ML25175A109

Revisiting Functional Requirements Analysis and Function Allocation to Support Automation Decisions in Advanced Reactor Designs (Paper)

ML25175A109
Person / Time
Issue date:	06/23/2025
From:	Natalee Green, Stephanie Morrow, Jing Xing NRC/RES/DRA, NRC/RES/DRA/HFRB
To:
References
Download: ML25175A109 (1)

Text

Revisiting Functional Requirements Analysis and Function Allocation to Support Automation Decisions in Advanced Reactor Designs Stephanie Morrow*, Jing Xing, Niav Hughes Green U.S. Nuclear Regulatory Commission, Washington D.C.

ABSTRACT Functional requirements analysis (FRA) and function allocation (FA) are human factors engineering (HFE) processes that, when appropriately integrated into system design, provide a systematic means to elucidate the roles of personnel and automation in accomplishing operational goals. FRA and FA can provide a fundamental understanding of the role of personnel in achieving safe operations.

Further, FRA and FA serve as a foundation for other key HFE elements in a design, including task analyses, human-system interface design, analysis of staffing, and operator qualifications considerations. Both FRA and FA would be required as part of advanced reactor licensing applications submitted under the proposed 10 CFR Part 53 regulation. However, utilizing the tools of FRA and FA to their full potential requires the use of methods that can support modern automation decisions, including consideration of the complexities of human-automation interaction and coordination. FRA and FA methods must evolve to account for the design features and characteristics of advanced nuclear plants, especially where those features are passive or inherent in nature. This paper discusses the challenges and considerations when applying FRA and FA methods to support automation decisions in advanced reactor designs.

Keywords: Human factors, function allocation, functional requirements analysis, automation, nuclear safety

1. INTRODUCTION Conducting functional requirements analysis (FRA) and function allocation (FA) requires multidisciplinary collaboration among such areas as system design, risk analysis, digital instrumentation and control, and human factors. This paper focuses on challenges and considerations related to human factors engineering as defined in the U.S. Nuclear Regulatory Commission (NRC) Human Factors Engineering (HFE) Program Review Model (i.e., NUREG-0711) [1]. FRA and FA are integral elements of the guidance used by the NRC to conduct HFE program reviews [1]. From a nuclear safety perspective, FRA is important for identifying what features, systems, and human actions are relied upon to accomplish overall safety goals, while FA characterizes how safety functions will be accomplished by personnel, automatic systems, or some combination thereof. We note that the term agent may be used to refer to the person or automation (or any combination thereof) that are responsible for achieving a plant function.

Both FRA and FA would be required as part of advanced reactor licensing applications submitted under the proposed 10 CFR Part 53 regulation [2]. The identification of design-specific safety functions and how they are fulfilled serves as a primary means for achieving technology-inclusive requirements within areas such as staffing, operator qualifications, and HFE. The FRA and FA processes (which are both HFE methods derived from systems engineering principles), provide an effective means to identify both how safety functions will be satisfied and how to characterize any associated operator role in doing so. FRA shows

• Stephanie.Morrow@nrc.gov

what features, systems, and human actions are relied upon to demonstrate safety (i.e., fulfill safety functions). FA then describes how safety functions are assigned to both personnel and automatic systems.

However, an important adaptation of the FA process for use under the proposed rule would be to not only describe allocations of safety functions to human action and automation, but also to identify allocations made to active safety features, passive safety features, or inherent safety characteristics. Characterizing the agents in this manner allows for a greater degree of insight into allocations that may still leave a considerable backup or defense-in-depth role for the human (e.g., manually actuating an active system that has failed to function automatically). Specifically, the proposed 10 CFR 53.730(d) would require 1) the FRA to describe how safety functions would be satisfied, and 2) the FA to describe how safety functions will be assigned to human action, automation, active safety features, passive safety features, and/or inherent safety characteristics.

The significance of FRA and FA is also reflected in NRC guidance for developing scaled HFE review plans

[3, 4]. FRA and FA are required elements of an HFE review because they provide a fundamental understanding of the role of personnel in achieving safe operations. Further, FRA and FA serve as a foundation for other key HFE elements in a design, including task analyses, human-system interface design, analysis of staffing, and operator qualifications considerations. Importantly, during the development of 10 Code of Federal Regulations (CFR) Part 53 draft rule, the NRC staff identified that both FRA and FA could play a unique role in transitioning from a historically prescriptive regulatory framework to a flexible, performance-based one. Specifically, an FRA and FA (of the modified scope previously discussed), in conjunction with a concept of operations (ConOps)1, can provide an effective means of facilitating NRC staff reviewers understanding of new reactor technologies, novel operational approaches, and any related human roles in achieving plant safety [2].

However, the authors recognize that utilizing the tools of FRA and FA to their full potential requires the use of methods that can support modern automation decisions, including consideration of the complexities of human-automation interaction and coordination. The application of automation has expanded significantly in the past 50 years, with designers now facing many different automation types and task interactions. FRA and FA methods must evolve to account for the design features and characteristics of advanced nuclear plants, especially where those features are passive or inherent in nature. To this end, this paper discusses the challenges and considerations when applying FRA and FA methods to support automation decisions in advanced reactor designs.

2. OBJECTIVES OF FUNCTIONAL REQUIREMENTS ANALYSIS AND FUNCTION ALLOCATION The general objective of FRA and FA, as described in NUREG-0711 [1], is to ensure that functions necessary to accomplish plant goals are sufficiently defined and analyzed so that the allocation of functions to personnel and machine resources can take advantage of human and machine strengths and avoid human and machine limitations. These processes are inextricably linked as they collectively provide a framework for determining the roles and responsibilities of personnel and automation.

The first step is to define the high-level functions that must be accomplished to meet the plants goals and desired performance. High-level functions can be broken down into the actions that are necessary to 1 In addition to requiring FRA/FA, an advanced reactor ConOps submittal would be expected to address the following areas: (1) plant goals; (2) the roles and responsibilities of personnel and automation (or any combination thereof) that are responsible for completing plant functions; (3) staffing, qualifications, and training; (4) the management of normal operations; (5) the management of off-normal conditions and emergencies; (6) the management of maintenance and modifications; and (7) the management of tests, inspections, and surveillances.

perform that function, whether those actions are performed by personnel or automation. Then designers allocate functions to personnel, automation, or a combination of both, to meet the functional requirements.

The process of defining and allocating functions includes the following general elements, while the details of the elements may vary in different methods or guidance:

1) Define the overall design goals, objectives, and requirements.

2) Identify the functions that are required to achieve the high-level goals and break down into actions, processes, systems, and components needed to achieve each function.

3) Allocate the functions to personnel and automatic systems.

4) Evaluate the allocation decisions and iterate as necessary throughout design process.

5) Verify and validate the analysis and allocation.

The NRCs focus for regulatory decision-making is on those functions important to safety. An example of a high-level safety goal might be preventing the release of radioactive material to the environment, and a typical safety function related to that goal is reactivity control. Functions are often accomplished through some combination of lower-level actions that involve specific plant systems and components, such as reactor trip. The assignment of control actions to humans and machines to accomplish a reactor trip should be documented in the function allocation. The review criteria in NUREG-0711 are used by the NRC staff when evaluating the HFE programs of applicants. For FRA and FA, the review criteria2 specify that an applicant should:

1) Use a structured, documented methodology reflecting HFE principles.

2) Perform FRA and FA iteratively to keep it current for use as a design basis.

3) Describe the plants functional hierarchy, including goals, functions, processes, and systems.

4) Identify requirements for each high-level function related to:

the purpose of the function and conditions indicating it is needed, parameters indicating it is available, operating, achieving its purpose, and parameters indicating that it can or should be terminated.

5) Allocate functions to a level of automation (e.g., from manual to fully automatic) and identify the technical bases for the allocations.

6) Consider not only the primary allocations to personnel (those functions for which personnel have the primary responsibility), but also their responsibilities to monitor automatic functions, detect degradations and failures, and to assume manual control when necessary.

7) Describe the overall role of personnel by considering all functions allocated to them.

8) Verify that the FRA and FA accomplish the following:

all the high-level functions needed to achieve safe operation and the requirements of each high-level function are identified, and the allocation of functions to humans and automatic systems assures a role for personnel that takes advantage of human strengths and avoids human limitations.

3. CHALLENGES WITH APPLYING FRA AND FA IN PRACTICE The NRC staff recognize that plant safety functions and how they are fulfilled are shaped by a combination of technology and operational concepts. FRA and FA can provide an effective means to identify both how safety functions will be satisfied and how to characterize human roles in doing so, provided that the methodologies are sufficient to capture the dynamic interplay between humans and automation in varying operational contexts. Advanced technologies, novel uses of automation, and greater complexity in human-2 Note that the review criteria have been edited for the sake of brevity in this paper. Please refer to NUREG-0711, Rev.

3 for the criteria in their entirety.

machine integration challenge FA methods that were mostly developed when analog technologies were dominant. For example, research related to adaptive automation has specifically noted that FA methodologies have not kept up with the state of automation technology [5]. This section discusses some challenges in FRA and FA.

3.1. Allocation Decisions are Rarely Binary Traditional approaches to FA, such as those based on Fitts List from 1951 [6], present allocation decisions as a simple classification of human or machine. Modern applications of automation are much more interactive, often involving cooperation and sharing of responsibilities between humans and automatic systems. Increasingly, levels of automation are being implemented on a continuum from manual operation to automatic operation, wherein the relative responsibilities of humans and automation can vary [7].

Adaptive automation approaches, for example, change the degree of automation dynamically based on situational considerations, such as poor task performance or high operator workload [5]. An action performed by an automatic system may include a secondary allocation to a human agent to satisfy a backup role by virtue of it involving an active system (e.g., in the case of a failure of an automatic reactor protection system to initiate a reactor trip, a human may need to manually initiate a reactor trip in order to shut down the reactor and control reactivity) [2]. As these examples illustrate, allocations may be dynamic or shared between human and machine agents, depending upon the operational context and specific attributes of the system involved.

3.2. Advanced Technologies Increase the Integration of Human and Automatic Systems Traditional FA methods focus on execution of control actions, which can be clearly defined from the FRA.

With advanced digital systems, humans and systems are integrated such that the boundaries between human actions and automatic actions become blurry. Automation may serve to assist operators with detection and monitoring, understanding and evaluating, or decision-making tasks such that their actions are tightly coupled. For example, a computerized procedure system (CPS) might automate some aspects of information acquisition and evaluation functions, such as place-keeping or the evaluation of specified parameters, thereby reducing the attention and effort required for accessing the information [7, 8]. The CPS serves as an operator aid bringing information to the attention of the operator or independently providing an evaluation of parameters specified in the procedure and recommending next steps based on that evaluation.

Clearly allocating the actions required by a function exclusively to personnel or automatic systems in such situations can be a challenge. Even functions determined to be fully automated may still involve human actions in monitoring automatic systems. Essentially, every function is achieved through the integrated efforts of human and automatic systems. As technology evolves and becomes more sophisticated, the delineation between agents can be unclear and challenging to address with traditional approaches to FA.

3.3. Important Human Actions May be Outside the Control Room Proposed 10 CFR 53.730(a) states that the plant design must reflect state-of-the-art human factors principles for safe and reliable performance in all locations that human activities are expected for performing or supporting the continued availability of plant safety or emergency response functions [2].

Thus, consideration of human factors is no longer limited to important human actions for controlling and operating a reactor from a traditional control room. For instance, the functions of some passive systems may not require human actions. However, monitoring, testing, inspecting, and maintaining those passive systems are important activities to plant integrity and safety. Even when activities are performed by automated systems, humans may still be involved in monitoring, diagnosing, and making decisions to ensure system safety. Identifying when human actions are important to ensuring safety functions, regardless of where they occur, will be a critical component to an applicants human factors engineering program.

3.4. Automation Can Increase Cognitive Distance Between Personnel and Plant Systems Advanced digital technologies rely on plant data systems that process and integrate data from abundant sensors all over the plant. The technologies provide personnel a tremendous amount of information about the reactor, but at the same time, place cognitive distance between operational personnel and the reactors structures, systems, and components. Human actions may not directly control and operate the reactors.

Instead, the human agent works with the digital systems which respond to reactor states. It becomes challenging to clearly specify all the entry, exit conditions, and authorities of the actions performed by personnel and automatic systems to ensure plant safety under all circumstances. Without the clear specification and understanding of how the automatic system works, personnel may take actions too early, too late, or under the wrong conditions when interacting with automatic systems. Moreover, lack of clear specifications and understanding may lead to undesirable human actions on the automatic system.

3.5. Functions May Involve Passive Safety Features and Inherent Safety Characteristics A report by Sandia National Laboratory on Human Factors Considerations for Automating Microreactors

[9] noted that both passive safety features and inherent safety characteristics were expected to heavily influence advanced reactor design and operations. In particular, reliance upon passive safety systems would generally result in a design not being dependent upon the intervention of a human or automation in order to achieve a safe state. While certain causes of failure for active systems would not normally exist for a passive system (such as a loss of electrical power), passive features may still be subject to other failures, such as those which are mechanical or structural in nature. Thus, they are also still subject to potential human error. The implication of this is that human and automated tasks would, within the context of an allocation to a passive safety system, tend to serve only as a secondary check for the purposes of fulfilling the needed function. Inherent safety characteristics are distinct from passive safety features in that they have an even higher degree of comparative reliability. An example of such a characteristic is a fuel temperature coefficient of reactivity that tends to result in reactor power being self-limiting in response to a transient. Provided that limitations are adequately accounted for, the reliability of inherent safety characteristics may even be considered to be nearly absolute under appropriate circumstances [9].

3.6. Allocations Can Create Mismatches Between Authority and Responsibility Authority refers to who is assigned the execution of a function in an operational sense, whereas responsibility indicates who will be held responsible in an organizational and legal sense [10]. Even in cases where automation is capable of assuming authority for executing a function, the human operator may still be responsible for the outcome of its actions. Woods refers to this as the responsibility-authority doublebind [11]. This is especially relevant in safety-critical industries like nuclear, where licensed operators are vested with a great deal of responsibility for safety. Potential mismatches between authority and responsibility can be a challenge when making allocation decisions because there is a risk of impacting an operators ability to maintain the situation awareness needed to perform monitoring or backup actions.

If automation cannot perform safely and reliably in all contexts, humans must monitor the automation to maintain responsibility for the function.

3.7. Limited Risk Information May be Available for New Designs The FRA process should include consideration of the functional requirements to maintain the reactor in a safe state under all conditions, including normal, abnormal, emergency, and design-basis risk scenarios.

Existing plants have Probabilistic Risk Assessment (PRA) models that can provide inputs into risk scenarios

for FRA. However, FRA and FA for new designs starts well before PRA models are fully developed. Thus, it is challenging for the FRA process to be based on thorough risk scenario identification.

Further, the FA process should include assessment of the risk associated with actions allocated to human and automatic systems, and the risk associated with human-system integration. Yet, most FA methods do not include explicit elements of how to assess the reliability of human actions. Some methods mention the use of PRA models. However, as stated previously, PRA models may be unavailable or incomplete when initial allocation decisions are made for new designs. The FRA and FA processes may be based on initial safety analyses as described in the risk-informed performance-based framework and iterate as more risk information becomes available.

3.8. Validation is Difficult in Early Design Stages FRA and FA are iterative processes that increase in detail and specificity as a design progresses. This makes it difficult to validate allocation decisions in early design stages. At the same time, allocation challenges identified later in the design may be difficult to address because they would result in costly hardware or software changes. As a result, actions may be relegated to human control in a sub-optimal manner.

Further, comprehensive, performance-based validation efforts are often not possible in early design stages.

The nuclear industry has traditionally relied on integrated system validation (ISV), where a full-scope high-fidelity simulator, trained operating crew, and operating procedures are available. Such resources may not be available or feasible for advanced reactors, particularly in the design stage.

Relying on the ISV to validate and modify FA for new designs imposes challenges to vendors and regulators. If ISV demonstrates that certain human actions should be reallocated to systems, the modifications may require changing software or even hardware of the systems. That may increase the burden of regulatory review in many fields beyond HFE (e.g., digital instrumentation and control, cybersecurity, probabilistic risk assessment).

4. CONSIDERATIONS FOR MODERNIZING FRA AND FA This section describes some considerations for modernizing approaches to FRA and FA based on the challenges described above. We approach this from the perspective of questions that might arise in a regulatory review of FRA and FA under the 10 CFR Part 53 framework for a new advanced reactor design.

This section is not intended to propose a new FRA or FA method for industry use, nor should it be construed as new guidance endorsed by the NRC.

4.1. Considerations for FRA/FA Basis and Principles The first review criteria for FRA and FA in NUREG-0711 states that applicants should use a structured, documented methodology reflecting HFE principles. Many FA methods have adapted the traditional Humans are better at and Machines are better at (HABA-MABA) approach to establish a basis or set of principles for allocating functions to humans or automatic systems, based on the original Fitts List from 1951 [6]. Some of the actions from Fitts List have changed as digital technologies have evolved, yet the underly principle of HABA-MABA still presents allocation as an either/or decision. Further, the criteria for better at can be ambiguous, especially with the increased integration between human and machine actions.

Some methods use optimization as the primary principle for allocating functions to achieve both productivity and safety. The methodology in NUREG/CR-3331 includes a proposed probabilistic metric

for optimization [12]. However, the optimization strategy may not fully account for what is optimal in different operating contexts or the level of interdependence between functions.

Another strategy employed in FRA/FA is often referred to as automation-first, where functions are initially allocated to automatic systems and only assigned to humans if they cannot be performed safely and reliably by automatic systems. This strategy has been criticized for its potential to leave the human operator with leftover functions that are a poor fit for human capabilities [13].

Roth and colleagues [14] advocate for an integrated approach to FA that leverages four key activities:

1) Analyzing operational demands and work requirements

2) Exploring alternative distributions of work across human and machine agents

3) Examining interdependencies between human and autonomous technologies

4) Exploring function allocation tradeoffs in the broader system design In a review paper on FA, Feigh and Pritchett [10] identify a set of basic principles for effective FA:

Each agent must be allocated functions that it is capable of performing Each agent must be capable of performing its collective set of functions The FA must be realized with reasonable teamwork The FA must support the dynamics of the work The FA should be the result of deliberate design decisions Regardless of the approach, the basis or principles used to make allocation decisions should always consider the safety goals of the design. From a regulatory perspective, questions pertaining to the adequacy of the basis or principles include:

Does the basis consider the strengths and limitations of human and machine agents?

Are there established criteria against which to make allocation decisions?

Does the basis consider interdependences between humans and automatic systems?

Is there an established process for iteration and reexamination of allocation decisions and any associated tradeoffs?

4.2. Considerations for Scope of FRA/FA Due to the complex nature of the assignment of functions among human, automation, and passive and inherent safety features, defining the scope of what is included in the FRA/FA process will be an important step for advanced reactor designs. The scope of FRA/FA may also address how the process will be iterated through design development, operation, and decommissioning. New inputs may become available as new designs evolve and acquire more detail. Inputs may also change as modifications to the original design are considered. Questions to explore pertaining the adequacy of the scope of FRA/FA include:

Does the scope address structures, systems, and components classified as safety-related and non-safety-related-requiring-special-treatment (NSRST) [2]?

Does the scope include all important human actions to meet safety goals, including actions beyond the main control room?

Does the scope clearly identify inputs to the FRA and FA, and the assumptions and limitations of those inputs?

Does the scope address how the FRA and FA will be kept current through design development and when modifications are considered?

4.3. Considerations for Specifying Functional Requirements The objective of FRA is to identify the high-level functions that are required to achieve the plant goals, characterize the actions required to accomplish those high-level functions, and then specify the associated human and system performance characteristics. Safety functions include functions needed to prevent or mitigate the consequences of accidents that could pose undue risk to public health and safety [1]. Some considerations when reviewing FRA include:

Does the FRA include all actions important to plant safety, consistent with the defined scope?

Does the FRA address the role of passive safety features and inherent safety characteristics in accomplishing safety functions?

Does the FRA provide detail regarding human and system performance characteristics, such as detecting and monitoring information, understanding and diagnosing a situation, planning and making decisions, and execution or implementation of actions?

Does the FRA specify the safety characteristics of the actions, such as consequences of failure of the action, dependency of the action on other actions, time frame allowing for recovery if the action is performed incorrectly or not performed?

4.4. Considerations for Allocating Functions Given that advanced technologies are more likely to integrate activities performed by personnel and automatic systems, the practice of allocating functions becomes more of a distribution of the actions or activities of a function to personnel and automatic systems. Thus, allocating is not only assigning actions to personnel and systems, but also determining all the actions, authorities, and responsibilities of both personnel and the automatic system in achieving a high-level function. Further, the distribution of personnel and system actions may change across operating conditions. Some considerations when reviewing the allocation of functions include:

Does the allocation specify the actions, authorities, and responsibilities required for both personnel and systems under the range of operating conditions and risk scenarios as defined in the scope?

If an action is primarily allocated to automatic systems, are there any interactions, responsibilities, or authorities associated with personnel?

Do personnel need to monitor automatic actions, understand automatic actions, take over or shut down automatic actions under certain circumstances?

Do personnel need to take actions to correct deviations or abnormal behaviors of automatic actions?

Do personnel have the authority to start, turn off, or bypass automatic actions?

If an action is primarily allocated to human agents, are there any interactions, responsibilities, or authorities associated with automatic systems?

Are automatic systems needed to assist the human in accomplishing the action?

What are the automatic systems responsibilities for supporting the human action?

What are the logic specifications regarding human and system interaction?

What are personnels responsibilities for supervising or monitoring the systems to which the function or action is dependent on?

Does the allocation consider the overall role of personnel, including the potential for interdependencies or interference, such that personnel would not be capable of performing all functions as allocated?

4.5. Considerations for FRA/FA Evaluation and Validation As noted earlier in this paper, validating FRA and FA can be challenging in early design stages. Further, novel designs may not have a wealth of operating experience upon which to base allocation decisions. It is likely that the evaluation and validation of FRA and FA will be a staged, iterative process that is dependent on the information and resources available at the time. Some considerations when reviewing evaluations and validations of FRA and FA include:

Does the outcome of the FA specify the conditions under which the allocation is evaluated as acceptable, the reliability evaluation result, and any uncertainties in the evaluation?

Does the evaluation establish reliability criteria for automatic actions, human actions, and human-system integration?

Has the FA outcome been evaluated for system and human reliability, including human-system integration reliability?

Does the evaluation consider the range of risk scenarios identified in the safety analysis?

Does the evaluation consider performance influencing factors that can challenge human performance (e.g., scenario familiarity, information reliability and completeness, task complexity, transparency of the automation systems, environmental factors, physical demands, physical or mental fatigue, etc.)?

5.

SUMMARY

Under the proposed 10 CFR Part 53 rule, advanced reactor licensing reviews would be risk-informed and performance-based [2]. Having a clear understanding of an applicants FRA and FA can be an asset in supporting appropriate, efficient, risk-informed, and performance-based decisions by the staff during the review of advanced reactor applications. Advanced technologies present unique challenges and considerations that may not be fully addressed by traditional approaches to FRA and FA. This calls for modern approaches based on principles that address the distribution of functions among human and machine agents across a full spectrum of levels of automation, and the associated interactions and interdependencies between humans and automation. This paper outlines some of the key challenges that should be addressed by FRA and FA methods applied to advanced technologies, and considerations for performing technical reviews of FRA and FA. In preparation for advanced reactor licensing applications, NRC-sponsored research efforts are underway to further explore principles and practices for applying FRA and FA and determine whether updates are needed to human factors review guidance for advanced reactor licensing applications.

6. ACKNOWLEDGMENTS The authors would like to acknowledge the technical contributions of Jesse Seymour to the formation of this paper, input and reviews provided by Dr. David Desaulniers, Dr. Brian Green, and Stephen Fleger of the U.S. Nuclear Regulatory Commission, as well as the work of Dr. John OHara of the Brookhaven National Laboratory, in the development of material discussed within this paper.

This paper was prepared as an account of work sponsored by an agency of the U.S. Government. Neither the U.S. Government nor any agency thereof, nor any employee, makes any warranty, expressed or implied, or assumes any legal liability or responsibility for any third party's use, or the results of such use, of any information, apparatus, product, or process disclosed in this publication, or represents that its use by such third party would not infringe privately owned rights.

7. REFERENCES

1. J. OHara, J. Higgins, S. Fleger, & P. Pieringer, Human Factors Engineering Program Review Model (NUREG-0711, Revision 3), U.S. NRC, Washington DC, United States, U.S. NRC Agencywide Document Access and Management System (ADAMS) Accession No. ML12324A013 (2012).

2. Nuclear Regulatory Commission (NRC), Risk-Informed, Technology-Inclusive Regulatory Framework for Advanced Reactors [proposed 10 CFR Part 53 rule], Federal Register, 89 (221) p.p.

86918-87128, (2024).

3. J. OHara, S. Fleger, D. Desaulniers, B. Green, J. Seymour, & A. D'Agostino, Development of HFE Review Guidance for Advanced Reactors (Report No. F0028-04), Brookhaven National Laboratory, Upton NY, United States, ADAMS Accession No. ML21287A088 (2021).

4. NRC, Draft Interim Staff Guidance: Development of Scalable Human Factors Engineering Review Plans (DRO-ISG-2023-03), U.S. NRC, Washington D.C., United States, ADAMS Accession No. ML22272A051 (2023).

5. J. OHara, & J. Higgins, Adaptive Automation: Current Status and Challenges (RIL 2020-05), p. 63, U.S. NRC, Washington DC, United States, ADAMS Accession No. ML20176A199 (2020).

6. P. M. Fitts, Human engineering for an effective air-navigation and traffic-control system, (1951).

7. J. OHara, & S. Fleger, Human-System Interface Design Review Guidelines (NUREG-0700, Rev. 3),

U.S. Nuclear Regulatory Commission, Washington, D.C., ADAMS Accession No. ML20162A214 (2020).

8. C. Taylor, M. Hildebrandt, R. McDonald, & N. Hughes, Operator Response to Failures of a Computerised Procedure System: Results from a Training Simulator Study, Halden Work Report No.

1198, Institute for Energy Technology, Halden, Norway (2017).

9. Sandia National Laboratory, Human Factors Considerations for Automating Microreactors, (SAND-2020-5635), pp. 10 and 30-31, ADAMS Accession No. ML20175A117 (2020).

10. K. M. Feigh, & A. R. Pritchett, Requirements for effective function allocation: A critical review, Jo Journal of Cognitive Engineering and Decision Making, 8(1), 23-32 (2014).

11. D. Woods, Cognitive technologies: The design of joint human-machine cognitive systems., AI Magazine, 6(4), 86-92 (1985).

12. R. Pulliam, H. Price, J. Bongarra, C. Sawyer, & R. Kisner, A Methodology for Allocating Nuclear Power Plant Control Nuclear to Human or Automatic Control (NUREG/CR-3331), U.S. NRC, Washington D.C., United States, ADAMS Accession No. ML20024E954 (1983).

13. Pritchett, A. R., Kim, S. Y., & Feigh, K. M. (2014). Measuring human-automation function allocation. Journal of Cognitive Engineering and Decision Making, 8(1), 52-77.

14. E. M. Roth, C. Sushereba, L. G. Militello, J. Diiulio, & K. Ernst, "Function allocation considerations in the era of human autonomy teaming," Journal of Cognitive Engineering and Decision Making 13(4),

pp. 199-220 (2019).