ML23237B258

From kanterella
Jump to navigation Jump to search
Nuclear Regulatory Commission Vendor Inspection Report of Ansys Corporation 99902113/2023201, Notice of Violations, and Notice of Nonconformances
ML23237B258
Person / Time
Site: 99902113
Issue date: 09/07/2023
From: Kerri Kavanagh
NRC/NRR/DRO/IQVB
To: Collard G
ANSYS
References
EPID I-2023-201-0002 IR 2023201
Download: ML23237B258 (29)


Text

Guylene Collard Director of Quality Assurance Ansys Corporation 2600 Ansys Drive Canonsburg, PA 15317

SUBJECT:

NUCLEAR REGULATORY COMMISSION VENDOR INSPECTION REPORT OF ANSYS CORPORATION NO. 99902113/2023-201, NOTICE OF VIOLATIONS, AND NOTICE OF NONCONFORMANCES

Dear Ms. Collard:

On June 26 - 30, 2023, the U.S. Nuclear Regulatory Commission (NRC) staff conducted an inspection at the Ansys Corporation (hereafter referred to as Ansys) facilities in Canonsburg, PA. The purpose of this limited-scope routine inspection was to assess Ansys compliance with provisions of Title 10 of the Code of Federal Regulations (10 CFR) Part 21, Reporting of Defects and Noncompliance, and selected portions of Appendix B, Quality Assurance Program Criteria for Nuclear Power Plants and Fuel Reprocessing Plants, to 10 CFR Part 50, Domestic Licensing of Production and Utilization Facilities.

This inspection specifically evaluated Ansys implementation of the quality activities associated with design verification and engineering simulation software products used for safety-related applications for US Nuclear Power Plants. The enclosed report presents the results of the inspection. This NRC inspection report does not constitute NRC endorsement of Ansys overall quality assurance (QA) or 10 CFR Part 21 program. The NRC inspection team discussed the preliminary inspection findings with you at the conclusion of the on-site portion of the inspection. A final exit briefing was conducted virtually with you on August 3, 2023.

Based on the results of this inspection, the NRC has determined that two Severity Level IV violations of NRC requirements occurred. The NRC evaluated the violation in accordance with the agencys Enforcement Policy, which is available on the NRCs Web site at http://www.nrc.gov/about-nrc/regulatory/enforcement/enforce-pol.html.

The enclosed Notice of Violation (NOV) cites the two violations, and the subject inspection report details the circumstances surround the violations. Violation 99902113/2023-201-01 cites Ansys for failing to adopt appropriate procedures to evaluate deviations to determine whether the deviation could lead to a substantial safety hazard, as required by 10 CFR Part 21.21(a)(1). Violation 99902113/2023-201-02 cites Ansys for failing to inform its customers or purchasers within five working days of determining that Ansys does not have the capability to perform an evaluation of a deviation to determine if a defect exists, as required by 10 CFR 21.21(a)(2).

You are required to respond to this letter and to follow the instructions specified in the enclosed NOV when preparing your response. In your response to the enclosed NOV, Ansys should September 7, 2023

G. Collard 2

document the results of the extent of condition review for the two findings and determine if there are any effects on other safety-related components. If you have additional information that you believe the NRC should consider, you may provide it in your response to the NOV. The NRCs review of your response to the NOV also will determine if further enforcement action is necessary to ensure compliance with regulatory requirements.

In addition, during this inspection, the NRC inspection team found that the implementation of your QA program did not meet certain regulatory requirements contractually imposed on you by NRC licensees. Specifically, the NRC inspection team determined that Ansys was not fully implementing its QA program in the area of Criterion II, Quality Assurance Program, and Criterion XVI, Corrective Action, of Appendix B to 10 CFR Part 50. The specific findings and references to the pertinent requirements are identified in the enclosures to this letter. In response to the enclosed notice of nonconformance (NON), Ansys should document the results of the extent of condition review for this finding and determine if there are any effects on safety-related components.

Please provide a written statement or explanation within 30 days of this letter in accordance with the instructions specified in the enclosed NOV and NON. We will consider extending the response time if you show good cause for us to do so.

In accordance with 10 CFR 2.390, Public inspections, exemptions, requests for withholding, of the NRC's "Rules of Practice," a copy of this letter, its enclosure(s), and your response will be made available electronically for public inspection in the NRC Public Document Room or from the NRCs document system (ADAMS), accessible at http://www.nrc.gov/reading-rm/adams.html. To the extent possible, your response, (if applicable), should not include any personal privacy, proprietary, or safeguards information (SGI) so that it can be made available to the public without redaction. If personal privacy or proprietary information is necessary to provide an acceptable response, then please provide a bracketed copy of your response that identifies the information that should be protected and a redacted copy of your response that deletes such information. If you request that such material is withheld from public disclosure, you must specifically identify the portions of your response that you seek to have withheld and provide in detail the bases for your claim (e.g., explain why the disclosure of information will create an unwarranted invasion of personal privacy or provide the information required by 10 CFR 2.390(b) to support a request for withholding confidential commercial or financial information).

G. Collard 3

If safeguards information is necessary to provide an acceptable response, please provide the level of protection described in 10 CFR 73.21, Protection of safeguards information:

performance requirements.

Sincerely, Kerri Kavanagh, Chief Quality Assurance Vendor Inspection Branch Division of Reactor Oversight Office of Nuclear Reactor Regulation Docket No.: 99902113 EPID No.:

I-2023-201-0002

Enclosures:

1. Notice of Violation
2. Notice of Nonconformance
3. Inspection Report No. 99902113/2023-201 and Attachment Signed by Kavanagh, Kerri on 09/07/23

ML23237B258 NRR-106 OFFICE NRR/DRO/IQVB NRR/DRO/IQVB NRR/DRO/IQVB NAME DZhang AKeim RRomero DATE 8/28/2023 8/29//2023 8/28/2023 OFFICE NRR/DRO/IRAB NRR/DRO/IQVB NRR/DRO/IQVB NAME BHughes KKavanagh DATE 8/29/2023 9/7/2023 NOTICE OF VIOLATION Ansys Corporation Docket No. 99902113 2600 Ansys Dr.

Report No. 2023-201 Canonsburg, PA 15317 Based on the results of a U.S. Nuclear Regulatory Commission (NRC) inspection conducted at the Ansys Corporations (hereafter referred to as Ansys) facility in Canonsburg, PA from June 26, 2023, through June 30, 2023, two violations of NRC requirements were identified. In accordance with the NRCs Enforcement Policy, violations are listed below:

A. Section 21.21, Notification of failure to comply or existence of a defect and its evaluation, of Title 10 of the Code of Federal Regulations (10 CFR) Part 21, paragraph (a)(1) requires, in part, that Each individual, corporation, partnership, dedicating entity, or other entity subject to the regulations in this part shall adopt appropriate procedures to evaluate deviations and failures to comply to identify defects and failures to comply associated with substantial safety hazards as soon as practicable. 10 CFR 21.3 defines a deviation as a departure from the technical requirements included in a procurement document, or specified in early site permit information, a standard design certification or standard design approval.

Ansys procedure, QP-21, 10 CFR 21 Reporting Responsibilities, Revision 8, Section 2, states, in part, that Ansys Inc. is in no position to determine how or if its software products were used in designing or analyzing safety-related components. Hence it is not feasible to evaluate whether a particular deviation or failure could create a substantial safety hazard. Such evaluations are to be performed by Ansys Inc. customers to determine whether deviations are reportable defectsSince by definition Ansys Inc.

cannot determine if a defect exists due to an error in Ansys, Inc. products, reporting of defects only applies to knowledge we may have obtained from our customers usage.

Ansys Inc. informs all licensees with QA service agreements of Class 3 Errors (hidden issues) according to [QP-20]...

Ansys procedure QP-20, Error Notification System, Revision 8, defines Class 3 errors as an error which allows the program execution to complete and yield results that may be wrong but not easily identifiable as incorrect.

Contrary to the above, as of June 30, 2023, Ansys failed to adopt appropriate procedures to evaluate deviations and failures to comply and identify defects as soon as practicable.

Specifically, Ansys implementing procedure for 10 CFR Part 21 only requires reporting of Class 3 errors to purchasers of its products in lieu of reporting any departures from technical requirements included in a procurement document, per the definition of a deviation in 10 CFR 21.3. As a result, Ansys failed to perform an adequate evaluation of a deviation in its products to determine a defect exists, or notify Ansys customers of all deviations (e.g., non-class 3 errors) so that they may evaluate the deviations, pursuant to § 21.21(a).

2 This issue has been identified as Violation 99902113/2023-201-01.

This is a Severity Level IV violation (Section 6.9.d of the NRC Enforcement Policy).

B. Section 21.21, Notification of failure to comply or existence of a defect and its evaluation, of 10 CFR Part 21, paragraph (b) states, in part, that If the deviation or failure to comply is discovered by a supplier of basic components, or services associated with basic components, and the supplier determines that it does not have the capability to perform the evaluation to determine if a defect exists, then the supplier must inform the purchasers or affected licensees within five working days of this determination so that the purchasers or affected licensees may evaluate the deviation or failure to comply.

As of June 30, 2023, Ansys, a supplier of software products for safety-related applications, failed to inform its customers or purchasers within five working days of determining that Ansys does not have the capability to perform an evaluation of a deviation to determine if a defect exists. Specifically, Class 3 error reports 2022-013, 2022-016, 2022-108, and 2023-059, were sent to Ansys customers 21 to 65 days from Ansys classification of these errors as Class 3.

This issue has been identified as Violation 99902113/2023-201-02.

This is a Severity Level IV violation (Section 6.9.d of the NRC Enforcement Policy).

Under the provisions of 10 CFR Part 2.201, Notice of Violation, Ansys is hereby required to submit a written statement or explanation to the U.S. Nuclear Regulatory Commission, ATTN:

Document Control Desk, Washington, DC 20555-0001, with a copy to the Chief, Quality Assurance and Vendor Inspection Branch, Division of Reactor Oversight, Office of Nuclear Reactor Regulation, within 30 days of the date of the letter transmitting this notice of violation.

This reply should be clearly marked as a Reply to a Notice of Violation and should include (1) the reason for the violation or, if contested, the basis for disputing the violation or severity level, (2) the corrective steps that have been taken and the results achieved, (3) the corrective steps that will be taken, and (4) the date when full compliance will be achieved. Your response may reference or include previous docketed correspondence if the correspondence adequately addresses the required response. Where good cause is shown, the NRC will consider extending the response time.

If you contest this enforcement action, provide a copy of your response, with the basis for your denial, to the Director, Office of Enforcement, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001.

Because your response will be made available electronically for public inspection in the NRC Public Document Room or from the NRCs Agencywide Documents Access and Management System, which is accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html, to the extent possible it should not include any personal privacy, proprietary, or Safeguards Information (SGI) so that the agency can make it available to the public without redaction. If personal privacy or proprietary information is necessary to provide an acceptable response, then please provide a bracketed copy of your response that identifies the information that should be protected and a redacted copy of your response that deletes such information.

3 If you request that such material be withheld, you must specifically identify the portions of your response that you seek to have withheld and provide in detail the bases for your claim of withholding (e.g., explain why the disclosure of information would create an unwarranted invasion of personal privacy or provide the information required by 10 CFR 2.390(b) to support a request for withholding confidential commercial or financial information). If SGI is necessary to provide an acceptable response, please provide the level of protection described in 10 CFR 73.21, Protection of Safeguards Information: Performance Requirements.

Dated this X day of September 2023 NOTICE OF NONCONFORMANCE Ansys Corporation Docket No. 99902113 2600 Ansys Drive Report No. 2023-201 Canonsburg, PA 15317 Based on the results of a U.S. Nuclear Regulatory Commission (NRC) inspection conducted at the Ansys Corporations (hereafter referred to as Ansys) facility in Canonsburg, PA from June 26, 2023, through June 30, 2023, Ansys did not conduct certain activities in accordance with NRC requirements that were contractually imposed on Ansys by its customers or NRC licensees:

A. Criterion II, Quality Assurance Program, of Appendix B to Title 10 of the Code of Federal Regulations (10 CFR) Part 50 requires the establishment of a quality assurance program which complies with the requirements of [Appendix B to 10 CFR Part 50]. This program shall be documented by written policies, procedures, or instructions and shall be carried out in accordance with those policies, procedures, or instructions.

Purchase Order (PO) 0043107, dated December 16, 2022, and PO 127765523, dated December 1, 2022, required Ansys to meet Appendix B of 10 CFR Part 50 in procurement of Ansys software products and services.

Contrary to the above, as of June 30, 2023, Ansys failed to establish a quality assurance program that met the applicable provisions of Appendix B to 10 CFR Part 50 specified in POs 0043107 and 127765523 for the procurement of Ansys software products and services. Specifically, Ansys Quality Manual, Revision 17 failed to document the policies, procedures, and instructions of a quality assurance program which complies with the appropriate provisions of Appendix B. Specifically:

Ansys Quality Manual and its referenced documents do not include provisions for ensuring that measures are established to assure that applicable regulatory requirements and the design basis for those Ansys products that Appendix B to 10 CFR Part 50 applies to are correctly translated into specifications. The Ansys Quality Manual and referenced procedures do not provide consistent definitions of what constitutes design specifications or requirements. Ansys Quality Manual and referenced procedures do not have provisions to establish controls for traceability from specifications and requirements to software design and code. Details for this example are provided in Section 3 of this inspection report.

Ansys Quality Manual does not include provisions for establishing measures for the selection and review for suitability of application of materials, parts, equipment, and processes that are essential to the safety-related functions of the structures, systems and components and establishment of provisions to assure that purchased material, equipment, and services conform to the procurement documents, when applied to the use of third party software. Third party software includes open source and freeware software integrated into Ansys products. Details of this example are provided in Sections 3 and 4 of this inspection report.

2

Ansys Quality Manual does not include provisions for ensuring activities affecting quality are prescribed by documented instructions, procedures, or drawings, of a type appropriate to the circumstances and are accomplished in accordance with these instructions, procedures, or drawings. Ansys Quality Manual references specific policies, procedures, and work instructions, but does not specify the adherence to these documents for accomplishing specific requirements within the Quality Manual. In addition, instructions, procedures, or drawings do not specify appropriate quantitative or qualitative acceptance criteria for determining that important activities have been satisfactorily accomplished. Examples are provided in the Section 3 of this inspection report.

Ansys Quality Manual and its referenced procedures do not include requirements for the prompt identification and resolution of conditions adverse to quality. Specifically, Ansys Quality Manual and procedure QP-14, Corrective and Preventive Actions, Revision 12, do not specify that conditions adverse to quality must be promptly identified and corrected.

This issue has been identified as Nonconformance 99902113/2023-201-03.

B. Criterion XVI, Corrective Action, of Appendix B to 10 CFR Part 50 requires that Measures shall be established to assure that conditions adverse to quality, such as failures, malfunctions, deficiencies, deviations, defective material and equipment, and nonconformances are promptly identified and corrected.

QP-14, Corrective and Preventive Actions, Revision 12, Section 7.1, states, The Quality System Management Representative or Business Unit designee assigns the corrective action request to the responsible process owner(s) or functional manager(s) for investigation. This individual is responsible for determining the cause of the problem, evaluating its impact on related items or activities, and proposing actions to contain, correct and prevent recurrences as appropriate.

Contrary to the above, Ansys failed to correct conditions adverse to quality.

Specifically, Ansys closed Corrective Action Reports (CAR) 742, and implemented corrective actions in CAR 759, without adequately correcting the conditions adverse to quality identified in these CARs.

This issue has been identified as Nonconformance 99902113/2023-201-04.

Please provide a written statement or explanation to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, DC 20555-0001, with a copy to the Chief, Quality Assurance and Vendor Inspection Branch, Division of Reactor Oversight, Office of Nuclear Reactor Regulation, within 30 days of the date of the letter transmitting this Notice of Nonconformance. This reply should be clearly marked as a Reply to a Notice of Nonconformance and should include for each noncompliance: (1) the reason for the noncompliance or, if contested, the basis for disputing the noncompliance; (2) the corrective steps that have been taken and the results achieved; (3) the corrective steps that will be taken to avoid further noncompliance; and (4) the date when the corrective action will be completed. Where good cause is shown, the NRC will consider extending the response time.

3 In accordance with the requirements of 10 CFR 2.390, Public inspections, exemptions, requests for withholding, of the NRCs Rule of Practice, your response will be made available electronically for public inspection in the NRC Public Document Room or from the NRCs document system (ADAMS), accessible from the NRC Web site at http://www.nrc.gov/reading-rm/adams.html. To the extent possible, it should not include any personal privacy, proprietary, or safeguards information so that it can be made available to the public without redaction.

If personal privacy or proprietary information is necessary to provide an acceptable response, then please provide a bracketed copy of your response that identifies the information that should be protected and a redacted copy of your response that deletes such information. If you request withholding of such material, you must specifically identify the portions of your response that you seek to have withheld and provide in detail the bases for your claim of withholding (e.g., explain why the disclosure of information will create an unwarranted invasion of personal privacy or provide the information required by 10 CFR 2.390(b) to support a request for withholding confidential commercial or financial information). If safeguards information is necessary to provide an acceptable response, please provide the level of protection described in 10 CFR 73.21.

Dated this X day of September 2023.

U.S. NUCLEAR REGULATORY COMMISSION OFFICE OF NUCLEAR REACTOR REGULATION DIVISION OF REACTOR OVERSIGHT VENDOR INSPECTION REPORT Docket No.:

99902113 Report No.:

99902113/2023-201 Vendor:

Ansys Corporation Guylene Collard Guylene.Collard@ansys.com Nuclear Industry Activity:

Ansys Corporation supplies and supports safety-related software products used for design verification and engineering simulation by the commercial nuclear industry.

Inspection Dates:

June 26 - 30, 2023 Vendor Location:

2600 Ansys Blvd.

Canonsburg, PA 15317 Inspection Team Leader:

Deanna Zhang NRR/DRO/IQVB Inspectors:

Andrea Kiem NRR/DRO/IQVB Rebecca Romero NRR/DRO/IQVB, trainee Joseph Lokos NRR/DRO/IQVB, trainee Approved by:

Kerri Kavanagh, Chief Quality Assurance and Vendor Inspection Branch Division of Reactor Oversight Office of Nuclear Reactor Regulation

2 EXECUTIVE

SUMMARY

Ansys Corporation 99902113/2023-201 The U.S. Nuclear Regulatory Commission (NRC) staff conducted a reactive vendor inspection at the Ansys Corporations (hereafter referred to as Ansys) facility in Canonsburg, PA, to verify it had implemented an adequate quality assurance (QA) program that complies with the requirements of Appendix B, Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants, to Title 10 of the Code of Federal Regulations (10 CFR) Part 50, Domestic Licensing of Production and Utilization Facilities, and 10 CFR Part 21, Reporting of Defects and Noncompliance. The NRC inspection team conducted this inspection on-site from June 26 - 30, 2023.

This technically-focused inspection specifically evaluated Ansys implementation of its QA and 10 CFR Part 21 programs as applied to the design, development, and testing activities for software used in safety-related applications at U.S. nuclear power plants.

The following regulations served as the bases for the NRC inspection:

Appendix B to 10 CFR Part 50

10 CFR Part 21 During this inspection, the NRC inspection team implemented Inspection Procedure (IP) 43002, Routine Inspections of Nuclear Vendors, dated February 10, 2023; IP 36100, Inspection of 10 CFR Part 21 and Programs for Reporting of Defects and Noncompliance, dated February 10, 2023; and IP 35710, Quality Assurance Inspection of Software used in Nuclear Applications, dated January 30, 2018.

The results of this inspection are summarized below.

10 CFR Part 21 The NRC inspection team issued Violations 99902113/2023-201-01 and 99902113/2023-201-

02. Violation 99902113/2023-201-01 cites Ansys failure to adopt appropriate procedures to evaluate deviations and failures to comply and identify defects as soon as practicable.

Specifically, Ansys implementing procedure for 10 CFR Part 21 did not contain accurate criteria for the evaluation of deviations to determine whether defects exist as required by 10 CFR 21.21(a)(1). Violation 99902113/2023-201-02 cites Ansys failure to notify affected purchasers within five working days of determining that Ansys did not have a capability for evaluating a deviation to determine if a defect exists, as required by 10 CFR 21.21(b).

3 Quality Assurance Program The NRC inspection team issued Notice of Nonconformance (NON) 99902113/2023-201-03.

NON 99902113/2023-201-03 cites Ansys failure to establish a quality assurance program that met the applicable provisions of Appendix B to 10 CFR Part 50. Specifically, Ansys Quality Manual, Revision 17 and its referenced procedures failed to document the policies, procedures, and instructions of a quality assurance program which complies with the appropriate provisions of Appendix B.

Nonconforming Materials, Parts, or Components and Corrective Actions The NRC inspection team issued NON 99902113/2023-201-04. NON 99902113/2023-201-04 cites Ansys failure to implement the regulatory requirements of Criterion XVI of Appendix B to 10 CFR Part 50. Ansys failed to assure that conditions adverse to quality such as failures, malfunctions, deficiencies, deviations, defective material and equipment and nonconformances are promptly identified and corrected. Specifically, Ansys closed Corrective Action Report (CAR) 742, and implemented the corrective actions in CAR 759, without adequately correcting the conditions adverse to quality identified in these CARs.

Other Inspection Areas Based on the limited sample of documents reviewed and activities observed, the NRC inspection team determined that Ansys is implementing its internal audits program in accordance with the applicable regulatory requirements of Appendix B to 10 CFR Part 50. No findings of significance were identified in these areas.

4 REPORT DETAILS 1.

10 CFR Part 21 Program a.

Inspection Scope The U.S. Nuclear Regulatory Commission (NRC) inspection team reviewed Ansys Corporation (hereafter referred to as Ansys) policies and implementing procedures that govern the implementation of its Title 10 of the Code of Federal Regulations (10 CFR) Part 21, Reporting of Defects and Noncompliance, program to verify compliance with the regulatory requirements. The NRC inspection team also evaluated the 10 CFR Part 21 postings and a sample of purchase orders (POs) from Ansys customers to verify compliance with the requirements of 10 CFR 21.21, Notification of Failure to Comply or Existence of a Defect and its Evaluation, and 10 CFR 21.31, Procurement Documents. The NRC inspection team observed that Ansys does not procure safety-related items. The NRC inspection team also verified that Ansys nonconformance and corrective action procedures provide a link to the 10 CFR Part 21 program.

The NRC inspection team also discussed the 10 CFR Part 21 program with Ansys management and technical staff. The attachment to this inspection report lists the documents reviewed and personnel interviewed by the NRC inspection team.

b.

Observations and Findings The NRC inspection team reviewed Ansys 10 CFR Part 21 implementing procedure, QP-21, 10 CFR 21 Reporting Responsibilities, Revision 8, and observed that the procedure did not contain adequate criteria to evaluate deviations to determine whether they could lead to a defect, as required by 10 CFR 21.21(a). Specifically, QP-21 states that Ansys does not have the ability to determine if a deviation exists since it is not aware of how customers may have used any Ansys software in any safety-related application. In lieu of Ansys performing an evaluation of a deviation to determine whether a defect exists, QP-21, states that Class 3 errors in Ansys software products are communicated to users per Ansys procedure, QP-20, Error Notification System in order for Ansys customers to evaluate whether non-obvious errors in Ansys products may have impacted their use of the software for any safety-related application. QP-20, Revision 8, defines Class 3 errors as an error which allows the program execution to complete and yield results that may be wrong but not easily identifiable as incorrect. Although QP-21 references the definition of a deviation per 10 CFR Part 21, the NRC inspection team observed that QP-21 limits Ansys identification and customer notification of deviations to Class 3 errors, which is inconsistent with the definition of deviation per 10 CFR 21.3 (e.g., Class 1 and 2 errors are not considered deviations).

As a result, Ansys failed to perform an adequate evaluation of deviations in its products to determine if a defect exists or notify Ansys customers of all deviations (e.g., non-class 3 errors) so that they may evaluate the deviations, pursuant to § 21.21(a). This issue is cited as Violation 99902113/2023-201-01.

The NRC inspection team observed that Ansys failed to inform its customers or purchasers within five working days of determining that Ansys does not have the capability to perform an evaluation of a deviation to determine if a defect exists. Specifically, Class 3 error reports 2022-013, 2022-016, 2022-108, and 2023-059, were sent to Ansys customers 21 to 65

5 days from Ansys classification of these errors as Class 3, which is beyond the requirements of five working days, as required by 10 CFR 21.21(b). The NRC inspection team observed that an attributing factor for this issue is inadequate criteria for notifying customers within QP-21 and QP-20. Specifically:

QP-21 does not provide criteria for the time limit to report to Ansys customers once a Class 3 error is identified.

QP-20 allows for 60 days to complete a Class 3 error report after it is determined that an error is classified as Class 3. QP-20, Section 7.1.3, states, in part that, Corporate Quality oversees that class 3 reports are created and signed off by the business units within 60 days from [C]lass 3 classification to comply with [10 CFR Part 21] and expedites [C]lass 3 reports that are not created within 30 days from their assignment for investigation. QP-20, Section 7.1.1, states, in part that, Ansys issues [Class 3] reportsto comply with [10 CFR Part 21] requirements for the communication of problems that may significantly affect a nuclear power plant in the US. It is the responsibility of the product user in receipt of a [C]lass 3 report to evaluate if the Class 3 defect could create a substantial safety hazard and therefore need to report to the [NRC]

Since Ansys will, in all cases, defer to its customer in evaluating a Class 3 error to determine whether the error (i.e., deviation) could lead to a substantial safety hazard, the NRC inspection team determined that the time limit of 60 days in QP-20 to provide a report of the Class 3 error to customers is in violation of 10 CFR 21.21(b). This issue is cited as Violation 99902113/2023-201-02.

c.

Conclusion The NRC inspection team identified two violations (99902113/2023-201-01 and 99902113/2023-201-02) associated with Ansys failure to implement the regulatory requirements of 10 CFR Part 21. Violation 99902113/2023-201-01 cites Ansys for failing to have adequate procedures to evaluate deviations and failures to comply to identify defects and failures to comply associated with substantial safety hazards. Violation 99902113/2023-201-02 cites Ansys for failing to inform its customers or purchasers within five working days of determining that it does not have the capability to perform an evaluation of a deviation that Ansys discovered to determine if a defect exists.

2.

Quality Assurance Program a.

Inspection Scope The NRC inspection team reviewed Ansys policies and implementing procedures that govern the establishment and execution of Ansys quality assurance program to verify compliance with the requirements of Criterion II, Quality Assurance Program, of Appendix B, Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants, to 10 CFR Part 50, Domestic Licensing of Production and Utilization Facilities.

The NRC inspection team reviewed Ansys Quality Manual, Revision 17, and its referenced procedures to verify that Ansys QA program identifies items and activities to which it applies, are documented by written policies, procedures, or instructions, and meets the requirements of Appendix B to 10 CFR Part 50. In addition, the NRC inspection team

6 reviewed the training policies and procedures for indoctrination and training of personnel performing activities affecting quality and selected a sample of the training records from Ansys personnel to verify that that these personnel have completed the requisite training.

Additionally, the NRC inspection team discussed Ansys QA program and organizational structure with Ansys management and technical staff. The attachment to this inspection report lists the documents reviewed and personnel interviewed by the NRC inspection team.

b.

Observations and Findings The NRC inspection team reviewed a select sample of purchase orders (POs) from Ansys customers for the procurement of safety-related software. The NRC inspection team observed that the requirements from these POs were not met by Ansys in the implementation of its QA program. Specifically, PO 0043107, dated December 16, 2022, and PO 127765523, dated December 1, 2022, required Ansys to meet Appendix B of 10 CFR Part 50 in procurement of Ansys software products and services. However, Ansys failed to establish a QA program that met the applicable provisions of Appendix B to 10 CFR Part 50 specified in POs 0043107 and 127765523 for the procurement of Ansys software products and services. Specifically, Ansys Quality Manual, Revision 17 failed to document the policies, procedures, and instructions of a quality assurance program which complies with the appropriate provisions of Appendix B. For example:

(1) Ansys Quality Manual and its referenced documents do not include provisions for ensuring that measures are established to assure that applicable regulatory requirements and the design basis for those Ansys products that Appendix B to 10 CFR Part 50 applies to are correctly translated into specifications. Specifically, Ansys Quality Manual and referenced procedures do not provide consistent definitions of what constitutes design specifications or requirements. Ansys Quality Manual and referenced procedures do not have provisions to establish controls for traceability from specifications and requirements to software design and code. The NRC inspection team could not trace the requirements from the software products procured in POs 0043107 and 127765523 to the software code implementing these requirements and testing to validate the requirements because the software development process within Ansys did not allow of vertical forward traceability. Details for this example are provided in Section 3 of this inspection report.

(2) Ansys Quality Manual does not include provisions for establishing measures for the selection and review for suitability of application of materials, parts, equipment, and processes that are essential to the safety-related functions of the structures, systems and components and establishment of provisions to assure that purchased material, equipment, and services conform to the procurement documents, when applied to the use of third party software. Third party software includes procured commercial software, open source software, and freeware integrated into Ansys products. Details of this example are provided in Sections 3 and 4 of this inspection report.

(3) Ansys Quality Manual does not include provisions for ensuring activities affecting quality are prescribed by documented instructions, procedures, or drawings, of a type appropriate to the circumstances and are accomplished in accordance with these instructions, procedures, or drawings. Ansys Quality Manual references specific policies, procedures, and work instructions, but does not specify the adherence to these documents for accomplishing specific requirements within the Quality Manual. In

7 addition, instructions, procedures, or drawings do not specify appropriate quantitative or qualitative acceptance criteria for determining that important activities have been satisfactorily accomplished. Examples are provided in the Section 3 of this inspection report.

(4) Ansys Quality Manual does not include requirements for the prompt identification and resolution of conditions adverse to quality. Specifically, Ansys Quality Manual and procedure QP-14, Corrective and Preventive Actions, Revision 12, do not specify that conditions adverse to quality must be promptly identified and corrected.

This issue has been identified as Nonconformance 99902113/2023-201-03.

c.

Conclusion The NRC inspection team issued Nonconformance 99902113/2023-201-03 in association with Ansys failure to implement the regulatory requirements in Criterion II of Appendix B to 10 CFR Part 50. Nonconformance 99902113/2023-201-03 cites Ansys for failing to establish a QA program in compliance with Appendix B to 10 CFR Part 50, as required by purchasers of Ansys software products.

3.

Design Control a.

Inspection Scope The NRC inspection team reviewed Ansys policies and implementing procedures that govern the implementation of its design control program to verify compliance with the regulatory requirements of Criterion III, Design Control, of Appendix B to 10 CFR Part 50.

The NRC inspection team selected a sample of design features within Ansys software product lines provided to U.S. nuclear power plants and reviewed design changes to these features to verify that these changes were conducted in accordance with Ansys policies and procedures. The NRC inspection team also reviewed configuration management of Ansys software products to verify that changes were properly controlled in accordance with Ansys procedures for configuration management.

In addition, the NRC inspection team discussed Ansys program for design control with Ansys management and technical staff. The attachment to this inspection report lists the documents reviewed and personnel interviewed by the NRC inspection team.

b.

Observations and Findings b.1 Requirement to Implement Referenced Procedures The NRC inspection team reviewed Ansys Quality Manual, Revision 17, Section 6, Design Control. The NRC inspection team observed that this section does not clearly delineate which procedures or work instructions Ansys design activities must adhere to accomplish the requirements specified in this section. Specifically, Section 6.6 of the Quality Manual lists procedures as references but does not specify that these procedures must be used for the activities described in Section 6 of the Quality Manual. This issue provides details to support Example (3) of Nonconformance 99902113/2023-201-03.

8 b.2 Traceability of Specifications to Design and Implementation The NRC inspection team observed that Ansys Quality Manual and its referenced documents do not include provisions for ensuring that measures are established to assure that applicable regulatory requirements and the design basis for those Ansys products that Appendix B to 10 CFR Part 50 applies to are correctly translated into specifications.

Specifically, Ansys Quality Manual and referenced procedures do not (1) provide consistent definitions of what constitutes design specifications or product requirements, and (2) have provisions to establish controls for traceability from specifications to software design and code, as described below:

Section 6.3.4 of the Quality Manual states that upon completion of a product or product feature, the resulting Users Manual documentation becomes the specification for how the software operates. The Users Manual also serves as the baseline requirements for any future release of that software product. Section 11.3 of Ansys Quality Manual states, in part, that all source code and software design specifications are maintained and controlled using computerized change management tools Section 7.5.7 of Ansys procedure QP-7, Configuration Control, states, that At a minimum, the configuration control methods for Product Documentation must establish to which release(s) of a software product the written and on-line documentation pieces apply.

The changes made to the baseline Product documentation must be identifiable, and be attributable to design specifications, design change requests, or error corrections.

However, the NRC inspection team observed that the term design specifications or specification is not used in Ansys procedures QP-1, Product Development Life Cycle, Revision 17 or QP-44, Ansys Software Development Lifecycle Process Definition, Revision 10. As such, the NRC inspection team observed that no objective evidence exists to demonstrate that design or product specifications are identified during the product development Lifecycle.

QP-1, Section 7.1, states, in part, that requirements are captured in a hierarchical leveled set of work items referenced in Initiatives (optional), Epics (optional), Features (mandatory), and Stories (mandatory). Initiatives are derived from portfolio level planning, which form the beginning of the lifecycle process for Ansys products. QP-44 Section 7.3 states, in part, that each code addition or change will be traceable to the corresponding user story. The NRC inspection team observed that Initiatives and Epics are optional to lower-level work items (i.e., Features and Stories), and that QP-1, QP-7, and QP-44 do not specify that controls are established to ensure traceability between Initiatives, Epics, and Stories and the design/product specification. As such, the NRC inspection team finds that Ansys procedures do not have adequate provisions to establish controls for traceability from specifications to software design and code.

QP-44, Section 7.3 specifies that Done criteria for stories are defined in guideline GL-44-3, Managing the User Story. Section 4.2 of GL-44-3, Revision 9, states, in part, that all functional and technical stories must have a description and/or acceptance criteria. However, Section 4.3 of GL-44-3, states that It is recommended that stories are elaborated by adding acceptance criteria. The NRC inspection team observed several cases in which functional and technical stories only had descriptions without any acceptance criteria and therefore, there is insufficient objective evidence that the requirements of these stories have been met.

9 These issues provide details to support Example (1) of Nonconformance 99902113/2023-201-03.

b.3 Selection and Review of Suitability The NRC inspection team observed that Ansys Quality Manual does not include provisions for establishing measures to (1) select and review for suitability of application of materials, parts, equipment, and processes that are essential to the safety-related functions of the structures, systems and components, and (2) verify that third party software conform to requirements specifications. Specifically, the NRC inspection team observed the following:

Ansys Quality Manual, Section 6.6 lists procedure QP-10, Acquisition and Integration of Third-Party Software Components as a reference, but the Quality Manual does not specify that use of third-party software must undergo the process defined in QP-10.

Section 8.3 of the Ansys Quality Manual states, in part, that When licensed software is incorporated into one of our software products per QP-10, the supplier is chosen by the appropriate manager(s) based on an assessment of the supplier's product quality. However, Ansys Quality Manual is silent on selection and review for suitability of other types of third-party software used in Ansys products (i.e., open-source software or freeware).

QP-10, Revision 8 documents the lifecycle and process for acquiring and integrating third-party software components in Ansys products. These third-party software components are either acquired from an Open-Source Provider or purchased from a Commercial Software Component Provider. Although QP-10, Section 7.1, states, in part, that Open-Source and Freeware Component Requests shall be reviewed and approved before being integrated into an Ansys Product, there are no criteria provided in this procedure to assess the suitability of open-source and freeware components in the approval process.

Section 7.1.4 of QP-10 states, stories shall identify all Ansys software requirements, acceptance criteria and functionality exposed to the user, including those which make use of the Third-Party Software Component. The stories shall be reviewed and approved per QP-44 and GL-44-3. However, QP-44 fails to include criteria to assess the suitability of open-source and freeware components in the approval process. QP-44 only references QP-10. Further, GL-44-3 is silent on managing stories that use third-party software components.

Based on these observations, the NRC inspection team determined that the process used to accept third-party software is not defined in these procedures. Therefore, the NRC inspection team determined that not all third party software underwent the documentation and validation process in order to be considered as safety-related software supplied by Ansys. These issues provide details to support Example (2) of Nonconformance 99902113/2023-201-03.

c.

Conclusion As stated in Section 2 of this inspection report, the NRC staff issued Nonconformance 99902113/2023-201-03 in association with Ansys failure to implement the regulatory requirements in Criterion II of Appendix B to 10 CFR Part 50. The issues cited in Section 3.b

10 above related to Ansys program for design control provide details that support the examples cited in Nonconformance 999021113/2023-201-03.

4.

Test Control a.

Inspection Scope The NRC inspection team reviewed Ansys policies and implementing procedures that govern the implementation of its test control program to verify compliance with the regulatory requirements of Criterion XI, Test Control, of Appendix B to 10 CFR Part 50. Specifically, the NRC inspection team reviewed (1) procedures QP-1 and QP-44 to verify how testing is incorporated into Ansys product and software development lifecycle, (2) procedure QP-5, Product Testing, Revision 13, to verify that the testing process described validates that the product requirements have been met, and (3) guideline GL-44-1, Test Case Use, Revision 7 to verify that the process described provides criteria for generating test cases for adequate coverage. The NRC inspection team reviewed a sample of test packages for new or modified product features, including a review of the test plan, test cases, and test results that verified a New coupled Field Beam and Link Elements feature.

The NRC inspection team also discussed Ansys test control program with Ansys management and technical staff. The attachment to this inspection report lists the documents reviewed and personnel interviewed by the NRC inspection team.

b.

Observations and Findings The NRC inspection team observed that Ansys procedures do not adequately address testing of third-party software. Specifically, Section 7.2.4 of QP-10 states that The stories related to the Integrated Third-Party Software Component shall be executed and tested according to (QP-5) Product Testing and (GL-44-1) Test Case Use. However, QP-5, Section 7.6, merely states, Integrated software products from third parties require testing according to (QP-10) Acquisition and Integration of Third-Part Software Components, and GL-44-1 does not identify any requirements for third-party software. Therefore, the NRC inspection team determined that there are no clear requirements in Ansys processes and procedures that define how third-party software components are validated. As a result, the NRC inspection team could not determine whether the Ansys software products supplied to the customers in POs 0043107 and 127765523 contained validated third-party software.

This issue provides details to support Example (2) of Nonconformance 99902113/2023-201-03.

c.

Conclusion As stated in Section 2 of this inspection report, the NRC staff issued Nonconformance 99902113/2023-201-03 in association with Ansys failure to implement the regulatory requirements in Criterion II of Appendix B to 10 CFR Part 50. The issue cited in Section 4.b above related to Ansys test control program provide details that support the examples cited in Nonconformance 99902113/2023-201-03.

11 5.

Nonconforming Materials, Parts, or Components and Corrective Action a.

Inspection Scope The NRC inspection team reviewed Ansys policies and implementing procedures that govern the implementation of its control of nonconforming parts, materials, or components and corrective action programs to verify compliance with the requirements of Criterion XV, Nonconforming Materials, Parts, or Components, and Criterion XVI, Corrective Action, of Appendix B to 10 CFR Part 50, respectively.

The NRC inspection team also reviewed a sample of corrective action reports (CARs) to verify: (1) adequate documentation and description of conditions adverse to quality; (2) an appropriate analysis of the cause of these conditions and the corrective actions taken to prevent recurrence; (3) direction for review and approval by the responsible authority; (4) a description of the current status of the correction actions; and (5) the actions taken to verify timely and effective implementation of the corrective actions. In addition, the NRC inspection team confirmed that the corrective action process provides a link to the 10 CFR Part 21 program.

Additionally, the NRC inspection team discussed the nonconformance and corrective action program with Ansys management and technical staff. The attachment to this inspection report lists the documents reviewed and personnel interviewed by the NRC inspection team.

b.

Observations and Findings During the review of a select sample of CARs, the NRC inspection team observed that Ansys did not adequately correct the conditions adverse to quality identified in these CARs.

Specifically,

CAR 742 was created to address a deficiency in the Nuclear Procurement Issues Corporation (NUPIC) audit report No. 25329, related to QP-14, Corrective and Preventive Actions not addressing or defining the term condition adverse to quality. CAR 742 was closed with a determination that changing the terminology to use the term condition adverse to quality or adding a definition would be confusing, which did not correct the issue identified in this CAR. Furthermore, the evaluation of the problem identified in CAR 742 failed to consider other Ansys procedures that use the term condition adverse to quality. Specifically, QP-17, Internal Quality Audits, Revision 20 defines the term condition adverse to quality as an all-inclusive term used in reference to any of the following: failures, malfunctions, deficiencies, defective items, and nonconformances. A significant condition adverse to quality is one that, if left uncorrected, could have a serious effect on safety or operability: and provided direction for entering items into the corrective action program. The NRC inspection team determined this to be one example of an ineffective corrective action.

CAR 759 was created to address an internal audit finding related to integration of a third-party software into Ansys product without documented evidence that the software (1) is approved for use, and (2) underwent verification, as required by Ansys procedure QP-10. The root cause analysis of this issue attributed the cause to a lack of awareness of applicability of Ansys procedure QP-10 for the use of open source software, lack of awareness of the approval process for open source

12 software, and conflicting information provided by approvers for open source software. Corrective actions identified in CAR 759 are limited to revising QP-10, creating a template, and providing training. As such, the NRC inspection team found that the corrective actions would not address the use of undocumented and unverified third-party software in currently released versions of Ansys products. CAR 759 did not identify a need for containment, which would have identified all software products that were affected by the root cause of the issue. The corrective actions identified in the CAR were all implemented and therefore, the NRC inspection team determined this to be a second example of ineffective corrective action.

These issues are documented as Nonconformance 99902113/2023-201-04.

c.

Conclusion The NRC inspection team issued NON 99902113/2023-201-04 in association with Ansys failure to implement the regulatory requirements of Criterion XVI of Appendix B to 10 CFR Part 50. This NON cites Ansys for failing to assure that conditions adverse to quality such as failures, malfunctions, deficiencies, deviations, defective material and equipment, and nonconformances are promptly identified and corrected. Specifically, Ansys closed CAR 742, and implemented the corrective actions within CAR 759, without adequately correcting the conditions adverse to quality identified in these CARs.

6.

Internal Audits a.

Inspection Scope The NRC inspection team reviewed Ansys policies and implementing procedures that govern its internal audit program to verify compliance with the requirements of Criterion XVIII, Audits of Appendix B to 10 CFR Part 50. The NRC inspection team reviewed Ansys internal audit plans, internal audit reports, and corrective actions generated during internal audits.

The NRC inspection team verified that the audit documents reviewed were adequately completed and that Ansys adequately corrected the conditions identified in CARs generated during internal audits. Additionally, the NRC inspection team verified that Ansys procedures described the scope and purpose of audits to be performed, the frequency, audit criteria, and corrective actions when required. The NRC inspection team verified that the audit teams were selected using qualified auditors, and that they were not auditing their own work, and reviewed the qualification records of the lead auditors who performed the audits and verified that qualification activities met Ansys requirements for lead auditors. The NRC inspection team verified that internal audits were performed using checklists.

The NRC inspection team discussed the internal audits program with Ansys management and technical staff. The attachment to this inspection report lists the documents reviewed and personnel interviewed by the NRC inspection team.

b.

Observations and Findings The NRC inspection team reviewed the Ansys Quality Manual, Revision 17. Section 19.2.1, which states, Quality system audits of each department or group having responsibilities in implementing Quality Manual requirements are conducted as determined by the

13 Management Representative. These are conducted on a scheduled basis by internal auditing teams to verify that the company is following the documented charters and plans, that the quality system is effective, and that compliance to ISO 9001 and NQA-1 will continue. The Ansys implementing procedure for this section is QP-17, Internal Quality Audits, Revision 20. During the review of the implementing procedure, the NRC inspection team observed that QP-17 does not specify the internal audit frequency, as required by NQA-1, Quality Assurance Requirements for Nuclear Facility Applications, Requirement 18.

The NRC inspection team observed that Ansys did not identify a version of NQA-1 that it is implementing. The NRC inspection team reviewed the internal audit reports for 2021 and 2022 and verified that Ansys was performing internal audits at an annual frequency. The NRC determined this issue to be no more than minor because Ansys had scheduled and performed the internal audits annually.

c.

Conclusion With the exception of the minor issue described above, the NRC inspection team concluded that Ansys is implementing its internal audits program in accordance with the regulatory requirements of Criterion XVIII of Appendix B to 10 CFR Part 50. Based on the limited sample of documents reviewed, the NRC inspection team determined that Ansys is adequately implementing its policies and procedures associated with the internal audits program. No findings of significance were identified.

7.

Entrance and Exit Meetings On June 26, 2023, the NRC inspection team presented the inspection scope during an entrance meeting with Ms. Guylene Collard, Ansys Director of Quality Assurance, and other members of Ansys management and technical staff. On June 30, 2023, the NRC inspection team presented the inspection results to Ms. Collard and other members of Ansys management and technical staff. On August 3, 2023, the NRC inspection team conducted an additional exit meeting with Mr. Arman Nomani, Senior Quality Assurance Engineer, and other members of Ansys management. The attachment to this report lists the attendees of the entrance and exit meetings, as well as those individuals whom the NRC inspection team interviewed.

14 ATTACHMENT 1.

ENTRANCE/EXIT MEETING ATTENDEES Name Position Affiliation Entrance Exit Interviewed Aditya Dekhane Senior R&D Verification Engineer Ansys X*

Arman Nomani Senior Quality Assurance Engineer Ansys X

X X

Atul Verma Director R&D Ansys X*

X*

Aviva Faraggi Senior Manager Ansys X*

X*

Audrey Stepoli Administrative Assistant Ansys X*

X*

Billy Strunk Senior Manager Global Vendor Relationship Ansys X*

X*

Brian Mentzer Principal R&D Documentation Specialist Ansys X*

X*

X*

Carrie Joyce Senior Quality Assurance Engineer Ansys X

X X

Celine Fesselier Senior Quality Assurance Engineer Ansys X*

Cory Huey Director Ansys Customer Excellence Ansys X*

David Benson Manager Business Operations Ansys X*

Glenn Myers Lead R&D Verification Engineer Ansys X*

X*

15 Guylene Collard Director Quality Assurance Ansys X

X X

Imtiaz Ahmed Director R&D Verification Ansys X*

X*

James Geis Senior Manager R&D Ansys X*

Jesse Quintero Director Global Business Operations Ansys X*

X*

John Svitek Principle R&D Engineer Ansys X

X Kim Christian Manager Administrative Services Ansys X*

Kiran Kumar Senior Director R&D Ansys X

X*

X Kurt Rush Lead R&D Engineer Ansys X*

Lauren May Lead Business Operation Specialist Ansys X*

X*

X*

Marcy Jordan Director R&D Documentation Ansys X*

X*

Matt Mehalic Senior Technical Content Developer Ansys X*

Michael Pracht Contracts Director Legal Ansys X*

X*

Mike McGovern Director R&D Ansys X*

X*

X*

Morgan Weaver Supervisor HRIS Ansys X*

Prashant Gagnan Senior Manager R&D Ansys X*

Rebecca Ianelli Principal R&D Engineer Ansys X*

Roxana Cisloiu Senior Manager R&D Verification Ansys X*

X*

X*

16 Sanela Orsino Senior Manager R&D Verification Ansys X*

X*

X*

Sarah Olsson Senior Customer L&D Manager Ansys X*

X*

Shawn Ayers Director IT Ansys X*

X*

X*

Srinivas Ramakrishnan Lead R&D Engineer Ansys X*

Thomas Gessner Director R&D Ansys X*

X*

X*

Thomas Scheidegger Principal R&D Engineer Ansys X*

Varun Rao Manager R&D Ansys X*

Deanna Zhang Inspector NRC X

X Andrea Keim Inspector NRC X

X Rebecca Romero Inspector/trainee NRC X

X Joseph Lokos Trainee NRC X

X Kerri Kavanagh Branch Chief NRC X*

X*

  • - Attended virtually

17 2.

INSPECTION PROCEDURES USED:

Inspection Procedure (IP) 43002, Reactive Inspections of Nuclear Vendors, dated February 10, 2023

IP 35710, Quality Assurance Inspection of Software used in Nuclear Applications, dated January 30, 2018

IP 36100, Inspection of 10 CFR Part 21 and Programs for Reporting of Defects and Noncompliance, dated February 10, 2023 3.

LIST OF ITEMS OPENED, CLOSED, AND DISCUSSED Item Number Status Type Description 99902113/2023-201-01 Opened Notice of Violation (NOV) 10 CFR 21.21, paragraphs (a) 99902113/2023-201-02 Opened NOV 10 CFR 21.21(b) 99902113/2023-201-03 Opened Notice of Nonconformance (NON)

Criterion II of Appendix B 99902113/2023-201-04 Opened NON Criterion XVI of Appendix B 4.

DOCUMENTS REVIEWED Quality Assurance and Work Procedures

Ansys, Inc. Quality Manual, Revision 17, dated May 13, 2022

Ansys Mechanical APDL Verification Manual, Revision 2, Release dated 2023

Ansys Workbench Verification, Revision 1, Release dated 2024

GL-44-3, Managing the User Story, Revision 9, dated March 14, 2023

GL-44-1, Test Case Use, Revision 7, dated April 27, 2023

QP-1, Ansys Product Development Life Cycle, Revision 17, dated March 13, 2023

QP-2, Cloud and Continuous Development Life Cycle, Revision 3, dated 10/11/2021

QP-4, Defect Report Analysis, Revision 7, dated May 6, 2021

QP-5, Product Testing, Revision 14, dated May 10, 2021

QP-6, Service Packs, Special Versions and Prereleases, Revision 17, May 31, 2023

QP-7, Configuration Control, Revision 12, dated April 24, 2023

QP-8, Product Release, Revision 10, dated May 9, 2022

QP-9, Product Documentation, Revision 15, dated January 13, 2023

QP-10, Acquisition and Integration of Third-Party Software Components, Revision 8, dated June 1, 2023

QP-12, Document Control, Revision 12, dated March 1, 2023

QP-13, Quality Records, Revision 13, dated June 15, 2023

QP-14, Corrective and Preventative Actions, Revision 12, dated November 10, 2022

QP-15, Order Fulfillment, Revision 14, dated March 13, 2023

QP-16, Purchasing, Revision 23, dated April 25, 2023

18

QP-17, Internal Quality Audits, Revision 20, dated March 1, 2023

QP-18, Training, Revision 13, dated October 21, 2022

QP-19, Shipping and Handling, Revision 9, dated May 17, 2021

QP-20, Error Notification System, Revision 8, dated February 17, 2023

QP-21, 10CFR21 Reporting Responsibilities, Revision 8, dated June 22, 2023

QP-22, Technical Support Staff, Revision 7, dated May 19, 2022

QP-23, Commercial Grade Dedication, Revision 5, dated June 21, 2023

QP-24, Customer Feedback System, Revision 11, dated February 17, 2023

QP-28, Content Development, Revision 14, dated March 13, 2023

QP-33, Contract Review, Revision 5, dated April 25, 2022

QP-34, Quality Assurance Services, Revision 10, dated June 14, 2023

QP-36, Supplier Quality Audit/Survey, Revision 5, dated September 13, 2021

QP-37, Ansys Channel Partner Certification, Revision 5, dated May 17, 2021

QP-42, Resold Software Products, Revision 6, dated September 30, 2022

QP-43, Sales Training, Revision 2, dated May 12/2021

QP-44, Ansys Software Development Lifecycle Process Definition, Revision 10, dated March 14, 2023

QP-46, IT Services, Revision 5, dated February 21, 2023

QP-53, Private Training Course Delivery, Revision 2, dated August 29, 2022

QP-58, Request for Deviation Handling, Revision 1, dated March 10, 2023

WI-16-1, Vendor Selection Process, Revision 8, dated May 18, 2021

WI-16-2, Approving and Qualifying Vendors, Revision 10 dated May 18, 2021

WI-44-1, Artifact Definition, Revision 11, dated March 13, 2020 Purchase Orders (PO)

PO 0043107, dated December 16, 2022

PO 127765523, dated December 1, 2022 Quality Service Agreements

Quality Service Agreement for Customer #218182

Quality Service Agreement for Account #601905

Quality Service Agreement for Account #218888 Test Plan

Test plan_LINK228, dated June 7, 2022 Corrective Action Reports (CARs) Reviewed During the NRC Inspection

ICAR 547

ICAR 622

ICAR 655

ICAR 661

ICAR 668

19

ICAR 671

ICAR 679

ICAR 694

ICAR 696

ICAR 698

ICAR 742

ICAR 743

ICAR 756

ICAR 759

ICAR 764

ICAR 769

ICAR 781

ICAR 789 Class 3 Error Reports

2022-016, Mechanical, dated March 15, 2022

2022-013, Mechanical, dated March 11, 2022

2022-036, Fluids, dated April 14, 2022

2022-108, Mechanical, dated December 19, 2022

2023-013, Fluids, dated January 26, 2023

2023-059, Mechanical APDL, dated May 12, 2023 Software Nonconformance/Bug Numbers

586543

558263

59339

750452

822124 Training Records

Lead Auditor Qualification of Glenn Myers

Lead Auditor Qualification of Guylene Collard Internal Audit Reports

2021-1-HQ, Ansys Audit Report - Canonsburg 2021"

2022-1-HQ, Ansys Audit Report - Headquarters, Canonsburg 2022

2022-2-HQ, Ansys Audit Report - Headquarters, Canonsburg 2022