Small modular reactors | Instrumentation & control
One person, x reactors3 December 2012
One benefit proposed by vendors of small modular reactors is their ability for many to be combined into a single station. In which case, they would likely be operated by a single operator or a crew of operators in the same control room in future. This kind of control arrangement is unusual in the nuclear industry. To understand the issues human performance issues involved, US regulators are looking to glean lessons from other industries. By John O’Hara, James Higgins and Amy D’Agostino
Small modular reactors (SMRs) are a promising approach to meeting future energy needs. Although the electrical output of an individual SMR is relatively small compared to that of typical commercial nuclear plants, they can be grouped to produce as much energy as a utility demands. Furthermore, SMRs can be used for other purposes, such as producing hydrogen and generating process heat.
Many characteristics of SMRs are quite different from those of current plants and may be operated quite differently. The US Nuclear Regulatory Commission (NRC) is examining the human factors engineering (HFE) and the operational aspects of SMRs. Our main objective is to identify potential issues in human performance related to the design and operations of SMRs.
One important issue identified is the operation of multiple SMR units from a single control room and possibly by a single operator. While we reviewed information on SMR designs, the designs are not completed and all of the design and operational information is not yet available. Nor is there information on multi-unit operations as envisioned for SMRs available in operating experience. Thus we examined several non-nuclear systems where multi-unit operations are performed. Although there are important differences between SMRs and these surrogates (namely refineries, unmanned aircraft systems and tele-intensive care units), there also are similarities that afford us an opportunity to learn about the design and operation of multiple units, and the resulting demands on human performance.
Unmanned aircraft systems
Unmanned aircraft systems (UASs) consist of an unmanned aerial vehicle (UAV) and operators located in a remote control room to undertake flight and mission operations. Although some UASs are fully autonomous, most of them are flown remotely by crews of varying sizes from control rooms where the vehicle is monitored and controlled at workstations that support mission planning, navigation, aircraft control, and management systems.
Perhaps the best-known UAS is the Predator; equipped with various sensors and payloads, it is used extensively in military operations by the United States Air Force (USAF). A two-person crew (pilot and sensor operator) operates the Predator.
In 2005, the US Department of Defence (DoD) published a UAS Roadmap offering its vision of UAS operations over the next 25 years; the overall goal is to expand their use to new missions and identify the capability infrastructure needed to accomplish them. One such future direction is multiple control; that is to change the ratio of crew members to vehicles from many-to-one to one-to-many (a single person controlling multiple aircraft). In general the DoD’s goals for UASs is analogous to those of SMR designers: to reduce staffing requirements, in part, through increased automation. The DoD initiated a research programme to address the technological developments needed to change the operator-vehicle ratio, and to detail its impact on mission and human performance. The approach being taken to meet this goal may offer lessons learned for SMR operations.
A principal objective of much of the research was to investigate the size of the UAV team (that is, the number of UAVs), its impact on performance, and technologies for enabling operators and crews to manage large teams of UAVs. This is a major factor of interest to our work since team size is analogous to number of SMR units that an operator manages.
Nearly all studies found notable effects of team size. As the size of the UAV team increased, task performance declined and workload rose. It also impacted other factors such as vehicle ‘neglect’—a vehicle being underutilized or ignored—rose as the team size increased. Another important characteristic of teams is their degree of team homogeneity; generally, as the differences between the vehicles in the teams increased, it becomes more difficult for operators to manage.
Automation is deemed a key enabling technology for increasing team size. The aspects of automation examined are summarized below.
- Functions automated. The studies reviewed verified the successful application of automation to a variety of UAS functions, such as vehicle monitoring and control functions. More abstract functions, such as mission coordination (supervision), are more difficult to automate.
- Level of automation (LOA). Many studies considered the LOA; that is, the degree to which a function is automated, ranging from no automation (manually performed by personnel) to full automation (no direct personnel involvement). In general, increasing the LOA led to better task performance. However, these effects were not universal for all measures.
- Flexibility. LOA can be implemented statically or flexibly. When ‘static’ the LOA never changes. When flexible, the LOA changes based on situational considerations, such as the overall workload of personnel. Flexible LOA implementation is called adaptive automation (AA). Static LOA frequently did not significantly impact workload or situation awareness, though most studies did not evaluate SA. AA was associated with better task performance and lower workload. Increasing the automation options available to operators may have helped them manage their workload.
- Transparency. Increasing the transparency of the processes of automation proved an important factor supporting the ability of operators to understand its workings. To assure optimization of automation, communication features should be an inherent part of the HSI, allowing operators to interact with automation to better understand its behaviour.
- Reliability. In general, lower reliability led to declines in task performance, and a lower level of operator trust in the automation. Because the reliability of real-world systems is imperfect, their effect on operator- and system performance is a major consideration.
Reference  cautions against over-automation; namely, automating anything that can be is not a good strategy due to human-performance concerns associated with high degrees of automation. Determining when and how to automate is the key consideration to success. US Army Research Laboratory (ARL) researchers echoed this same consideration, stating that their experience shows that some higher levels of automation may be difficult to achieve. Reference  expressed the same concern about automating mission-planning functions that depend on decision-making, judgment, and experience. Thus, there are both technical concerns (difficulty automating a function) and human factor engineering concerns (negative effects on operators of high-levels of automation) that set constraints on the achievable crew-vehicle ratio.
Performance was also affected by task allocation between crew members. It was better when specific UAVs were assigned to specific crew members rather than shared between them. Reference  postulated that sharing diffused responsibility, leaving some vehicles underutilized (neglected); that is, each crew-member thought the other was responsible. Thus, an alternative explanation may be that, when sharing, operators were not functioning effectively as human teams, and did not clearly allocate their tasks or maintain awareness of each other’s responsibilities.
The design of the HSI is a key factor. The HSI should incorporate communication features enabling operators to better understand the automation’s process. These include:
- Providing HSI features so operators can effectively monitor multiple UAVs and gain accurate situation awareness (SA)
- Managing the workload for coordinating and controlling multiple vehicles, for example by using intelligent agents and of predefined ‘plays’
- Managing the interface management workload, because high workload can lead to operators’ disuse of automation, and can distract them, thereby impairing their performance.
UAS research also illustrated the importance of performance measures. Measures of primary task performance must be selected carefully. Many studies found effects on one performance measure but not another. Thus, important aspects of the primary task should be measured to avoid the possibility of committing a Type 2 error, that is, failing to identify significant effects when they exist.
The studies also illustrate the need for comprehensive performance measures that encompass primary task measures, and measures of situation awareness, workload, and trust. These cognitive measures were found to be viable constructs essential to understanding and predicting human-system performance in complex systems, especially those employing extensive automation .
The UAS studies suggest some additional measures, such as unit neglect time and change blindness, may be useful as well. In addition to selecting the right aspects of performance to measure, the measures should be sensitive to the expected reasonable variation in performance. Measures with restricted ranges, such as ceiling and floor effects, should be avoided because they produce misleading results.
An oil refinery comprises a series of processes that convert crude oil into different petroleum products. Many refineries are made up of multiple units. In new and modernised facilities, these units are monitored and controlled from a single central control room. We visited a refinery to observe the control room while operators were performing their tasks. We also interviewed them to obtain specific information about their approach to operations.
That plant was built in 1955 and was expanded and upgraded over the years. Its overall mission is to process crude oil into products such as gasoline, diesel, propane, and butane. It also manufactures asphalt, heating fuels, and sulphur for fertilizers. The facility accomplishes its mission through nine processes: Sulphur, Crude, Naphtha I and Naphtha II, Distillate, Coker, Gas Oil (G.O.), Alky, and Fluid Catalytic Cracker (FCC). Some of the processes have three units (for example, crude, distillate, hydrogen units, and G.O. have three units each). The units, however, are not identical.
Operations are performed in a modern, digital, centralized control room (CCR) from where operators monitor and control multiple process units with operational demands similar to those anticipated for SMRs. The processes are highly automated, so that the operating staff’s main role is to oversee them and make any needed adjustments. There also are local operators out in the plant whose main responsibility is ensuring the equipment’s reliability. Two key areas not automated are the startup and shutdown of the various units; these evolutions are performed manually, requiring additional staff to do all the needed tasks.
In the CCR, one operator, the project lead (PL), is assigned to each of the nine processes. There also is a control room supervisor and a day shift ‘bench leader’ for each process who fills in where needed. For each process, there also are three to five local personnel consisting of at least one local lead and two auxiliary operators. Figure 1 shows the layout of the control room, consisting of three ‘pods’ and nine ‘consoles’.
A console is a workstation, one for each process, and a pod is a group of connected consoles. The figure identifies which process is controlled from which console. The consoles are sit-down workstations manned by one PL; they have room for additional staff when needed.
Processes can involve up to three units and are monitored and controlled from a single console by a single PL; about 250 controls and 2000 indicators are available at the console. Workload is a key consideration in evaluating the assignment of units to PLs. For each PL, engineering analyses ensure that the workload is acceptable, and the required tasks can be successfully performed. Evaluations of task loads determined the number of controls and indicators that the PL can manage. Engineers can reassign parts of a process or secondary functions to another PL, should the workload prove too high. Facility management also brings in additional staff when they anticipate high workload, such as during startup, shutdown, or major transients.
Workstation screens display almost all of the information and controls. Each console has approximately three monitors for the distributed control system (DCS), and five to seven monitors for other purposes. The DCS is the most important I&C system; it is used to monitor and control key process parameters and identify critical alarms. Facility personnel stated that the design of the alarms is critical to operations. Each alarm must be identified carefully. The criterion determining whether a parameter should be an alarm is that it must be unique information requiring an achievable action. An alarm is considered critical when immediate action by operations is needed. The facility receives an estimated two critical alarms per shift across all nine processes. The secondary alarms, also called Console Action Plan alarms, are non-critical alarms.
When PLs monitor three units, the alarms for all three are integrated; that is, they are presented together, so that PLs only have to look at one screen to see them all. However, the information displays for each unit are separate. The two primary types of displays are process (mimic) displays, and trend displays, using fairly standard display formats for modern digital systems. The crude process, for example, contains three crude units, numbered 1, 2 and 3. Unit 1 has a small capacity, while units 2 and 3 are large capacity. Both the inputs to and the outputs from the process for each of the units differ, as do the number and sizes of their components. The PLs indicated that these differences, which show up on the screens, made it easier for them to distinguish between the units. These differences between multiple units within one process are addressed in training. Soft controls (on-screen controls), also called faceplates, are used to control the equipment.
Procedures guide personnel action. PLs must follow them and sign off upon completing a step. However, there is a formal deviation sheet if needed. The refinery undertakes an annual review of the accuracy of procedures, noting any improvements.
In summary, the lessons learned from refinery operations that are relevant to SMRs include the following.
- Operators can monitor and control multiple units, and the refinery’s operating experience supported this conclusion. Keys to making this possible include: careful analyses of workload to ensure operators are not overloaded, and automation, so operators can focus on monitoring and managing processes.
- Careful attention to designing the alarm system is essential so the number of alarms is manageable, each alarm is unique, and each is associated with an achievable action. In the refinery, alarms for different units are integrated into a single display rather than being presented separately for each unit.
- Unit differences, as depicted in the HSIs, supported operators in maintaining awareness of the status of individual units.
- Organizational changes are needed during emergencies to manage events occurring at one unit. The availability of additional staff during periods of high workload (such as startup/shutdown and to manage major off-normal conditions) is necessary for the refinery’s multi-unit operations.
Tele-intensive care units
Tele-ICUs are facilities that remotely monitor intensive-care patients and notify on-site hospital staff when conditions warrant medical intervention. While patient monitoring is clearly different from reactor monitoring, the remote monitoring of patients at multiple hospitals places demands on human performance that have some similarities with those that SMR operators may face.
The project staff visited a tele-ICU to observe control-room operations and interview staff to obtain specific information about their operations (the picture shows a different tele-ICU system). The tele-ICU has operated for over five years and provides a remote ICU monitoring control room for four hospitals.
The high-level functions that tele-ICU staff perform involve patient monitoring, condition assessment, and responding to events.
They monitor the vital signs and medications of each patient, classified into one of three categories: red (most serious), yellow, and green (least serious). This classification guides the extent of monitoring of individual patients. When an abnormal vital sign is identified, assessment of conditions requires access to the patient’s data, charts, test results, x-rays, and visual observation of the patient. For example, the tele-ICU nurse may communicate with on-site staff to check a lead on measuring equipment to determine if an abnormal heartbeat is due to a loose connection. If the facility’s staff determines that intervention is required, they need communication equipment to contact on-site staff to take necessary actions. Common information displays for the tele-ICU staff and local hospital staff support their communication.
The tele-ICU we visited has one experienced nurse (at least five years of work experience) for every 30 patients. The ideal patient-to-physician ratio still is being determined, but facility staff estimate it to be between 120 to 150 patients per physician.
The control room layout includes a workstation for each of the nurses and the doctor. Each workstation has five monitors, keyboard, mouse, camera controls, and telephone. The data displayed for each patient include: demographic data (including names of patient and their physician), vital signs (heart rate, heart rhythm, blood pressure, respiratory rate, and oxygen saturation), laboratory tests and X-rays.
Monitoring is supported by alarms and signal processing of the patient’s vital signs. Cameras and communication equipment enable the tele-ICU staff to observe patients and interact with on-site staff.
The lessons learned from tele-ICU operations that are relevant to SMRs include the following:
- Monitoring individual patients can be viewed as analogous to monitoring individual reactor units. The tele-ICU staff indicated that monitoring and intervention can be complicated by the differences between hospitals. For example, the differences between hospitals’ chart formats create higher workload and slow physician response. If SMR units monitored by the control room staff are at different sites, site differences may impose additional complications, as do different hospitals. Also, there may be variations in the design between units and/or their HSIs at one site.
- A related issue concerns differences in the I&C system when new units are brought on-line. When hospitals are brought online, new ones may have more recent versions of the patient monitoring software, entailing differences in data and data presentation between new and old hospitals. This problem may arise as new reactors are brought online. Indeed, the development of I&C systems is so rapid that reactors brought online a decade apart may have different I&C systems, different levels of data processing, and might measure different parameters.
- Organizational changes are needed during emergencies to manage events occurring at one unit. For example, when a nurse is intervening with a critical patient, a particular specialist may have to be called in, and the monitoring of less critical patients delegated to other nurses. A similar flexible adaptability to emergency events might be used in operating modular reactors.
- Some aspects of the HIS are not well-suited to monitoring multiple ‘units’; for example the tele-ICU lacks a flexible means to display simultaneously the vital information for many patients. The approach to HSI design for monitoring multiple SMR units will be a key aspect of safe operations, and may involve novel approaches to HSI design.
- HSI support is needed for monitoring multiple ‘units’. The tele-ICU gives patient criticality codes to guide where to focus monitoring attention (‘red’ patients). Alarms and signal-processing aid personnel to monitor individual parameters. HSI designs for SMRs must consider HSI support for the workload associated with monitoring multiple units.
General implications for SMRs
The three examples illustrate that monitoring and control of multi-unit facilities by a single operator or crew in a single control room is possible. However, the successful accomplishment by a single crew of multi-unit operations in the commercial nuclear industry is yet to be demonstrated.
First, the unique operational demands of different systems need to be addressed before we can formulate conclusions about multi-unit NPP operations. The special demands of one industrial application may limit our ability to generalize to another. For example, while multi-unit operations may be routine in the petrochemical industry, it is proving a difficult challenge for unmanned vehicle operations. We recommend conducting more research on surrogate systems to answer questions, such as the impact of unit differences on monitoring, and to verify our findings, thereby expanding the technical basis of information pertaining to multi-unit control.
The information obtained from these non-nuclear systems will help the NRC to better understand the issues and human performance challenges associated with multi-unit operations and to provide a technical basis, along with the other information obtained from our research, to develop guidance to support the safety review of the HFE aspects of SMRs.
|Summary: common lessons|
1. Monitoring and controlling multiple units can be accomplished by a single operator or crew in a single control room, and is part of the normal operations in refineries and tele-ICUs. The US Defence Department is developing this capability for UASs, although it is proving to be a challenge to designers.
3. The effect of unit differences (heterogeneity) on performance is unresolved. At the refinery, such differences were helpful in monitoring and distinguishing between units; while for tele-ICUs and UAS operators, differences complicated operations.
4. Automation is a key enabling technology. Concerns about over-automation and its potentially negative effects on human performance have led designers to develop more interactive and flexible approaches to automation. Adaptive automation, for example, may be valuable in assisting operators to manage the workload in supervising multiple plants. Training improves operators' understanding and use of automation.
5. Clear staffing responsibilities are defined for personnel at the refinery and tele-ICU, and are being defined for UAS staff. Allocating tasks to crew members is vital in terms of the performance of the overall team and integrated system.
6. Crew flexibility is a key to managing off-normal situations. At refineries and tele-ICUs, significant organisational changes are made to manage them. The availability of additional staff for the off-normal unit was necessary. Additional staff also were used for some transitions, such as unit startup or shutdown at the refinery. Having a way to transfer responsibilities for reactors in off-normal states to a person or team specialised in dealing with them may be beneficial to SMR operations.
7. Communication between personnel is crucial. Maintaining situation awareness during off-normal situations is easier when operators have a simple means to communicate with other personnel.
8. Designing the control room and HSI for multi-unit monitoring and control is challenging. HSIs must enable monitoring of the overall status of multiple units, and the easy retrieval of detailed information on an individual unit. The design of alarms particularly must ensure operators are aware of important disturbances, thus minimising the effects of change blindness and neglect. The organisation of information is another critical HSI consideration, for example, deciding on what information crew members need to access, both individually and as a crew, to support teamwork. HSIs also must support the transfer of operations between crew members.
9. The design for multi-unit management is aided by detailed HFE analyses of staffing and operator tasks, via task analysis, human-performance modelling, and operator-in-the-loop simulations.
John O’Hara ([email protected]) and James Higgins, Brookhaven National Laboratory, New York, 11779, USA. Amy D’Agostino, U.S. Nuclear Regulatory Commission Washington DC 20555. This article first appeared in the November 2012 issue of Nuclear Engineering International magazine.
References for â€˜One person, x reactorsâ€™, NEI November 2012
 Cummings, M., Bruni, S., Mercier, S. & Mitchell P. (2007). Automation Architecture for Single Operator, Multiple UAV Command and Control. The International C2 Journal, 1 (2), 1-24.
 Lee, P., Wang, H, Chien, S., Lewis, S., Scerri, P., Velagapudi, P., Sycara, K. & Kane, B. (2010). Teams for Teams: Performance in Multi-human/Multi-robot Teams. In Proceedings of the Human Factors and Ergonomics Society 54th Annual Meeting, Santa Monica, CA: Human Factors and Ergonomics Society.
 Parasuraman, R., Sheridan, T. & Wickens, C. (2008). Situation Awareness, Mental Workload, and Trust in Automation: Viable, Empirically Supported Cognitive Engineering. Journal of Cognitive Engineering and Decision Making, 2(2), 140-160.
Barnes, M. & Jentsch, F. (2010). Human-robot Interactions in Future Military Operations. Farnham, Surrey, England: Ashgate.
Barnes, M., Jentsch, F., Chen, J., Haas, E. & Cosenzo, K. (2010). Soldier-Robot Teams: Six Years of Research. In Proceedings of the Proceedings of the Human Factors and Ergonomics Society 54th Annual Meeting, Santa Monica, CA: Human Factors and Ergonomics Society.
Crandall, J. & Cummings, M. (2007). Developing Performance Metrics for the Supervisory Control of Multiple Robots. In Proceedings of the HRI '07 Proceedings of the ACM/IEEE international conference on Human-robot interaction. http://portal.acm.org/citation.cfm?doid=1228716.1228722 10.1145/1228716.1228722.
DoD (2005). Unmanned Aircraft System Roadmap: 2005-2030. Washington DC: U.S. Department of Defense.
Heightman, A. (2009). New Software Leads to Decreased Patient Mortality. Journal of Emergency Medical Services, 34(12).
Kohl, B., Gutsche, J. Kim, P., Sites, F. & Ochroch,E. (2007). Effect of Telemedicine on Mortality and Length of Stay in a University ICU. Critical Care Medicine, 35(12), 22.
Lilly, C. & Thomas, E. (2010). Tele-ICU: Experience to Date. Journal of Intensive Care Medicine, 25(1), 16-22.
O'Hara, J.; Higgins, J., & Pena, M. (2012). Human Factors Engineering Aspects of Small Modular Reactor Design and Operations (Draft NUREG/CR-7126). Washington, D.C.: U. S. Nuclear Regulatory Commission.
O'Hara, J., Higgins, J., Xing J. & D'Agostino, A. (2010). Human Factors Aspects of Small Modular Reactor Operations. In Proceeding of the Seventh American Nuclear Society International Topical Meeting on Nuclear Plant Instrumentation, Control, and Human-Machine Interface Technologies (NPIC&HMIT 2010). La Grange Park, Illinois: American Nuclear Society, Inc.
Parasuraman, R., Cosenzo, K. & De Visser, E. (2009). Adaptive Automation for Human Supervision of Multiple Uninhabited Vehicles: Effects on Change Detection, Situation Awareness, and Mental Workload. Military Psychology, 21(2), 270-297.
Simons, D. & Ambinder, M. (2005). Change Blindness: Theory and Consequences. Current Directions in Psychological Science, 14(1), 44-48.
Wickens, C., Li, H., Santamaria, A., Sebok, A. & Sarter, N. (2010). Stages and Levels of Automation: An Integrated Meta-analysis. In Proceedings of the Human Factors and Ergonomics Society 54th Annual Meeting, Santa Monica: CA.
Zawada, E., Herr, P., Larson, D., Fromm, R., Kapaska, D. & Erickson, D. (2009). Impact of an Intensive Care Unit Telemedicine Program on a Rural Health Care System. Health Economics, 121(3), 160-170.