versions of the types of UASs

System 

Representation

A variety of UAVs designed for 

various purposes

Simulated vehicles with limited control 

capabilities

HSIs Alarm, displays, and controls 

presented in control stations for 

one or more operators

Very simple, lacking the complexity and 

number of displays as are found in a 

typical UAS control station

Personnel Highly-trained, professional 

operators

While some professional operators (pilots) 

participated in these studies, most 

research used students with very limited 

experience and training

We emphasize that this is not a criticism of the research we reviewed. Future UAS systems are 

in the early design phase where research can be directed to identifying issues and developing 

approaches and concepts for addressing them. Studies like those we reviewed provide 

important contributions at this stage. Once identified, promising technologies and strategies to
55

achieving DoD’s long-term goals can advance to the systems development and evaluation 

phase, where real-world mission constraints can be addressed. 

The difficulties of addressing UAS issues in a real-world context was illustrated by ARL 

researchers who summarized the current status of DoD’s efforts to achieve the one-to-many 

ratio of operators to UVs by indicating how difficult it is to attain a 1:1 ratio. The principal 

reasons include (1) the degree of automation needed is difficult to achieve, (2) high workload is 

a problem, and (3) switching tasks between vehicles is very disruptive.

5.1.5 Pertinent Challenges for Modular Reactor Operations

In this section, we summarize the challenges identified for future UAS development that are 

relevant to SMR operations. 

1. The characteristics of the UAV team proved important, especially its size (number of 

vehicles monitored and controlled by an operator or crew), and the homogeneity of the 

vehicles assigned to an operator (vehicular differences compound the difficulty operators 

have managing the team). Both these issues are significant to developing SMR ConOps, 

and were identified earlier in this report. SMR designers will have to identify the 

manageable number of units; wherein unit differences may play a role in determining the 

specific number. We expect the SMR units at a site generally to be the same, but some 

differences likely will develop over time.

2. Increasing the number of UAVs assigned to an operator (or crew) depends on the 

automation’s design. Automation is being applied to supervisory- and interfacemanagement, as well as monitoring and control functions. SMR designers recognized the 

need to increase automation; similar to UAS designers, they are likely to apply automation 

to more than monitoring and control. As its usage extends to diagnostics, situation 

assessment, prognostics, and other support aids, the systems’ reliability will be a key issue. 

UAS researchers found that as automation’s reliability declines, operator’s performance and 

trust is degraded. As we noted earlier, the reliability of real-world systems is imperfect. 

Therefore, it is vital to quantify the reliability of automation in general, and of decision 

support systems in particular. A further consideration is assessing the effects of differences 

in automation’s reliability on SMR operators. 

3. UAS designers found that increasing the LOA generally improves performance and 

providing flexibility over the level, such as AA, supports workload management. They are 

evaluating the use of different LOAs and LOA flexibility to achieve the benefits of automation, 

while minimizing the negative effects of very high levels on human performance. These 

considerations must be examined for in designing SMR automation, finding the proper mix 

of automation and human involvement to ensure the safety of SMR operations. 

4. Applying automation to SMR operations needs to be carefully tested. UAS researchers 

encountered difficulties achieving the levels of automation needed to improve the operatorto-vehicle ratio. Careful evaluations considering the performance of the entire system will 

assure the success of automated systems in achieving their functions and their acceptable 

integration into the human-automation team. Herein, the UAS community employs operatorin-the-loop simulations as a primary tool. 

5. UAS researchers reported that the allocation of tasks between crew members affected 

performance, which will be an important consideration in developing SMR ConOps. For 
56

example, at a site with four SMR units and two operators, each might monitor two reactors 

along with their BOP systems. Alternatively, one operator might manage all four reactors, 

while the other operator manages the four BOP systems. The advantages and 

disadvantages of different task allocations must be assessed, while also considering the 

impacts on teamwork and supervision. 

6. UAS researchers highlighted the importance of HSI design when managing multiple vehicles; 

this also is applicable for SMR operators managing multiple units. Designing the HSI for 

multi-unit monitoring and control is a new challenge to designers and regulators for which 

there is little precedent. 

7. The UAS research emphasizes the importance of measuring performance. A 

comprehensive set of measures is needed to address, at a minimum, important aspects of 

primary task performance, teamwork, SA, trust (in automation), and workload; the same 

considerations are needed in developing and evaluating SMRs. The UAS studies suggest 

some additional measures, such as unit neglect time and change blindness, may be useful 

in evaluating them. As well as selecting the right aspects of performance to measure, the 

measures should be sensitive to the expected reasonable variation in performance. 

Measures with restricted ranges, such as ceiling and floor effects, should be avoided 

because they produce misleading results. 

5.2 Oil Refineries

5.2.1 Introduction

An oil refinery (Figure 5-2) comprises a series of processes that convert crude oil into different 

petroleum products; many refineries are made up of multiple units. In new and modernized 

facilities, these units are monitored and controlled from a single central control room. We made 

a site visit to one such facility. 

Figure 5-2 Oil refinery

(Source:http://www.google.com/images?hl=en&biw=1276&bih=859&gbv=2&tbs=

isch%3A1&sa=1&q=oil+refinery&aq=f&aqi=&aql=&oq=)
57

This plant was built in 1955 and was expanded and upgraded over the years. Its overall 

mission is to process crude oil into products such as gasoline, diesel, propane, and butane. It 

also manufactures asphalt, heating fuels, and sulfur for fertilizers. Of particular note is the 

centralization of operations from multiple distributed control rooms into a modern, digital, 

centralized control room (CCR) from where operators monitor and control multiple process units 

with operational demands similar to those anticipated for SMRs. 

In this section, we summarize the information obtained from the site visit and identify those 

issues potentially pertinent to SMR operations.

5.2.2 Methodology

Two BNL project staff visited the refinery to observe the operations of the control room 

operations while operators were performing their tasks, and to interview them to obtain specific 

information about their approach to operations. The questions asked were a variant of the 

ConOps questionnaire in the Appendix. 

5.2.3 Results

The overall mission of the facility is to process crude oil into a variety of products, such as jet 

fuel, gasoline, diesel, propane, and heating fuels. Environmental protection and safety are a 

priority in the facility. 

The facility accomplishes these functions through nine processes: Sulfur, Crude, Naphtha I and 

Naphtha II, Distillate, Coker, Gas Oil (GO), Alky, and Fluid Catalytic Cracker (FCC). Some of 

them have three units (e. g., crude, distillate, hydrogen units, and GO). All units are not 

identical.

The processes are highly automated, so that the operating staff’s main role is to oversee them 

and make any needed adjustments. There also are local operators out in the plant whose main 

responsibility is ensuring the equipment’s reliability. Two key areas not automated are the 

startup and shutdown of the various units; these evolutions are performed manually, requiring 

additional staff to accomplish all the needed tasks. 

Control room operations have evolved. Before the late 1990s, each process was managed from 

its own control room. The control rooms were distributed throughout the plant. Thereafter, 

facility management integrated all the local control rooms into a CCR. 

In the CCR, one operator, the project lead (PL), is assigned to each of the nine processes. 

There also is a control room supervisor and a day shift “bench lead” for each process who fills in 

where needed. For each process, there also are three to five local personnel consisting of at 

least one local lead and two auxiliary operators. The total operating shift comprises about 50 

people. It takes six months to train a new operator, using structured training and on-the-job 

training. Operators are tested using a skills demonstration and an oral exam.

Figure 5-3 shows the layout of the CCR, consisting of three “pods” and nine “consoles.”
58

Figure 5-3 Layout of the refinery control room 

(Figure provided by refinery staff and annotated by the authors)

A console is a workstation, one for each process, and a pod is a group of connected consoles. 

The figure identifies which process is controlled from which console. The consoles are sit-down 

workstations manned by one PL; they have sufficient room for additional staff when needed. 

Some processes involve up to three units that are monitored and controlled from a single 

console by a single PL; about 250 controls and 2000 indicators are available at the console.

Workload is a key consideration in evaluating the assignment of units to PLs. For each PL, 

engineering analyses ensure that the workload is acceptable, and the required tasks can be 

successfully performed. Evaluations of task loads determined the number of controls and 

indicators that the PL can manage.15 Engineers can reassign parts of a process or secondary 

functions to another PL, should the workload prove too high. Facility management also brings 

in additional staff when they anticipate high workload, such as during startup, shutdown, or 

major transients. 

Screens display almost all of the information and controls. Each console has approximately 

three monitors for the distributed control system (DCS), and five to seven monitors for other 

purposes. 

The DCS is the most important I&C system; it is used to monitor and control key process 

parameters and identify critical alarms. Facility personnel stated that the design of the alarms is 

 15 Following our visit, we contacted Beville Engineering to obtain more information on the types of studies 

done. They performed a variation on time-and-motion studies to determine operator workload and the 

workload associated with the position of each console, This entailed repeated four-hour observations 

of operator activity that were encoded into different types of tasks. Since working with the refinery, 

Beville has used this methodology to evaluate over 300 console positions, encompassing over 2400 

hours of observation. From that data, they developed a correlation between alarms/control changes 

and total workload. Underlying the approach is the premise that the console’s position should be 

staffed for steady-state workload, while the operator-process system (automation, interface, and 

training) should be designed to enable that staffing to handle foreseeable upsets. Unfortunately, Beville 

has not published the method, but did provide additional information and more concrete examples 

(personal communication August 13, 2010).

One Pod with 

three consoles,

one for each of 

the processes 

listed
59

critical to operations. Each alarm must be identified carefully. The criterion determining 

whether a parameter should be an alarm is that it must be unique information requiring an 

achievable action. An alarm is considered critical when immediate action by operations is 

needed. The facility receives an estimated two critical alarms per shift across all nine processes. 

The secondary alarms, also called Console Action Plan alarms, are non-critical alarms (Figure 

5-5). 

Some PLs monitor three similar units. The alarms for all three are integrated; that is, they are 

presented together so that PLs only have to look at one screen to see them all. However, the 

displays for each unit are separate. The two primary types of displays are process (mimic) 

displays and trend displays, fairly standard display formats used in modern digital systems. The 

crude process, for example, contains three crude units, numbered 1, 2 and 3. Unit 1 has a 

small capacity, while Units 2 and 3 are large capacity. Both the inputs to and the outputs of the 

process for each of the units differ, as do, the number and sizes of their components. The PLs 

indicated that these differences made it easier for them to distinguish between the units, i.e., 

they look different on the displays so they are easily distinguished. These differences between 

multiple units within one process are addressed in training. 

Soft controls (on-screen controls), also called faceplates, control the equipment. Like the mimic 

displays, the soft controls were typical of modern computer-based systems. 

Procedures guide personnel action. PLs must follow them and sign off upon completing a step. 

However, there is a formal deviation sheet if needed. The refinery undertakes an annual review 

of the accuracy of procedures, noting any improvements.

Each console has two redundant DCS pathways, and two failures are needed to fail the DCS. 

Power is supplied through an uninterruptable power supply (UPS). PLs have separate alarms 

for problems with the DCS system for each console. However, there have been no DCS 

failures since the system was installed in 1997/8. The computer workstations (non-DCS) could 

fail since they are single path I&C. However, should that happen, operators can then use the 

DCS or operate equipment locally. PLs have a procedure for loss of DCS and are trained in 

what to do when failures occur.

5.2.4 Pertinent Challenges for Modular Reactor Operations

In this section, we summarize challenges identified at the refinery that are relevant to SMR 

operations.

1. Operators can monitor and control multiple units, and the refinery’s operating experience 

supported this conclusion. Keys to making this possible include:

• careful analyses of workload to ensure operators are not overloaded

• automation, so operators can focus on monitoring and managing processes
60

2. Careful attention to designing the alarm systems design is essential so the number of 

alarms is manageable, each alarm is unique, and each is associated with an achievable 

action. In the refinery, alarms for different units are integrated into a single display rather 

than being presented separately for each unit. 

3. Unit differences, as depicted in the HSIs, supported operators in maintaining awareness of 

the status of individual units. 

4. Organizational changes are needed during emergencies to manage events occurring at one 

unit. The availability of additional staff during periods of high workload (such as 

startup/shutdown and to manage major off-normal conditions) is necessary for the refinery’s 

multi-unit operations. 

 

5. Important contributors to safe, reliable operation we noted during our visit were:

• a highly trained, experienced staff

• a professional attitude amongst operators and engineers

• a well-designed CCR

• careful analysis of operator workload and its implications for staffing

5.3 Tele-intensive Care Units

5.3.1 Introduction

Tele-intensive care units (tele-ICUs) are emerging as an alternative to and backup for traditional 

hospital ICUs.16 Tele-ICUs are facilities that remotely monitor intensive-care patients and notify 

on-site hospital staff when conditions warrant medical intervention. They share many 

characteristics with other high-risk, high-reliability organizations; that is, a critical mission, 

wherein the consequences of error can be unacceptable, is accomplished by a formalized 

organization of highly trained experts, using pre-established procedures, supported by state-ofthe-art computer technology. 

The need for such facilities arose from the dearth of physicians specializing in critical-care 

medicine (so-called intensivists). The shortage is especially acute during overnight hours when 

hospitals may not have intensivists on shift, and at rural hospitals where such specialists may 

not be available.

Tele-ICUs have a control room from where the tele-ICU staff can monitor many more patients in 

hospitals remote from the facility than can the on-site hospital staff. For example, an ICU nurse 

in the hospital may monitor two patients, while a tele-ICU nurse may monitor as many as 30 

patients. One hospital’s intensivist may administer to 10 ICU patients in a hospital, while a teleICU intensivist is available to well over 100 patients located at many different hospitals. 

Studies of patients monitored by tele-ICUs found reductions in patient mortality, length of stay, 

and cost compared with traditional ICU methods (Kohl et al., 2007; Lilly & Thomas, 2009; 

Heightman, 2009). Further, the availability of tele-ICUs has improved critical care services in 

small rural hospitals and reduced patient transfers to larger ones (Zawada et al., 2009).

 16 Lilly and Thomas (2009) comprehensively reviewed Tele-ICUs. 
61

Remote monitoring of and intervention for multiple patients places demands on human 

performance analogous to those that SMR operators may face; they may need to do the 

following: 

• monitor multiple independent “units” (patients or reactors)

• monitor the same multiple parameters of those independent units

• maintain SA of multiple independent units

• deal with differences in information available across “sites” (it may vary from one hospital to 

another)

• deal with differences in the presentation of information across “sites” (it may vary from one 

hospital to another)

• manage events that may arise and cope with the workload of emergency management

• manage multiple events occurring among independent units when such situations arise

• coordinate shifts in staff responsibilities to manage emergencies

• manage increased communication demands during emergencies

• deal with bringing new independent units on-line

Thus, tele-ICUs may provide insights to the issues that SMR operators may face.

Below, we summarize the information obtained from a site visit to one tele-ICU, highlighting the 

issues potentially pertinent to SMR operations.

5.3.2 Methodology

On March 24, 2010, two BNL project staff visited a tele-ICU located in the United States from 

approximately 4PM to 8PM, a span that included a shift turnover. 

We had two objectives: Observe control-room operations while facility personnel were 

performing their tasks; and interview staff to obtain specific information about their concept of 

operations. 

5.3.3 Results

The tele-ICU, operated for over 5 years, provides a remote ICU monitoring control room for four 

hospitals (one major hospital and four rural ones). 

The high-level functions that the tele-ICU staff performs involve monitoring patients, assessing 

conditions, and responding to events. 

• Patient monitoring – Tele-ICU staff monitor the vital signs and medications of each patient, 

classified into one of three categories: Red (most serious), yellow, and green (least 

serious). This classification guides the extent of monitoring of individual patients. 

• Assessment of conditions – When an abnormal vital sign is identified, assessment of 

conditions requires access to the patient’s data, charts, test results, X-rays, and visual 

observation of the patient. For example, the tele-ICU nurse may communicate with on-site 
62

staff to check a lead on measuring equipment to determine if an abnormal heartbeat is due 

to a loose connection.

• Responding to events – If the facility’s staff determines that intervention is required, they 

need communication equipment to contact on-site staff to take necessary actions. Common 

information displays for the tele-ICU staff and the local hospital’s staff support their 

communication. 

The facility is staffed as follows:

• one intensivist17

• three ICU nurses (providing round-the-clock coverage)

(night shift only) 

• two clerks providing round-the-clock coverage

As noted above, the on-shift staff emphasized the importance of communication with in-hospital 

staff on patient interventions.

The tele-ICU we visited has one experienced nurse (at least 5 years of work experience) for 

every 30 patients. The ideal patient-to-physician ratio still is being determined, but probably will 

be between 120 to 150 patients per physician.

The ICU monitoring system is supplied by VISICU.18 The control room layout includes a 

workstation for each of the nurses and the doctor (Figure 5-4). Each workstation has five 

monitors, keyboard, mouse, camera controls, and telephone. The data displayed for each 

patient includesS

• demographic data (including names of patient and their physician)

• vital signs (heart rate, heart rhythm, blood pressure, respiratory rate, oxygen saturation)

• laboratory tests

• X-rays

Figure 5-4 Tele-ICU control room 

(not the site visited)

(Source: http://visicu.mediaroom.com/index.php?s=13&cat=8&mode=gallery)

 17 Daytime shifts for weekends and holidays supplement ICU coverage when rural hospitals have 

decreased staffing. 18 Information in Visicu is available at: http://www.visicu.com/index_flash.asp
63

Monitoring is supported by alarms and signal processing of the patient’s vital signs. Cameras 

enable the tele-ICU staff to observe patients, and with the communication equipment, interact 

with on-site staff. 

5.3.4 Pertinent Challenges for Modular Reactor Operations

We next summarize the challenges we identified at the tele-ICU that are relevant to SMR 

operations. 

1. Monitoring individual patients can be viewed as analogous to monitoring individual reactor 

units. The tele-ICU staff indicated that monitoring and intervention can be complicated by 

the differences between hospitals. For example, different hospitals’ chart formats create 

higher workload and slow the physician’s response. If the modular reactors monitored by 

the control room staff are at different sites, site differences may impose additional 

complications, as do different hospitals. Also, there may be variations in the design 

between reactors and/or their HSIs. At one site Modular reactors are planned to be 

standard, but changes in design likely will evolve.

2. Another issue concerns possible differences in the I&C system when new units are brought 

on-site. Also, when hospitals are brought on-line, new ones may have more recent versions 

of VISICU, entailing differences in data and data presentation between new and old 

hospitals. This problem may arise as new reactors are brought on-line. Indeed, the 

development of I&C systems is so rapid that reactors brought on-line a decade apart may 

have different I&C systems, different levels of data processing, and might measure different 

parameters. 

3. Organizational changes are needed during emergencies to manage events occurring at one 

unit. For example, when a nurse is intervening with a critical patient, a particular specialist 

may have to be called in, and the monitoring of less critical patients delegated to other 

nurses. A similar flexible adaptability to emergency events might be used in operating 

modular reactors. 

4. Some aspects of the HSI are not well suited to monitoring multiple “units,” e.g., the tele-ICU 

lacks a flexible means simultaneously to display the vital information for many patients. The 

approach to HSI design for monitoring multiple reactor units will be a key aspect of safe 

operations, and may involve novel approaches to HSI design. 

5. HSI support is needed for monitoring multiple “units.” The tele-ICU gives patient criticality 

codes to guide where to focus monitoring attention (“red” patients). Alarms and signalprocessing aid personnel to monitor individual parameters. Reviewing HSI designs of 

modular reactors must consider HSI support for the workload associated with monitoring.

6. The staff of the tele-ICU deemed their familiarity and trust with staff at the local ICU as an 

important feature. Without these, smooth operations are impossible. This aspect could be 

pertinent to modular reactors, for example, the familiarity of control room operators with all 

the local operators on site, who may alternate between units. 
64

5.4 Insights for SMR ConOps from Surrogate Facilities

We examined the ConOps of the surrogate facilities, and from the information obtained, we offer

the following as considerations for SMRs.

1. Monitoring and controlling multiple units can be accomplished by a single operator or crew 

in a single control room, and is part of the ConOps for normal operations in refineries and 

tele-ICUs. The DoD is developing this capability for UASs by DoD, and it’s proving a 

challenge to designers. 

2. Enabling technologies that support operators to monitor multiple units include:

• extensive use of automation

• advanced designs of HSIs and alarm systems

• design of control room that fosters teamwork and communication 

• procedures and HSIs that support the transition from normal operation to offnormal/emergency management

• extensive information technology support for troubleshooting the problems users 

encounter 

3. The effect of unit differences (heterogeneity) is unresolved. At the refinery, such 

differences helped somewhat in monitoring and distinguishing between units, while for teleICUs and UAS operators, differences complicated operations. We noted at the tele-ICUs 

the negative effects of differences at higher levels of organization on monitoring individual 

units. By analogy, these might be effects due to different locations, e.g., if several SMRs 

are located at one place, while others are elsewhere. 

4. Automation is a key enabling technology. Concerns about over-automation and its 

potentially negative effects on human performance have entailed more interactive and 

flexible approaches to automation. Adaptive automation, for example, may be valuable in 

assisting operators to manage the workload in supervising multiple plants. Training 

improves operators’ understanding and use of automation. 

5. Clear staffing responsibilities are defined for personnel at the refinery and tele-ICU, and is 

underway for UAS staff. Allocating tasks to crew members is vital in terms of the 

performance of the overall team and integrated system.

6. Crew flexibility is key to managing off-normal situations. At refineries and tele-ICUs, 

significant organizational changes are made to manage them. The availability of additional 

staff for the off-normal unit was necessary. They also were used for some transitions, such 

as unit start-up or shut-down at the refinery. Having a way to transfer responsibilities for 

reactors in off-normal states to a person or team specialized in dealing with them may be 

beneficial to SMR operations. Communication between personnel then is crucial. 

Maintaining SA during off-normal situations is easier when operators have a simple means 

to communicate with other personnel.

7. Staff at the refinery and tele-ICU emphasized the importance of familiarity of control room 

staff with local operators; it fosters trust and smooth operations.
65

8. Designing the HSI for multi-unit monitoring and control is challenging. HSIs must enable 

monitoring of the overall status of multi-units, and the easy retrieval of detailed information

on an individual unit. The design of alarms particularly must ensure operators are aware of 

important disturbances, so minimizing that the effects of change blindness and neglect.

The organization of information is another critical HSI consideration, e.g., deciding to what 

information crew members need access, individually and as a crew, to support teamwork. 

HSIs also must support the transfer of operations between crew members. 

9. The design for multi-unit management also is aided by detailed HFE analyses of staffing 

and operator tasks, via task analysis, human-performance modeling, and operator-in-theloop simulations. 

67

6 POTENTIAL HUMAN-PERFORMANCE ISSUES

We evaluated several sources of information about SMRs and related systems in Sections 3, 4, 

and 5, identifying potential challenges to human performance that touch upon several 

technological disciplines, such as HFE, I&C, plant operations, maintenance, and PRA. In this 

section, we integrate this information to identify a set of potential human-performance issues to 

consider in research on, and in regulatory reviews of SMRs. There is some redundancy therein 

because different sources of information often identified the same or similar challenges. This 

redundancy is good because it is a measure of the converging validation of the issues. In 

describing the issues, we often integrated individual challenges we separately identified in 

previous sections into a single one, particularly when the issues highlighted different aspects of 

the same topic. 

There are some dependencies between the final set of issues, often reflecting their hierarchal 

relationships. For example, new missions lead to new staffing approaches that necessitate new 

designs for the control room and HSI. We point out these relationships when they are 

significant. 

In Section 3, we found that SMRs differ from currently operating plants in many important ways, 

as summarized in Table 3-2. Many issues discussed in this section stem from them. Individual 

SMR designs also differ from each other. Thus, not all issues described below pertain to all 

designs.

We also identified several issues that are not solely related to SMRs, such as passive systems, 

and non-LWR technology. We included them here because they will have to be addressed in 

SMR licensing reviews, even though they are not strictly limited to SMRs. 

Table 6-1 lists the issues identified for each ConOps dimension, all of which are discussed 

below. We first describe each one, and then detail its implications for research and for design 

reviews. Several pathways may be involved in resolving the issues:

• Policy implications/regulation update – Resolution may necessitate updating the NRC’s

policy and/or regulations. 

• Guidance update – Resolution may require updating HFE design review guidance, such as 

NUREG-0711 and NUREG-0700.

• NRC research needed to support guidance development – Resolution may require research 

to (1) determine whether an issue is a potential safety concern, and (2) if so, to establish a 

technical basis upon which to formulate review guidance. We note that not all issues 

requiring an update of HFE review guidance necessarily require new research to support the 

development of guidance. 

• Industry actions – Resolution may be addressed in industry research or vendor/utility HFE 

programs, such that additional action by the NRC probably is not needed.

Where possible, we pointed out the resolution pathways applicable for each issue. A given 

issue can have more than one implication category; we give examples of the usage of the 

categories. 
68

Table 6-1 Potential Human-Performance Issues

ConOps Dimension Human Performance Issue

Plant Mission 

(Section 6.1)

New Missions

Novel Designs and Limited Operating Experience from 

Predecessor Systems

Agents’ Roles and 

Responsibilities

(Section 6.2)

Multi-unit Operations and Teamwork

High Levels of Automation for All Operations and Its 

Implementation

Function Allocation Methodology to Support Automation 

Decisions

Staffing, Qualifications, and 

Training 

(Section 6.3)

New Staffing Positions 

Staffing Models

Staffing Levels

Management of Normal 

Operations 

(Section 6.4)

Different Unit States of Operation

Unit Design Differences

Operational Impact of Control Systems for Shared Aspects of 

SMRs

Impact of Adding New Units While Other Units are Operating

Managing Non-LWR Processes and Reactivity Effects

Load-following Operations

Novel Refueling Methods

Control Room Configuration and Workstation Design for MultiUnit Teams

HSI Design for Multi-unit Monitoring and Control

HSIs for New Missions (e.g., steam production, hydrogen)

Management of Off-normal 

Conditions and 

Emergencies (Section 6.5)

Safety Function Monitoring

Potential Impacts of Unplanned Shutdowns or Degraded 

Conditions of One Unit on Other Units

Handling Off-Normal Conditions at Multiple Units

Design of Emergency Operating Procedures (EOPs) for MultiUnit Disturbances

New Hazards

Passive Safety Systems

Loss of HSIs and Control Room 

PRA Evaluation of Site-wide Risk (i.e., across all units)

Identification of Risk-Important Human Actions (RIHAs) when 

One Operator/Crew is Managing Multiple SMRs

Management of 

Maintenance and 

Modifications 

(Section 6.6)

Modular Construction and Component Replacement

New Maintenance Operations

Managing Novel Maintenance Hazards

6.1 Plant Mission

We identified two issues for this aspect of SMR ConOps: 

• New Missions

• Novel Designs and Limited Operating Experience from Predecessor Systems
69

6.1.1 New Missions

Issue Description

The primary mission of current U.S. NPPs is to safely generate electrical power. Some SMRs 

are designed to accomplish additional missions, such as producing hydrogen and steam for 

industrial applications, e.g., heating or manufacturing. Demick (2010) describes these new

missions for HTGRs as follows:

These applications include supplying process heat and energy in the forms of steam, electricity and 

high temperature gas to a wide variety of industrial processes including, for example, petro-chemical 

and chemical processing, fertilizer production, and crude oil refining. In addition to supplying process 

heat and energy the HTGR can be used to produce hydrogen and oxygen which can be used in 

combination with steam and electricity from the HTGR plant to produce, for example, synthetic 

transportation fuels, chemical feedstock, ammonia, from coal and natural gas.)

Achieving these missions will necessitate having new systems and personnel tasks, and 

possibly, added workload. Questions important in multi-mission operations include:

• If process-heat applications are envisioned for multi-unit sites, will different ones be allowed 

at the same facility, e. g., hydrogen production, steam production, desalination, refining, and 

electricity production? 

• Will the new processes associated with these missions create new hazards and safety 

issues, such as fires and explosions from hydrogen, methane, or natural gas?

• How will plant staff manage these new missions?

- Will new process applications use the same or different operators as the NPP?

- Will new staffing positions be created?

- Will plant operators be trained in dealing with upset conditions in process-heat 

applications, and other interfacing requirements? 

- Depending on number of process applications the nuclear facility services, how will 

these new responsibilities complicate operator training since they must be familiar with

all application interfaces? 

Implications

The determination of the importance of this issue will depend upon additional information from 

vendors. How they answer the questions we raised above will help assess the extent to which 

the safety of reactor operations may be impacted. Current licensing reviews do examine the 

hazards of nearby facilities, such as natural gas; now, these may be onsite and be a mission of 

the plant. Also, the operators must deal with these new hazards along with reactor-related 

hazards.

In the near-term, HFE reviewers of applications for SMRs that include new missions should 

ensure that applicants address these questions. 

Additional details related to new missions are encompassed in many issues below.
70

6.1.2 Novel Designs and Limited Operating Experience from Predecessor Systems

Issue Description

Commercial NPPs evolved gradually, with new designs improving upon prior ones. Using 

operating experience from predecessor plants has been an important aspect of plant design, 

licensing reviews, and operational improvements for years. By contrast, SMRs represent a new 

category of plant design, and consequently, for many, there is little operating experience. 

Those that are somewhat similar to SMRs (in terms of size and output) are research -and 

demonstration-plants operated as a single unit and use old technology. For example, in 

examining the operating experience of a demonstration plant, Beck et al. (2010) and Copinger 

and Moses (2004) gained only limited insights for HFE. We may have to address and assess 

the need for operating experience by considering the experience of similar designs and nonnuclear systems. The impact of this information gap and compensatory approaches should be 

evaluated. 

Implications

The first implication of this issue is that modifications of the staff’s review guidance on operating 

experience are needed to accommodate a greater diversity of experiences at predecessor plant 

that likely will contribute to SMR design more than the traditional new-plant designs reviewed to 

date. Current guidance is based on the way large LWR were designed, viz., small evolutionary 

changes from specific predecessor plants. For addressing SMRs, NUREG-0711, Section 3, 

Operating Experience Review, must be revised. 

The second implication is that operating experience may be lacking for predecessor designs in 

comparison with those new reactors that underwent design-certification reviews. The extent to 

which OpE is lacking should be evaluated to determine the potential impact on the HFE 

program, e.g., will additional test and evaluations be needed in lieu of operational experience; 

here, input from SMR vendors may be a valuable source of information.

6.2 Agents’ Roles and Responsibilities

We identified three issues for this aspect of SMR ConOps: 

• Multi-unit Monitoring and Teamwork

• High Levels of Automation for All Operations and its Implementation

• Function Allocation Methodology to Support Automation Decisions

6.2.1 Multi-unit Operations and Teamwork

Issue Description

For many designs we examined, a single crew/operator simultaneously monitored and 

controlled multiple units from one control room. Key issues in effectively and reliably 

accomplishing this task will be teamwork, SA, control room and HSI design, and the operator’s 

workload. Maintaining sufficient awareness of the status of multiple SMRs may tax crews and 

individual operators. For example, UAV studies found that operators sometimes focus on a 

particular unit and may neglect others, or fail to notice important changes to them (change 

blindness). 
71

When operators are focused on a particular problem in current plants, other operators 

undertake their tasks. Such cooperation may be problematic when each operator is responsible 

for multiple units. In the oil refinery facility, this situation was resolved augmenting the crew with 

additional staff during times of high workload or special evolutions. This is a different 

operational practice than that in present-day control rooms where the on-shift crew manages all 

aspects of the plant’s condition (except accidents). 

Maintaining SA may be further challenged when other situational factors intervene (separately 

identified as issues below):

• individual units can be at different operating states, e.g. different power levels or different 

states such as shutdown, startup, transients, accidents, refueling and various types of 

maintenance and testing (see Section 6.4.1) 

• unit design differences often exist (see Section 6.4.2) 

Shift turnovers occur two to three times a day when a new crew relieves the old crew. An 

effective way is needed to convey the status of each plant, ongoing maintenance, and trends in 

operation from one crew to another, particularly because more than one plant is involved, and 

one operator will be operating multiple plants. 

An understanding of the contribution of situational factors such as these to multi-unit monitoring 

and control tasks will be important in safety reviews. 

Implications

Multi-unit monitoring and control is a new type of operation in the commercial nuclear-power 

industry, with a limited technical basis for developing review guidance for multi-unit operations. 

Therefore, research is needed to address the issue and identify the considerations that must be 

accounted for in evaluating applicant submittals for multi-unit operations. We recommend that 

this research include an extended in-depth study of multi-unit operations in other industries, 

similar to our use of surrogate facilities. Since there is a limited literature to draw on in many 

industries, site visits may be the best way to obtain data. Having a fuller technical basis rests 

on identifying the enabling technologies, operational strategies for both normal and off-normal 

situations, control room and HSI design, and lessons learned; evaluations will demonstrate if the 

latter can be generalized to NPP operations. In addition, the findings should be compared with 

NPP specific research to verify that their technical basis is appropriate for resolving NPPspecific issues. 

Until such research in complete, HFE reviewers should request applicants to justify their 

proposed multi-unit operational strategy, e.g., by simulations. However, this is not a substitute 

for the research needs identified above. The NRC still needs an enhanced technical basis to 

ensure they ask the proper questions, and that the review guidance addresses those aspects of 

multi-unit operations impacting human performance and plant safety.

Revisions may be needed, for example, to portions of the regulations in 10 CFR: 50.34(f)(2)(i) 

on simulators; 50.54(i) - (m) on staffing; and Appendix A, GDC, Criterion 19 on control room 

design. Regulatory guidance may need updating: RG 1.114, guidance to operators at the 

controls; RG 1.149 and the related ANS 3.5 on simulators; the SRP NUREG-0800 Chapters 13 

and 18; and NUREG-1791, guidance for staffing exemptions. Like many issues discussed in 

this section, the guidance developed likely will impact NUREG-0711 and NUREG-0700.
72

Related issues are discussed below in Sections 6.3.2.and 6.5.3.

6.2.2 High Levels of Automation for All Operations and its Implementation 

Issue Description

The findings from our surrogate facilities emphasized automation as key enabling technology for 

multi-unit operations. As crews are assigned more units to manage, automation must undertake 

tasks traditionally performed by operators. SMRs are no exception, and their degree of 

automation will be high as both normal- and safety-operations will be automated. The 

“automate all you can automate” philosophy often dominates programs for developing advanced 

reactors to improve their performance and decrease operational costs. However, as we noted 

earlier, there is a complex relationship between automation and human performance, which 

often fails to confirm common-sense expectations. For example, expectedly high levels of 

automation will lower workload; instead, it shifts workload and creates other humanperformance difficulties (O’Hara & Higgins, 2010), as summarized in Section 3.4, Insights for 

SMR ConOps from SMR Design and Operations.

Concerns about these negative effects of over-automation increased the usage of more 

interactive automation implemented at different levels (summarized in Table 5-1). In addition, 

flexible approaches to using different levels of automation in a single system are being explored. 

In adaptive automation, its level is dynamic and changes with the needs of personnel and plant 

conditions. Therefore, this approach may assist operators in managing changing attentionaland workload demands in supervising multiple plants. 

The reliability of automation also is an important consideration in using it. As automation’s 

reliability declines, operator’s performance and trust in the automation is degraded.

SMR designs must find the right balance between automation and human involvement to assure 

plant safety, by determining the right levels of automation and flexibility to support operators in 

maintaining multi-unit SA and managing workload- demands. In addition, the design of SMR 

automation should mitigate the types of human performance issues identified in Item 3 in 

Section 3.4, Insights for SMR ConOps from SMR Design and Operations. Licensing reviews of 

SMRs must determine whether the applicant has reasonably assured the effective integration of 

automation and operators, and the design supports safe operations.

Implications

The pitfalls of high-levels of automation for human performance are well known, as are some of 

the design characteristics that generate them. The NRC published guidance (O’Hara & Higgins, 

2010) on human-automation interactions that should support HFE reviewers in addressing 

automation in SMR designs. The guidance is being incorporated into NUREGs-0711 and -0700. 

While this guidance significantly enhances the staff’s reviews, additional research is needed in 

some areas (O’Hara and Higgins, 2010 detail the research needs listed below):

• models of teamwork

• reliability 

• processes used by automation 

• isolation of the effects of automation’s dimensions
73

• triggering mechanisms for adaptive automation 

• HSI design

In addition, a lesson learned from the DoD’s experience is the difficulty in automating high-level, 

unmanned vehicle functions. The NRC’s HFE reviewers should pay special attention to 

applications of SMR automation that extend beyond those typically used in new reactors, since 

there is little experience with them. 

See also the related issue in Section 6.4.3, Operational Impact of Control Systems for Shared 

Aspects of SMRs. 

6.2.3 Function Allocation Methodology to Support Automation Decisions

Issue Description

Under the issue of “High Levels of Automation for All Operations and its Implementation,” we 

discussed establishing various levels of automation and their flexible use by operators. Making 

design decisions on these two parameters generally is called allocation. An issue facing 

designers and reviewers is that current allocation methods do not offer specific analytic tools for 

deciding when and how to apply new types of automation. SMR designers also noted this 

problem. In discussing automation for the PBMR, Hugo and Engela (2005) observed that most 

methods of function allocation are “...subjective and prone to error and in projects where human 

and environmental safety is a concern, it is necessary to use more rigorous methods.” More 

comprehensive and objective methodologies are needed to support function allocation analyses 

by designers.

Implications

NUREG-0711 gives general guidance for reviewing function allocation in Section 4, Functional 

Requirements Analysis and Function Allocation. However, modern applications of automation 

have much flexibility, so that operators face many different types of tasks and interactions (as 

discussed earlier). The NRC’s characterization of automation identified six dimensions 

(functions, processes, modes, levels, adaptability, and reliability) that can be combined to 

design automation for a specific application. However, designers lack methodologies to backup their decisions as to what combinations are appropriate, i.e., current function-allocation 

methods do not address such choices; and reviewers lack guidance to evaluate them. 

Additional research is needed on function allocation; that is, selecting the types of automation 

and levels of operator involvement to implement for specific applications; the resulting guidance 

should be included in NUREG-0711.

6.3 Staffing, Qualifications, and Training

We identified three closely related issues for this aspect of SMR ConOps: 

• New Staffing Positions

• Staffing Models

• Staffing Levels
74

6.3.1 New Staffing Positions

Issue Description

In discussing “New Missions” above, we noted that the industry identified SMR missions beyond 

safe production of electricity; hence, management may require new staffing positions over 

current NPPs staffing. As well as the new missions, new positions may be needed to manage 

design differences between current plants and SMRs, such as reactor transfer and on-line 

refueling.

The allocation of responsibilities for new missions and new operational activities to shift crew 

members, either in terms of new positions or new personnel responsibilities must be a part of 

staffing and qualifications analyses, training program development, and regulatory reviews to 

determine their potential impact on safety.

Implications

This issue has potential impact on 10 CFR 50.54, Staffing, and 50.120, Training, the 

implications of which are detailed in Section 6.3.3, Staffing Levels.

6.3.2 Staffing Models

Issue Description

The concept of “staffing model” addresses the general approaches to fulfilling the organizational 

functions necessary to operate a NPP, including operations, maintenance, engineering, 

administration, and security (O’Hara et al., 2008).

19 To meet these responsibilities, utilities 

employ a combination of on-site staff and off-site personnel. The staffing model chosen is a 

very significant design-decision as it drives many other aspects of the plant’s design, including

degree of automation, the HSI design, and personnel training. (Section 4.3, Staffing, 

Qualifications, and Training, has more details) 

Current U.S. NPPs have many on-site personnel organized into functional groups. Operations 

are performed by shifts of reactor operators who the NRC licenses to manage reactor and 

balance of plant systems. Each shift is expected to manage all phases of plant operations 

including normal (e.g., startup, changing power levels, and shutdown) and off-normal conditions 

(e.g., equipment failures, transients, and accidents). In certain emergencies, additional staff is 

brought in to assist. While day-to-day maintenance is handled by on-site staff, outside 

organizations often come on-site during outages to undertake major maintenance. 

However, the same model is not employed worldwide. For example, in many European NPPs, 

the operations shift crew divides responsibilities between a reactor operator who manages the 

reactor systems, and the balance-of-plant operator who manages the rest of the plant, an 

approach analogous to the UAV and refinery operations we examined. UAV crews split duties 

between flying/navigating the vehicle, and payload operations. In the refinery, four units were 

managed, with each operator being responsible for a part of the process and monitored all four 

units for it. 

 19 Our use of the term “staffing models” should not be confused with “human performance models.” The 

latter refers to models that are (1) mathematical, programmable, and executable rather than purely 

explanatory; and (2) applied in the engineering design and evaluation of complex systems.
75

Definition of staffing models needed for SMRs; they may differ from those in currently operating 

plants. For example, we noted in our discussion in Section 6.2.1, Multi-unit Operations and 

Teamwork, that the crews in some of our surrogate facilities where operators monitor multiple 

units, are augmented with additional staff when dealing with units under high-workload 

situations (such as during startup or emergencies). Crew flexibility is a key to managing offnormal situations. Thus, at refineries and tele-ICUs, significant organizational changes are

needed to manage these situations. In both, additional staff is brought in for off-normal units, 

and during transitions at the refinery (unit startup or shutdown). Being able to transfer 

responsibilities for reactors in off-normal states to a person or team specialized in dealing with 

them may benefit SMR operations. 

After defining personnel responsibilities for a particular SMR design, the associated tasks must

be assigned to specific staff positions for both normal operations and off-normal/emergency 

conditions. Depending on the use of automation, these tasks may include the monitoring and 

control of multiple individual units, shared systems, reactor transfer, online refueling, new 

missions, and monitoring and backing-up the automation. SMR designers will have to 

determine the allocations of operator role hat best support overall system performance and 

safety, and consider the impact on teamwork, e.g., on the peer-checking process. 

Implications

Changes to staffing models that deviate from current practices are likely to have implications for 

10 CFR 50.54 and the various staffing guidance documents, including NUREG-0711, as we 

further discussed next in Section 6.3.3, Staffing Levels.

6.3.3 Staffing Levels

Issue Description

10 CFR 50.54m governs the minimum staffing levels for licensed operators in current plants; it

has a table establishing the numbers of operators for one-, two- and three-unit sites. For a oneunit site, one SRO, two ROs, and a shift supervisor (second SRO) are required for an operating 

reactor. For a two-unit site, two SROs and three ROs are needed. A three-unit site needs three

SROs and five ROs. The table does not cover sites with more than three units.

Most SMRs for which staffing information is available, propose staffing levels below these 

requirements and, therefore, an exemption from this staffing regulation is needed. For example, 

one SMR design anticipates assigning one reactor operator to monitor and control four units, 

each consisting of a fully integrated reactor and turbine generator. Drivers supporting this 

approach include the reactor’s small size, it’s simple, design, high-degree of automation, 

modern HSIs, and it’s slow response to transients. Control room staffing for the baseline 

configuration of one SMR design consisting of 12 units encompasses three ROs, one SRO

control room supervisor, one SRO shift manager, and one shift STA. Thus, the staffing levels 

needed to safely and reliably monitor and control SMR units must be determined and reviewed, 

possibly addressing new positions and staffing models, as described above.

Implications

Staffing levels are identified in 10 CFR 50.54(m); hence, a change in this regulation or an 

exemption is needed to permit SMRs to deviate from the minimum established levels. As we 

noted in Section 4.3, SMR staffing levels was recognized in Issue 4.1, Appropriate 
76

Requirements for Operator Staffing for Small or Multi-Module Facilities of SECY-10-0034 (NRC, 

2010) “...as a potential policy issue that may require changes to existing regulations.” Also, 

staffing levels must be considered in the broader context of new staffing positions and models 

that might different than those used in currently operating plants and must be reflected in NRC 

regulations and review guidance.

Until such regulatory changes are made, NUREG-1791 (Persensky, et. al, 2005) provides 

guidance for reviewing staffing exemptions. The guidance therein reflects the NUREG-0711 

HFE review process, and addresses multi-unit operations. So far, the guidance has not been

tested or used to evaluate an exemption request. Additional research is warranted, aimed at 

verifying its approach and updating it. If necessary, it should better address the SMR staffing 

issues in light of the design developments and human-performance considerations since its 

publication. 

Other impacted regulations were noted in the implications discussed in Section 6.3.1 above.

6.4 Management of Normal Operations

We identified 10 issues for this aspect of SMR ConOps: 

• Different Unit States of Operation

• Unit Design Differences

• Operational Impact of Control Systems for Shared Aspects of SMRs

• Impact of Adding New Units While Other Units are Operating

• Managing Non-LWR Processes and Reactivity Effects

• Load-following Operations

• Novel Refueling Methods

• Control Room Configuration and Workstation Design for Multi-Unit Teams

• HSI Design for Multi-unit Monitoring and Control

• HSIs for New Missions (e.g., steam production, hydrogen)

6.4.1 Different Unit States of Operation

Issue Description

Individual SMR units may be in different operating conditions, e.g., different power levels or 

different states, such as shutdown, startup, transients, accidents, refueling and various types of 

maintenance and testing. Depending on the staffing model used and the allocation of SMR 

units to individual operators, the effects must be evaluated of these differences on the operators’ 

workloads and their operators to maintain SA.

Implications

This issue has two implications. First, the applicants need to determine how the crew will 

manage units in different states, e.g., will one operator continue to monitor multiple units in 

different states, or will units in states other than at-power be transferred to a different operator or 

crew. Second, the NRC and industry need research data assessing the ability of operators and 

crews to maintain SA of units in different states and to act appropriately as they arise for each 

unit based on their state. In addition, the ability of operators to respond to off-normal conditions 

based on unit state must be investigated.
77

The findings will offer guidance for addressing unit states as part of the HFE program reviewed 

via NUREG-0711, and for depicting unit status and status changes in the control room’s HSIs, 

reviewed using NUREG-0700. 

6.4.2 Unit Design Differences

Issue Description

The effect of SMR unit differences (heterogeneity) is unresolved. Every surrogate-system 

organization we contacted deals with unit differences, some of which were significant. At the 

refinery, these differences aided monitoring by helping operators to distinguish between the 

units, but for tele-ICU and UAV operators, differences complicate operations. There may be 

differences between the individual units at a given site, between units at different sites, or both. 

Since many SMRs are designed to be scalable, units can be added while other units of the plant 

are operating. Whilst a licensee may plan to have all identical units at a particular site, this may 

not be achievable due to changes made to improve reliability, lower cost, or deal with 

obsolescence issues, so impacting, crew and operator reliability. Thus, we need to understand 

and address the effect of unit differences on SMRs operations. 

Implications

The research questions stemming from this issue may be qualifying the extent to which 

differences impact performance, and identifying which aspect of performance affected. Unit 

differences may support the operator’s ability to distinguish between them when monitoring 

workstation displays; yet, the difference may make situational assessment and response 

planning more difficult. For example, if the disparities in the units lead to a different 

interpretation of their status based on parameter displays, it may impair the operator’s 

recognition of performance that deviates from what it should be. Further, if these unlikenesses 

in the units lead to the need for different responses, then they may compromise the operator’s 

response and open in a way that is an opportunity for operator error; for example, the operator 

may respond to a disturbance in Unit 2 is appropriate to Unit 1, but inappropriate to Unit 2. The 

results of research addressing this issue affect the review of procedures as well as HSIs. 

For HSIs, we need guidance on whether and how these differences should be depicted in 

control room HSIs. NUREG-0700 lacks guidance on this issue. Depicting differences with no 

import on operator’s performance could needlessly complicate displays; failing to depict those 

that impact operator performance may engender difficulty in situation assessment, and operator 

error. 

Furthermore, once the effects on performance of unit differences are determined, the results 

may help resolve the needs for standardization, for evaluating unit differences using the 50.59 

process, or for ways to address it, such as specific HSI design techniques. There are 

implications also in how to address these unit differences in procedures and training. Should 

the procedures be common for all units with the differences noted in the appropriate places, or 

should the procedures be completely separate and different for each unit? Operators must be 

thoroughly trained in recognizing the differences between units. 
78

6.4.3 Operational Impact of Control Systems for Shared Aspects of SMRs

Issue Description

In today’s typical plants, the control systems manage a single unit. For SMRs, the control 

systems may manage multiple units in an integrated fashion. This could include systems that 

the units share in common, such as for circulating water, for the ultimate heat sink for removing 

decay heat, and systems for instrument air, service-water cooling and AC and DC electric power. 

It may also include common control of systems that are similar but not shared between units, 

such as balance of plant (BOP) systems. Clayton and Wood (2010) noted that “Multi-unit 

control with significant system integration and reconfigurable product streams has never before 

been accomplished for nuclear power, and this has profound implications for system design, 

construction, regulation, and operations” (p. 146). The integrated control of multiple SMRs and 

their shared systems can be an operational challenge, as well as an I&C one. The challenge to 

operators lies in monitoring such a control system to confirm that individual units and shared 

system are performing properly, and that there are not degradations of the I&C system.

A few additional considerations enhance the challenge. The first is that SMR scalability can 

make multi-unit operations even more complex as new units are added to the control system. 

Wood et al. (2003) noted that “...this may result in a control room that is less optimal for human 

factors at all levels than would otherwise be possible if all the modules simultaneously 

completed construction” (p. 59).

The second is that SMRs may serve multiple missions. That is, systems must be flexibly 

reconfigured to meet electricity production and other objectives, such as hydrogen production. 

For example, the operators may need to change the SMR units driving a turbine to produce 

electricity so they generate hydrogen. Designing operational practices and control rooms to 

effectively support operators is an important issue to address in design and licensing multi-unit 

SMRs.

Implications

The HFE implications of this issue pertain mainly to HSI design. While NUREG-0700 has 

guidance on controls, it does not consider how multi-unit and shared system controls should be 

implemented at operator’s workstations. Another question, from an HSI design perspective, is 

how to address controls for shared systems when different operators at different workstations 

monitor the units sharing those systems. There may also be increased opportunities for wrongunit/wrong-train types of error that need resolution. 

Additional implications are the outcomes of degradation of the control system on the operator’s 

detection of malfunctions and SA of the status of units and shared systems. 

The different ways that a plant may select to implement procedures for each unit (Section 6.4.2 

implications) may, in turn, impact the HSI's design, particularly if the choice is separate 

procedures for each unit.

Research on this issue will afford a basis for writing NUREG-0700 guidance to help ensure the 

SMR control room and HSIs provide the necessary information to enable detection of 

degradation on the control system and SA.
79

6.4.4 Impact of Adding New Units While Other Units are Operating

Issue Description

Most SMRs are scalable; that is, multiple units can be grouped at a site to meet a utility’s 

specific power needs. Current construction plans are to have ongoing installation of additional 

units while earlier units operate at power, in contrast to current practices at multi-unit sites

where a Unit 2 under construction is clearly separated from operating Unit 1. The impact of 

adding new units on a site with existing units must be addressed. 

Another consideration is the need to add workstations to a control room to accommodate new 

units. For current plants, the practice is to erect a stout wall between the operating control room 

and the control room being built. The wall controls access to the new unit, and limits noise, 

interruptions, fumes, dust, the potential for construction-related fires and electromagnetic 

interference from radios, along with other construction work and tests. The shared or common 

systems typically are included in the operating control room’s boundaries.

Implications

If construction activities on subsequent units cannot be completely separated from operating 

units, they might distract operators. Even if separated, there likely will be mechanical and I&C 

tie-in activities that could cause trips or other operational problems for the operating units. This 

may be a particular issue in designing the workstation and HSI displays that will be used to 

monitor and control existing operating units and the new ones under construction. Research will 

clarify these issues, from which to develop guidance to assess proposed vendor approaches to 

introducing new units; it is likely to impact both NUREG-0711 and NUREG-0700.

6.4.5 Managing Non-LWR Processes and Reactivity Effects

Issue Description

Non-LWR SMR designs incorporate the unique systems and features of their processes, and 

may have reactivity effects that differ from LWRs. For example, the presence of lead in the core 

area of HPM, a lead-cooled fast reactor, will involve different reactivity effects from those in 

light-water reactors. It will exhibit little neutron thermalization, have lower Doppler effects, the 

temperature coefficient of reactivity will be less negative, and the neutron lifetime shorter. 

These features all quicken the dynamics of core power and transient operations. The operator’s 

control of both reactivity effects and overall reactor safety depends on their understanding of 

these effects.

Implications

To understand these differences, operators familiar only with LWRs, but transitioning to nonLWR plants, will require special training both in the classroom and on simulators. In addition, 

the design of the HSI and procedures should particularly aim to support the operator’s 

performance. The acceptability of the operator’s performance must be specifically tested as 

part of a thorough an integrated system validation program. Thus, the new guidance will impact 

both NUREG-0711 and NUREG-0700.
80

6.4.6 Load-following Operations

Issue Description

Current day NPPs typically operate at 100% power and provide a base load to the utility’s 

electrical distribution system, i.e., the plants produce electricity for the grid and other producers 

of electricity compensate for changes in demand. Clayton and Wood (2010) suggested that a 

base-load mode of operation may not suffice for SMRs that may have to cooperate with other 

sources of renewable energy whose production is variable because they depend on sun and 

wind.

Load following is an operating procedure that allows the power output generated by the NPP to 

vary up or down as determined by the load demanded by the distribution system. It entails 

more transients, so the plant can increase or decrease both reactor- and turbine-power in 

response to the external demand. In turn, this requires more actions from operators, and 

increased monitoring of the response of the automatic systems. In addition, for a multi-unit site, 

load following may entail the startup and shutdown of units to meet large changes in load 

demand. Hence, there is more opportunity for equipment failures and operator errors. 

Implications

Vendors and plant owners, in conjunction with the NRC, will need to decide on the method to 

implement load-following, e.g.: 

Method A – A load dispatcher contacts the NPP’s shift supervisor for all changes.

Method B – A load dispatcher dials in requested change, and the NPP automatically 

responds, while the load dispatcher and RO/SRO monitor for the proper 

response.

Each of the two approaches has its own issues. Method A creates a greater workload and more 

distractions for the operators. While manual control of a single unit is well within an operator’s 

capability, simultaneously controlling several may be much more difficult and lead to errors. 

Method B permits a person not trained in NPP systems and not licensed to change reactivity 

and power level in the reactor to do so. The NRC has not permitted plants to be operated by an 

automatic load-following scheme. 

Once an acceptable approach is determined, designers will need to define the needed operator 

tasks to properly manage load-following operations, and to provide HSIs procedures and 

training to support them. Guidance will be needed for both NUREG-0700 and 0711 to review 

the applicants’ analyses of load-following operations and the HSI that manages them.

Such a change in operating methods might increase risk due to a higher frequency of transients, 

and should be evaluated via PRA techniques. 
81

6.4.7 Novel Refueling Methods

Issue Description

Several SMR designs refuel the reactor on-line or continuously. While there is international 

experience with such refueling operations, it will represent a new practice in the United States. 

Further, in some circumstances, specific approaches to refueling will be novel. For example, we 

repeat the information we obtained about the current NuScale refueling concept discussed in 

Section 3.1.

There will be online refueling operations where the reactor to be refueled is detached from its 

mounting position and connected to a crane. The crane then moves the reactor to a refueling bay 

for disassembly and refueling. The reactor instrumentation is monitored through the entire 

process. There are four channels of instrumentation and control (I&C). When preparing to move 

the reactor, first one channel’s cable connector is removed from the reactor and attached to the 

refueling bridge (RB). When the channel on the RB is verified to be reading properly, the second 

I&C channel is similarly transferred, and then in turn the 3rd and 4th channels are transferred. 

Control of this reactor is the responsibility of an SRO in the refueling area, not the main control 

room. One concept under consideration is having a 13th reactor, which would then be moved to 

replace the one being refueled. Then the reactor could be refueled while the other 12 are still 

maintaining the full power output of the station.

It is likely that a refueling crew will manage this operation. However, there still are interfaces 

with the operators of the primary reactor that should be considered, as well as the operations of 

the refueling crews. The effects of such novel approaches on human performance and plant 

safety need to be assessed.

Implications

Vendors will have to define the methods by which reactors will be refueled, and their impacts on 

operator performance assessed through HFE analysis and research, particularly by operators 

responsible for other operating units at the same time. A key policy question here is whether 

the NRC will allow one operator simultaneously to control both an operating unit and one 

undergoing refueling. 

Depending on the effects of refueling on the operator’s performance, additional review guidance 

may be needed to support the review of the associated HSIs, procedures, and training. See 

also, the discussion in Section 6.4.1, Different Unit States of Operation.

6.4.8 Control Room Configuration and Workstation Design for Multi-unit Teams

Issue Description

The control room’s design, from where three or more people manage the plant, is an important 

issue. For a single reactor and its secondary systems, modern computer-based control rooms 

typically have a large overview display, several operator workstations, a supervisor’s 

workstation, and supplemental workstations for engineering and maintenance work. The 

question is how to design a single control room to support SMR operations encompassing 

multiple reactors, and where a single person may be responsible for a reactor and its secondary 

systems for up to four complete units. The answers partly depend on the allocation of the 

crew’s responsibilities. Nevertheless, it may be demanding to design a single workstation to 
82

monitor one unit alone in light of the HSI resources needed for today’s control room that 

monitors a single unit; expanding that to four units may prove more challenging. 

One SMR designer’s very preliminary concept suggested that eight monitors are needed to 

display the alarms, displays, procedures, and controls for a single unit. Thus, four units would 

necessitate 32 monitors. It is unclear whether a single operator could monitor such a large 

amount of information, and the chances of missing important data might well increase.

As well as considering multi-unit operations, the design will need to accommodate new tasks, 

such as moving reactors for refueling, as well as new missions, such as hydrogen production.

Another question is whether the individual unit control stations should be located in one room or 

in different ones close together. In a single control room, situational factors associated with a 

single unit, such as alarms and using emergency procedures, may impact the operators 

monitoring other units. However, accommodating operational staff in one room, allows them to

help each other more easily, and they will be easier to supervise. If individual unit-control

stations are in separate control rooms, overall supervision, teamwork, and the transitions 

needed in high workload situations may be more difficult to manage. Also, operations at each 

unit will be undisturbed by what happens at the others. 

Implications

Operating multiple units from a single control room is a new practice and research into the 

workstation and control room configuration is needed to determine an appropriate approach to 

ensure its support of situation awareness and teamwork. As noted earlier, one aspect of this 

research is to gather experience from other industries on multi-unit operation. In our research to 

date, we observed both single control rooms and multiple ones.

See also the implication discussed in 6.2.1, Multi-unit Operations and Teamwork, and Section 

6.4.9, HSI Design for Multi-unit Monitoring and Control. 

6.4.9 HSI Design for Multi-unit Monitoring and Control

Issue Description

The detailed design of HSIs (alarms, displays, and controls) to enable a single operator to 

effectively manage one or more SMRs is an important feature. HSIs must enable monitoring 

the overall status of multi-units, as well as easy retrieval of detailed information on an individual 

unit. This need raises several questions. For example, should the HSIs for each unit be 

separate from those of other units, or should they be integrated to help operators maintain highlevel awareness of the status of all units for which they are responsible. If the units are 

separated, and an operator is focusing on one of them, awareness of the status of the other 

units may be lost. If the information is integrated, it might be a challenge to ensure that 

operators do not confuse information about one unit with that about the others. Related to this 

is the problem of how to address unit differences in designing HSIs, as discussed earlier. 

Alarm design is especially important in ensuring that operators are aware of important 

disturbances, thereby minimizing the effects of change blindness and neglect.

SMR personnel may also require more advanced I&C- and HSI-capabilities to support their 

tasks. For example, systems that provide diagnostics and prognostics support to monitoring 
83

and situation assessment activities may be available. How personnel manage and understand 

these capabilities is an important consideration in overall personnel- and plant-performance.

The organization of information in supporting teamwork is another important HSI factor e.g., 

deciding what information crew members need to have access to individually, and as a crew, to 

promote teamwork. A key aspect to be researched is employing a large overview display in a 

control room with multiple operators, each controlling more than one unit. Its value here may 

not be so clear-cut and obvious as it is for a single unit’s control room. 

Another problem is the HSIs needed for shifting control for one unit from one operator to 

another.

Implications

Research should be undertaken to more define the requirements imposed by multi-unit 

monitoring and control on all HSI resources, and to delineate how they should be integrated into 

workstation, overview displays, and control room layouts to support multi-unit control rooms. 

The NRC reviews the detailed design of control room HSIs, in part using the guidance in 

NUREG-0700. Thus, the research on this issue should provide a technical basis for developing 

new guidance.

See also the implication discussed in 6.2.1, Multi-unit Operations and Teamwork, and 6.4.8, 

Control Room Configuration and Workstation Design for Multi-unit Teams. 

6.4.10 HSIs for New Missions

Issue Description

HSIs are needed to help monitoring and controlling new missions, such as hydrogen production, 

or the industrial use of steam, so that the question of how to design and integrate them into the 

control room must be answered. 

Implications

The design of the new HSIs themselves probably can follow the guidance in NUREG-0700, but 

it may need to be expanded to guide the interplay between these new functions and the reactor 

controls. Before researching this issue, more detailed data are needed from SMR designers on 

how personnel manage new missions, and how their operations are staffed and integrated into 

the rest of SMR operations.

6.5 Management of Off-normal Conditions and Emergencies

One important aspect of managing off-normal conditions and emergencies already raised issue 

6.3.2, Staffing Models, that discusses, among other aspects, the operational team’s transitions

that may be required to manage off-normal units, such as transferring the unit to another 

operator(s). 
84

We identified nine other issues for this aspect of SMR ConOps: 

• Safety Function Monitoring

• Potential Impacts of Unplanned Shutdowns or Degraded Conditions of One Unit on Other 

Units

• Handling Off-Normal Conditions at Multiple Units

• Design of Emergency Operating Procedures (EOPs) for Multi-Unit Disturbances

• New Hazards

• Passive Safety Systems

• Loss of HSIs and Control Room 

• PRA Evaluation of Site-wide Risk

• Identification of Risk-Important Human Actions (RIHAs) when One Operator/Crew is 

Managing Multiple SMRs

6.5.1 Safety Function Monitoring

Issue Description

One action taken by the NRC after the accident at the Three-Mile Island NPP was to improve 

the operating crews’ ability to monitor critical safety functions by requiring each plant to install a 

safety-parameter display system (SPDS) through 10 CFR 50.34(f)(2)(iv). The NRC also 

published guidance on the characteristics of SPDS in NUREG-0835 (NRC, 1981)), NUREG1342 (Lapinsky et al, 1989), NUREG-0737 (Supplement 1) (NRC, 1983), and NUREG-0700, 

Section 5 (O’Hara et al., 2002). The specific safety functions and parameters identified in these 

documents are based on conventional LWRs. However, SMR designs, using HTGRs and 

LMRs, may require different safety functions and parameters to help operating crews to 

effectively monitor the plant’s safety.

Implications

Improving safety-function monitoring is a post-TMI item required by 10 CFR 50.34(f)(2)(iv). A 

change in this regulation is needed for some SMRs, such as HTGR and LMRs, to address the 

identification both of the safety functions appropriate for these designs and the important safety 

parameters that operators will use to monitor them. The new guidance will affect both NUREG0711 and NUREG-0700. While the guidance must be updated, new research is unlikely to be 

needed to support the formulation of new guidance.

6.5.2 Potential Impacts of Unplanned Shutdowns or Degraded Conditions of One Unit 

on Other Units

Issue Description

Unplanned shutdowns or degraded conditions of one unit may affect other units, especially 

those sharing systems. Operators must be able to detect and assess these impacts; therefore, 

HSIs are needed to support their managing the situation. Clear criteria should signal the 

conditions under which additional personnel must be brought-in or the affected unit is 
85

transferred to another operator or crew. Further, the design of the MCR and the HSI must 

support the effective transfer of a unit to other operators. 

Implications

While this is clearly a broad safety issue of interest to many NRC technical disciplines, more 

research is needed on the operator’s tasks, HSIs, procedures, and training essential to 

successfully manage such situations. The research should reflect approaches proposed by 

SMR applicants. Guidance is needed for HFE reviews of proposed approaches to handle 

unplanned shutdowns and degraded conditions; it will impact NUREG-0711 and NUREG-0700. 

6.5.3 Handling Off-normal Conditions at Multiple Units

Issue Description

Evaluations are needed of the crew’s ability to handle off-normal conditions and emergencies in 

a control room with multiple units, as we commented on earlier in Sections 6.2.1 and 6.3.2. As 

with current plants, changes in the crew, including their augmentation, may be needed to handle 

off-normal situations. Most SMRs propose having operators/crews monitoring and controlling 

multiple units. Then, the following questions about off-normal conditions arise.20 

• With the large number of operating units on a site, e.g., 12, a transient frequency of once 

per reactor-year becomes once per calendar-month for the site. How such events will be

addressed poses several issues:

- With operators controlling multiple reactors, do they need relief if a transient occurs in 

one of their units? If so, how will it be provided, on-shift or on-call?

- Will the designated transient relief be for the site or per unit? 

- Will this relief be an operator or a crew? 

• For an “accident” in contrast to a transient, there will likely be augmented crew per 

emergency planning (EP) requirements. But questions remain about the EP staff needed on 

shift to immediately respond to an accident while awaiting augmented staff:

- Is the number of on-shift EP staff at current plants,adequate for multi- SMR plants? 

- Will it apply to the site or does each unit need a designated emergency crew? 

These questions should be addressed considering the potential for common-cause initiating 

events that could affect multiple onsite units, or even all of them. Examples are LOOP and 

“external events” such as fire, flood, and earthquakes.

A related question, discussed in Section 6.5.2, pertains to the control location(s) where the 

affected units are managed. Is it acceptable to have the affected unit controlled from the same 

workstation as unaffected units, or is it preferable to switch operations of the affected unit to 

separate workstation? 

 20 Transients occur more frequently than accidents and are less severe. Examples of transients are 

reactor or turbine trips and loss of offsite power, while those of accidents are a stuck-open primary 

relief valve and a loss of coolant accident.
86

Implications

This issue affects 10 CFR’s staffing and emergency-planning regulations and guidance. SMR 

vendors stated that emergency planning zones might be reduced, potentially lowering the 

staffing requirements for EP crews.

The resolution of this issue can have a significant impact on staffing, since any increase per 

SMR unit is multiplied by the number of reactors on site. 

See also the discussion in Section 6.5.2, Potential Impacts of Unplanned Shutdowns or 

Degraded Conditions of One Unit on Other Units.

6.5.4 Design of Emergency Operating Procedures (EOPs) for Multi-unit Disturbances

Issue Description

The potential for disturbances at multiple units, particularly ones sharing systems, may 

necessitate developing emergency operating procedures (EOPs) that consider strategies for 

responding to multi-unit emergencies from external events, such as loss of grid, earthquakes, 

high winds, and floods, or from failures of shared systems, such as the ultimate cooling or the 

switchyard. Responses must be evaluated carefully to account for unit interactions, and 

procedures must ensure the critical safety functions of each unit. Some questions that arise are:

• Will each unit have independent procedures or will they be integrated? 

• As noted in Section 6.4.2, how will procedures address differences in units?

• Will a set of common procedures apply to all units? 

• How will the execution of common procedures be managed?

Most new reactor designs have computer-based procedure (CBP) systems to support crews in 

managing emergency conditions. Their use in managing multi-unit emergencies must ensure 

the operators awareness of all units. The procedures likely will have to support use by multiple 

crew members. CBPs are relatively new operator-support systems in NPPs; the many new 

demands imposed by multi-unit EOPs will require new functionalities necessitating regulatory 

review.

Implications

The NRC reviews the design and content of EOPs and also their implementation as computerbased procedures under SRP Chapter 13 and 18 reviews. This guidance might need updating 

if EOPs are modified to cover multi-unit disturbances. In addition, NUREG-0700 contains 

detailed design review guidelines for CBP that also may need upgrades to address multi-unit 

applications.

6.5.5 New Hazards

Issue Description

Two classes of SMR designs are based on non-light water technology: HTGRs and LMRs. In 

contrast to LWR designs, they involve new technology-associated hazards, for example, 

hydrogen, liquid-metal (such as sodium and lead), and much higher operating 

temperatures/pressures, and the use of high temperature gas and graphite in the core. Under 
87

some circumstances, graphite cores are flammable and could create radiologically hazardous 

fumes. The hazards must be understood, and then addressed in those safety systems that

monitor and mitigate the hazards, the HSIs that personnel employ to monitor the plant, the 

procedures they use to address hazards, and operator training.

Implications

Vendors will need to address new hazards and NRC likely will review them as part of the 

licensing process. Review guidance will be needed for monitoring the HSIs of systems that 

detect hazards, the procedures identifying appropriate operator actions, and the training in the 

overall management of hazards; this probably will affect the guidance in NUREG-0711 and 

NUREG-0700. 

6.5.6 Passive Safety Systems

Issue Description

Like some new reactor designs, SMRs employ passive safety systems to respond to transients 

and accidents that depend on physical processes rather than active components, such as 

pumps. For example, should an excessively high temperature be reached, the temperature 

gradient increases natural circulation. Many passive systems use one or two valves to initiate 

the process; the valve(s) must be highly reliable.

We reiterate the IAEA’s (2009) concerns about passive systems based on the limited 

experience with reactor design using such systems: 

• The reliability of passive safety systems may not be understood as well as that of active 

ones.

• There might be undesired interaction between active and passive safety systems.

• It may be difficult to ‘turn off’ an activated passive safety system after it was passively 

actuated.

• Implications must be proven of incorporating passive safety features and systems into 

advanced reactor designs to achieve targeted safety goals; supporting regulatory 

requirements must be formulated and established. 

We note that passive safety systems depending of physical processes are not as amenable to 

routine testing as are active ones. There are no components to easily test, e.g., no pumps to 

start. For passive systems with valves, operating them would not fully test the process in the 

absence of the physical condition that initiates it. Thus, operators may not become as familiar 

using them as they are with current-generation active systems, nor know from operational 

experience how to verify the system’s proper automatic initiation and operation in a real event. 

For example, there may not be the same observable initiation signals to start systems. Flow 

rates and temperatures typically are much lower, and perhaps not as easily verified. 

Operational aspects of monitoring and verifying the success of passive systems must be 

defined, along with any operator’s actions needed to initiate or back them up should they fail to 

operate as designed.
88

Implications

Active safety systems must be tested periodically, thereby giving operators the opportunity to 

become familiar with them. However, there may not be an equivalent opportunity with passive 

safety systems. Thus, higher reliance on simulators may be needed to assure the operators’ 

familiarity with, and training on, passive safety systems. 

Procedures must be written to carefully specify the operator’s actions for monitoring, backing-up, 

and securing passive systems, and NRC’s guidance updated to address these new review 

areas. Additionally, the control room V&V program should encompass these three aspects of 

operator interaction with passive systems. The new guidance likely will impact the review 

guidance in both NUREG-0711 and NUREG-0700. 

6.5.7 Loss of HSIs and Control Room 

Issue Description

The design of a multi-modular SMR control room should consider the potential loss of HSIs and 

the entire MCR, taking into account (1) NRC I&C requirements and guidance, and (2) 10 CFR 

50 Appendix A, GDC 19, Control Room, and Appendix R. Also, for the site-wide PRA

(discussed in Section 6.5.8 below), the impact of loss of control room and HSIs might consider

the following:

• potential loss of the main control room and how to use back-up facilities

• operator errors at one operator workstation may affect multiple units rather than just one

• potential loss of one operator-workstation that impacts multiple units

• a site-wide initiating event that likely will impact all units similarly

Implications

Using a single MCR for multiple units has implications for various aspects of CR requirements, 

guidance, and analyses, including design, PRA and failure analysis, HRA, GDC 19 compliance, 

MCR evacuation, Appendix R and remote shutdown. The HFE guidance in NUREG-0711 most 

likely will be affected because it addresses analyses and evaluations of degraded conditions.

6.5.8 PRA Evaluation of Site-wide Risk

Issue Description

Current PRAs in the United States address two- or three-unit sites. However, SMR sites may 

have many more units. Therefore, modeling SMRs, especially those with shared systems, 

probably will require new models for PRAs. A single-unit PRA considers common- or site-widesystems such as offsite power, AC power on site, the ultimate heat sink, and various crossconnections between units, such as air- and cooling-water-systems. They also cover the effect 

of site-wide initiating events, such as loss of offsite power, station blackout, seismic events, and 

external floods. 

PRAs may need upgrading to encompass site-wide risk for multiple units. A site-wide PRA may 

evaluate potential core damage (CD) at multiple units caused by site-wide initiating events and 
89

the influences of common systems and a common control room as potential common- cause 

failures. This site-wide PRA may result in CD at multiple units, but at a lower frequency than for 

a single unit. However, the PRA level 2 releases could be potentially higher due to CD at 

multiple units.

Implications

The overall issue of site-wide PRAs is a policy issue for the NRC. From an HFE perspective, 

calculating RIHAs from a site-wide PRA may generate further actions than does a single-unit 

PRA. These RIHAs will be addressed as part of the applicant’s HFE program to ensure they 

can be reliably performed by plant staff. The treatment of RIHAs is already addressed in HFE 

reviews via NUREG-0711, so that new guidance for the HFE reviews may be unnecessary. 

However, additional HRA considerations might be required to identify these RIHAs. 

See the discussion in Section 6.5.9, Identification of RIHAs when One Operator/Crew is 

Managing Multiple SMRs.

6.5.9 Identification of Risk-important Human Actions when One Operator/Crew is 

Managing Multiple SMRs

Issue Description

An area where new techniques may be needed is the identification of RIHAs. Plant designers 

typically identify and address them in their HFE programs. For SMRs, this is more challenging 

since there will be new/unfamiliar systems and hence, little or no operating experience to draw 

upon. If the PRA is more troublesome to quantify, it will be harder accurately to identify RIHAs.

Even when the units themselves are deemed independent; i.e., no shared systems and the 

units are separated physically, there is the potential for human error if the same operator/crew 

monitors them. For example, the potential for human error for one unit may increase if the 

operator’s attention is directed to another unit. 

Modifications may be needed to PRA and HRA methods to account for these effects. 

Implications

This issue has implications for PRA and HRA techniques and for calculating risk-important 

human actions. The HFE guidance most likely to be affected is NUREG-0711, which addresses 

how applicant’s HFE program addresses RIHAs.

See also the discussion in Section 6.5.7, PRA Evaluation of Site-wide Risk.

6.6 Management of Maintenance and Modifications 

We identified three issues for this aspect of SMR ConOps: 

• Modular Construction and Component Replacement

• New Maintenance Operations

• Managing Novel Maintenance Hazards
90

6.6.1 Modular Construction and Component Replacement

Issue Description

Many SMRs are designed for modular construction and component replacement. Some SMR 

designs will be fabricated at the factory, transported to the plant site, and assembled there. 

Previously, plant personnel participated in the on-site construction, component-level testing of 

installed components, and pre-operational testing; hence, they gained a thorough knowledge of 

structures, systems, and components. Fabricating plants at factories will necessitate changing 

how personnel obtain knowledge of systems and components that historically was gained (at 

least partially) via the construction process.

Implications

The implications on safety of this approach are unknown, but should be discussed with industry 

and vendors to determine their plans to resolve this issue.

6.6.2 New Maintenance Operations

Issue Description

Some SMRs will require new maintenance operations whose impact of safety must be assessed. 

They include operations such as disconnecting a reactor and moving it past other operating 

reactors to a maintenance location, which will involve decoupling the reactor from all the 

electrical- and mechanical-systems while continuously monitoring the reactor throughout the 

entire process. 

In addition, current practices take on new meaning in applying them to SMRs. Current 

operating practices led to the increase in capacity factors from about 63% several decades ago,

to the industry’s current 93%. These practices include on-line maintenance. The next 

generation of plants similarly are likely to employ on-line maintenance practices because the 

same working fluids (steam and water) and equipment (pumps, motors, valves, piping, and heat 

exchangers) will be used. Consequently, the SMRs can be expected to be maintained on line, 

just like their current larger counterparts. 

One outcome of continuous on-line maintenance is that the operator will be faced with several 

units, each in a different configuration due to normal maintenance and surveillance. Research 

is required to develop displays to show operators the important differences in the configurations 

of the units they are monitoring, and the acceptable operations. The operator requires an 

accurate situational awareness of each unit’s status. The displays are likely to differ from the 

current alarm and display strategies.

Plant operators are responsible for the plant and its safe operation including establishing and 

maintaining it in a condition safe for maintenance personnel. Operators take a system out of 

service, ensure it is safely isolated during maintenance, and return it to service. The process is 

difficult enough with one operating crew per unit; it must be evaluated for multiple units. 

Systems are taken out of and returned to service under the direction of the control room, 

typically through a system of locks and tags that signal to maintenance personnel and others 

when the component and system cannot be operated. Additional research is required into the 

ways by which operators can maintain safe configuration of multiple units during maintenance.
91

Implications

There are new operations whose impact on safety must to be evaluated. As noted above, 

current practices applied to SMRs at multi-unit sites may entail different implications. Additional 

information is needed from vendors about these planned practices, followed by research to 

determine their effects on performance, and how to design HSIs, procedures, and training to 

support their safe practice. 

6.6.3 Managing Maintenance Hazards

Issue Description

We identified several potential challenges in human factors associated with maintaining each 

specific design we examined; we list them in Section 3.4, Insights for SMR ConOps from SMR 

Design and Operations, item 19. These new maintenance practices should be analyzed 

carefully to ensure personnel and plant safety.

Implications

This issue can most likely be addressed by industry research, and vendors’ HFE programs

addressing maintenance design and planning, rather than by the NRC.

6.7 Conclusions 

In this section, we identified potential human-performance issues associated with the ConOps of 

SMRs. Table 6-1 lists these issues. 

Some of them can be addressed relatively simply by modifying the wording of existing guidance 

to make is less reflective of LWR technology and more technologically neutral. An example is 

the guidance on monitoring safety functions. HFE-related regulations are similarly modifiable, 

but the process is not as simple because a change is needed in 10 CFR. 

Other issues necessitate additional research to determine whether additional guidance is 

warranted; if so, it will establish a technical basis upon which to develop HFE review guidance. 

The NRC has an HFE guidance-development process that can be followed to guide the work. 

Until such detailed guidance is available, HFE reviews can make use of our findings. First, the 

issues we discussed give reviewers information about what questions to ask SMR design 

applications, knowing what questions to ask is a vital aspect of conducting a design review. 

This is typically guided by the SRP and supporting review guidance. Lacking such guidance, 

knowledge of those design aspects that might impact performance provides a basis for seeking 

information about it. Our detailing of issues identifies these information needs. 

In lieu of detailed review guidance, reviewers can evaluate, design information by:

• adapting existing criteria, e.g., from NUREG-0711 and NUREG-0700

• extrapolating best practices from general HFE principles, such as are presented in 0700, 

Appendix A 
92

• examining an applicant’s tests and evaluations (T&E) that demonstrate the acceptability of a 

new technology or operational approach (T&E is built into the NUREG-0711 HFE review 

process; test results can be a good substitute for deterministic review criteria.)

• ensuring the ISV addresses all issues for which limited guidance is available, so they are 

evaluated in an integrated-systems manner using comprehensive performance 

measurement

Flexibility is essential in a safety-review process to accommodate any of the applicant’s design 

innovations that may impact safety. Review strategies, such as we described above, provide a 

means for an HFE reviewer to address such innovations and applications of new technologies 

and operational strategies.
93

7 DISCUSSION

The main objective of our research was to identify potential human-performance issues 

associated with SMR design and operations. For our purposes, the term “issue” refers to:

• an aspect of SMR development or design for which information suggests that human 

performance may be negatively impacted

• an aspect of SMR development or design that may degrade human performance, but 

additional research and/or analysis is needed to better understand and quantify the effect 

• a technology or technique that will be used for a new plant design or implementation for 

which there is little or no review guidance

To accomplish this objective, we developed a six-dimensional ConOps model. We used it to

evaluate information about SMRs obtained from (1) design and operational information for eight 

SMR designs, and (2) general literature about SMRs and related studies pertaining to specific 

aspects of their operations, such as multi-unit monitoring and control. Since there is limited 

detailed information about operational and HFE aspects of SMRs, we examined several 

“surrogate facilities” where operators manage multiple units in a manner similar to what might 

be expected at SMRs. The surrogate facilities were unmanned vehicles, petroleum refineries, 

and remote intensive-care medical centers. 

From these sources of information, we identified numerous challenges to human performance. 

We then integrated the information, identifying a set of potential human-performance issues to 

be considered in research and regulatory reviews of SMRs. 

Here, we offer our general conclusions and observations from our research.

1. Potential human-performance issues exist pertaining to the design and operational 

characteristics of SMRs. Our review of SMR designs highlighted the differences between 

them and currently operating plants, as summarized in Table 3-2. From these differences 

and other considerations we identified the human performance issues and their implications, 

as summarized in Table 6-1 and discussed in Section 6. 

2. Additional information is needed on the ConOps of SMRs. Much of the information on the 

operational- and HFE-aspects of SMRs that we reviewed was in the preliminary stages of 

design; it continues to evolve as the plant designs are refined and the vendors prepare for 

licensing activities. As more such details are developed, new issues may arise, whereas

some of those we discussed in Section 6 may have to be reevaluated. Therefore, we 

recommend updating the findings of this study as new information emerges. 

3. The monitoring and control of multi-unit facilities by a single operator or crew in a single 

control room is possible and is part of the ConOps for normal operations in several 

industries. However, the successful accomplishment by a single crew of multi-unit 

operations in the commercial nuclear industry is yet to be demonstrated. First, the unique 

operational demands of different types of complex systems must be addressed before we 

can formulate conclusions about multi-unit NPP operations. The special demands of one 

industrial application may limit our making generalizations to another. For example, while 

multi-unit operations are routine in the petrochemical industry, it is proving a difficult 

challenge for unmanned vehicle operations. We recommend conducting more research on 

surrogate facilities to answer questions, such as the impact of unit differences on monitoring, 
94

and to verify our findings, thereby expanding the technical basis of information pertaining to 

multi-unit control. 

4. The issues have implications for the NRC’s HFE regulations and design review guidance. 

As we discussed in Section 6 and in another report (Higgins & O’Hara, 2010), modifications 

to some HFE regulations and review guidance are likely to be needed to address SMR 

licensing reviews. While it is straightforward to identify many recommended changes, the 

substance of some of them may require additional research. For example, the integrated 

system validation for SMRs (NUREG-0711, Section 11) may need modification to reflect 

multi-unit simulation, especially for plant designs with shared systems. Hence, this may 

require research to determine specifically how to modify the guidance. While other specific 

modifications are needed, we offer two general observations: 

• First, the wording of the regulations and guidance reflects light water reactor technology. 

Since non-light water reactor technology is used in two classes of SMRs (HTGRs and 

LMRs) changes will be needed to address these designs. The Safety Function 

Monitoring issue discussed in Section 7.2 above is an example. The regulations and 

guidance is based on the functions and parameters of LWRs so that it may be changed 

to accommodate reviews of non-LWR reactors.

• Second, the regulations and guidance reflect the current ConOps in today's plants, such 

as (1) the definition of crew members and their roles and responsibilities, and (2) control 

room staffing levels. Some SMRs are likely to employ new ConOps that may not fit the 

current review-criteria.

5. The concept of operations model we developed had six dimensions: Plant mission; agents’ 

roles and responsibilities; staffing, qualifications, and training; management of normal 

operations; management of off-normal conditions and emergencies; and management of

maintenance and modifications. The model is based on recent literature, including 

standards and guidance documents used in different industries. Each dimension provided

information about the HFE aspects of the plant. We deem this model to be very useful, not 

only in discussing topics important to NPPs, but also for collecting data from surrogate 

facilities. While NUREG-0711addresses ConOps as part of the design review, the treatment 

therein is much more narrowly focused and is not addressed until HSI design. We think our 

model can play a more important role in design reviews and its consideration should begin 

much earlier in the review process, such as in HFE Program Management, to help better 

define the designer’s goal, assumptions, and constraints. We recommend including 

ConOps as part of HFE Program Management in future revisions to NUREG-0800, Chapter 

18 and NUREG-0711.

6. In addition to traditional HFE methods and tools, the development of future unmanned 

vehicle systems currently employs human performance modeling and simulation methods. 

This approach is consistent with the DoD’s overall goal of increasing the use of modeling 

and simulation methods as part of systems development (DoD, 2003). SMR designers also 

are employing the latest HFE methods and tools as well. For example, Hugo (2006) used 

human performance modeling to evaluate event timing and error rate as part of the PBMR

HFE program, as did PBMR designers in assessing the effects on task performance of 

performance-shaping factors and workload. Advances to HFE methods and tools have 

implications for HFE design reviews (O’Hara, 2010). The NRC currently is exploring ways to 

address advances in HFE methods and tools; our SMR research supports that endeavor. 
95

7. The studies we reviewed illustrated the importance of performance measures, as discussed 

in Section 5.1.4. Primary task performance measures must be carefully selected. Many 

studies noted the effects of design or operational strategies on one primary task measure,

but not another. This finding suggests that all important aspects of the operators primary 

tasks should be identified and assessed, using measures that are sensitive to the expected 

variations in performance. 

The studies also illustrate the need for comprehensive performance measures that include 

not only primary task measures, but also ones for situation awareness, workload, and trust

in automation. NUREG-0711 already identifies situation awareness and workload as 

performance measures, but not trust in automation. Parasuraman, Sheridan, and Wickens, 

(2008) argued that these cognitive measures are essential viable constructs for 

understanding and predicting human-system performance in complex systems, especially 

those employing extensive automation. Since SMR designs will rely on extensive 

automation, trust may be an important construct in SMR studies and validations. 

Unmanned vehicle studies used additional measures that offer special relevance in a multiunit system. One measure was “neglect time;” the time an operator fails to attend to one 

unit while attending to another unit. Another measure was “change detection/blindness, viz., 

failing to see large, salient changes in the environment, usually because attention is focused 

elsewhere. As the monitoring demand in multi-unit operations is expected to be large, both 

neglect and change blindness may prove significant concerns, and warrant important 

considerations for multi-unit operations.

These aspects of performance measurement are important considerations in industry and 

regulatory SMR research along with in an applicant’s design work, such as tests, 

evaluations, and integrated system validations.

In conclusion, our research provided insights into the operational and HFE aspects of SMRs 

that will support current and future safety reviews and licensing activities. At a minimum, our 

work identifies the needed research and questions about SMR design and operations that HFE 

reviewers should address. We also believe that the HFE review process, guided by NUREG0800, Chapter 18, NUREG-0711, and NUREG-0700, can accommodate the review of novel 

technology and new operational approaches using a variety of strategies until more complete, 

comprehensive review guidance becomes available. We discussed the robustness of the NRC’s 

HFE review process in Section 6.7. What is critical to an HFE reviewer in utilizing the robust 

review process is knowing the questions to ask about the design and operational characteristics 

that may impact plant safety and human performance. The results of our research provide an 

important step towards achieving this critical aspect of the HFE safety-review process. 

97

8 REFERENCES

AIAA (1992). AIAA Recommended Technical Practice - Operational Concept Document 

Preparation Guidelines. Reston, VA: American Institute of Aeronautics and Astronautics.

ANS (2010). Interim Report of the American Nuclear Society President’s Special Committee on 

Small and Medium Sized Reactor (SMR) Generic Licensing Issues. La Grange, IL: 

American Nuclear Society.

Apostolakis, G. & Jaczko, G. (2010). Use of Risk Insights to Enhance Safety Focus of Small 

Modular Reactor Reviews (Memorandum COMGEA-10-0001/ COMGEJ-10-0004).

Washington, D.C.: U.S. Nuclear Regulatory Commission.

Ball, S. et al. (2010). NRC Advanced Reactors: Modular HTGRs (LTR/NRC/2010-002). 

Washington, D.C.: U.S. Nuclear Regulatory Commission.

Barnes, M. & Jentsch, F. (2010). Human-robot Interactions in Future Military Operations. 

Farnham, Surrey, England: Ashgate.

Barnes, M., Jentsch, F., Chen, J., Haas, E. & Cosenzo, K. (2010). Soldier–Robot Teams: Six 

Years of Research. In Proceedings of the Proceedings of the Human Factors and 

Ergonomics Society 54th Annual Meeting, Santa Monica, CA: Human Factors and 

Ergonomics Society. (1493-1497).

Baxi, C, Perez, E., Shenoy, A., Kostin, V., Kodochigov, N., Vasyaev, A., Belov, S. & Golovko, V. 

(2006). Evolution of the Power Conversion Unit Design of the GT-MHR (GA–A25381). 

Washington, DC: DOE. (http://fusion.gat.com/pubs-ext/MISCONF06/A25381.pdf)

Beck, J., Garcia, C. & Pincock, L. (2010). High Temperature Gas-cooled Reactors Lessons 

Learned Applicable to the Next Generation Nuclear Plant (INL/EXT-10-19329). Washington, 

D.C.: U.S. Department of Energy.

Belles, R. et al. (2010). NRC Advanced Reactors: iPWRs (LTR/NRC/2010-004 - Proprietary). 

Washington, D.C.: U.S. Nuclear Regulatory Commission.

Burke, J. & Murphy, R. (2004). Human-robot Interaction in User Technical Search: Two Heads 

are Better than One. Robot and Human Interactive Communication, Retrieved from 

http://ieeexplore.ieee.org/xpls/abs_all.jsp?arnumber=1374778&tag=1 doi: 

10.1109/ROMAN.2004.1374778

Calhoun, G., Draper, M. & Ruff, H. (2009). Effect of Level of Automation on Unmanned Aerial 

Vehicle Routing Task. Proceedings of the Proceedings of the Human Factors and 

Ergonomics Society 53rd Annual Meeting. Santa Monica, CA: Human Factors and 

Ergonomics Society.

Chaney, R., Colt, S., Johnson, R., Wies, R., & White, G. (2004). Galena Electric Power – A

Situational Analysis. Washington DC: U.S. Department of Energy. 

(http://www.iser.uaa.alaska.edu/publications/Galena_power_draftfinal_15Dec2004.pdf)
98

Chen, J., Barnes, M., Qu, Z. & Snyder, M. (2010a). RoboLeader: An Intelligent Agent for 

Enhancing Supervisory Control of Multiple Robots (ARL-TR-5239). Aberdeen Proving 

Ground, MD: Army Research Laboratory.

Chen, J., & Barnes, M. (2010b). Supervisory Control of Robots Using RoboLeader. In 

Proceedings of the Human Factors and Ergonomics Society 54th Annual Meeting. Santa 

Monica, CA: Human Factors and Ergonomics Society.

Clayton, D. & Wood, R. (2010). The role of Instrumentation and Control Technology in Enabling 

Deployment of Small Modular Reactors. In Proceeding of the Seventh American Nuclear 

Society International Topical Meeting on Nuclear Plant Instrumentation, Control, and 

Human-Machine Interface Technologies (NPIC&HMIT 2010). La Grange Park, Illinois: 

American Nuclear Society, Inc.

Colombi, J. & Ward, J. (2010). Human Systems Integration: A Discrete Event Simulation of 

Operational Utility for Control of Multiple Small Unmanned Aerial Systems. In Proceedings

of the Human Factors and Ergonomics Society 54th Annual Meeting. Santa Monica, CA: 

Human Factors and Ergonomics Society.

Cook, M., Smallman, H., Lacson, F. & Manes,D. (2010). Situation Displays for Dynamic UAV 

Replanning: Intuitions and Performance for Display Formats. In Proceedings of the Human 

Factors and Ergonomics Society 54th Annual Meeting. Santa Monica, CA: Human Factors 

and Ergonomics Society.

Copinger, D. & Moses, D. (2004). Fort Saint Vrain Gas Cooled Reactor Operational Experience 

(NUREG/CR-6839). Washington, D.C.: U.S. Nuclear Regulatory Commission.

Crandall, J. & Cummings, M. (2007). Developing Performance Metrics for the Supervisory 

Control of Multiple Robots. In Proceedings of the HRI '07 Proceedings of the ACM/IEEE 

international conference on Human-robot interaction.

http://portal.acm.org/citation.cfm?doid=1228716.1228722 10.1145/1228716.1228722.

Cummings, M., Bruni, S., Mercier, S. & Mitchell P. (2007). Automation Architecture for Single

Operator, Multiple UAV Command and Control. The International C2 Journal, 1 (2), 1-24.

Cummings, M., & Guerlain, S. (2007). Developing Operator Capacity Estimates for Supervisory 

Control of Autonomous Vehicles. Human Factors, 49(1), 1-15.

Cummings, M. & Mitchell, P. (2005). Managing Multiple UAVs Through a Timeline Display. 

Proceedings of the Proceedings of AIAA info tech (pp. 1-13). 

http://web.mit.edu/aeroastro/labs/halab/papers/Cummings_AIAA05.pdf.

de Greef, T., Arciszewski, H. & Neerincx, M. (2010). Adaptive Automation Based on an ObjectOriented Task Model: Implementation and Evaluation in a Realistic C2 Environment. 

Journal of Cognitive Engineering and Decision Making, 4(2), 152–182.

Demick, L. (2010). Transforming the U.S. Energy Infrastructure (IN/EXT-09-17436). 

Washington, DC: U.S. Department of Energy.

De Visser, E., LeGoullon, M., Freedy, A., Freedy, E., Weltman, G. & Parasuraman. R. (2008). 

Designing an Adaptive Automation System for Human Supervision of Unmanned Vehicles: 
99

A Bridge from Theory to Practice. In Proceedings of the Human Factors and Ergonomics 

Society 52nd Annual Meeting. Santa Monica, CA: Human Factors and Ergonomics Society.

De Visser, E. & Parasuraman, R. (2007). Effects of Imperfect Automation and Task Load on 

Human Supervision of Multiple Uninhibited Vehicles. In Proceedings of the Human Factors 

and Ergonomics Society 51st Annual Meeting. Santa Monica, CA: Human Factors and 

Ergonomics Society. (pp. 1081-1085)

Dixon, S., Wickens, C., & Chang, D. (2005). Mission Control of Multiple Unmanned Aerial 

Vehicles: A Workload Analysis. Human Factors, 47, 479-48.

Dixon, S. & Wickens, C. (2006). Automation Reliability in Unmanned Aerial Vehicle Control: A 

Reliance-Compliance Model of Automation Dependence in High Workload. Human Factors, 

48 (3), 474-486.

DoD (2009). FY2009–2034 Unmanned Systems Integrated Roadmap. Washington DC: U.S. 

Department of Defense.

DoD (2005). Unmanned Aircraft System Roadmap: 2005 – 2030. Washington DC: U.S. 

Department of Defense.

DoD (2003). Modeling and Simulation (M&S) Verification, Validation, and Accreditation (DoD 

Instruction Number 5000.61). Washington DC: U.S. Department of Defense.

DoD (2000). Operational Concept Description (DI-IPSC- 81430A). Washington DC: U.S. 

Department of Defense.

DoD (1995). Software Development and Documentation Standard (MIL-STD-498). Washington 

DC: U.S. Department of Defense.

DOE (2010). Next Generation Nuclear Plant: Report to Congress. Washington, DC: U.S. 

Department of Energy.

DOE (2003). The U.S. Generation IV Implementation Strategy. Washington, D.C.: U.S. 

Department of Energy.

DOE (2002). A Technology Roadmap for Generation IV Nuclear Energy Systems. Washington, 

D.C.: U.S. Department of Energy.

DOT (2009). Systems Engineering Guidebook for Intelligent Transportation Systems. 

Washington, D.C.: U.S. Department of Transportation. See also updated web site: 

http://www.fhwa.dot.gov/cadiv/segb/

DOT (2004). Developing and Using Concept of Operations in Transportation Management 

Systems. Washington, D.C.: U.S. Department of Transportation.

Eitrheim, M., Skraaning Jr., G., Lau, N., Karlsson, T. Nihlwing, C., Hoffmann, M. & Farbrot, J. 

(2010). Staffing Strategies In Highly Automated Future Plants - Results from the 2009 

HAMMLAB Experiment (HWR 938). Halden, Norway: OECD Halden Reactor Project.
100

FAA (2007). Concept of Operations for the Next Generation Air Transportation System. 

Washington, DC: Joint Planning and Development Office. 

Fairley, R. & Thayer, R. (1977). The Concept of Operations: The Bridge from Operational 

Requirements to Technical Specifications. Annals of Software Engineering, 3, 417-432.

Flanagan, G. et al. (2010). NRC Advanced Reactors: LMRs (LTR/NRC/2010-003). 

Washington, D.C.: U.S. Nuclear Regulatory Commission.

Fleming, K. & Silady, F. (2002). A Risk Informed Defense-in-Depth Framework for Existing and 

Advanced Reactors. Reliability Engineering and System Safety, 78, 205–225.

Folds, D. & Hutto, C. (2008). Distributed Control and Collaborative Displays: Weathering the 

Change to a Network Centric Mission Environment. Presented at the DoD HFE TAG 59

Meeting , retrieved January 15, 2011 from 

http://www.hfetag.com/subtags/briefs/briefs59.html.

Grenci, T. & Haemer, R. (2010). Operations Staffing Issues Relating to SMRs. In ANS (Ed.) 

Interim Report of the American Nuclear Society President’s Special Committee on Small and 

Medium Sized Reactor (SMR) Generic Licensing Issues. La Grange, IL: American Nuclear 

Society.

Hallbert, B., Sebok, A. & Morisseau D. (2000). A Study of Control Room Staffing Levels for 

Advanced Reactors (NUREG/IA-0137). Washington, D.C.: U.S. Nuclear Regulatory 

Commission.

Heightman, A. (2009). New Software Leads to Decreased Patient Mortality. Journal of 

Emergency Medical Services, 34(12).

Higgins, J. & O’Hara, J. (2010). Evaluation of NRC Human Factors Engineering Regulations 

and Review Criteria for Use with Small Modular Reactors (BNL Technical Report No. 6862-

2-2010). Upton, NY: Brookhaven National Laboratory.

Hou, M., Kobierski, R., & Brown, M. (2007). Intelligent Adaptive Interfaces for the Control of 

Multiple UAVs. Journal of Cognitive Engineering and Decision Making, 1(3), 327-362.

Hugo, J. (2006). A Model-base Approach to the Integration of Human Factors and Systems 

Engineering. ESSA 2006 Conference, Pretoria, South Africa: CSIR.

Hugo. J. & Engela, H. (2005). Function allocation for industrial human-system interfaces. In 

Proceedings of CybErg 2005. Johannesburg, South Africa: International Ergonomics 

Association Press.

IAEA (2009). Design Features to Achieve Defense in Depth in Small and Medium Sized 

Reactors (IAEA Nuclear Energy Series Technical Report No. NP-T-2.2). Vienna, Austria: 

International Atomic Energy Agency.

IAEA (2007). Liquid Metal Cooled Reactors: Experience in Design and Operation (IAEATECDOC-1569). Vienna, Austria: International Atomic Energy Agency.
101

IAEA (2006). Status of Innovative Small and Medium Sized Reactor Designs 2005: Reactors 

with Conventional Refueling Schemes (IAEA-TECDOC-1485). Vienna, Austria: 

International Atomic Energy Agency.

IAEA (2005). Innovative Small and Medium Sized Reactors: Design Features, Safety 

Approaches and R&D trends (IAEA-TECDOC-1451). Vienna, Austria: International Atomic 

Energy Agency.

IAEA (2001). Staffing Requirements for Future Small and Medium Reactors Based on 

Operating Experience and Projections (IAEA-TECDOC-1193). Vienna, Austria: 

International Atomic Energy Agency.

IEEE (2007). IEEE Guide for Information Technology - System Definition - Concept of 

Operations (ConOps) Document (IEEE Std 1362-1998; R2007). Piscataway, NJ: IEEE.

INL (2009). NGNP Licensing Plan (PLN-3202). Washington, D.C.: U.S. Department of Energy.

Kadak, A. (2000). Modular Pebble Bed Reactor. Presentation at MIT available at

http://web.mit.edu/pebble-bed/Presentation/MITINEEL.pdf.

Kinsey, J. (2010). Identification of Priority Licensing Issues for NGNP. Paper presented at the 

Regulatory Information Conference. Washington, D.C.: U.S. Nuclear Regulatory 

Commission. (http://www.nrc.gov/public-involve/conferencesymposia/ric/slides/w12kinseyjpv.pdf)

Kohl, B., Gutsche, J. Kim, P., Sites, F. & Ochroch,E. (2007). Effect of Telemedicine on Mortality 

and Length of Stay in a University ICU. Critical Care Medicine, 35(12), 22.

Lane, L. & Davey, E. (2007). Establishing Successful Teamwork in Upset Response - Issues 

and Control Centre Impacts. In Proceedings of the Workshop on Future Control Station 

Designs and Human Performance Issues in Nuclear Power Plants (NEA/CSNI/R-2007-8).

Halden, Norway: OECD Halden Reactor Project.

Lapinsky, G., Eckenrode, R., Goodman, P. & Correia, R. (1989). A Status Report Regarding 

Industry Implementation of Safety Parameter Display System (NUREG-1342). Washington, 

D.C.: U. S. Nuclear Regulatory Commission.

Lee, J. (2006). Human Factors and Ergonomics in Automation Design. In G. Salvendy (Ed.),

Handbook of Human Factors and Ergonomics (3rd Ed.). New York, NY: John Wiley & Sons, 

Inc.

Lee, P., Wang, H, Chien, S., Lewis, S., Scerri, P., Velagapudi, P., Sycara, K. & Kane, B. (2010). 

Teams for Teams: Performance in Multi-human/Multi-robot Teams. In Proceedings of the 

Human Factors and Ergonomics Society 54th Annual Meeting, Santa Monica, CA: Human 

Factors and Ergonomics Society (pp. 438-442).

Lilly, C. & Thomas, E. (2010). Tele-ICU: Experience to Date. Journal of Intensive Care 

Medicine, 25(1), 16-22.

Maere, P., Clare, A. & Cummings, M. (2010). Assessing Operator Strategies for Adjusting 

Replan Alerts in Controlling Multiple Unmanned Vehicles. In Proceedings of the 11th 
102

IFAC/IFIP/IFORS/IEA Symposium on Analysis, Design, and Evaluation of Human-machine 

Systems, Valenciennes, France. retreived January 15, 2011 from 

http://web.mit.edu/aeroastro/labs/halab/papers/MaereClareCummings_IFACHMS2010.pdf.

Mallett, B. (2010). Presentation at the Commission Briefing on Reactor Issues - Design 

Certifications. April 6, 2010 (available at: http://www.nrc.gov/reading-rm/doccollections/commission/slides/2010/20100406/staff-20100406.pdf).

Mays, G. & Williams, Jr. (2010). Key Technical Issues Associated with SMR Policy Issues. 

Paper presented at the Regulatory Information Conference. Washington, D.C.: U.S. 

Nuclear Regulatory Commission. (http://www.nrc.gov/public-involve/conferencesymposia/ric/slides/w12maysgpv.pdf).

Miller, C., Funk, H., Wu, P., Goldman, R., Meisner, J. & Chapman, M. (2005). The PlaybookTM 

Approach to Adaptive Automation. In Proceedings of the Human Factors and Ergonomics 

Society 49th Annual Meeting. Santa Monica, CA: Human Factors and Ergonomics Society. 

Miller, C., & Parasuraman, R. (2007). Designing for Flexible Interaction Between Human and 

Automation: Delegation Interfaces for Supervisory Control. Human Factors, 49(1), 57-75.

Miller, C. & Parasuraman, R. (2003). Beyond levels of Automation: An Architecture for More 

Flexible Human-Automation Collaboration. In Proceedings of the Human Factors and 

Ergonomics Society 47th Annual Meeting. Santa Monica, CA: Human Factors and 

Ergonomics Society.

Nehme, C. & Cumming, M. (2007). An Analysis of Heterogeneity in Future Unmanned Vehicle 

Systems (HAL2007-07). Cambridge, MA: MIT.

Nehme, C., Mekdeci, B., Crandall, J. & Cumming, M. (2008). The Impact of Heterogeneity on 

Operator Performance in Future Unmanned Vehicle Systems. The International C2 Journal, 

2(2), 1-30.

NAS (2008). Review of DOE's Nuclear Energy Research and Development Program. 

Washington, D.C.: The National Academies Press.

NRC (2010). Potential Policy, Licensing, and Key Technical Issues for Small Modular Nuclear 

Reactor Designs (SECY-10-0034). Washington, D.C.: U.S. Nuclear Regulatory 

Commission. 

NRC (1983). Clarification of TMI Action Plan Requirements (NUREG-0737 and supplements). 

Washington, D.C.: U.S. Nuclear Regulatory Commission.

NRC (1981). Human Factors Acceptance Criteria for the Safety Parameter Display System

(NUREG-0835). Washington, D.C.: U. S. Nuclear Regulatory Commission.

NuScale (2010). Human Factors Engineering Program Management Plan (NP-TR-0610-290-

NP, Rev 0). Corvallis, Oregon: NuScale Power, Inc.

O'Hara, J. & Brown, W. (2002). The Effects of Interface Management Tasks on Crew 

Performance and Safety in Complex, Computer-based Systems. (NUREG/CR-6690). 

Washington, D.C.: U.S. Nuclear Regulatory Commission.
103

O'Hara, J., Brown, W., Lewis, P. & Persensky, J. (2002). Human-system Interface Design 

Review Guidelines (NUREG-0700, Rev 2). Washington, D.C.: U.S. Nuclear Regulatory

Commission.

O’Hara J., Gunther, W. & Martinez-Guridi, G. (2010). The Effects of Degraded Digital 

Instrumentation and Control Systems on Human-system Interfaces and Operator 

Performance (BNL Tech Report No. 91047-2010). Upton, NY: Brookhaven National 

Laboratory.

O’Hara, J., & Higgins, J. (2010). Human-System Interfaces to Automatic Systems: Review 

Guidance and Technical Basis (BNL Technical Report 91017-2010). Upton, NY: 

Brookhaven National Laboratory.

O'Hara, J., Higgins, J., Brown, W. & Fink, R. (2008). Human Factors Considerations with 

Respect to Emerging Technology in Nuclear Power Plants: Detailed Analyses (BNL 

Technical Report No: 79947-2008). Upton, NY: Brookhaven National Laboratory.

O'Hara, J., Higgins, J., Persensky, J., Lewis, P. & Bongarra, J. (2004). Human Factors 

Engineering Program Review Model (NUREG-0711, Rev.2). Washington, D.C.: U.S. 

Nuclear Regulatory Commission.

Parasuraman, R., Cosenzo, K. & De Visser, E. (2009). Adaptive Automation for Human 

Supervision of Multiple Uninhabited Vehicles: Effects on Change Detection, Situation 

Awareness, and Mental Workload. Military Psychology, 21(2), 270-297. 

Parasuraman, R., Galster, S., Squire, P., Furukawa, H. & Miller, C. (2005). A Flexible 

Delegation-type Interface Enhances System Performance in Human Supervision of Multiple 

Robots: Empirical Studies with RoboFlag. IEEE Transactions on Systems, Man, and 

Cybernetics—Part A: Systems and Humans, 35(4) 481-493.

Parasuraman, R., Sheridan, T. & Wickens, C. (2008). Situation Awareness, Mental Workload, 

and Trust in Automation: Viable, Empirically Supported Cognitive Engineering. Journal of 

Cognitive Engineering and Decision Making, 2(2), 140-160.

Perillo S. & Upadhyaya, B. (2010). Dynamic Modeling and Control Strategy For Multimodular 

Integral Pressurized Water Reactors. In Proceeding of the Seventh American Nuclear 

Society International Topical Meeting on Nuclear Plant Instrumentation, Control, and 

Human-Machine Interface Technologies (NPIC&HMIT 2010). La Grange Park, Illinois: 

American Nuclear Society, Inc.

Persensky, J., Szabo, A., Plott, C., Engh, T. & Barnes, A. (2005). Guidance for Assessing 

Exemption Requests from the Nuclear Power Plant Licensed Operator Staffing 

Requirements Specified in 10 CFR 50.5(m) (NUREG-1791). Washington, D.C.: U.S. 

Nuclear Regulatory Commission.

Pew, R. & Mavor, A. (2007). Human-system Integration in the System Development Process: A 

New Look. Washington, D.C.: The National Academies Press.

Plott, C., Engh, T. & Barnes, V. (2004). Technical Basis for Regulatory Guidance for Assessing 

Exemption Requests from Nuclear Power Plant Licensed Operator Staffing Requirements 
104

Specified in 10 CFR 50.54(m) (NUREG/CR-6838). Washington, D.C.: U.S. Nuclear 

Regulatory Commission.

Prinzel, L. (2003). Team-centered Perspective for Adaptive Automation Design (NASA/TM2003-212154). Hanover, MD: NASA Center for AeroSpace Information 

Reckley, W. (2009). Licensing Issues. Paper presented at the Workshop on Small- and 

Medium-sized Nuclear Reactors (SMRs). Washington, D.C.: U.S. Nuclear Regulatory 

Commission. 

(http://adamswebsearch2.nrc.gov/idmws/doccontent.dll?library=PU_ADAMS^PBNTAD01&I

D=092800497)

Roth, E., Hanson, M., Hopkins, C., Mancuso, V. & Zacharias, G. (2004). Human in the Loop 

Evaluation of a Mixed-initiative System for Planning and Control of Multiple UAV Teams. In 

Proceedings of the Human Factors and Ergonomics Society 48th Annual Meeting. Santa 

Monica, CA: Human Factors and Ergonomics Society. 

Ruff, H., Calhoun, G., Draper, M., Fontejon, J.& Guilfoos, B. (2004). Exploring Automation 

Issues in Supervisory Control of Multiple UAVs. In Proceedings of the Human Performance, 

Situation Awareness and Automation Conference, March 22-25. Daytona Beach, FL, 408-

412.

Shaw, T, Emfield, A, Garcia, A, De Visser, E, Miller, C, Parasuraman, R. & Fern, L. (2010). 

Evaluating the benefits and potential costs of automation delegation for supervisory control 

of multiple UAVs. In Proceedings of the Human Factors and Ergonomics Society 54 Annual 

Meeting, Santa Monica, CA: Human Factors and Ergonomics Society. (pp. 1498-1502).

Simons, D. & Ambinder, M. (2005). Change Blindness: Theory and Consequences. Current 

Directions in Psychological Science, 14(1), 44-48.

Smith, J. (2009). Staffing, Human Factors and Operational Issues. Paper presented at the 

Workshop on Small- and Medium-Sized Nuclear Reactors (SMRs). Washington, D.C.: U.S. 

Nuclear Regulatory Commission. 

(http://adamswebsearch2.nrc.gov/idmws/doccontent.dll?library=PU_ADAMS^PBNTAD01&I

D=092800497)

Thronesbery, C., Schreckenghost, D. & Molin, A. (2009). Concept of Operations Storyboard 

Tool. In Proceedings of the Human Factors and Ergonomics Society 53rd Annual Meeting. 

Santo Monica, CA: Human Factors and Ergonomics Society.

Tran, T., Garcia, H., Boring, R., Joe, J. & Hallbert, B. (2007). Human Factors Issues for Multimodular Reactor Units. In Proceeding of the Joint 8th IEEE HFPP /13th HPRCT. 

Piscataway, NJ: IEEE.

Vicente, K. (1999). Cognitive Work Analysis. Mahwah, NJ: Lawrence Erlbaum Associates.

Wang. J., Wang, H. & Lewis, M. (2008). Assessing Cooperation in Human Control of 

Heterogeneous Robots. In Proceedings of the ACM/IEEE International Conference on 

Human-robot Interaction. New York, NY: ACM.
105

Weaver, C., Harris, K. & Blomgren, S. (2010). Developing the Human System Interface (HSI) 

and the Supporting Instrumentation & Control (I&C) Architecture for a Multi-module Control 

Room. In Proceedings of the 7th International Topical Meeting on Nuclear Plant 

Instrumentation, Control and Human Machine Interface Technologies (NPIC&HMIT 2010). 

La Grange Park, IL: American Nuclear Society, Inc.

Wickens, C., Li, H., Santamaria, A., Sebok, A. & Sarter, N. (2010). Stages and Levels of 

Automation: An Integrated Meta-analysis. In Proceedings of the Human Factors and 

Ergonomics Society 54th Annual Meeting, Santa Monica: CA.

Wilson, T., White, J. & Whitus, B. (2003). Emerging Technologies in Instrumentation and 

Controls (NUREG/CR-6812). Washington, D.C.: U.S. Nuclear Regulatory Commission.

Wood, R., Antonescu, C., Arndt, S., Britton, C., Brown-VanHoozer, S. Calvert, J. Damiano, B., 

Easter, J., Freer, M. , Mullens, J., Neal, J., Protopopescu,V., Shaffer, R., Schryver, J., Smith, 

C. Tucker, R., Uhrig, R., Upadhyaya, B., Wetherington, G., Wilson, T., White, J. & Whitus, B. 

(2003). Emerging Technologies in Instrumentation and Controls (NUREG/CR-6812). 

Washington, D.C.: U.S. Nuclear Regulatory Commission.

Zawada, E., Herr, P., Larson, D., Fromm, R., Kapaska, D. & Erickson, D. (2009). Impact of an 

Intensive Care Unit Telemedicine Program on a Rural Health Care System. Health 

Economics, 121(3), 160-170.

Zsambok, C. & Klein, G. (1999). Naturalistic Decision Making. Mahwah, NJ: Erlbaum.

A-1

APPENDIX: CONCEPT OF OPERATIONS QUESTIONS

Section 3 describes the ConOps model we developed to support this research. This appendix 

includes the general questions formulated to address SMR ConOps, and the operations of other 

types of facilities (described in Section 4). We adapted the questions for each type of facility to 

better tailor them to their mission and processes.

Plant Mission

1. What is the overall mission or purpose of the facility?

2. Are there any secondary purposes of the facility other than safe electric power 

generation, such as hydrogen generation? 

3. What is the overall approach taken to accomplish the facilities’ purpose? How was the 

approach identified and how has it evolved? 

4. For multi-unit plants, what systems, if any, do the units share?

5. If a site is expected to have multiple units, is each independent from the others or do the 

units share common support systems?

6. What features of the design are new or quite different from current LWRs?

7. What are the predecessor plants, if any, to the design and what is their operating 

experience?

8. Are there non-nuclear facilities that operate in a similar fashion to the current design, 

such as refineries, whose operational experience is used to inform the design? 

Agents’ Roles and Responsibilities

1. What high-level functions have to be performed to accomplish the mission? 

2. What are the relative roles of personnel and automation in accomplishing these 

functions? 

3. Do personnel interact with the automation or does it perform its functions independently? 

Can operators override automation when they think it is needed? Can operators 

determine whether automation or personnel should perform a function or task? 

4. How were the relative roles of personnel and automation determined? 

Staffing, Qualifications, and Training 

1. How is the facility to be staffed? 

• What are the staff positions? 

• How many of each position are on staff at any one time? 

• What are the relative roles and responsibilities of each staff position?
A-2

2. How were staffing needs determined?

3. Are there defined qualifications for each position? 

4. How were the qualifications for each position determined? 

5. What type of training is provided for each staff position? 

6. How are training needs determined? 

7. What tools are available for training, e.g. simulators?

8. How many shifts are used and how is shift turnover managed?

Management of Normal Operations 

1. What is the concept for how the plant will be operated by personnel to accomplish all of 

its functions for normal operations, e.g., to follow its normal evolutions, such as startup, 

low power, full power, shutdown, and refueling? What are the major tasks of personnel?

2. How has the current concept of operations been determined (use of engineering 

analyses, human factors engineering, past operating experience, etc.)? How has it been 

(or will be) determined how many units an operator or crew can monitor and control? 

3. How is the control room designed to support the monitoring and control or multiple 

reactors modules, BOP systems, and secondary functions?

4. If multiple units are monitored and controlled by the same crew, do single operators 

monitor multiple reactors and their BOP systems or are monitoring responsibilities split 

between reactor and BOP? 

5. How do unit differences impact multi-unit monitoring and control?

6. What human-system interfaces (HSIs) are used, e.g., alarms, displays, controls, 

decision/job aids, communications, etc.? How will the HSI support multi-reactors 

monitoring and control? 

7. What procedures will be available to guide personnel actions? Do the procedures reflect 

multi-unit operations? Are the procedures computerized or paper-based?

8. To what degree do operators have to comply with procedures? 

9. How is the need to take action identified?

10. Do control room personnel interact with personnel at other locations? If so, what are the 

other locations and how do they interact? 

11. What aspects of normal operations may be challenging to personnel, e.g., require 

knowledge-based behavior or associated with high workload? 
A-3

Management of Off-normal Conditions and Emergencies

1. What is the concept for how off-normal conditions and emergencies are managed? 

What are the main failure events and degraded conditions and how does the crew 

respond to them? Are there emergencies that require a change in staffing?

2. What HSIs and procedures are available to support these tasks? Are there dedicated 

HSIs for handling off-normal conditions and emergencies?

3. What types of equipment checks or diagnostics are available to help ensure the quality 

of equipment operations? 

4. What type of equipment degradations and failure conditions arise?

5. How often do they impact the ability of personnel to perform their tasks?

6. When functions are degraded or lost, how do personnel recognize that such a condition 

exists? 

7. How do personnel manage degradations and failures of the instrumentation and control 

system and the control room HSIs? Are their specific procedures to deal with these 

situations?

8. What aspects of emergency operations may be challenging to personnel, e.g., require 

knowledge-based behavior or associated with high workload?

Management of Maintenance and Modifications 

1. What is the current concept for how the plant maintenance will be accomplished? Does 

plant maintenance of one unit impact other operating units?

2. How is the installation of upgrades managed? What tasks are involved?

3. What HSIs and procedures are available to support these tasks?

4. If the plant is below grade, how are maintenance activities impacted? 

5. If applicable, how are additional “units” brought on line? 




UNITED STATES 

NUCLEAR REGULATORY COMMISSION

WASHINGTON, DC 20555-0001

--------------------

OFFICIAL BUSINESS
NUREG/CR-7126 Human-Performance Issues Related to the Design and Operation 

of Small Modular Reactors