## 2 FRAM and Decision Ladder Models' Development
### FRAM Models  
The FRAM model for severe accident management of NPPs is shown in Figure 3. We used the FRAM Model Visualizer tool [41] to create the model and the aspects' names were hidden for presentation clarity. We observed 14 functions related to managing severe accidents of NPPs, listed in Table 1. In the following, we discuss the main insights from the FRAM model, i.e., (1) important functions with a higher number of aspects, (2) high workload function with a lack of SAMG content, (3) model development using the work-as-imagined concept, (4) absence of model instantiation, and (5) the FRAM model limitations. **(1) Important functions with a higher number of aspects. ** Provided the analysts possess the domain knowledge and consistent granularity in creating the FRAM model, the number of connections of a function shows its relative importance or complexity. In our model, functions with a high number of connections are: 'F.2 Perform control guideline (select mitigation strategy)', 'F.7 Decide whether to implement the mitigation strategy', and 'F.11 Identify and evaluate the devices/facilities recovery measures'. F.2 and F.7 are both main decision-making activities in the model (F.11 is discussed next). F.2 selects a \begin{table}
\begin{tabular}{c c c c} \hline \hline
**No** & **Function Name** & **No** & **Function Name** \\ \hline F.1 & Secure power & F.8 & \begin{tabular}{c} Decide the measures/methods to \\ perform mitigation strategy \\ \end{tabular} \\ F.2 & Perform control guideline (select mitigation strategy) & F.9 & \begin{tabular}{c} Instruct for plant recovery measures \\ \end{tabular} \\ F.3 & Monitor power plant’s condition & F.10 & \begin{tabular}{c} Evaluate the results of mitigation \\ strategy implementation \\ \end{tabular} \\ F.4 & Identify the available & F.11 & Identify and evaluate the \\  & measures/methods & \begin{tabular}{c} devices/facilities recovery measures \\ \end{tabular} \\ F.5 & Identify the impacts of & \begin{tabular}{c} Identify and evaluate the \\ measures to mitigate the occurred \\ negative impacts \\ \end{tabular} \\ F.6 & \
\begin{tabular}{c} Evaluate the possible negative \\ impacts from mitigation strategy \\ \end{tabular} & F.13 & Evaluate the recovery measures \\ F.7 & Decide whether to implement the &
\begin{tabular}{c} F.14 \\ \end{tabular} & Evaluate the alternative strategies \\ \hline \hline \end{tabular}
\end{table} 
Table 1: List of functions from FRAM Modeling Results. Figure 3: FRAM model of severe accident management of NPPs. The functions related to mitigation strategy execution are marked in a blue border. mitigation strategy among available strategies (in our reference SAMG, there are eight mitigation strategies) based on the current safety variables. After a certain strategy is chosen, the operators carefully examine the execution method and estimate the impacts of the strategy implementation on the accident. Then, the operators have the option to either proceed or cancel the strategy execution, as in F.7. As the main decision functions in severe accident management, we expect F.2 and F.7 to be performed cautiously by referring to a higher volume of information compared to the remaining functions. This indication can be well captured in the FRAM model. **(2) High workload function with lack of SAMG content. ** We found a function containing a high workload, cognitively and physically, but it has minimum description in the SAMG content. This function is the recovery measures taken after the operators decided not to perform the mitigation strategy, namely, F.11 Identify and evaluate the devices/facilities recovery measures'. Two occasions may trigger this function, both refer to the two reasons the operators chose not to perform the mitigation strategy: (1) when there are no available measures/methods to carry out the mitigation strategy and (2) if the estimated negative impacts happened, they would not be able to be mitigated.