ML24249A119
| ML24249A119 | |
| Person / Time | |
|---|---|
| Issue date: | 09/10/2024 |
| From: | Yamir Diaz-Castillo, Deanna Zhang NRC/NRR/DRO/IQVB |
| To: | |
| References | |
| Download: ML24249A119 (8) | |
Text
Observations from NRC Vendor Inspections of Suppliers of Safety-Related Design and Analysis Software NUPIC Meeting - September 10 - 11, 2024 Birmingham, AL Deanna Zhang & Yamir Diaz-Castillo Quality Assurance & Vendor Inspection Branch Office of Nuclear Reactor Regulation
Purpose 2
Raise awareness of issues identified during recent NRC inspections of suppliers of safety-related design and analysis software.
Present recommendations on application of NUPICs audit checklist for audits of these suppliers.
=
Background===
3 NRC conducted inspections of Ansys and Bentley Systems in June 2023 and August 2024, respectively.
NRCs first time inspecting both suppliers.
Ansys and Bentley Systems supply their products to the commercial industry as well as to the nuclear power industry.
Based on the results of the inspection, NRC issued Ansys two violations against 10 CFR Part 21 and two nonconformances against Appendix B to 10 CFR Part 50.
The NRC has similar preliminary findings for Bentley Systems; the NRCs inspection report will be issued at the end of this month.
NRC Inspection Observations 4
One version of software exists for each software product; no differences between software product supplied as commercial or as safety-related (i.e., 10 CFR Part 21 and Appendix B to 10 CFR Part 50 apply).
Add-on service agreements distinguish the software as commercial or safety-related.
Bentley Systems has additional documentation for software that is supplied as safety-related.
Design and development activities for the software do not align with the documented Quality Assurance (QA) Program Manual and implementing procedures.
10 CFR Part 21 Program Observations 5
Both suppliers did not understand 10 CFR Part 21 requirements and their 10 CFR Part 21 implementing procedure does not align with the 10 Part 21 regulation.
The 10 CFR Part 21 program automatically defers the evaluation responsibilities to the customer - those with a service agreement receive notification of significant errors.
The 10 CFR Part 21 program does not require customers to be notified of all errors:
Ansys only notifies its customers on errors that appear to provide a correct solution when it is not.
Bentley Systems only notifies its customers of errors that it considers as non-conservative.
Observations of Application of NUPIC Audit Checklist to Software Suppliers 6
Design and analysis software suppliers have unique processes different from traditional manufacturing facilities.
Application of the NUPIC audit checklist for these suppliers should be tailored to the design, development, and testing processes and software terminologies. Examples include application of:
Nonconformance program: Ansys and Bentley Systems view nonconformances as deviations from process, and not software errors, defects, or anomalies.
Corrective actions program: Ansys and Bentley Systems do not apply terminologies in their QA procedures (e.g., conditions adverse to quality or significant conditions adverse to quality) to the software development activities.
Audits should be performed on the development environment and activities; not just the documentation.
Summary 7
Recent NRC inspections of two design and analysis software suppliers found common issues with the implementation of the suppliers 10 CFR Part 21 and Appendix B to 10 CFR Part 50 QA programs.
NRC plans to conduct one or two more inspections of design and analysis software suppliers and depending on the inspection results, the NRC may issue generic communications.
Software suppliers have unique implementations of 10 CFR Part 21 and Appendix B to 10 CFR Part 50 QA programs; therefore, it is recommended that NUPIC adapts its audit checklist and audit processes to accommodate the uniqueness of each software supplier in the NUPIC suppliers list.
8 Yamir Diaz-Castillo Reactor Operations Engineer (301) 415-2228 Yamir.Diaz-Castillo@nrc.gov Deanna Zhang Senior Reactor Operations Engineer (301) 415-1946 Deanna.Zhang@nrc.gov