## 2 FRAM and Decision Ladder Models' Development
### Decision ladder Models
However, we cannot apply the same analysis to F.10 and this shall be explained in the decision ladder model limitations. Moreover, recalling the analysis in the FRAM model, F.2 and F.7 are the main decision functions. Our analysis shows that in the decision ladder model, these main decision functions are reflected in the inclusion of the 'Goals' state. However, an exception to this analysis is applied for 'F.1 Secure power', which also covers the 'Goals' state but neither main decision functions nor identified as high workload functions. The reason is that F.1 is an independent, yet important, task from the central tasks of severe accident mitigation (the 'Goals' in F.1 is to secure power and the 'Chosen Goals' is the selected power supply strategy). **(4) The 'Execute' activity of the decision ladder model. ** Our decision ladder model has three 'execute' activities. 'F.1 Secure power' is an independent and supporting function that has to be performed during severe accident management, thus it has to be executed. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Activity** & **Knowledge** & **Description** & & **Prompts** & \
\begin{tabular}{c} **Information Requirements** \\ **(Duplicates Removed)** \\ \end{tabular} \\ \hline \multirow{4}{*}{Activation} & \multirow{4}{*}{ALERT} & \multirow{4}{*}{
\begin{tabular}{c} Entering severe \\ accident situation \\ \end{tabular} } & - & Has severe accident & - & Severe accident’s entry \\  & & & occurred? & & condition \\  & & & - & Are the severe variables & - & List of severe variables \\  & & & & exceed the thresholds? & - & List of severe variables’ \\  & & & - & Has the mitigation & - & threshold \\  & & & & strategy carried out? & - & Decision whether to \\  & & & & - & What is the status of the & \\  & & & & power supply? & \\  & & & - & What is the status of the & - & Power supply status \\  & & & & safety variables and & - & List of safety variables \\  & & & severe variables? & - & List of safety variables’ \\  & & & plant’s condition & - & What is the status of the & threshold \\  & & & & pressurizer manway and & - & Pressurizer manway \\  & & & & RV head? & status \\  & & & & - & How is the progress of & - & RV head status \\  & & & mitigation strategy & & \\  & & & implementation? & & \\  & & & & - & Which mitigation & - \\  & & & strategy should be & - & Power plant’s operation \\ Identify state & SYSTEM STATE & Select mitigation & & performed based on & - \\  & & strategy & current power plant & - & Severe accident \\  & & condition and control & & mitigation control \\  & & & strategy? & & strategy \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Information requirements elicitation from the mapped decision ladder. The other two functions, 'F.9 Instruct for plant recovery measures' and 'F.11 Identify and evaluate the devices/facilities recovery measures' are the two outcomes from considering the mitigation strategies, namely, choosing to perform the mitigation strategy (execute in F.9) or choosing not to perform the mitigation strategy and proceed with recovering the devices/facilities (execute in F.11). Through this analysis, our decision ladder model captures the key outcomes of severe accident mitigation, that is, to carry out a mitigation strategy or not. **(5) Linear progression without shortcuts. ** Our decision ladder model shows linear progression without shortcuts, even though shortcuts are supported and usually the source of insights in the analysis of decision-making. Shortcuts are taken by experts based on their domain-specific experiences [43]. Severe accidents in commercial NPPs took place three times and the causes of the accidents were all different. Thus, the assumption that the unfamiliar and infrequent events of severe accidents are outside of the operators' expertise [27], however experienced they are in the NPP normal operations domain, is acceptable. The operators shall follow the linear information-processing steps upon performing severe accident mitigation. **(6) Decision ladder model limitations.