## 2 FRAM and Decision Ladder Models' Development
### FRAM Models
F.11 implies these tasks: analyze why the devices/facilities were not available, identify how to fix or return them to available status, analyze why the negative impacts cannot be mitigated, identify how to recover the methods required to mitigate the negative impacts, evaluate the priority of the repair/recovery works based on the current workload, arrange the repair/recovery workflow (when and who), and finally, instruct and carry out the repair/recovery of the devices/facilities. The content in SAMG fails to capture the complexity of F.11, thus, we took a more detailed analysis of this function. By using FRAM modeling, we were able to represent the workload of F.11 through a high number of connections (refer to the previous finding). Four evaluation functions carried out at the latter part of SAMG also imply a high cognitive workload, they are: F.10 Evaluate the results of mitigation strategy implementation', F.12 Identify and evaluate the measures to mitigate the occurred negative impacts', F.13 Evaluate the recovery measures', and F.14 Evaluate the alternative strategies'. The high cognitive load is caused by the lack of details about the acceptable performance range or evaluation timing/schedule; only the target performances are given in the guidelines. The operators have to decide when to start and end the evaluation period, as well as the acceptable performance range. Additionally, F.10 entails the decision of whether to repeat the same strategy, while F.12, F.13, and F.14 involve whether to instruct the implementation of a certain recovery measure or an alternative strategy. **(3) Model development using the work-as-imagined concept. ** FRAM modeling principles do not require a predetermined or sequential order of functions, but rather encourage capturing the dynamic connections between functions as they occur in the real operation conditions (work-as-done, WAD), especially considering FRAM was initially developed for retrospective analysis. In our study, creating the FRAM model based on the WAD concept means modeling the already occurred severe accidents. While such analysis might be useful, it is not a suitable approach to our current prospective study. To match our intention of developing the information requirements for managing severe accidents, instead, we modeled using the work-as-imagined (WAI) concept, in particular by referring to the content of SAMG. The explicit information in SAMG is included in the model and the analysts searched and added supplementary information whenever required. Moreover, SAMG's content is highly related to a certain NPP. The target NPP of our SAMG has not experienced any severe accidents, adding to our limitations to observe and develop the model based on WAD. **(4) Absence of model instantiation. ** We created one FRAM model for our study, without any instantiated version. System modeling methods usually proceed with model instantiation after creating the baseline model. In the case of FRAM for accident analysis, after modeling the work domain as a baseline model, it is instantiated to represent the specific accident scenario of interest. Or the analyst may create a baseline FRAM model from the WAI concept and instantiate it based on the WAD concept. The WAD-based accident model is then compared with the WAI-based version to analyze how the event unfolds and how to prevent it in the future. Presently we are not analyzing accidents, thus, we did not feel the need to instantiate the model. We included all the possible management scenarios, as mentioned in SAMG, in our FRAM model. The model that we created, however, can be used as a meta-model to analyze each mitigation strategy separately. **(5) FRAM model limitations. ** In our reference SAMG, there are two monitoring tasks for two sets of variables: safety variables and severe risk variables. Both sets of variables are monitored continuously and simultaneously, with higher priority given to the severe risk variables.