DOE-HDBK-1230-2019, Commercial Grade Dedication Application Handbook

DOE-HDBK-1230-2019 July 2019 DOE HANDBOOK COMMERCIAL GRADE DEDICATION APPLICATION HANDBOOK U.S. Department of Energy Washington, DC 20585 DISTRIBUTION STATEMENT A. Approved for public release; distribution is unlimited. NOT MEASUREMENT SENSITIVE DOE-HDBK-1230-2019 Foreword This Department of Energy (DOE) Handbook provides information to assist DOE and National Nuclear Security Administration (NNSA) sites in developing a process for commercial grade dedication (CGD) of items and services. The Handbook includes a few examples of technical evaluation plans for CGD items. Case studies are documented throughout the Handbook to help clarify CGD processes that will assist the DOE and NNSA community in implementing effective and efficient CGD processes. CGD is an acceptance process performed in accordance with American Society of Mechanical Engineers (ASME), Nuclear Quality Assurance (NQA-1), Quality Assurance Requirements for Nuclear Facility Applications, Subpart 2.14 to provide reasonable assurance that an item or service will successfully perform its intended safety function. The 2015 edition of ASME NQA-1 was used as the basis for the implementation of the CGD process in this Handbook. Other editions of ASME NQA-1 also contain CGD requirements and guidance. Organizations may adapt and use this Handbook based on the version of ASME NQA-1 identified in their quality program. The CGD requirements of ASME NQA-1-2015 as compared to ASME NQA-1-2008, 2009 Addenda are the same. This Handbook does not establish new requirements, and any existing requirements are explicitly referenced from a DOE Order. DOE Order requirements prevail. This Handbook provides instructions and examples to implement CGD requirements and therefore uses the words “should” and “may”. Beneficial comments (recommendations, additions and deletions), as well as any pertinent data that may be of use in improving this document should be emailed to addressed to nuclearsafety@hq.doe.gov or addressed to: Office of Nuclear Safety (AU-30) Office of Environment, Health, Safety and Security (AU) U.S. Department of Energy 1000 Independence Avenue, SW Washington, DC 20585 mailto:nuclearsafety@hq.doe.gov DOE-HDBK-1230-2019 1.0 Purpose and Applicability ...................................................................................................... 1 2.0 Scope......................................................................................................................................... 1 3.0 Introduction ............................................................................................................................. 1 4.0 Definitions ................................................................................................................................ 3 5.0 CGD Procurement Strategy Prerequisites/Pre-Planning.................................................... 8 5.1 Sources for Safety Classifications/Safety Functions .......................................................... 8 5.2 Sources for Supporting Commercial Grade Dedication Development ............................... 9 5.3 Safety Function is Determined by the Purchaser – Not by the Manufacturer or Supplier 10 5.4 Importance of Design for Commercial Grade Dedication ................................................ 11 5.5 Obsolete Parts or Parts no Longer Available .................................................................... 11

5.5.1 Risk and Cost Analysis Considerations ................................................................... 11 5.5.2 Other Issues .............................................................................................................. 12 6.0 CGD Process Description ..................................................................................................... 12 6.1 Planning for Commercial Grade Dedication ..................................................................... 15 6.2 Technical Evaluation ........................................................................................................ 16 6.2.1 Performance and Service Conditions ....................................................................... 17 6.2.2 New or Replacement Item Evaluation ..................................................................... 18 6.2.3 Like-for-Like Item Evaluation ................................................................................. 18 6.2.4 Equivalent Item Evaluation...................................................................................... 19 6.3 Critical Characteristics Determination .............................................................................. 20 6.3.1 Consideration of Failure Modes............................................................................... 22 6.3.2 Environmental Conditions and Natural Phenomena Evaluation ............................. 22 6.3.3 Item Characteristics ................................................................................................. 24 6.4 Dependability Characteristics: Special Considerations for Software ............................... 26 6.5 Dedication Process ............................................................................................................ 28 6.5.1 Third Party Organization (TPO) Dedication............................................................ 29 6.5.2 Method 1 – Special Tests, Inspections, and/or Analyses ......................................... 29 6.5.3 Method 2 – Commercial Grade Survey of the Supplier ........................................... 33 6.5.4 Method 3 – Source Verification and ........................................................................ 38 6.5.5 Method 4 – Acceptable Supplier Item or Service Performance Record .................. 41 6.6 Sampling Plans and Lot Formation................................................................................... 43 7.0 Other Considerations ........................................................................................................... 45 7.1 Oversight and Flow-Down Expectations .......................................................................... 45 7.2 Commercial Grade Services ............................................................................................. 45 7.3 Correction of Supplier Issues ............................................................................................ 45 7.4 Documentation .................................................................................................................. 45 8.0 NQA-1 Original Equipment Manufacturer Options and Oversight ................................ 46 9.0 References and Reading List................................................................................................ 50

9.1 Codes and Standards ......................................................................................................... 50 9.2 Industry and Regulatory References ................................................................................. 50 9.3 Other Information Related to Commercial Grade Dedication .......................................... 50 10.0 Examples for Case Studies ................................................................................................. 52 Example No. 1 (Ball Valves) .................................................................................................. 53 Example No. 2 (Air Actuated Ball Valves) ............................................................................ 63 Example No. 3 (Gaskets for Piping Systems) ......................................................................... 85 Example No. 4 (O-Rings, Seals, and Gaskets) ....................................................................... 94 DOE-HDBK-1230-2019 APPENDIX A. Examples of Characteristics for Design ...................................................... A-1 APPENDIX B. Examples of Credible Failure Mechanisms................................................. B-1 APPENDIX C. Commercial Grade Dedication Process Flow Charts ................................ C-1 DOE-HDBK-1230-2019 Abbreviations and Acronyms ANSI American National Standards Institute ASME American Society of Mechanical Engineers ASQ American Society for Quality ASTM American Society for Testing and Materials (now ASTM International) AU Associate Under Secretary for the Office of Environment, Health, Safety & Security CGD Commercial Grade Dedication C of C Certificate of Conformance CFR Code of Federal Regulations CGI Commercial Grade Item CGS Commercial Grade Service CMTR Certified Material Test Report EEQ Equipment Environmental Qualification ESQ Equipment Seismic Qualification DOE Department of Energy DSA Documented Safety Analysis EPRI Electric Power Research Institute IEEE Institute of Electrical and Electronics Engineers INPO Institute of Nuclear Power Operations NNSA National Nuclear Security Administration NRC Nuclear Regulatory Commission OEM Original Equipment Manufacturer PDSA Preliminary Documented Safety Analysis PMI Positive Material Identification QA Quality Assurance SDD System Design Description SSC Structure, System, and Component TPO Third Party Organization TSR Technical Safety Requirements UL Underwriters Laboratories XRF X-ray Fluorescence DOE-HDBK-1230-2019 1 1.0 Purpose and Applicability The purpose of this Handbook is a teaching tool for commercial grade dedication (CGD). This is accomplished by providing best practices and examples for developing CGD technical evaluation plans which meet the provisions of ASME NQA-1, Quality Assurance Requirements for Nuclear Facility Applications. This Handbook is not to be used as a requirements document. This Handbook is applicable to the Department of Energy (DOE) and NNSA entities performing CGD work activities. 2.0 Scope This Handbook provides an acceptable CGD approach to dedicate an item or service that performs a nuclear safety function when the item or service was not manufactured, developed, or performed under a qualified ASME NQA-1 Quality Assurance Program (QAP). The CGD process also provides a method to dedicate existing commercial grade SSC already in service or on-hand, when they are re-purposed and have a new nuclear safety function. CGD is an engineering method to evaluate the critical characteristics of an item or service to ensure that it will perform the required safety function. Computer programs are also subject to CGD, but the Handbook does not attempt to cover those techniques in detail. Instead, where appropriate the Handbook notes considerations for computer programs along with the discussions concerning items and services.

ASME NQA-1, Subpart 2.14, Quality Assurance Requirements for Commercial Grade Items and Services provides a structure for the CGD process. This Handbook provides instruction on how to develop Technical Evaluation Plans for CGD items and services. This includes: • Identification of critical characteristics; • Identification of dedication methods to be selected for an item to be procured; • Explanation of the technical evaluation process, and; • Providing examples of commercial grade dedication packages. The approach to the Handbook is to meet ASME NQA-1 to support the DOE and NNSA implementation for a successful CGD process. DOE staff conducted several benchmarking activities of DOE projects and commercial nuclear facilities to support the selected examples provided in Section 9.0 and Case Studies provided throughout several sections of this Handbook. The examples provided in the Handbook are not to be considered all-inclusive individually. However, best practices from these examples, provide acceptable and complete CGD methods. The intent of the Case Studies documented throughout this Handbook is to assist in best practices and lessons learned from the examples provided. 3.0 Introduction In the heyday of nuclear power plant construction, many suppliers maintained nuclear quality assurance QA programs and provided nuclear-grade services and structures, systems, and components (SSC). Purchasers only needed to specify the item or service and the quality requirements to buy nuclear grade items and services with appropriate certifications. As the nuclear market diminished, suppliers terminated their nuclear QA programs and nuclear-grade replacement DOE-HDBK-1230-2019 2 parts became difficult or impossible to procure. Commercial Grade Dedication (CGD) was developed to provide a process for nuclear power plants to evaluate items and services that were not obtained in accordance with a nuclear QA program and determine, with reasonable assurance, that the items would perform their intended safety functions. The CGD methods developed for the commercial nuclear power industry are also used in the DOE, and for the same reasons- nuclear- grade items and services are not as readily available as they once were, so DOE facilities need to perform CGD of commercial items to keep vital facilities in operation. The CGD process consists of two main activities: • Perform a technical evaluation of the item or service: o Determine the scope of the technical evaluation o Determine the safety function (if not already known) o Evaluate the equivalence of a substitute item (when necessary) o Develop appropriate technical and quality requirements o Identify the critical characteristics, including acceptance criteria o Identify the dedication methods for verification of the acceptance criteria (Methods 1-4) • Perform verification actions on each of the critical characteristics to provide reasonable assurance that the item or service will perform its safety function, using one or more of the acceptance methods: o Method 1, Special Tests, Inspections, and/or Analyses o Method 2, Commercial Grade Survey of the Supplier o Method 3, Source Verification o Method 4, Acceptable Supplier Item or Service Performance Record

Briefly, examples of Method 1 Special Tests, Inspections, and/or Analyses are dimensional measurements, chemical composition tests, hardness tests, and various electrical tests. A Method 2 Commercial Grade Survey of the Supplier is similar to a QA audit, but the Survey specifically assesses a supplier’s controls over specific critical characteristics , not their general QA program. Method 3 is a more intrusive assessment of a supplier, akin to the purchaser performing QA inspections of specific processes in the manufacturer of the items they are purchasing rather than assessing the supplier’s own controls in the Method 2 Commercial Grade Survey of the Supplier. Method 4 consists of a review of the documented performance history to verify a critical characteristic with reasonable assurance. In practice, it is never used as the sole method of acceptance of an item or service, but is used in conjunction with one or more of the other methods (1-3). As discussed later in the Handbook, excellent CGD packages consist of: • Documentation of the technical evaluation • Documentation of the critical characteristics • Documentation of the acceptance criteria • Documentation that verifies the item or service meets the acceptance criteria for the identified critical characteristics by one or more of the dedication methods • Documentation of final acceptance This Handbook will discuss the details of the CGD process and expand on this brief introduction with case studies and examples taken from actual DOE experience to illustrate lessons learned and good practices. DOE-HDBK-1230-2019 3 Since CGD originated in the nuclear power industry, there are some differences in terminology in the DOE application. The nuclear power industry refers to “basic components” when discussing the application of CGD since their regulations use that term for the safety-related SSC that require nuclear-grade QA. In DOE usage, the terms Safety Class and Safety Significant describe the SSC that require nuclear-grade QA, and the definitions are not equivalent, since the nuclear power industry deals with power reactors and DOE deals with a wide variety of nuclear facilities that pose hazards but are not reactors. This Handbook uses much of the nuclear power industry documentation regarding CGD because it is mature and the processes are well understood and applicable to DOE, but readers should bear in mind that the DOE regulatory basis is different. 4.0 Definitions These definitions are intended to provide a common set of terms for use in this Handbook. In general, the definitions are quoted from other standards and guidance currently used in nuclear applications. Where a definition is derived from another reference, the reference is provided in brackets. The definitions listed here are not all the definitions applicable to CGD. Users are encouraged to consult the standards or guides for any additional definitions that they may also be using to develop their CGD program. This Handbook makes multiple references to EPRI Technical Report 3002002982, Plant Engineering: Guideline for the Acceptance of Commercial-Grade Items in Nuclear Safety related Applications: Revision 1 to EPRI NP-5652 and TR 102260. For convenience, this document will be referred to as “EPRI TR 3002002982.”

Several of these definitions come from EPRI TR 3002002982 because they succinctly capture the meaning of terms that are not explicitly defined in ASME NQA-1, but are instead covered in longer discussions. The use of the concise definitions from EPRI does not constitute an endorsement of EPRI TR 3002002982 as directly applicable to DOE. Note that the EPRI process is designed to meet Nuclear Regulatory Commission (NRC) requirements and while many practices and concepts translate to DOE usage, the process as a whole is not directly applicable to DOE's different regulatory scheme. DOE operators are cautioned to carefully consider the differences between the power reactor environment and DOE when choosing methods and practices for their CGD processes. Acceptance. The employment of one or more dedication methods to produce objective evidence which provides reasonable assurance that a commercial-grade item received will perform its intended safety function(s). [EPRI TR 3002002982] Acceptance Criteria. Specified limits placed on the performance, results, or other characteristics of an item, process, or service defined in codes, standards, or other requirement documents. [ASME NQA-1-2015, Quality Assurance Requirements for Nuclear Facility Applications] Basic Component. A structure, system component, or part thereof that affects its safety function, that was designed and manufactured in accordance with the requirements of this Standard [NQA-1], or commercial grade items which have successfully completed the dedication process. [ASME NQA-1-2015 Subpart 2.14] DOE-HDBK-1230-2019 4 N.B. In the nuclear power industry, a Basic Component refers to an item that meets the QA attributes of 10 CFR Part 50 and maintains a reactor’s pressure boundary, its ability to shut down, or to mitigate accident offsite exposures. This is similar to, but not congruent with DOE Safety Class and Safety Significant since DOE has different regulatory bases and different safety measures. Bounding Conditions. Parameters that envelop the normal, abnormal, and accidental environmental conditions an item is expected to meet during its lifetime in the plant (e.g., temperature, humidity, radiation, seismic response spectra). [EPRI TR 3002002982] Certificate of Conformance (C of C). A document signed or otherwise authenticated by an authorized individual certifying the degree to which items or services meet specified requirements. [ASME NQA-1-2015] Certified Material Test Report. A document attesting that the materials are in accordance with specified requirements, including the actual results of all required chemical analyses, tests, and examinations. [EPRI TR 3002002982] Commercial Grade Item (CGI). A structure, system, or component, or part thereof, that affects its safety function, that was not designed and manufactured in accordance with the requirements of this Standard [NQA-1]. [ASME NQA-1-2015] Commercial Grade Service (CGS). A service that was not provided in accordance with the requirements of this Standard [NQA-1] that affects the safety function of a basic component. [ASME NQA-1-2015] Commodity Item. An item having a generic application throughout a nuclear unit that lends itself to bulk procurement (such as nuts, bolts, materials, O-rings, gaskets, indicator lights, fuses, relays, and resistors). [EPRI TR 3002002982]. Computer Program1 A combination of computer instructions and data definitions that enables computer hardware to perform computational or control functions. [ASME NQA-1-2015]

Credible Failure Mechanism. The manner by which an item may fail, degrading the item’s ability to perform the component or system safety function under evaluation. [EPRI TR 3002002982] 1 Computer programs covered by this definition are those used for design analysis, operations or process control, or data base or document control registers when used as the controlled source of quality information for a) design analysis, b) operations or process control, or c) database or document control registers when used as the controlled source of quality information for a) or b) above. This definition has been copied from Institute of Electrical and Electronic Engineers (IEEE) 610.12-1990, Glossary of Software Engineering Terminology. To the extent that computer programs are a physical part of plant systems (e.g., digital reactor protection system, digital instrumentation) they are included in the term “item.” DOE-HDBK-1230-2019 5 Critical Characteristics. Important design, material, and performance characteristics of a commercial grade item or service that, once verified, will provide reasonable assurance that the item or service will perform its intended safety function. [ASME NQA-1-2015, Subpart 2.14] Dedication. An acceptance process performed in accordance with ASME NQA-1, Subpart 2.14 to provide reasonable assurance that a commercial grade item or service will perform its intended safety function and, in this respect, is deemed equivalent to an item or service designed and manufactured or provided under the requirements of ASME NQA-1. This assurance is achieved by identifying the critical characteristics of an item and verifying their acceptability by inspections, tests, or analyses performed by the purchaser or third-party dedicating entity after delivery, supplemented as necessary by one or more of the following: commercial grade surveys; product inspections or witness at hold-points at the manufacturer’s facility, and analysis of historical records for acceptable performance. In all cases, the dedication process must be conducted in accordance with the applicable provisions of NQA-1, Part I. [ASME NQA-1-2015, Subpart 2.14] Dedicating Entity. The organization performing the dedication process. Dedication may be performed by the manufacturer of the item, a third-party dedicating entity, or by the facility. [ASME NQA-1-2015, Subpart 2.14] Equivalency Evaluation. A technical evaluation performed to confirm that a replacement item (not identical to the original) can satisfactorily perform its intended functions, including its safety functions. [ASME NQA-1-2015, Subpart 2.14] Equivalent Replacement. A replacement item not physically identical to the original. These replacement items require an equivalency evaluation to ensure that the intended functions, including its safety function, will be maintained. [ASME NQA-1-2015, Subpart 2.14] Failure. A mechanism that prevents an item from accomplishing its function. [EPRI TR 3002002982] Failure Mode. The effects or conditions that result from an item’s credible failure mechanisms. [EPRI TR 3002002982] Failure Modes and Effects Analysis. An evaluation of an item’s credible failure mechanisms and their effect on system and/or component functions. [EPRI TR 3002002982] Identical Item. An item that exhibits the same technical and physical characteristics (physically identical). [ASME NQA-1-2015, Subpart 2.14]

Item2. An all-inclusive term used in place of appurtenance, assembly, component, equipment, material, module, part, structure, product, software, subassembly, subsystem, system, unit, or support systems. [DOE Order (O) 414.1D, Quality Assurance] 2 For the purposes of this Handbook the definition of “item” provided in DOE O 414.1D that includes software should be used. The ASME NQA-1-2015 definition is similar but does not include the word software. DOE-HDBK-1230-2019 6 Like-for-Like Replacement. The replacement of an item with an item that is identical. [ASME NQA-1-2015, Subpart 2.14] Parts. Items from which a component is assembled, such as resistors, capacitors, wires, connectors, transistors, lubricants, O-rings, and springs. [EPRI TR 3002002982] Reasonable Assurance. In the context of commercial grade item acceptance, reasonable assurance is an engineering determination premised upon a justifiable level of confidence based on objective and measurable facts, actions, or observations from which adequacy of the item for its intended purpose can be inferred. [EPRI TR 3002002982] Safety Software. Includes the following: [DOE O 414.1D] Safety System Software. Software for a nuclear facility that performs a safety function as part of a structure, system, or component and is cited in either (a) a DOE approved documented safety analysis; or, (b) an approved hazard analysis per DOE P 450.4A, “Safety Management System Policy,” 2011, and the DEAR clause. [DOE O 414.1D] Safety and Hazard Analysis Software and Design Software. Software that is used to classify, design, or analyze nuclear facilities. This software is not part of an SSC but helps to ensure the proper accident or hazards analysis of nuclear facilities or an SSC that performs a safety function. [DOE O 414.1D] Safety Management and Administrative Controls Software. Software that performs a hazard control function in support of nuclear facility or radiological safety management programs or technical safety requirements or other software that performs a control function necessary to provide adequate protection from nuclear facility or radiological hazards. This software supports eliminating, limiting, or mitigating nuclear hazards to workers, the public, or the environment as addressed in 10 C.F.R. Parts 830 and 835, the DEAR Integrated Safety Management System clause, and 48 C.F.R. 970-5223.1. [DOE O 4141D] Safety Class Structures, Systems, and Components. Structures, systems, or components, including portions of process systems, whose preventive and mitigative function is necessary to limit radioactive hazardous material exposure to the public, as determined from the safety analyses. [10 Code of Federal Regulations (CFR) Part 830] Safety Function. The performance of an item or service necessary to achieve safe, reliable, and effective utilization of nuclear energy and nuclear material processing. [ASME NQA-1-2015] Safety Significant Structures, Systems, and Components. Structures, systems, and components which are not designated as safety-class SSCs but whose preventive or mitigative function is a major contributor to defense in depth and/or worker safety as determined from safety analyses. [10 CFR 830] DOE-HDBK-1230-2019 7 Sample. A sample consists of one or more units of product drawn from a lot with the units of the sample being selected at random without regard to their quality. The number of units of product in the sample is the sample size. [EPRI TR 017218 R1, Guideline for Sampling in the Commercial-Grade Item Acceptance Process, January 1999]

Sampling Plan. A plan developed to determine the definition of appropriate lot and sample size in order to achieve reasonable assurance that the sample size chosen provides an adequate representation of the item(s) quality. [EPRI TR 017218 R1] Service. The performance of activities such as design, fabrication, inspection, nondestructive examination, repair, or installation. [ASME NQA-1-2015] Supplier. Any individual or organization who furnishes items or services in accordance with a procurement document. An all-inclusive term used in place of any of the following: vendor, seller, contractor, fabricator, consultant, and their sub-tier levels. [ASME NQA-1-2015] Traceability. The ability to trace the history, application, or location of an item and like items or activities by means of recorded identification. [ASME NQA-1-2015] DOE-HDBK-1230-2019 8 5.0 CGD Procurement Strategy Prerequisites/Pre-Planning This section of the Handbook provides instruction on how to prepare for CGD procurements consistent with ASME NQA-1 requirements. The overall intent of this section is to encourage the development of more detailed and consistent CGD packages. The collection of background information for commercial grade dedication of a Structure, System, and Component (SSC) begins with safety classification. Functional classification of SSCs as either safety class or safety significant is implemented through DOE standard DOE-STD-3009, Preparation of Nonreactor Nuclear Facility Documented Safety Analysis. Implementation of QA requirements in accordance with 10 CFR Part 830 is accomplished via use of a quality standard such as ASME NQA-1. Safety class SSCs limit radiation dose to the public, as determined by the safety analysis. Safety significant SSCs contribute to defense in depth and/or worker safety, as determined from the safety analysis. CGD is concerned only with SSCs that provide a safety class or safety significant safety function and were not designed or manufactured in accordance with an approved NQA-1 quality assurance program. 5.1 Sources for Safety Classifications/Safety Functions/Performance Criteria Prerequisites to CGD – The purpose of this section is to reference the upper tier design documents that discuss safety classifications and safety functions. Depending on the phase of construction or extent of facility operations, SSC safety classifications/safety functions can be found in the following sources: (1) Preliminary Documented Safety Analysis (PDSA) - When required to support major modifications to existing facilities or new facility construction, the PDSA is the key safety document developed, updated, and maintained while the design progresses from the preliminary to the final design phase. The PDSA provides descriptions of safety class and safety significant SSCs, and functional requirements and performance criteria for early CGD development and to support procurement strategies. Generally, procurement activities are not authorized until the PDSA is approved. The PDSA is maintained current throughout the design process. (2) Documented Safety Analysis (DSA) - A DSA is an analysis of the extent to which a nuclear

facility can be operated safely with respect to workers, the public, and the environment, including a description of the conditions, safe boundaries, and hazard controls that provide the basis for ensuring safety. In general, Chapter 4 of the DSA describes the safety class and safety significant SSCs, their safety functions, and performance criteria. Chapter 5 provides Technical Safety Requirements (TSR), including important design features, limiting conditions for operation, and surveillance requirements. These two chapters provide useful information on safety functional requirements, design margins, performance criteria and reference to supporting analysis and, in many situations, important modification history. DOE-HDBK-1230-2019 9 (3) Functional Classification Documents provide supportive information that may not be explicitly included in a safety analysis and are useful for facility operations and engineering. They provide system and component functional classification and system functional classification boundaries. Functional Classification Documents (or databases) can be effectively used to document evaluations on subcomponents of SSCs. Many subcomponents can be justified as not providing a safety function and, therefore, may be exempt from safety class and safety significant requirements. (4) System Design Description (SDDs) are a convenient single point of reference that centralizes pertinent information or interpretations of details in supplier technical manuals and engineering documents (DOE-STD-3024-2011, Content of System Design Descriptions) 5.2 Sources for Supporting Commercial Grade Dedication Development Below are several sources for CGD items and services that provide information to support the classification, function, technical information, information concerning part failures, and functional requirements/performance criteria and references. • Technical Baseline – This is controlled documentation identified and maintained by the Cognizant System Engineer, as defined in DOE O 420.1, Facility Safety, Chapter V (could be different from organization to organization). The technical baseline is used to identify, justify and demonstrate the physical, functional or operational requirements of configuration-controlled structures, systems and components. The technical baseline includes selected controlled documents, such as but not limited to system and component drawings, supplier files, (e.g., drawings, manuals) SDDs, and functional classification reports. • Manufacturer or Supplier Information – It is expected and acceptable to obtain technical information about a part considered for commercial grade dedication directly from a manufacturer or supplier. The information may be in the form of a specification, data sheet, drawing or instructional guide or manual or other communication with the supplier. Engineering judgement based on the source of information is the most significant factor in building confidence that the technical information provided by the supplier is correct. Engineering judgement should be documented to provide the basis for the acceptance of this information and that this engineering judgement is based on one of the four CGD dedication methods. Requests for other specific technical, function, quality, or performance information other than what is provided in available literature should be directed to and provided by appropriate supplier engineering or quality organization. Usually the initial interface is with a customer service representative. These representatives may act as the interface between the supplier/manufacturer’s technical personnel and purchaser’s technical personnel.

• Access to National Codes and Standards – Access to codes and standards is generally necessary to provide information on material, material properties, testing requirements, and supporting information. • DOE Lesson Learned, Product Recalls, NRC 10 CFR Part 21 Notifications – Information concerning part failures due to manufacturing defects, design or quality issues should be reviewed for applicability. • Safety Analysis Documents – As previously discussed, safety analysis documents (PDSA, DSA, TSR) identify safety class and safety significant equipment, provide DOE-HDBK-1230-2019 10 functional requirements and performance criteria and references to supporting documents. 5.3 Safety Function is Determined by the Purchaser – Not by the Manufacturer or Supplier The section below is provided to help clarify that the purchaser, not the supplier, determines the safety functions for safety SSCs, which are derived from the DOE approved safety basis. Protection of the public is predominant in safety design and is achieved by safety class SSCs. Protection of workers is no less important and is achieved by safety significant SSCs. The degree of protection for facility workers achievable by SSCs is limited. Other factors such as disciplined conduct of operations, training, and safety management programs are also important in assuring worker safety. Through a disciplined and documented process, the safety analysis determines the system functional classification, including its functional requirements and performance criteria for Hazard Category 1, 2, or 3 facilities. The safety analysis may extend into specific equipment or part description, safety function and performance criteria. In most cases, however, Engineering, with the support of a Safety Analyst, use these system functional requirements and performance criteria to evaluate a specific part’s safety function. For example, a 10” underground gate valve in the same fire water supply distribution system may have a safety function of closing to isolate a non-safety-related portion of the system from the safety-related portion to prevent loss of water supply in the event of a significant leak in the non- safety-related portion of the system. In this case, the valve has a safety function of being able to close, and performance criteria to leak no more than 0.5 gallons per minute and provide a pressure boundary of 175 pounds per square inch, gauge. Water flow through the valve would not be a safety function. This example illustrates that, while the sprinkler head has obvious similar functional requirements regardless of being safety rated, the 10” gate valve safety function is not as clear and is based on its credited safety function as described in the DOE approved safety analysis This example illustrates that, while the sprinkler head has an obvious safety function, the 10” gate valve safety function is not as clear and is based on its credited safety function as described in the safety analysis. Likewise, manufacturers or suppliers cannot determine safety functions of equipment, as the manufacturer or supplier do not have access or responsibility to interpret the safety analysis.

As another example, a set point alarm module may have 10 different reporting or input/output capabilities, including performance of various calculations. These capabilities may be important to the manufacturer; however, only two of the capabilities may be important for the safety function, such as interpretation of the input signal within a given tolerance and activation of a mechanical relay to signal shutdown of a steam heating source to a chemical dissolver tank when the tank temperature exceeds a predetermined set point. It is important to remember that manufacturers or suppliers do not determine the safety function of supplied commercial items. DOE-HDBK-1230-2019 11 5.4 Importance of Design for Commercial Grade Dedication SSCs associated with Hazard Category 1, 2, or 3 nuclear facilities have approved and controlled designs based on graded approach methodologies. Suitability of an SSC to reliably perform its functions is accomplished through design, including design verification, which may include prototype testing, and qualification testing. This ensures desired performance is maintained during design conditions. CGD is not part of, or a substitute for, the rigorous design process to determine suitability of a part. Therefore, CGD is not used as a process to change or incrementally change a system’s design basis. CGD is evaluated and performed after the determination of suitability. This order of completion is important because design and design verification determine suitability of the part to perform its designed functions, which bounds its safety functions. CGD is an acceptance process to provide reasonable assurance that the part will perform its safety functions. This includes critical characteristics needed to ensure those aspects of design (including prototype and qualification testing) are present in the actual item being dedicated. There are exceptions when the final design is not complete but advanced procurement of the part would be advantageous to DOE. This may occur because of a long lead-time to obtain the part or, for larger modifications or projects, important design details are not known until contractor bids are reviewed and awarded. In general, however, the suitability of design is established prior to initiating item procurement or the risk is accepted by the project team. Through review and reconciliation during the design and construction phases, the commercial grade dedication process should align with the final design and should address the safety function of the parts within the safety system. 5.5 Obsolete Parts or Parts no Longer Available In the event the purchaser lacks design information for obsolete parts or for parts that are no longer available, the appropriate organization should consider conducting reverse engineering. Reverse engineering can be a useful technique for replacement components and parts, especially when Original Equipment Manufacturer (OEM) support is minimal or non-existent. There are potential benefits to continue with an existing design by replacing obsolete components and parts versus modifying and/or replacing systems with the added design and modification costs. There are also challenges from the complete ownership of the design once reverse engineering is undertaken and the OEM part is essentially abandoned. When considering this discussion of reverse engineering, it is important to be familiar with NRC Information Notice 2016-09, “Recent Issues Identified when using Reverse Engineering Techniques in the Procurement of Safety Related Components” and EPRI TR-3002011678, Guidance for the Use of Reverse Engineering Techniques, Revision 1 to EPRI TR-107372, May 2018.

Some of the primary considerations when deciding and entering a reverse engineering strategy are described below. 5.5.1 Risk and Cost Analysis Considerations • Risk and cost are increased with the complexity of the component or part. DOE-HDBK-1230-2019 12 • Risk and cost are increased with the presence or possibility of special processes or conditioning of the component or part. • Risk and cost are increased by the lack of information and data. The more data and information that needs to be developed and processed to support reverse engineering, the higher the risk and cost. • Risk and cost are compared to all options available 5.5.2 Other Issues • Patents • Proprietary Information • Copyrights • Trade Secrets These items are unique with each reverse engineering opportunity and, depending on the OEM, the complexity and function of the item can weigh heavily on the decision to use the reverse engineering methodology. 6.0 Commercial Grade Dedication Process Description A facility obtaining an item or service that supports a nuclear safety function has two options. The item or service should be procured subject to the requirements of ASME NQA-1 Part I and II or be commercial grade dedicated in accordance with the requirements of ASME NQA-1. It is important to point out some clarification provided by the Electric Power Research Institute (EPRI) in their Technical Report, EPRI TR 3002002982. As noted in the EPRI document, when the supplier controls the design information, a supplier can produce a basic component using their ASME NQA-1 program. This topic is discussed in more depth in Section 8.0 of this Handbook. When CGD is needed, dedication requirements should be included in applicable procurement and technical documents as necessary to support the planned dedication efforts. Suitability of an item or service should be established before CGD of that item or service can be considered. Suitability is determined through the detailed design process where the design inputs and conditions are established, and the appropriate item or service is selected. The process may require calculations, analyses, cost benefit evaluations, and other design activities. The design should consider all applicable design requirements including operability, maintainability, fit, form, function, process, interfaces, seismic, and environmental. If seismic or environmental qualification is required, it should be established as part of the design process. Only after suitability of a design has been established can the CGD process be implemented. The dedication plan should be developed by the engineering organization with input from the QA and design organizations, as discussed in Section 6.1 of this Handbook regarding how selected critical characteristics should be verified. The CGD effort requires a dedication plan incorporating requirements from the technical evaluation (see section 6.2). CGD includes the identification of critical characteristics and methods for their acceptance, and the acceptance criteria that will provide reasonable assurance that the item or service will perform its intended safety function. The identified critical characteristics involved in CGD are those that may be important to identification DOE-HDBK-1230-2019 13

attributes, design, physical, performance, or dependability characteristics of a commercial grade item or service that, once verified, will provide reasonable assurance that the item or service will perform its intended safety function. If a design characteristic is important to the entity needing the item or service, but that characteristic is not critical to providing reasonable assurance that the item or service will perform its intended safety function, then the characteristic should not be termed a critical characteristic. Where feasible, those critical characteristics selected for an item should be measurable, cost-effective, and easily verified, but if needed to demonstrate reasonable assurance, more difficult acceptance criteria should also be chosen. Initiation of the dedication process is dependent on the following: • Confirmation that the item or service performs a safety function; and • Confirmation that the item or service is a commercial grade item (CGI). A typical CGD process includes the following: • Performing a technical evaluation (see section 6.1, Technical Evaluation) resulting in the identification of the safety function and the selection of the critical characteristics; • Selecting acceptance criteria; • Selecting, and documenting one or more of the four acceptance methods (discussed below) for each critical characteristic; • Using the plan to evaluate the item or service to be dedicated. Note: For further information, see Section 6.3, Critical Characteristics Determination and Appendix C, “Commercial Grade Dedication Process Flow Chart” for new item, like-for-like, and equivalent evaluations. The goal is to provide reasonable assurance that the CGI or service can perform its intended safety function and is the part or service specified in the procurement documents. Reasonable assurance is established by engineering judgement. This process should be supported by sufficient documentation to permit verification by a qualified individual. The word “reasonable” connotes a level of confidence which is justifiable but not absolute. In the context of product or service quality, “reasonable assurance” of measurable performance should be based on facts, actions, or observations (objective evidence). When you have objective evidence and/or measurable performance, someone can draw the conclusion that reasonable assurance has been attained. These judgements are commonly referred to as “engineering judgement” and should be documented as a QA record. (See EPRI Report TR-3002002982 Section 13.2) An efficient CGD program performs the CGD process on a case-by-case basis defined by the items being dedicated. Although it seems logical to develop one dedication plan for a given purchase order, attempting to dedicate multiple dissimilar commercial items increases the risk of errors in planning and estimating the cost of performing the CGD process. Prior to initiating the CGD process, an estimate of the cost to perform the CGD process should be completed. The cost- effectiveness of pursuing CGD as opposed to buying the item from a supplier with an ASME NQA-1 program can then be determined. There are also tradeoffs involved in choosing between available commercial items. It may be more cost effective to select a somewhat higher priced item if the supplier of that item has a better process and will require less costly and/or time-consuming supplemental activities by the dedicating entity to dedicate the item.

DOE-HDBK-1230-2019 14 Figure 1 provides an overview of the generic CGD process. This overview demonstrates how the technical evaluation and acceptance process are applied to perform CGD. Note that even when using a supplier with an ASME NQA-1 program, CGD may be required for sub-tier suppliers. See Section 8.0, NQA-1 Original Equipment Manufacturer Options and Oversight. Documentation of the completion of the elements of CGD provides the quality record of the logic for selection of critical characteristics to be verified, verification of those critical characteristics, and documentation of acceptance of the item or service. Appendix C provides an overview of the generic CGD process, demonstrating how the technical evaluation and acceptance process are applied to perform CGD. DOE-HDBK-1230-2019 15 6.1 Planning for Commercial Grade Dedication This section supports the planning process in coordination with Sections 5.1 through 5.5 of this Handbook. The intent is to emphasize the importance of training, the procurement strategy meeting, and the CGD methods to be selected based on the options of the suppliers that are available. Personnel involved with the selection of procurement strategies should have in-depth training in the procurement and CGD processes; design engineering processes; and on the procedures that address these processes. Prior to developing CGD packages and/or purchasing items, it is important to consider the procurement strategy for obtaining the item to be obtained. A Procurement Strategy meeting may not be required in all cases but is considered best practice and should be held as early as is practicable. The purpose of the meeting is to include Procurement, Engineering, Project Management (if assigned), Operations, Nuclear Safety, Quality Assurance, and other appropriate stakeholders in the process. Procurement personnel may not have expertise for all items being dedicated. They may need to rely on personnel in the design organization or outside sources for the requisite expertise. Many facilities have found that the procurement and engineering staff should work together to reach sound decisions on applying the CGD process for safety applications. Procurement Strategy Meeting The procurement strategy meeting determines if using an ASME NQA-1 Evaluated Supplier is feasible. If not, the team determines the framework for the CGD acceptance process that assures the item will perform its intended safety function. The team selects one or more of the 4 methods of acceptance (see Section 6.3, Dedication Process): • Method 1, Special Tests, Inspections, and/or Analyses • Method 2, Commercial Grade Survey of the Supplier • Method 3, Source Verification • Method 4, Acceptable Item or Service Performance Record (Note that Method 4 is always combined with one or more of the other three methods) The procurement strategy should consider using an ASME NQA-1 Evaluated Supplier as a source of parts. Facilities normally maintain a list of suppliers who maintain QA programs per ASME NQA-1 and who have been audited either by the facility or by a trusted agent (another facility or third-party auditor) for inclusion in the list. The procurement personnel should consider the following:

(1) Evaluated supplier vs. Commercial Grade supplier: A best practice for operating facilities is to develop methodologies for identifying critical parts based on operating history, commercial availability, effects of failed parts on processes and then develop procurement strategies prior to urgent needs requiring the use of CGD on a part-by-part basis. CGD can become burdensome, even for small projects, if advanced procurement strategy planning is not considered. For example, if a planned project is to upgrade a safety significant fire water suppression system within a facility that will need safety significant pipe of various sizes, various styles of sprinkler heads, pipe fittings, and fasteners, then consideration of the procurement strategy should take place well in advance; otherwise it would not be uncommon to develop 25 to 30 CGDs and, if Method (1) is selected to DOE-HDBK-1230-2019 16 provide objective evidence for the acceptance criteria, then the process can be overwhelming and inefficient, especially if destructive testing is required. (2) If the supplier meets cost, schedule, performance, and other considerations. (3) If there is no evaluated supplier (or one that can be evaluated), then proceed to CGD process. Case Study: Example 1 in Section 9 of this Handbook illustrates a best practice approach for CGD preparation, review and approval. The round table meeting represented in the example is being held to discuss the CGD approach and prepare for the procurement of the item/service. Present at the meeting should be participants with knowledge of the item/service. Communication between the organization’s CGD participants is paramount for a successful program. As shown in the example, the review and preparation of the CGD package includes the Design Authority, QA Engineering, Procurement Engineering, and other interested parties. A final review by the same organizations and personnel is performed upon completion of the acceptance process to validate that the CGD was conducted properly and that the results met the CGD plan. Examples 2-4 in Section 9 illustrate the rigor of an up-front round-table discussion/review process. However, as demonstrated in these examples, they do not apply the same rigor to reviews of the completed CGD package. The purpose of a final review is to add another layer of assurance that the CGD documentation package is satisfactory. 6.2 Technical Evaluation The technical evaluation should be performed to ensure that the correct technical requirements for an item are specified in a procurement document. This evaluation is conducted by the engineering organization and used to identify and document the safety function of each item/service based on review of the approved safety analysis and supporting data (see Section 5.0, Commercial Grade Dedication Preparation). Under ASME NQA-1, CGD is performed only on those items and services that provide a safety function. Design output documents, supplier technical information, and other relevant industry technical and operating experience information, as appropriate, should be utilized to prepare the technical evaluation. Under DOE regulatory requirements, there may be instances in which a commitment to implement ASME NQA-1 on a non-safety-related item such as hardware for an air permit would need the performance of CGD. As such, critical characteristics would be those that support the performance of the item to meet program requirements and not the safety class/safety significant safety function.

Analysis of system and component level safety functions may be required to determine item level safety functions if not discussed in the safety basis. Components that perform a safety function can contain items that do not perform a safety function. Replacement items should be evaluated in accordance with an approved and controlled process to determine their individual safety function in relation to the component or equipment. The technical evaluation should also result in an understanding of the overall safety function. Based on this evaluation, the engineer should be able DOE-HDBK-1230-2019 17 to determine which items/services of the procurement should be procured to ASME NQA-1 requirements or dedicated, and which items/services can be procured from a commercial supplier. The technical evaluation for an item or service should also evaluate the scope and boundary for use of the item or service and determine whether or not the item is passive or active in performing the safety function. When an item has multiple functions in a facility (procured as bulk items), the technical evaluation should be based on the most severe use of the item. If the technical evaluation does not evaluate the most severe function, then controls should be established to ensure that the dedicated item is only used for the evaluated scope. A methodical approach to technical evaluations provides thorough, accurate and consistent results. The technical evaluation should be performed by the responsible organization to: • Determine the safety function of the item or service; • Identify performance requirements, the item functional classification, and applicable service/state conditions (seismic and/or environmental) in appropriate design documents and perform a failure modes analysis if required; • Confirm that the item or service meets the commercial grade item definition criteria; • Identify the critical characteristics; • Identify the dedication method for verification of the acceptance criteria; and • Determine if a replacement item is a like-for like, equivalent or new item. The credible failure modes of an item in its operating environment and the effects of these failure modes on the safety function should be considered in the technical evaluation for the selection of the critical characteristics. Services should be evaluated to determine if the failure or improper performance of the service could have an adverse impact on the safety function of equipment, items/materials, or the facility operations. If the design criteria for the CGI are known by the dedicating entity, then the item may be dedicated to these criteria in lieu of defining a specific safety function (the design criteria envelope the safety function). In this case, consideration of failure modes is not required, and the item’s design requirements become the critical characteristics for acceptance criteria. This would be most appropriate when applied to large numbers of simple commodity items. In accordance with ASME NQA-1, when evaluating a replacement item, if the design criteria or safety function of the original item have changed, the replacement item should meet the new design criteria and safety function. Like-for-like and equivalent items are not a design change subject to ASME-NQA-1-2015 Part I, Requirement 3, Section 600, “Change Control.” 6.2.1 Performance and Service Conditions

An effective dedication process is based upon a clearly defined safety function for the item or service being dedicated. The safety function includes on-demand performance to prevent or mitigate a nuclear hazardous condition through correct design of safety SSCs, proper analysis of credible accident scenarios, and management and administrative decisions impacting safety. The safety functions performed by the item or a host component in support of the overall safety function are described in the DSA for an existing facility, the PDSA for a facility under construction, or other safety basis documentation. For systems or complex components, it may be that not all DOE-HDBK-1230-2019 18 subcomponents would impact the safety function. If this is the case, the logic used by engineering for selecting the specific subcomponents to dedicate should be documented. The safety function is often a subset of the item function. For instance, the function of an instrument may be to maintain the pressure boundary of a pipe system and provide a flow signal, but the safety function may only be to maintain the pressure boundary. For a computer program that tracks surveillances of safety SSCs to meet the technical safety requirements, the portion of the computer program that calculates dates based upon past surveillances completed and automatically notifies an engineer to schedule the surveillance would be the safety function, whereas the portion of that same computer program that stores the surveillance report may not be part of the safety function. If there is any question as to the safety function, the question should be raised to the responsible engineering and nuclear safety organizations. 6.2.2 New or Replacement Item Evaluation DOE is building new facilities and procuring new items from suppliers not having QA programs based on ASME NQA-1. In this situation the flow chart in Appendix C describes the steps normally used to develop a dedication package. 6.2.3 Like-for-Like Item Evaluation ASME NQA-1 defines like-for-like replacement as the replacement of an item with an item that is identical. It further defines “identical item” as an item that exhibits the same technical and physical characteristics (physically identical). If the design, materials, manufacturing processes, and end use of an item are identical to an item or service that has already been accepted and CGD performance issues have not been identified for that item, then ASME NQA-1 states that no further technical evaluation is required. A dedication of the item should still be performed and verified to meet the acceptance criteria. Items may be considered identical or like-for-like if one of the following applies: • The item is provided from the OEM (successor companies that maintain equivalent quality controls are acceptable), and has not been subject to design, materials, manufacturing, or nomenclature changes; • The item was purchased at the same time and from the same supplier, as determined by the purchase date, shipping date, date code, or batch/lot identification; • Evaluation of the item confirms that no changes in the design, materials, or manufacturing process have occurred since the procurement of the original item.

A like-for-like determination should not be based solely on the selection of a commercial-grade supplier with items manufactured to meet the same industry standards as the original item. Meeting the same industry standards may be a necessary condition but is not a sufficient condition for a like- for-like determination. For example, a national standard for a valve may require corrosion resistant material for the stem assembly. The manufacturer may initially use a stainless-steel material for the stem and later decide to substitute a different corrosion resistant material and still meet the national standard's requirement. Acceptance to a national standard only would not detect this possible issue in dedicating this valve as a like-for-like. DOE-HDBK-1230-2019 19 The like-for-like evaluation is to determine if there is an existing technical evaluation for the item, not an evaluation to determine if an alternate item is acceptable for use in the design. When considering a like-for-like procurement, the evaluation process should consider the following: • Same manufacturer; • Complexity of the item; • Same published product description of the item; • Supplier performance; • Supplier design change process to ensure no changes have been made to the design; • Adequate supplier controls of the manufacturing and procurement process; and • Supplier reaffirms no changes in material, design, physical characteristics (fit, form), function or interchangeability. If the dedicating entity can demonstrate that the replacement item is identical, then the safety function, design requirements, and critical characteristics need not be re-determined. However, verification of the identified critical characteristics by an appropriate dedication method is required to verify the acceptability of the replacement item. Generally, computer programs are replaced when the program fails to perform as expected, or is upgraded to include new functionality or no longer functions after modification to the underlying hardware or operating system. A computer program typically is not subject to like-for-like replacement unless it is installed from original media/source or a verified backup. 6.2.4 Equivalent Item Evaluation When differences exist from the original item, an equivalency evaluation is required to determine if any changes in design, material, manufacturing process, form, fit, or function could prevent the replacement item from being interchangeable under the design condition of the original items and performing its required safety function. The equivalency evaluation should be documented and include the following: • Identification of the changes in design, material, manufacturing process, computer programs development process, configuration, form, fit, or function of the replacement item that is different from the original item; • Evaluation of the changes; and • Confirmation that the changes do not adversely affect the current design or safety function of the item. If the change adversely affects or is not bounded by the current approved design bases, the replacement item is not equivalent and should be rejected or processed as a design change in accordance with ASME NQA-1-2015 Part 1, Requirement 3, section 600, “Change Control.” Equivalency evaluations can determine the acceptability of the difference in the item to perform its safety function and to identify the critical characteristics for acceptance for the replacement item. Equivalency evaluations are not to be used as the sole basis to accept a commercial grade item. Selection and verification of the identified critical characteristics by the appropriate dedication method is required to verify the acceptability of the replacement item.

DOE-HDBK-1230-2019 20 Equivalency can be used for computer programs when the computer instructions associated with the safety function and any of the safety functions interfaces are not changed, a situation most likely to be encountered during software updates. The equivalency evaluation determines that the changes made in the new software item do not affect the coding in the software related to its safety function. Proving equivalency for software via documentation will be difficult to implement without access to the source coding or detailed descriptions of the changes included in any software updates. An approach using regression testing across an accepted set of test cases to determine if any changes have affected the software’s safety functions would be more likely to document equivalency between software updates. 6.3 Critical Characteristics Determination ASME NQA-1-2015, Part 2, Subpart 2.14, Paragraph 500 states that the critical characteristics should be identifiable and measurable attributes based on the complexity, application, function, and performance of the item or service for its intended safety function. The critical characteristics criteria should include tolerances and computer data input ranges when appropriate. Critical characteristics should include the part number, computer program version identifier, physical characteristics, identification markings, and performance criteria, as appropriate. ASME NQA-1- 2015, Part 2, Subpart 2.14, Paragraph 500 also states that an item’s part or catalog number should be considered a critical characteristic if it provides a method to link the item with the manufacturer’s product description and published data (see Figure 2). The dedication process should not rely on the part number or computer program version identifier alone as the only critical characteristic to be verified. CGIs or services can have numerous characteristics that are related to composition, identification, or performance of the item or service. However, it is not normally prudent or fiscally sound to verify all characteristics to provide reasonable assurance that the item or service will perform its intended safety function. The critical DOE-HDBK-1230-2019 21 characteristic acceptance criteria are those criteria for which one or more of the four acceptance methods discussed in Section 6.3 will be used to verify acceptability. Both the specific acceptance method and the acceptance criteria will be specified for each critical characteristic in the dedication package. Verification of the critical characteristics identified in the CGD plan provides reasonable assurance that the item or service will perform its safety functions. The level of verification is expected to be graded. Items with less impact to safety or large design margins may not need as many characteristics to be verified as in the case of items with critical safety and/or lower design margin. The following factors should be considered in determining the extent and type of verification to be applied: • The consequences of malfunction, defect, or failure of the item; • The complexity or uniqueness of the item; • The need for special controls over process parameters and surveillance of equipment resulting from use of the item; and • The degree of standardization of the item. When establishing reasonable assurance, the engineer should consider:

• What is the degree of verification of any acceptance criteria; • Was an adequate sample of items chosen for verification; and • Were the proper critical characteristics selected for verification? Critical characteristics selected for acceptance should have identifiable and measurable attributes based upon functional complexity and the application and performance of the item or service. Unless controls are in place to prevent usage in undesignated locations, include criteria related to the operating environment, location/design basis conditions (or manufacturing design limits) of the item in the facility. For computer programs, the location of the computer hardware and the computer configuration where the computer program is installed may be critical characteristics. The supplier’s published product description or additional technical information typically identifies technical criteria or performance characteristics inherent in the design and manufacturing or development of the item. The supplier can employ standard tests or inspections as part of the manufacturing/development process and utilize a quality program to assure that appropriate controls are applied. This type of information is an example to be considered in the selection of critical characteristics and the related acceptance criteria. In cases where the critical characteristics criteria cannot be determined from the manufacturer’s or other documentation, the dedicating entity may perform an engineering evaluation, examination, or test (or any combination thereof) of the original item to develop the critical characteristics criteria. When a procurement specifies that an item meet Underwriters Laboratories (UL) requirements, then the presence of a valid UL label can be listed as a critical characteristic if all of the following are verified: DOE-HDBK-1230-2019 22 • The supplier’s UL testing program covers the critical characteristics for the specific application for which UL equivalency is being sought. • The supplier’s procedures implement the appropriate testing. • When a supplier provides a UL listing from the manufacturer, verify that the manufacturer has a UL testing program that applied the UL label that adequately addresses the critical characteristics for the component. Document the following items before selecting critical characteristics: • Credible Failure Modes and Effects Analysis • Environmental and Natural Phenomena Evaluations • Item Characteristics Case Study: The following is a best practice: When a critical characteristic is deemed to be important as determined by the design and engineering documents and is not selected as a critical characteristic, a justification should be provided to address why it is not selected. The examples 1 through 4 (CGD Ball Valves, Fittings, Gaskets) are provided in Section 9.0 of this Handbook and document the critical characteristics selected. Example 1 has a section on the form that requires the documentation for “Justification for Changed Approach to Verify a Critical Characteristic.” This is considered a best practice since it is required to be addressed and not left to the CGD preparers to remember to document the explanation of the critical characteristics and acceptance criteria selection. See ASME NQA-1-2015, Part 2, Subpart 2.14, Paragraph 500. 6.3.1 Consideration of Failure Modes

Failure analysis provides information that assists in evaluating and verifying critical characteristics. It is important to understand the failure modes of the commercial item device and their impact on the system failure modes. Failure analysis supports CGD as well as design. Consideration of potential failure modes and mechanisms helps to identify critical characteristics. Without an understanding of the item/service failure modes and the effects of failure in its operating environment it can be difficult to discern the impact of a failure on the safety function or successful/satisfactory operation. ASME NQA-1-2015 Part 1, Subpart 2.14, Paragraph 401 states in the technical evaluation general discussion that the credible failure modes of an item in its operating environment and the effects of these failure modes on the safety function should be considered in the technical evaluation for the selection of the critical characteristics. It is incumbent on engineering to ensure that failure modes are properly developed and evaluated through a suitability review of the item’s design characteristics. Some common failure modes are listed in Appendix B, “Examples of Credible Failure Mechanisms.” 6.3.2 Environmental Conditions and Natural Phenomena Evaluation The terms Mild and Harsh Environment are included here because there are Equipment Environmental Qualification (EEQ) application considerations. CGD packages typically consider DOE-HDBK-1230-2019 23 each piece of equipment to determine its exact function for each accident and whether it can perform that function in a harsh environment. The terms were not included in the Section 4.0 Definitions since they were not used in the text portion of the Handbook and only used in the examples. Mild Environment. An environment that would at no time be significantly more severe than the environment that would occur during normal plant operation, including anticipated operational occurrences. [Institute of Electrical and Electronics Engineers (IEEE) Std 323, Standard for Qualifying Class 1E Equipment for Nuclear Power Generating Stations] Harsh Environment. An environment resulting from a design basis event that is not a mild environment, i.e., loss-of-coolant accident, high-energy line break, and main steam line break. [IEEE Std 323] The environmental conditions under which a safety function may need to perform over the life of the items, systems, or complex components are established during design work and need to be evaluated during the technical evaluation. ASME NQA-1-2015 Part II, Subpart 2.14 Paragraph 500 states that commercial grade items designated for installation or installed in seismically or environmentally qualified equipment or in locations which require such qualification should include the selection of appropriate critical characteristics required to maintain the qualification of the component or equipment. For example, environmental conditions such as the presence of high pH, and/or high radiation levels that would result in an adverse impact on an item’s material and the critical characteristics need to be identified. The expectation for long term performance of a valve seat in a high pH could require a specific material selection and subsequent acceptance criteria. The need for seismic qualifications could also impact material selection and acceptance criteria to ensure that the item will perform as expected relative to the seismic event. Typically, computer programs, including programs embedded in digital equipment, do not require an environmental or natural phenomena evaluation. The computer hardware and other equipment where the computer program resides should be evaluated for impacts from any environmental or natural phenomena condition.

The CGD process is the same when used to accept an item where the application has equipment qualification requirements as it is for applications which do not have equipment qualification requirements. The purpose of CGD acceptance is to provide reasonable assurance that an item will perform its intended safety function. Therefore, for applications which have equipment qualification requirements, these equipment qualification requirements simply become an input to the acceptance process for the selection of acceptance criteria. When the application includes equipment qualification requirements, the acceptance criteria should always include characteristics which maintain equipment qualification. Case Study: The examples provided in Section 9.0 of this Handbook provide different CGD items and levels of detail with various conditions. Best practices are discussed here: (1) When bulk items are procured without knowing their final installation location or safety classification, the dedication process for the whole batch needs to consider the most severe application or designation for the items. It is important to maintain traceability to the most severe requirements. DOE-HDBK-1230-2019 24 See Example 3 Section 7 (Bounded Scope of Use), for an example of bulk items traceable to the Project’s Engineering Specification document. See Example 2 Section 7 (Bounded Scope of Use) for the description of use. (2) For items dedicated in bulk, the responsible organization needs to ensure sufficient detail is provided in the CGD documentation to support future like for like/equivalency evaluations for replacement parts. This is accomplished by providing the details specified in Section 6 (Parent Component Information) of Examples 2 and 3. Areas such as End Use/Application, Design/Safety Classification, Design Function, and Functional Mode are required. See Examples 2 and 3. (3) Design/Safety Classification of “safety class and safety significant items” is determined through the engineering evaluation process provided by the PDSA/DSA, and Equipment Qualification datasheets. The engineering documents also determine the EEQ or Equipment Seismic Qualification (ESQ) applications. It is very important that the engineering organization provides the proper information, engineering judgement, and reasonable assurance when determining safety considerations and safety functions not only of the parent component but also its pieces and parts. See Examples 1 through 4. (4) Bulk commodities such as feed material for an ASME NQA-1 shop that manufactures safety class and safety significant equipment may be dedicated without having a defined safety function and without undergoing a creditable failure modes analysis. If the design is known by the dedicating entity, then the design requirements can be used as the basis of the critical characteristics without a defined safety function and without performing a creditable failure modes analysis. An alternative approach could be to have the ASME NQA-1 OEM bring the commercial material into the fabrication activity by using their ASME NQA-1 program requirements such as design, material receipt, procurement, procurement documents and controls, inspection, and testing. 6.3.3 Item Characteristics

Item characteristics include all the characteristics of an item, including design characteristics, identification attributes, physical characteristics, performance characteristics, and for software, dependability characteristics. Not all item characteristics contribute to an item’s safety function. An example is the case of safety-class jersey barriers that keep vehicles away from radioactive materials storage areas, where paint color or presence is immaterial to the safety function, but is an item characteristic none the less. Note that although an identification attribute may be important to verify that the item is correct, it may not have a relation to the item’s safety function. 6.3.3.1 Design Characteristics Design characteristics are those properties or attributes that are important for the item’s form, fit, and functional performance. These characteristics are the identifiable and/or measurable attributes of a replacement item that provide assurance that the replacement item will perform its design function. Many design characteristics can tie back to the performance of the safety function. Physical or performance characteristics of the item that may have been specified in the original equipment DOE-HDBK-1230-2019 25 specification and affect the item’s functional performance should be considered for verification. Important performance characteristics that do not impact the safety function are also valid design characteristics. Not all design characteristics that support the safety function need to be verified during the dedication process. The selection of design characteristics supporting dedication is discussed in more detail below. Examples of design characteristics (not all-inclusive) that could be selected as critical characteristics for hardware are listed in Appendix A. Critical characteristics to consider for computer programs are in NQA-1 2015, Subpart 3.2-2.14, Implementing Guidance for Part II, Requirement 2.14: Quality Assurance Requirements for Commercial Grade Items and Services, Commercial Grade Computer Programs, and Software Services. A complete understanding of the item or service specifications is an important prerequisite to ensuring the item or service is properly dedicated. Examples of specifications include instrumentation, equipment, computer hardware, computer programs, human-machine interface, quality and reliability requirements. Experience has shown that many of the problems that occur in dedication are due to inadequate understanding/description of the item specification. This is especially true with computer programs. The design requirements for the intended safety functions and anticipated failure modes factor heavily into ensuring the correct critical characteristics are identified. For computer programs, it is particularly important to identify specifications and design features that are related to unused and unintended or prohibited functions, as discussed in NQA-1, Part II, Subpart 2.7, Paragraph 404. Critical characteristics fall into the three categories: physical, performance, and dependability. The names of the categories were selected from industry guidance and chosen simply to be descriptive of the characteristics. Dependability applies only when dedicating digital equipment and computer programs. 6.3.3.2 Identification Attributes Identification attributes may include characteristics such as:

• Item part/model/drawing number including revision number; • Software/firmware version number; • Dimensions; • Shop order number • Location of mounting holes or brackets; and • Color. According to Subpart 2.14 of ASME NQA-1-2015, Paragraph 500, an item’s part or catalog number should be considered a critical characteristic if it provides a method to link the item with the manufacturer’s product description and published data. However, the dedication process should not rely on the part number alone as the only critical characteristic to be verified. 6.3.3.3 Physical Characteristics Physical characteristics include mounting attributes, dimensions, chemical or other material properties, computer file size, manufacturer’s part number, and computer program/firmware revision number. Most of these characteristics are verified using inspection and measurement, which fall under Method 1 (Tests and Inspections). DOE-HDBK-1230-2019 26 6.3.3.4 Performance Characteristics The engineering organization should, as part of the technical evaluation, determine if there are specific performance expectations that should be met by the item or service to perform the safety function. Examples could include start up and loading time for an emergency diesel generator, closing time for an automatic closing damper, blow-down percent for a relief valve, or operation during abnormal service conditions (such as tripping a breaker at X current). For computer programs, performance could also include the functionality of the item device (the “should-do” functions) and performance related to this functionality (e.g., response time). Performance characteristics could also include environmental requirements related to the needed performance (e.g., meeting accuracy requirements over a specified range of ambient temperatures). Performance characteristics also include characteristics related to failure management and “should- not-do” functions. Although applicable to mechanical and electrical systems, failure management is especially applicable to computer programs. For example, based on a failure analysis, a required behavior of the item under certain abnormal or faulted conditions may be identified in the specifications. This behavior most likely is a critical characteristic that will require verification. Acceptance criteria might include items such as detection of failures, and “preferred” or fail-safe failure modes to be entered under prescribed circumstances. Verification methods may include testing and design reviews, supported by failure analysis and reviews of operating history. These activities can involve Methods 1 (Special Tests, Inspections, and/or Analyses), 2 (Commercial Grade Survey of the Supplier), 3 (Source Verification), and 4 (Acceptable Supplier Item or Service Performance Record). 6.4 Dependability3 Characteristics: Special Considerations for Software Dependability characteristics are the category in which dedication of a computer program differs from that of other types of items. Dependability addresses attributes that typically cannot be verified through inspection and testing alone, and are generally affected by the process used to produce the item. A key issue is that mechanical and electrical item failures are typically associated with fabrication defects, aging, and wear-out, but computer programs do not wear out in the manner of mechanical or electrical equipment. If there is a problem in the computer program that degrades the dependability, this reflects the computer program design defect that was built into an item, a mismatch between the item specifications and its design, or lessening of functionality caused by changes to supporting elements such as operating system and library patches or updates.

In traditional dedications of mechanical and electrical equipment, dependability issues have been treated within the supplier’s QA program and have been delineated in the commercial grade survey or source inspection plan. Due to the increased importance of the “built-in” attributes to computer programs, NQA-1-2015 Part III, Subpart 3.2-2.14, Table 501, Typical Critical Characteristics to Consider for Computer Programs, contains the attributes that describe the critical characteristics to ensure that they are adequately addressed and documented during the dedication process. 3 The term “dependability” is used in various ways within the software and safety communities. In this document it is used broadly to include a number of characteristics of computer programs such as reliability, availability, built-in quality, and other related characteristics. DOE-HDBK-1230-2019 27 Dependability attributes, such as reliability and built-in quality, are generally influenced by the process and personnel used by the supplier in the design, development, verification, and validation of the item. For computer program-based systems, high quality is best achieved by building it in, following a systematic life cycle approach from requirements through implementation, with verification and validation steps, and appropriate documentation for each phase of the life cycle. Hence, understanding the supplier’s development process can be very useful in developing confidence in the dependability of a product. The dependability of an item can be heavily influenced by designed-in elements, including robustness of the computer hardware and computer program architectures, self-checking features such as watchdog timers, and failure management schemes such as use of redundant processors with automatic fail-over capabilities. Evaluation of these attributes requires a focus on more than just the development and QA processes. It may require gaining an understanding of the specific computer program and computer hardware features embodied in the design and ensuring that they are correct and appropriate in light of the requirements of the intended application. Accordingly, a survey team may need to include specialists who understand the computer program and the system in which it will be applied in addition to QA and programmatic issues. The dependability category captures those critical characteristics that should be evaluated to establish reasonable assurance regarding built-in quality of the item. It also includes characteristics related to problem reporting and configuration control. Verification of these characteristics typically involves a survey of the supplier’s processes (Method 2) and review of the supplier performance record and product operating history (Method 4). Source inspections (Method 3) may be used to verify certain computer hardware quality characteristics during manufacture, or to ensure quality of changes made to computer programs as part of a procurement. Source inspections would not be used in verifying built-in quality of pre-existing computer programs, because the computer program development has already occurred.

The critical characteristics in the dependability category, including the “built-in quality” characteristic is referenced in NQA-1-2015, Subpart 3.2-2.14, Implementing Guidance for Part II, Requirement 2.14: Quality Assurance Requirements for Commercial Grade Items and Services, Commercial Grade Computer Programs, and Software Services. The critical characteristics in this category are somewhat different from those in the other categories because they are less tangible and quantifiable than a part number or a physical dimension. A commercial item may be judged to have sufficient quality, even if its development process lacked some of the rigorous steps of modern computer program engineering, and/or some formal documentation. Reaching a reasonable level of assurance of quality of a CGI typically involves making a judgement based on a combination of the item development process and its documentation, operating history, testing, review of design features such as failure management, and other factors noted in the critical characteristics. The dedicator should determine what activities are appropriate to verify the built-in critical characteristics. In general, the choice and extent of activities undertaken to verify adequate quality, and the specific criteria applied in making the assessment, depend on the safety significance and complexity of the item. DOE-HDBK-1230-2019 28 6.5 Dedication Process The Engineering organization selects the acceptance methods as part of the Technical Evaluation and documents the selection in the CGD Plan. The selection of an acceptance method or combination of acceptance methods for the critical characteristics of a given CGI or Commercial Grade Service (CGS) should be based on factors defined in the CGD plan (e.g., selected critical characteristics, available supplier information, supplier quality history, and degree of standardization). The dedicating entity should provide reasonable assurance that the item meets the acceptance criteria for the identified critical characteristics. The four methods that can be used are: • Method 1 - Special Tests, Inspections, and/or Analyses; • Method 2 - Commercial Grade Survey of the Supplier; • Method 3 - Source Verification; and • Method 4 - Acceptable Supplier Item or Service Performance Record. The four acceptance methods provide, either individually or in combination, a means to reasonably assure that the CGI/CGS meets the requirements that were specified. Method 4 should not be used unless it is in conjunction with Methods 1, 2, and/or 3. The methods selected and the results of employing each method are important constituents of the dedication package documentation. Prior to classifying the item or service as acceptable to perform its safety function, the dedicating entity should determine if the following have been successfully performed: • The item is not damaged; • The item or service meets the specified acceptance criteria for the identified critical characteristics; and • Specified documentation was received and is acceptable. The selection of acceptance methods should be based on the type of critical characteristics to be verified, available supplier information, and the quality history of the item and supplier. If a critical characteristic cannot be verified by the selected dedication method, the dedication entity may select another or combination of dedication methods to verify the critical characteristics. The selection of another or combination of other dedication methods should be documented in a revision to the CGD Plan including justification for the revision.

The organization that performs or directs the dedication activity and determines that the item or service meets the acceptance criteria for the selected critical characteristics is the dedicating entity. The dedicating entity can be the manufacturer/supplier, a third-party organization (TPO), the purchaser, or the nuclear facility organization. In some instances, the responsibilities for the technical evaluation and performing the acceptance methods in accordance with the CGD Plan are shared among different organizations. For example, when the supplier does not have design responsibilities, the critical characteristics are provided by the purchaser/design authority. In this case the purchaser is directing the CGD activity and as such, is the dedicating entity. DOE-HDBK-1230-2019 29 6.5.1 Third Party Organization (TPO) Dedication A third-party dedicator is any company other than the OEM or purchaser that procures and accepts CGI and supplies the dedicated items as safety class or safety significant in accordance with their approved QA program. The purchase order to a TPO from the purchaser includes the quality and technical requirements and is designated safety class or safety significant. As such, the TPO’s ASME NQA-1 program should be evaluated and approved prior to performance of the dedication activity. The TPO may establish a working or teaming relationship with the supplier/OEM. This allows the TPO to obtain information on design, technical requirements, and design characteristics. Purchasers can use third-party dedicators to improve or maintain consistency and adequate control of suppliers conducting CGD activities. The purchaser may use oversight activities such as hold/witness points to verify the third-party dedicators and suppliers are functioning properly and are effective. The purchaser can provide the TPO with the technical information needed to accept the CGI. Where design information is not known, the TPO may perform the dedication activities typically conducted by the design organization (possibly using reverse engineering methods). When the TPO is an authorized representative for a supplier/OEM and has access to the design information, the TPO may also be responsible for assuring the CGI is like-for-like. If the CGI is equivalent, the TPO can be assigned to assure the item will not degrade the seismic and/or environmental qualification of the host equipment, if applicable. The TPO’s responsibility for like-for-like or equivalent evaluations needs to be clearly specified in the contract. 6.5.2 Method 1 – Special Tests, Inspections, and/or Analyses Method 1 includes special tests, inspections, and/or analyses performed after the receipt of a commercial grade item to verify the conformance with the acceptance criteria for the CC. This does not take the place of receipt inspection. Receipt inspection includes activities conducted upon receipt of items, including commercial grade items (NQA-1, Part II, Subpart 2.2) or other applicable QA standard, to check such elements as the quantity received, part number, general condition of items, damage and suspect/counterfeit items status. Use of Method 1 alone may be appropriate for the following: • When the item is simple in design; • When the computer program does not include functionality beyond the safety functions; • For commodity items; • When the critical characteristics are to be verified with tests/inspections; • When data to verify the critical characteristics is available in existing documents such as

specifications, drawings, computer program life cycle documents, instruction manuals, bills of material and catalogs; • Where multiple suppliers of the item exist; • When items are purchased in small quantities or larger homogeneous lots where sampling can be applied; • For items on which post-installation tests can be conducted; and DOE-HDBK-1230-2019 30 • When testing and inspection capabilities are available. If Method 1 is not appropriate as the only method of acceptance, it can be used in conjunction with Methods 2, 3, and/or 4. Special tests, inspections, and/or analyses may be carried out by TPOs (e.g., test labs or third-party dedicators) provided they have been approved by the purchaser as acceptable for use. Acceptance is either provided by an ASME NQA-1 evaluation and subsequent placement on an evaluated suppliers list or by survey if not part of an ASME NQA-1 program. In general, the services of an outside testing laboratory should be treated as any other service the user is procuring. Testing laboratories, as other types of suppliers, have a wide range of quality programs that may provide adequate controls over the analyses of interest. When outside services are used, the purchaser should verify that the test laboratory has in place programs and procedures which ensure as a minimum: • Tests are conducted properly and to industry standards (e.g., American Society for Testing and Materials [ASTM]); • Test equipment is calibrated and maintained in accordance with manufacturer recommendations; • Accuracy of test equipment used is appropriate to the acceptance criteria and tolerances specified; • Testing personnel are trained and qualified in the use of the test equipment and test methodologies; and • Calibration standards are traceable to nationally recognized standards or to international standards known to be equivalent to and verified against corresponding nationally recognized standards. Some tests and inspections cannot be performed until after an item is installed. When post- installation tests are used to verify acceptance criteria for the critical characteristics, the CGI or CGS should be identified and controlled to preclude inadvertent use prior to satisfactory completion of the dedication activities. Standard receipt inspection procedures typically involve checking the quantity received, damage, general conditions of items, suspect/counterfeit items status. and part number. For computer programs, receipt inspections often are as simple as checking that the computer program’s media has not been damaged and that the version identifiers are correct. Special tests and inspections go beyond these standard receipt inspection activities to verify that the critical characteristics are met. Examples of these types of critical characteristics include: • Material type (chemical make-up); • Material physical characteristics (e.g., hardness, yield strength); • Physical measurements and mass if required; • Open or closing time; • Leak rate; • Computer program version identifier; and • Computer program application size (e.g., number of kilobytes). DOE-HDBK-1230-2019 31 When implementing Method 1 it is important to understand that while receipt inspections and/or simple computer program installation checkouts are important to the CGD process, they are not adequate on their own for CGD. If special tests and inspections are performed, they should be done in addition to receipt inspections.

Note that some attributes such as the part number or computer program version identifier are attributes of a receipt inspection and should also be part of the dedication process for the item. They can be verified during receipt inspection and should also be listed as a critical characteristic. Acceptance criteria are generally contained in engineering documents held by the organization responsible for the design of the item. This may be the prime contractor’s engineering organization, computer program(s) development organization, or a supplier engineering organization, depending on the item. Specific acceptance criteria from the item specifications, design documents, technical codes, or industry standards should be listed in the CGD plan for each critical characteristic. Experience shows that the engineering, QA, and other organizations as appropriate, should work together during the development of the acceptance criteria. When evaluating the results of the test or inspection, all values tested or inspected should fall within the tolerance or data input range specified in the acceptance criteria. If one or more of the acceptance criteria is not met, the item is documented as nonconforming, resulting in an engineering evaluation of the results of the test and/or inspection to determine if the item is able to perform the safety function and meet design requirements. Other like items should be evaluated to determine if they exhibit the same nonconformance (i.e., extent of condition). In addition to tests or inspections by the dedicating entity or a third party, the results of tests and inspections performed by the supplier may be reviewed to establish acceptability if sufficient confidence in the supplier’s performance of the test or inspection is established. This is normally accomplished by performance of a Commercial Grade Survey (Method 2) discussed in Section 6.5.3. These are important elements of CGD Method 1 (not all inclusive) for preparers and reviewers.: • Perform receipt inspections to verify that the associated critical characteristics have been properly verified; • Review receiving records and associated supplier tests and inspection results; • Verify that the tests and inspections specified for acceptance using Method 1 will adequately verify the identified critical characteristics; • Verify that sampling plans are described and have adequate technical bases, considering lot traceability and homogeneity, complexity of the items, and adequacy of supplied controls; • Verify that the CGI inspection activities are adequately controlled under a quality program regardless of whether the inspections are performed in conjunction with other receipt inspection activities; • Maintain traceability of CGIs by controlling documents and identification and monitoring of CGIs DOE-HDBK-1230-2019 32 • Verify that measuring and test equipment were properly calibrated, that approved third party suppliers were used to perform tests, and that personnel were qualified to perform the tests; and • Ensure test results are documented in test reports. When a number of homogeneous items are being dedicated using Method 1, sampling may be used for the performance of non-destructive and destructive testing to establish reasonable assurance that items received are the items ordered and that they perform their intended safety functions.

Use of Method 1 frequently requires development of sampling plans to select items for special tests, inspections, and/or analyses. The plans should be based on standard statistical methods and supporting engineering justifications and should consider lot/batch traceability, homogeneity, and the complexity of the item. One generally accepted source for developing sampling plans is EPRI Final Report TR-017218-R1, which provides an enhanced methodology for the use of sampling in accepting and dedicating CGIs. This EPRI report provides useful information in establishing the basis for the sampling plan, but users should consider the document in total and clearly document the rationale for the selected sampling method. Sampling plans are discussed in more detail in Section 6.4. It is important to include the approved sampling plan in the dedication package for an item. In the event the purchaser or third-party dedicator choose to use outside testing services, these outside services are considered quality-affecting. The testing activities to support dedication should be performed under a QA program meeting ASME NQA-1 or procured and dedicated as a commercial-grade service. Services can result in a deliverable product that can be evaluated upon receipt or result in an activity that can be evaluated during or at the conclusion of its performance. Case Study: The examples provided in Section 9.0 of this Handbook provide different CGD items and levels of detail that support various conditions. Best practices and lessons learned are discussed here: This lesson learned is in the area of chemistry/partial chemistry as part of the critical characteristics for acceptance. Example 2, Section 10, documents that material chemistry is a critical characteristic. The acceptance criteria includes an ASTM specification, a list of chemistry compositions, and a reference for documentation of the material selection. Most procurement specifications state that the material used for components, bulk material, equipment, or subparts should meet an ASTM material specification for chemical and physical composition. Most also specify that a material test report, such as a Certified Material Test Report (CMTR), or Mill Test Report be provided to demonstrate that the item’s characteristics meet the referenced ASTM specification. In Example 2, there is a base document from a qualified or accredited laboratory that verified the requirements were met, and the Acceptance Activity in Section 10 is a destructive material chemistry examination. In some cases, a less exhaustive verification may be acceptable using the Positive Material Identification (PMI) methods of Standard ASTM A751-14a. The Standard discusses two common methods of performing PMI: XRF Spectroscopy and Spark Emission Spectroscopy. It also provides the normal elements and ranges for stainless steel in Tables 1 and 2 of the DOE-HDBK-1230-2019 33 standard. Note that XRF spectroscopy does not identify non-metal elements, and Appendix 2 of the Standard states that PMI is not a true analysis method comparable to the methods described in the body of the standard, and therefore is not to be used for reporting analysis of material chemical composition. The less-exhaustive verification via PMI might only check 3 of 7 compositions by XRF, but it would only be appropriate if there were an original CMTR from an evaluated supplier or from a testing organization previously verified to meet ASTM specifications. This prior verification would most likely be via Method 2, Commercial Grade Survey.

6.5.3 Method 2 – Commercial Grade Survey of the Supplier Method 2 activities are performed at the supplier’s facilities by the dedicating entity or its agent before releasing the CGI or CGS from the supplier or test laboratory facility. This confirms through direct observation of a supplier’s implementing process and commercial quality controls that are relevant to the selected critical characteristics to be verified without further dedication for safety related use. The commercial grade survey of the supplier should be performed, and the supplier’s capability deemed acceptable prior to issuing the purchase order for the item or service or as soon as possible after purchase order issuance. Failure to complete the commercial grade survey prior to allowing a supplier to produce the item or service creates a significant risk of procuring items or services that are not capable of being used for their intended purpose. The survey is not performed to the same level as an ASME NQA-1 Supplier Audit as discussed in ASME NQA-1, Requirement 7. A survey of a supplier may be appropriate: • When the supplier/manufacturer has implemented appropriate, documented, and effective commercial production and quality verification controls over the critical characteristics (as verified by the commercial grade survey); • When multiple items are being procured from the same supplier/manufacturing facility; • When those items are procured relatively frequently; and • When critical characteristics are not easily verified after receipt4. The basis of the commercial grade survey is to identify the process controls and their controlling documents used or planned for use during the manufacture or development of the specific CGI. A commercial grade survey is a method to verify critical characteristics by evaluating the adequacy and effectiveness of the supplier/manufacture’s commercial quality controls. A commercial grade survey is performed at the supplier/manufacture’s facility using a checklist or survey plan developed by the dedicating entity. The survey should be “performance-based” (not compliance- based) and address the following: • Identification of the item, product line, or service included within the scope of the survey; • Identification of the critical characteristics to be controlled by the supplier; • Verification that the supplier’s processes and quality program controls are effectively implemented for control of the critical characteristics; 4 For CGD of computer programs, frequently only Commercial Grade Survey can verify some of the critical characteristics. As such, this method will be used in most CGD of computer programs. DOE-HDBK-1230-2019 34 • Identification of the survey methods or verification activities performed with results obtained; and • Documentation of the adequacy of the supplier’s processes and controls. Because a commercial grade survey evaluates the adequacy of the supplier’s commercial quality controls, a commercial grade survey should not be employed as a method for accepting CGIs or CGSs from suppliers with undocumented quality programs or with programs lacking effective implementation of the supplier’s own specified processes and controls. After a supplier’s specified processes and controls have been determined to be adequate, the dedicating entity should invoke or reference the verified processes and controls, including revision level, as a part of the purchase order or control requirements for the CGI or CGS, and then require the supplier to provide a Certificate of Conformance (C of C) attesting to the implementation of the identified processes and controls. Dedicating entities rely on the supplier/manufacturer to verify critical characteristics during the fabrication process. Commercial grade surveys do not qualify a commercial supplier to ASME NQA-1 requirements.

The following approach should be used to prepare or review CGD packages for items that are dedicated using Method 2: When a critical characteristic is based on CMTRs or C of Cs, the criteria of ASME NQA-1-2015, Part I, Requirement 7, Section 503 should be met. Specifically, • The certificate should identify the purchased material or equipment. • The certificate should identify the specific procurement requirements met by the purchased material or equipment, such as codes, standards, and other specifications. This may be accomplished by including a list of the specific requirements or by providing, onsite, a copy of the purchase order and the procurement specifications or drawings, together with a suitable certificate. The procurement requirements identified should include any approved changes, waivers, or deviations applicable to the subject material or equipment. • The certificate should identify any procurement requirements that have not been met, together with an explanation and the means for resolving the nonconformance. • The certificate should be signed or authenticated by a person who is responsible for this QA function and whose function and position are described in the Purchaser’s or Supplier’s QA program. • The certification system, including the procedures to be followed in filling out a certificate and the administrative procedures for review and approval of the certificate, should be described in the Purchaser’s or Supplier’s QA program. • The package should include a method to verify the validity of Supplier certificates and the effectiveness of the certification system, such as through audits of the Supplier or independent inspection or test of the items. Such verification should be conducted by the Purchaser at intervals commensurate with the Supplier’s past quality performance. Surveys should not be employed as a method for accepting items from distributors unless the survey includes the manufacturer/developer of the item and the survey confirms adequate processes and controls by both the distributor and the manufacturer/developer. A survey of the distributor may not be necessary if: DOE-HDBK-1230-2019 35 • The distributor acts only as a broker and does not store or repackage the items; and • Traceability of the item can be established by other means such as verification of the manufacturer’s markings or shipping records. Surveys performed by organizations other than the dedicating entity may be used as a basis for acceptance if the survey results of the critical characteristics, survey scope, supplier’s processes and controls, and acceptance criteria are evaluated by the dedicating entity to be acceptable and consistent with the dedicating entity’s dedication requirements. The dedicating entity should also establish a basis on which to accept performance of a survey from another organization. One method to accomplish this would be for dedicating entities to consider partnering with other prime contractors to perform surveys together on the same supplier resulting in more efficient supplier oversight. The scope of the survey should be similar, with each dedicating entity responsible to ensure that their respective critical characteristics are appropriately evaluated.

The scope of the survey should be determined by the dedicating entity based upon the item or service and critical characteristics to be verified. The survey should be specific to the scope of the CGI or CGS being procured. When several items or services are purchased from a supplier, a survey of representative groups of CGIs or CGSs can be sufficient to demonstrate that adequate processes and controls exist. The survey report should provide objective evidence that the critical characteristics are verified and controlled by the supplier. If the scope of the survey cannot verify a designated critical characteristic due to controls by the supplier’s sub-suppliers, the dedicating entity should extend the survey to the sub-suppliers or select other dedication methods to verify the critical characteristic. Organizations performing surveys should develop criteria for the personnel qualifications and processes used to perform surveys. The survey documentation should provide objective evidence that the processes and controls for the identified critical characteristics were observed and evaluated for acceptance. Deficiencies identified in the supplier’s process or controls should be corrected, if the survey is used for acceptance of the identified critical characteristics. If items are to be procured over time or the manufacture and/or development of the item occurs over a period of time, the dedicating entity should establish a survey frequency to ensure that process controls applicable to the critical characteristics of the item or service procured continue to be effectively implemented. Factors to be considered in determining the frequency of commercial grade surveys include: • The complexity of the item or service, frequency of procurement, receipt inspection, performance history, and knowledge of changes in the supplier’s process and controls. • The survey frequency interval may be the same used for supplier audits but should not exceed the frequency interval for supplier audits. DOE-HDBK-1230-2019 36 The following additional points may be used to prepare or review CGD packages for items that are dedicated using Method 2: • Determine if supplier documentation (e.g., production and quality records) relied on in the dedication of the item, is verified during the survey; • Determine if surveys of a CGI supplier are performance-based as opposed to compliance-based or programmatic. Specifically, verify that the critical characteristics for the CGIs being surveyed are controlled by the supplier’s quality control activities; • If a potential supplier has multiple fabrication facilities, verify that the facility surveyed is the one providing the CGI or CGS; • Determine if survey teams include technical and quality personnel, as appropriate, who are knowledgeable in the operation and safety function of the item and the associated critical characteristics to be verified, including any special processes such as welding, computer program development, and heat treatment that are specific to the critical characteristics; • Determine if the control of sub-suppliers is adequately addressed by the surveys so that the supplier has an adequate basis to accept test results and certifications (e.g., CMTRs) from their sub- suppliers;

• Determine if pertinent information about a supplier or its products is used to plan, conduct, and report results of surveys and source verifications. Such information could have been available from source verifications, receiving inspections, the dedication process, supplier/product performance history, or other sources (e.g., from DOE, NRC, Environmental Protection Agency, National Institute of Standards and Technology, or other government agency, information notices and bulletins, nuclear plant reliability data system reports; • Confirm that: a) the documented commercial quality program was effectively implemented; and b) the surveys were conducted at the location necessary to verify that adequate controls were exercised on distributors as well as manufacturers; • Ensure the persons who perform supplier surveys are knowledgeable in: a) the use of performance-based surveys; or b) screening third-party surveys; • Determine if a previously performed survey is being used to establish the acceptability of a supplier’s commercial quality program. If so, verify that for each procurement, the program requirements necessary to ensure that a CGI or CGS will perform its safety function are the same. Determine if the surveys have been updated on a regular basis to support dedication; and • Evaluate adverse findings resulting from the review of third party surveys to ascertain if those findings affect CGIs already received. The dedicating entity should complete the commercial grade survey, review the survey report, and determine the extent to which the supplier’s controls were found adequate. Then the dedicating entity will make a final determination of which critical characteristics are to be accepted using Method 2 alone and document the basis in the CGD package. The dedicating entity should also ensure that the procurement documents specify that the fabricator/supplier or sub-tier supplier will provide a certificate of conformance attesting to the fact that the item was fabricated, or the service was performed per the processes and controls DOE-HDBK-1230-2019 37 determined to be adequate. The procurement contract should invoke or reference the verified processes and controls, including revision level, for the CGI or CGS. For accredited items, ensure that the certificate was valid when the work was performed, and the service was certified by the accreditation body (e.g., testing laboratories, like other types of suppliers, may implement quality programs ranging from 10 CFR Part 50, Appendix B, and ASME NQA-1 to unique internal programs, International Organization for Standarization programs, and programs accredited by organizations such as International Laboratory Accreditation Cooperation, Assured Calibration and Laboratory Accreditation Select Services, and the American Association of Laboratory Accreditation). Case Study: The examples provided in Section 9.0 of this Handbook provide different CGD items and levels of detail with various conditions. Best practices are discussed here: The roles and responsibilities for the use of distributors needs to be clearly defined in the project’s procurement and CGD documentation. Items procured from a manufacturer and passed through a distributor should address the controls in the CGD documentation. See examples 2 and 3.

The following is a lesson learned in the area of supplier cooperation and access to proprietary information. Some suppliers are not willing to work with a purchaser for nuclear grade items. The reasons vary, and may include the supplier’s lack of any QA program, lack of an ASME NQA-1 program and no interest in establishing one, or unwillingness to reveal proprietary information. There are ways to work with the supplier to overcome these obstacles and achieve CGD with time and effort. The purchaser should be willing to work with the supplier’s contact to build a level of trust and demonstrate that one can work around the proprietary issue. Working with the supplier and obtaining as much design/manufacturing information as possible without breaking the trust of the supplier can limit the amount of Method 1 (Special Tests, Inspections, and/or Analyses) testing necessary by the purchaser. Method 2 (Commercial Grade Survey of the Supplier) may even be allowed, although limited, but this will also support the purchaser’s CGD documentation and also continue to build a relationship of trust. This will save time and money at the end of the day. The purchaser should build this relationship, develop a contract that is acceptable to the supplier, and meet the contract and requirements. When a potential commercial supplier is not interested in allowing a commercial grade survey and/or is not willing to share proprietary information with the purchaser, the supplier may be willing to share the information with a third-party dedicator with whom they already have a relationship, and the dedication can be performed by the third-party dedicator on the behalf of the purchaser. When a third-party dedicator is used, their ASME NQA-1 program should be evaluated by the purchaser and they should be listed on the purchaser’s evaluated suppliers list. In keeping with the lesson learned above, the following is a summary of a purchaser’s actions to address the significant resource impact of dedicating parts for safety class and safety significant diesel generators using Method 1 (Special Tests, Inspections, and/or Analyses). Several items were to be procured, and in some cases the dedication would involve a destructive test. The purchaser sought ways to reduce the use of Method 1 through dialog with the supplier. DOE-HDBK-1230-2019 38 Those actions include: • Exploring dedication Method 2 (Commercial Grade Survey) with a smaller portion using Method 1. • Obtaining technical information on the parts to improve the technical aspect of the CGD package. • Establishing a partnership with the supplier to obtain technical information to support Method 2. o The partnership included contractual and non-disclosure agreements to protect proprietary information. o Once this agreement was established, a defined set of parts were created. o Technical information was obtained from the supplier and CGDs were created or revised. o A Method 2 Survey was performed with the cooperation of the supplier. The net results based on the establishment of agreements and cooperation between the purchaser and supplier were: • Reduced risk. • Technically improved CGD packages. • Confirmation of Quality Program implementation from a programmatic and performance basis. • Improved field delivery due to less use of Method 1. • Reduced cost due to no destructive testing. The collaboration between the purchaser and supplier produced a win-win for both parties involved.

Note: In all circumstances, the dedication package should document decisions and processes to justify the decision to dedicate the item. 6.5.4 Method 3 – Source Verification Source verification is a method of acceptance conducted at the supplier’s facility or other applicable location to verify conformance with the identified critical characteristics and acceptance criteria during the fabrication/development process. The scope of the source verifications should include activities such as witnessing the fabrication and assembly processes, quality control processes, non- destructive examinations, performance tests, computer program performance tests, or final inspections, as applicable. It should also include verification of the supplier’s contract review, design, procurement, calibration, quality improvement, and material process and control methods employed for the CGI or CGS being purchased, as applicable to the identified critical characteristics. For example, a requirement to perform an inspection of a welding activity would also expect that an evaluation of welder qualification, rod control, and the weld procedure would be performed. Organizations performing source verification should develop criteria for the personnel qualifications and processes used to perform source verification. Source verification documentation should provide objective evidence that the supplier’s activities for the identified characteristics were observed and evaluated for acceptance. DOE-HDBK-1230-2019 39 Source verification is only applicable to the actual item or service that is verified at the supplier’s facility or other applicable location. Source verification should be performed in accordance with a checklist or plan that addresses the applicable requirements of ASME NQA-1 and includes or addresses the following: • Identification of the item or service included within the scope of the contract and applicable work controls; • Identification of the controls used to produce and verify critical characteristics, including acceptance criteria being controlled by the supplier; • Verification that the supplier’s processes and controls are effectively implemented for the identified critical characteristics; • Identification of the activities witnessed during the source verification and the results obtained; • Identification of mandatory hold points to verify critical characteristics during manufacture, development, and/or testing for those characteristics that cannot be verified by evaluation of the completed item; and • Documentation of the adequacy of the supplier’s processes and controls associated with the critical characteristics and acceptance criteria. When using source verification, critical characteristics are verified by witnessing the quality activities of the supplier specific to the item being dedicated before an item is released for shipment to the Purchaser. If an item is shipped before verification activities are completed at the supplier’s facility, then other dedication methods are necessary for that item. It may be appropriate to use Method 3 if the following conditions exist; • In-process verification of one or more critical characteristics is needed; • Non-conformances were detected during prior receipt inspections; • Problems/deficiencies exist with the supplier’s QA program/procedures; • Purchaser schedule demands; • Single supplier of the item; • Item purchased infrequently; • Manufacture, computer program development or fabrication requires a significant

amount of time; or • Item being procured is the first of its kind being manufactured, developed or fabricated. The requirements for CGIs, including supporting technical documents, are defined in the purchase order. The documents include the identification of witness and hold points during the development or fabrication of a CGI, or performance of a CGS. The source verifier may be an auditor, inspector, engineer, subject matter expert consultant, or combination thereof. Source verification activities may include: Witnessing tests: • Material hardness; • Nondestructive examinations; • Tensile test; • Hydrostatic test; DOE-HDBK-1230-2019 40 • Leak rate test; • Material type (chemical analysis); • Calibration; • Operability; • Electrical continuity; • Insulation resistance; • Pressurization; and • Computer program module functionality. Witnessing inspections: • Dimensional; • Configuration; • Coating thickness; • Weld; • Non-destructive examination; and • Computer code. Observing processes: • Welding; • Assembly; • Insulating; • Coating; • Heat/cold treatment; • Machining; • Testing; • Reviewing computer program specifications; and • Reviewing computer program design. The following approach may be used to prepare or review CGD packages for items that are dedicated using Method 3: • Determine what critical characteristics can be best verified during the manufacturing, development, or fabrication activities at the supplier’s location; • Determine and define the necessary witness or hold points to allow proper verification activities of critical characteristics during the fabrication process. Include the required inspection/verification points in purchase orders to sub-suppliers to ensure notification of the dedicating entity; and • Verify and document the acceptance criteria selected for source verification in the CGD package. In the application of this method, proper care should be exercised to ensure that the data used is directly applicable to the verification of critical characteristics specific to the intended application of the item being dedicated. Using source verification for software dedication should only be considered when the software is currently being developed and the dedicating entity has access to the programming shop. It is DOE-HDBK-1230-2019 41 typically not feasible to dedicate already-existing software using source verification since the item already exists. Case Study: Section 9.0 of this Handbook, Examples 1 and 2, are provided to demonstrate a comparison of two different ways to approach a CGD method of verification. Example 1 demonstrates a procurement for Ball Valves (bulk purchase). As documented in Section III Critical Characteristic (For Acceptance Verification), the methods of verification selected for this CGD package are Method 1 (Special Tests, Inspections, and/or Analyses) and Method 2 (Commercial Grade Survey). Based on the methods selected, the documentation is supportive and appropriate for this type of procurement. Example 2 also demonstrates a procurement for Ball Valves (bulk purchase). This CGD package documents the selected methods of verification in Section 10 Critical Characteristics as Method 1 (Special Tests, Inspections, and/or Analyses) and Method 3 (Source Verification). Keep in mind that Method 3 would be very difficult to use, since the purchaser would have to visit the supplier to verify and witness the purchaser’s valves being manufactured. Source verification is only applicable to the actual items or services that are verified at the supplier’s facility or other applicable location. This is not impossible, but more complicated to coordinate with the supplier.

6.5.5 Method 4 – Acceptable Supplier Item or Service Performance Record The documented performance record of a supplier’s commercial item or service can serve as an acceptance method to verify conformance with the identified critical characteristics and acceptance criteria. This can provide reasonable assurance of the item’s or service’s performance based on historical performance gained from the successful utilization of other acceptance methods, and/or pertinent industry-wide performance data. Acceptable data for historical performance may come from monitored performance of the item, industry product tests, certification to non-nuclear national codes and standards, and other industry records or databases. Acceptable performance data would be from the use of the item or service under conditions equivalent to the intended application of the commercial grade item after dedication. Method 4 is a difficult method to implement as a stand-alone method of acceptance due to the lack of available history, documents available to support service performance, and/or supporting objective evidence. With rare exceptions where extensive performance information for identical items in similar use are available, Method 4 should not be used unless it is in conjunction with Methods 1, 2, and/or 3. This method of acceptance is based upon the documented, demonstrated past performance of the supplied item over a period of time for identical or similar items and/or services (review for the same safety function, the failure modes and mechanisms, and the critical characteristics). The method can be applied best when the historical performance results can be compiled using but not limited to: • industry product tests; • national codes and standards (ASME, ASTM, IEEE); • monitored performance of the item installed and operated in a similar environment as the intended facility; DOE-HDBK-1230-2019 42 • industry data bases (Institute of Nuclear Power Operations [INPO], EPRI, Aerospace, Military), or performance data resulting from use of Methods 1, 2, or 3; • documented indication of a supplier’s or an item’s past performance can be used as a basis for selecting an appropriate sampling plan. Method 4 is a valuable means to assist in accepting CGI/CGS since it relies on documented historical performance and may not require costly and time-consuming inspection and auditing activities. However, Method 4 should only be used when a large dataset of successful historical performance for the item is available. Supplier item or service performance records or data should be from the condition of service (e.g., environmental condition, failure mode, maintenance program, testing) or other conditions equivalent to the intended application of the CGI or CGS. Method 4 cannot be used if the only history available is with the purchaser. Use of Method 4 allows the purchaser to accept CGIs based upon a confidence in the supplied item achieved through proven performance of identical or similar items or services. The method allows the purchaser to take credit for item performance based upon the historical performance and the records of the successful utilization of Methods 1, 2, or 3. In the application of this method, dedicating entities should take care to ensure that they use performance data that is directly applicable to the verification of critical characteristics specific to the intended application. This is particularly true for software, where variables such as the installation platform, version and sub- version, compile/build environments, and input/output specifications would need to be verified as identical before history can be considered applicable.

The basis of this acceptance should include the following as applicable: • User historical performance data: o Reports of industry experience; o Results of periodic maintenance, inspection, surveillance, and test reports; o Completed maintenance and modification records; o Product records (work authorization, lubrication, and chemistry records, nonconformance and calibration reports); o Performance records (e.g., pump baseline curves, vibration monitoring results, thermal monitoring results, acoustics emission monitoring results); o Any associated CGD verification activities (Methods 1, 2, and 3); o Supplier responses to CGD program controls questionnaire. • Reports of external sources/industry-wide performance – should be specific and applicable to the item being accepted if it is to be used to establish an acceptable supplier/item performance record: o INPO nuclear parts reliability data system; o Commercial program audits/surveys conducted by industry groups; o Utilization of national codes and standards; o Supplier notices and bulletins. Method 4 should not be a single source of information and not be used as the sole method of acceptance. DOE-HDBK-1230-2019 43 An acceptable supplier item or service performance record should include the following: • Identification of the supplier item or service being evaluated; • Identification of previously established critical characteristics specific to the item or supplier; • Identification of utility/industry data examined to evaluate the supplier/item; • Basis for determining that industry data substantiates acceptability of the supplier/item; • Documentation of the adequacy and acceptance of the supplier/item/service performance record; and • Statement of the purchaser attesting to the acceptability of the supplier/item. An acceptable item or service performance record should not be employed alone as a method of acceptance unless the established historical record is based on industry-wide performance data that is directly applicable to the critical characteristics and the intended facility application. Single sources of information are not adequate to demonstrate satisfactory performance. Continued application of an acceptable supplier/item/service performance record as a method of acceptance should include a documented periodic update and review to assure the supplier/item/service maintains an acceptable performance record. 6.6 Sampling Plans and Lot Formation5 When sampling is required as a part of the acceptance process, the selection of the appropriate sampling plan complements the critical characteristic selection. Because of numerous procurement qualitative factors, it is normally not necessary to perform 100 percent tests or inspections to obtain reasonable assurance. According to NQA-1, Part II, Subpart 2.2, Paragraph 502.2, for receipt inspections, statistical sampling methods may be used for groups of similar items. Nuclear facility procurements usually involve quantities that are small relative to large production lots unless new facility construction or modification is involved. Just as in the selection of critical characteristics, sound engineering judgement in the selection of sampling size is a key factor. The basis of the acceptability of random sample selection is that each item in the lot has an equal opportunity of being selected as part of the sample. Acceptance of the lot is then based on the sample results. If the sample results are acceptable then there is reasonable assurance that the remainder of the lot is acceptable. Identification of sample lot and production lot for procured software items should also ensure that the lots are homogenous with respect to factors such as production version and installed platform.

Sampling plans used to select the number of items for special tests, inspections, and/or analyses should have an adequate technical basis using established standards that consider lot traceability, homogeneity, and complexity of the item. EPRI Report TR-017218-R1 provides an enhanced methodology for the use of sampling in accepting and dedicating CGIs. EPRI Report TR-017218-R1 should only be used after the report has been read in its entirety and the bases behind the included methods are understood. Alternatively, sampling plans may be developed 5 Sampling of computer programs is only applicable for computer programs embedded in digital equipment. In most instances the quantity of the same digital equipment item is small, requiring 100% sampling because of the small lot size. DOE-HDBK-1230-2019 44 based upon statistical methods that derive the desired confidence level. EPRI 3002002982 cautions that sampling should not be used for post-installation testing. The degree of lot homogeneity defines the degree to which the sampled items vary. When determining the homogeneity of a lot being sampled, objective evidence of the supplier’s ability to provide acceptable items through its manufacturing product controls is a key factor. It is important to recognize that heat number, manufacturer lot number or other manufacturing identification intended to demonstrate traceability to common production cannot be used unless the traceability can be verified back to the source of manufacture. Groups of components or commodities obtained through a distribution chain without traceability control established through QA audit or commercial survey cannot be considered homogenous. After the lot has been established and the degree of homogeneity within the lot determined, the sample size and allowed failure rate can be determined and documented within the sampling plan. Design of the sampling plan should also consider the required level of confidence. For a given CGI dedication, different critical characteristics can have different sampling plans. Sampling plans for non-destructive testing can be normal sampling plans, tightened sampling plans, or reduced sampling plans depending on how the lot is formed. Development of sampling size for destructive and non-destructive testing based on lot homogeneity is discussed in detail in EPRI Report TR-07218-R1. Guidance for determining an acceptable sample size may also be found in American National Standards Institute /American Society for Quality (ANSI/ASQ) Z1.4, Sampling Procedures and Tables for Inspection by Attributes, and ANSI/ASQ Z1.9, Sampling Procedures and Tables for Inspection by Variables for Percent Nonconforming. There may be cases where more or less than the recommended sample size should be tested based on specific details of the procurement. In dedications involving sampling, the basis for defining the lot and sample size should be documented in the sample plan. Case Study: The following lesson learned is provided as a suggested approach regarding the sampling plan for an item such as a steel plate or piping – destructive or nondestructive: Destructive testing is usually thought of as testing that consumes the tested item so that it is no longer usable. However, sometimes this isn’t the case: • A destructive test to verify material of a bearing roller would destroy the entire bearing and render it unusable. Therefore, this would be considered a destructive test.

• A destructive test of a coupon cut from a corner of steel plate or a section of a pipe would not destroy the balance of the plate/pipe or render it unusable. Therefore, this would not be considered a destructive test. In the first case, a sampling plan would specify the number of bearings that would have to be tested, and the procurement would have to include enough extra items to cover testing and final use. In the second case, the procurement would only have to include enough extra material to provide coupons. The CGD staff planning for the purchase of items and services should take into consideration the sampling plan and destruction of any samples to support the CGD effort to obtain the DOE-HDBK-1230-2019 45 needed number or amount of acceptable items/services, especially for long lead items and/or items of limited availability. 7.0 Other Considerations 7.1 Oversight and Flow-Down Expectations DOE contractors should flow down necessary expectations to their sub-contractors and sub-tier contractors and provide appropriate oversight. However, the responsibility for the competent performance of CGD activities remains with the DOE contractor placing the procurement. Therefore, it is important that the DOE contractor maintain oversight of the entire supply chain where dedication activities could be performed. 7.2 Commercial Grade Service ASME NQA-1-2015, Part I, Requirement 7, Section 507 should be reviewed before considering the dedication of a service and to determine if this requirement is applicable. As an alternative to commercial grade dedication, services may be performed under the dedicating entity’s or other organization’s QA program and procedures that meet the requirements. Some examples of services that may be provided as commercial grade include training, calibration, testing, engineering, computer software support, and other technical support activities. Services on equipment or items, including installation, repair, cleaning, or maintenance, that do not physically alter an item’s critical characteristics are additional examples. Personnel qualification, activity controls, independent certifications, and documents are typical examples of critical characteristics for dedication of services. Physical, mechanical, or other service activities that alter or create new critical characteristics of an item that can be used to determine the acceptability of the service that produced the critical characteristics should not be considered a CGS. For example, if a plate is rolled to a defined radius, the new critical characteristics produced is the radius of the rolled plate and not the rolling process or service that produced the curvature. Original critical characteristics of the plate materials and the plate thickness can remain unchanged or be specified by the design organization for the rolled plate. For an additional example see NQA-1-2015, part II, subpart 2.14, Section 700. 7.3 Correction of Supplier Issues Identified supplier issues with processes and controls relating to the acceptance method should be corrected by the supplier if it affects the acceptance criteria for critical characteristics utilized for CGD. Corrective actions should be documented and evaluated for acceptability by the dedicating entity. Uncorrected deficiencies in processes or controls may result in the selection of another dedication method for determining acceptance or rejection of the item. 7.4 Documentation

Documentation of the CGD process of an item or service should be traceable to the item, group of items, or services and should contain the following types of documents, depending on the applicable dedication method: DOE-HDBK-1230-2019 46 • Dedication plans or procedures including the essential elements of the dedication process; • CGI or CGS procurement documents; • Facility commercial grade definition criteria; • Technical evaluations (including acceptance plans); • Identification of critical characteristics and acceptance criteria, including or referencing design documents and failure mode analysis; • Test reports or results, inspection reports, analysis reports; • Commercial grade survey reports; • Source verification reports; • Historical performance information; and • Dedication report containing sufficient data to accept the item or service. 8.0 NQA-1 Original Equipment Manufacturer Options and Oversight When the supplier (OEM) receives an order for a safety class or safety significant item, they determine if they can procure from an NQA-1 supplier or have to process the order per their CGD process. As discussed in EPRI TR 3002002982, there are two methods for an OEM to provide an item with a safety function: (1) controlling the component in accordance with an approved ASME NQA-1 program; or (2) perform a commercial grade dedication. In either case, the OEM should have knowledge of the safety functions of the item. When not using a dedication process, an OEM that controls an item in accordance with their approved ASME NQA-1 program will still perform the same logical process as a CGD. However, the process will not be labeled a dedication. Although not labeled a CGD, the OEM maintains access to the design requirements and information necessary for the item to perform the associated safety functions. The OEM will also implement processes, in accordance with their ASME NQA-1 program, to ensure the item will meet the design requirements for its safety functions. The OEM will still be required to maintain and provide objective evidence to demonstrate the design requirements were met (e.g., implementation of procedures and processes, implementation of design controls). A flow-chart of this process is shown below (Figure 3. OEM Supplier Options). DOE-HDBK-1230-2019 47 In general, an OEM has three possible approaches to providing a basic component. 1) In the first approach; the OEM uses a supply chain where sub-tier suppliers have ASME NQA-1 quality programs evaluated by the OEM. Acceptance of the subcomponents in accordance with the OEM’s ASME NQA-1 program applicable requirements may require test reports, C of Cs, and a standard receipt inspection. 2) In the second approach, the OEM obtains commercial parts to manufacture the item by using their commercial quality program to select a sub-supplier to control and manufacture the item using a commercial manufacturing process in accordance with the sub-supplier’s commercial quality program requirements. The OEM then uses their ASME NQA-1 quality program to dedicate the item in-house and supply the item as a basic component through inspection, testing, sampling, etc. to ensure the item is in accordance with the CGD process. The OEM dedicates the item to the design criteria in lieu of a specific safety function, as allowed by ASME NQA-1-2015 Part II Subpart 2.14 paragraph 401. 3) In the third approach, the OEM uses its ASME NQA-1 quality program to control the raw

materials or commercial subcomponents that make up the finished item to supply a basic component. Two scenarios are provided to illuminate the third approach. In scenario 1, the OEM uses their ASME NQA-1 program to provide a basic component to the purchaser, but the OEM uses commercially available raw materials for the part. The commercial raw materials are procured and accepted in accordance with its ASME NQA-1 program. DOE-HDBK-1230-2019 48 In scenario 2, the OEM uses their ASME NQA-1 program to provide a safety assembly to the purchaser, but the OEM uses commercially available parts for the assembly. The commercial parts are procured and accepted in accordance with its ASME NQA-1 program. Scenario 1: • The raw materials are specified and procured from a sub-tier supplier; however, the purchase order does not invoke ASME NQA-1 controls for the raw material. (same as scenario 2 for commercial parts) • The OEM controls the design of the item under Requirement 3 of their ASME NQA- 1 program. (similar to scenario 2) • The translation of the design into the technical procurement requirements to the raw material supplier is also required to meet Requirement 4 of ASME NQA-1 (e.g., ASTM or ASME material requirements). (similar to scenario 2) • The OEM accepts the raw material by either a source evaluation or by objective evidence of quality (e.g., inspection at the supplier source, examination on delivery) in accordance with ASME NQA-1. • The OEM maintains control over material storage, traceability, manufacturing, and testing in accordance with applicable ASME NQA-1 criteria of their QA program. • The OEM manufactures a part using commercial grade raw materials and controls the part under their ASME NQA-1 QA program. Scenario 2: • The commercial parts are specified and procured from a sub-tier supplier; however, the purchase order does not invoke ASME NQA-1 controls for the parts. (same as scenario 1 for raw materials) • The OEM controls the design of the assembly in accordance with Requirement 3 of their ASME NQA-1 program and the commercial parts are specified and procured from sub-tier suppliers under Requirement 4 of ASME NQA-1. (similar to scenario 1) • The OEM ensures that their design for the subcomponents is accurately translated into the technical procurement requirements under Requirement 4 of ASME NQA-1. (similar to scenario 1) • The OEM accepts the subcomponents under ASME NQA-1 Requirement 7, but the actual installation into the assembly is controlled by the OEM’s ASME NQA-1 program. • The OEM manufactures an assembly using commercial grade parts and controls the assembly under their ASME NQA-1 QA program. In both scenarios, while fulfilling many of the same requirements as a CGD, these approaches are not referred to as a dedication since the part and assembly are controlled under the OEM’s ASME NQA-1 program. DOE-HDBK-1230-2019 49 It is important to note that regardless of the method used, the responsibility for the item’s performance remains with the DOE contractor placing the procurement. Therefore, it is important that the DOE contractor understand the method by which an ASME NQA-1 supplier is producing a basic component and maintain oversight of the entire supply chain where dedication activities could be performed. This process requires a good knowledge and understanding to ensure the requirements of ASME NQA-1 are maintained during the design and manufacture of the part or assembly.

DOE-HDBK-1230-2019 50 9.0 References and Reading List 9.1 Codes and Standards ANSI/ASQ Z1.4, Sampling Procedures and Tables for Inspection by Attributes ANSI/ASQ Z1.9, Sampling Procedures and Tables for Inspection by Variables for Percent Nonconforming ASME NQA-1-2015, Quality Assurance Requirements for Nuclear Facility Applications ASTM A751-14a, Standard Test Methods, Practices, and Terminology for Checmical Analysis of Steel Products DOE G 414.1-2B, Quality Assurance Program Guide, Chg. 2, 2013 DOE O 414.1D, Quality Assurance Chg. 1, 2013 DOE O 420.1, Facility Safety DOE-STD-3009, Preparation of Nonreactor Nuclear Facility Documented Safety Analysis DOE-STD-3024-2011, Content of System Design Descriptions 9.2 Industry and Regulatory References EPRI Report 3002002982 (2014), Plant Engineering: Guideline for the Acceptance of Commercial-Grade Items in Nuclear Safety Related Applications, Revision 1 to EPRI NP-5652 and TR-102260, September 2014 EPRI Report TR-017218 Revision 1 (1999), Guideline for Sampling in the Commercial- Grade Item Acceptance Process, EPRI, 1999 EPRI Report TR-106439 (1996), Guideline on Evaluation and Acceptance of Commercial Grade Digital Equipment for Nuclear Safety Applications, EPRI, 1996 EPRI Report 3002002289 (2013), Guidelines for the Acceptance of Commercial-Grade Design and Analysis Computer Programs used in Nuclear Safety Related Applications: Revision 1 of 1025243, EPRI, 2013 Institute of Electrical and Electronics Engineers (IEEE) Std 323, Standard for Qualifying Class 1E Equipment for Nuclear Power Generating Stations 9.3 Other Information Related to Commercial Grade Dedication NRC Generic Letter 89-02, Actions to Improve the Detection of Counterfeit and Fraudulently Marketed Products NRC Generic Letter 91-05, Licensee Commercial-Grade Procurement and Dedication Programs, US NRC, 1991 NRC IP 38703 (1996), Commercial Grade Dedication, US NRC, 1996 DOE-HDBK-1230-2019 51 NRC IP 43004 (2013), Inspection of Commercial Grade Dedication Programs, US NRC, November 2013 NRC IN 2011-01, Commercial Grade Dedication Issues Identified During NRC Inspections, US NRC, February 2011 NRC IN 2016-09, Recent Issues Identified when using Reverse Engineering Techniques in the Procurement of Safety Related Components, July 2016 NRC Regulatory Guide 1.164, Revision 0 (2017), Dedication of Commercial- Grade Items for Use in Nuclear Power Plants, US NRC, June 2017 DOE-HDBK-1230-2019 EXAMPLE 1 - COMMERCIAL GRADE DEDICATION FORM 52 10.0 Examples for Case Studies These examples are actual CGD packages modified to remove identifying information. They were gathered by the writing team from various DOE sites and commercial nuclear plants. While none of them represents a perfect CGD solution, they provide illustrations of good practices and lessons learned in various areas of the CGD process. DOE-HDBK-1230-2019 EXAMPLE 1 - COMMERCIAL GRADE DEDICATION FORM 53 Example No. 1 (Ball Valves) This example demonstrates a Technical Evaluation and Acceptance Plan for the procurement of bulk item Ball Valves. Methods 1 and 2 were selected as the acceptance methods for this procurement. The format and level of detail illustrate best practices for capturing and documenting the dedication process for bulk items, (valves, diesel oil, parts, and fittings) to successfully meet the ASME NQA-1 requirements for CGD. This example has an especially good example of documenting why a critical characteristic was NOT selected for verification. The assessor should ensure, when implementing Method 2 for acceptance, the scope of the survey includes the selected critical characteristics.

Editor’s Note: The examples are provided to demonstrate an acceptable methodology for implementing the CGD process outlined throughout this handbook. The details contained in the examples were obtained through benchmarking efforts from the DOE/NNSA complex, however, engineering personnel should establish their own level of detail and engineering judgement to produce an acceptable CGD package. DOE-HDBK-1230-2019 EXAMPLE 1 - COMMERCIAL GRADE DEDICATION FORM 54 EXAMPLE 1 - COMMERCIAL GRADE DEDICATION FORM CGD No.: CGD- MR No.: PO No.: CAT ID No.: WO No.: Rev No.: Item/Service: Ball Valve 1”, Two Way, Triad Series Manufacturer: Supplier XYZ Project/Location: Title: Supplier XYZ, 1 Inch, 2 Way, Triad Series, Ball Valve Release Stamp: Clearance Review Public release? ☒Yes ☐No Restricted use? ☐Yes ☒No Restriction type: Signatures Advance Procurement: No Reason for Advanced Procurement: N/A N/A QA Manager: Print Sign Date N/A Chief Engineer: Print Sign Date Initial Approvals: Originator: Print Sign Date Design Authority: Print Sign Date QA Engr.: Print Sign Date Proc. Eng. Lead: Print Sign Date Engr. Mgr.: Print Sign Date Other (If applicable): Print Sign Date Final Approvals: Design Authority Print Sign Date QA Engr.: Print Sign Date Proc. Eng. Lead Print Sign Date Engr. Mgr.: Print Sign Date Change Log Revision Description of Change Date Approval DOE-HDBK-1230-2019 EXAMPLE 1 - COMMERCIAL GRADE DEDICATION FORM 55 SECTION 1 ITEM INFORMATION Reason for Revision (if applicable): Model No./Series/Product Line: Ball Valve, Triad Series Manufacturer Location (if Known/Applicable): (Provide location) Supplier (if Applicable): Supplier XYZ (Ball Valve Company) Manf. Part No. (Provide appropriate Part number) Supplier P/N (if applicable): N/A Total Quantity: 100 Manf. Part No. Breakdown (if Applicable): FP – Full Port 3 – Body Material (CF8M) 3 – End Connection Butt Weld Schedule 80 (CF3M) 05 – Size 1 Inch 3 – 316 Stainless Steel U – Seats UHMWPE CF – Cavity Filler UHMWPE G – Graphite L – Lever S4 – Schedule 80 Recommended Procurement Strategy: Perform Method 1 & Method 2 inspections to determine that product received is the product specified in the supplier literature. Type of Procurement: ☐Replacement ☐Spare Part ☒Component ☐Upgrade ☐New Item ☒Other: ________ End Use: Supplier XYZ Ball Valves isolate or divert waste within waste transfer systems. Isolation valves for Double Valve Isolation (DVI) provide a barrier to physically disconnect interfacing systems and inactive portions of the waste transfer primary piping system from an active portion of the waste transfer system. Safety Function from DSA: The safety function of the Primary Piping System is to provide confinement of waste. Providing confinement of waste decreases the frequency and mitigates the consequences of a fine spray leak. In addition, providing confinement of waste protects the facility/worker from wetting spray/jet/stream leaks into a normally occupied area and from flammable gas deflagrations in a waste transfer associated structure due to a waste transfer leak.

Safety Function of Item: The safety function of the Ball Valve is to limit the leakage of waste. Limiting valve leakage decreases the consequences of a fine spray leak due to a transfer misroute. So the safety function of the Ball Valve is confinement. Since these valves are providing double valve isolation, they more than likely provide an isolation function. Safety Classification: safety significant Specification No: N/A DOE-HDBK-1230-2019 EXAMPLE 1 - COMMERCIAL GRADE DEDICATION FORM 56 Equipment Number (EIN) (if Known): N/A Past P.O. No. (if Applicable): SECTION II DETERMINATION OF CRITICAL CHARACTERISTICS Credible Failure Mode/Mechanism: Effect of Assembly/System or Host Item Safety Function: Design Characteristic/Control Load Conditions Excessive structural loading could prevent isolation valves from performing their safety function. Material Compatibility Process Pressures Unmitigated head/flow curves that can exceed the waste transfer system design pressures and thus could cause an overpressure condition. Flow transients (often called water hammer) could also cause an overpressure condition. Pressure Rating Valve Positioning Prevents further rotation of the valve actuator. Shell pressure should be considered. Pressure Rating Basis for Selection of Creditable Failure Mode/Mechanism: (Provide design references/requirements as applicable) Technical Basis Information Document Ref: RPT – 42000, Rev. XX “safety significant Waste Transfer Primary Piping Systems – Functions and Requirements Evaluation Document” RPT – 41000, Rev. XX “safety significant Isolation Valves for Double Valve Isolation – Functions and Requirements Evaluation Document” Service Conditions: ENG-STD-06, Rev C "Design Loads for Project Facilities" Active: ☐ Passive: ☒ Active: Mechanical or Electrical Change of State is required to occur for the component to perform its safety function. Passive: Change of State is not required for the component to perform its safety function. Environmental Conditions: ENG-STD-02, Rev A "Environmental/Seasonal Requirements for Project Systems, Structures, and Components" Seismic Qualification Needed? Yes☐ No☒ DOE-HDBK-1230-2019 EXAMPLE 1 - COMMERCIAL GRADE DEDICATION FORM 57 List of Critical Characteristic (List all Critical Characteristics for Design from Technical Baseline Documents and Tables) Source Item Characteristi c (X) Safety Function Affecting Characteristic (X) CC for Acceptance (X) /CC# Item Identification RPT – 42000, Rev. XX CGD – 03000, Rev. XX ☒ ☐ ☒/ 1 Design Pressure/Design Temperature RPT – 42000, Rev. XX CGD – 03000, Rev. XX ☐ ☒ ☒/ 2 ☒ Materials of Construction/Compatibility RPT – 42000, Rev. XX CGD – 03000, Rev. XX ☐ ☒ ☒/ 3 ☒ Justification for Changed Approach to Verify a Critical Characteristic: Dimensional Tolerance for Valve Positioning: Triad Series Ball Valve designs shall be designed for a minimum of 5 degrees of over or under travel to ensure post closure when the valve is positioned in the closed or blocked position. The Project has performed additional analysis by dimensional calculations documented in Project-09- 012. These dimensional calculations were performed to determine if the valve alignment is in accordance with ENG-STD-22. Based on the results and the information contained in the calculation, it can be concluded that the Triad Series Ball Valves have more than the 5 degrees of over travel that is required by ENG-STD-22. Therefore, no additional testing or verification is necessary.

Engineering Justification (if Applicable): RPT-42000, Rev. XX "safety significant Waste Transfer Primary Piping Systems - Functions and Requirements Evaluation Document" RPT-41000, Rev. XX “safety significant Isolation Valves for Double Valve Isolation - Functions and Requirements Evaluation Documents" ENG-STD-22, Rev. XX, “Piping, Jumpers, and Valves” TE-48000, Rev. XX, “Technical Evaluation and Risk Analysis for Supplier XYZ Triad Series Ball Valves” Notes: For orders with quantities greater than or equal to 6, a sampling plan per EPRI TR-017218-R1 "Guideline for the Utilization of Sampling Plans for Commercial Grade Item Acceptance" shall be used. If reduced or tightened plan is followed provide justification. If a failure occurs consult Project Engineering and document the failure on an NCR in accordance with the QA program requirements. DOE-HDBK-1230-2019 EXAMPLE 1 - COMMERCIAL GRADE DEDICATION FORM 58 SECTION III - CRITICAL CHARACTERISTIC (FOR ACCEPTANCE VERIFICATION) Method of Verification: Fill out appropriate forms for Methods 1-4 as needed and attach as supporting documentation in addition to any other supporting documentation. 1. Special Tests and Inspections: Special tests and inspections used to verify the critical characteristic. 2. Commercial Grade Survey: CGI Supplier’s activities used to control the critical characteristic subject to survey. 3. Source Verification: Supplier’s activities used to control the critical characteristic witnessed and examined during source surveillance. 4. Supplier /Item History: Performance information used to provide reasonable assurance the critical characteristic has been met. Critical Characteristic for Acceptance No.1: Item Identification Sample Size/Plan: Normal Description of Critical Characteristic: The item and/or packaging shall be clearly labeled with the items Model/Part/Catalog Number per the Purchase Order (PO). At receipt of the item; an inspection shall be performed verifying the item conforms to the requirements of the PO and the items are free from any damage or defects. This receipt inspection is documented on a Quality Assurance Inspection Plan (QAIP). The item's Model/Part/Catalog Number provide a method to link the items with the manufacturer's product description and published data. # Method of Verification: Acceptance/Criteria/ Tolerances: Supporting Documentation: 1. Method 1: Verify the items part number and that the QAIP is signed and complete. 1. Verify part number is FP3305-3-S4 2. Verify receipt documentation (QAIP, C of C, Test Reports) meets the requirements of the Purchase Order and is signed and complete. QAIP, PO (Attachment XX) # Verifying Organization: Print First and Last Name/Signature: Date: Comments: 1 QAT DOE-HDBK-1230-2019 EXAMPLE 1 - COMMERCIAL GRADE DEDICATION FORM 59 Critical Characteristic for Acceptance No. 2: Design Pressure/Design Temperature Sample Size/Plan: Normal Description of Critical Characteristic:

By validating the valve material via PMI and specific gravity tests, the Project confirms that the materials in the valve can meet its design temperature rating. The Project has evaluated the valve for its temperature rating in TE-10-002, Rev. XX. The valve design and materials dictate the temperature rating. The Project’s technical evaluation states these Supplier XYZ Ball Valves are capable of withstanding temperatures up to 180°F. By validating the materials stated under “Material Compatibility” the Project establishes reasonable assurance the item will perform its intended safety function. In addition, the Project previously contracted with Supplier (TE- 48000, Rev. X) to perform a high temperature, high pressure test on Supplier XYZ Triad Series Ball Valves to validate their design temperature and pressure ratings. Supplier tested the valves at 438 psig and 186°F for 10 minutes. The valves passed the test with no leakage and no damage to the seats or cavity filler material, thereby validating the valve is capable of withstanding 180°F when in service. The Supplier qualification testing validated Supplier XYZ’s design and process controls over materials of construction. No further temperature testing is required at this time. Supplier XYZ Ball Valves are designed, manufactured and tested in accordance with ASME B16.34. All pressure and temperature ratings are consistent with that standard. Supplier XYZ’s pressure/temperature chart identifies that the valves with UHMWPE seat material have a pressure rating of 2200 psig at 100°F. # Method of Verification: Acceptance Criteria/Tolerances: Supporting Documentation: 1. Method 2: Verify that Material of Construction/Compatibility has been verified and accepted. 1. Verify that the acceptance criteria for Material of Construction/Compatibi lity has been verified and accepted. PMI Reports (Attachment XX) 2. Method 1 & 2: Verify Design Temperature is met based on the manufacturer’s literature and UHMWPE seat material. 1. Design Temperature of 180°F is met based on the manufacturers published product literature and verification of UHMWPE seat material. Provide a C of C attesting to the implementation of the identified processes and controls for the Design Temperature specification. Also include and review Design Temperature Analysis Report documentation provided by the manufacturer. 3. Method 2: Verify Hydrostatic Tests were performed by the supplier meets the acceptance criteria. 1. Verify Hydrostatic Tests have been performed by the supplier, validating the valve meets the ASME B16.34 (not less than 1.5 times the 100°F pressure rating (2160 psig), ≥15 seconds) requirements. Hydrostatic Test Reports (Attachment X) DOE-HDBK-1230-2019 EXAMPLE 1 - COMMERCIAL GRADE DEDICATION FORM 60 # Verifying Organization: Print Name/Signature: Date: Comments: 1 QAE 2 ENG 3 ENG Critical Characteristic for Acceptance No. 3: Materials of Construction/Compatibility Sample Size/Plan: Normal Description of Critical Characteristic:

To gain reasonable assurance that the valve is compatible with the Project, the Body, Ball, End Caps, Valve Stop Bolt, Sleeve, Lock Nut, and Stem must be verified to be Stainless Steel. The seat needs to be verified to be UHMWPE. The Positive Material Identification (PMI) test will be conducted on the Body, Ball, End Caps, Valve Stop Bolt, Sleeve, Lock Nut, and Stem upon receipt to verify that they are Stainless Steel. The Project shall also visually inspect the UHMWPE seat to verify color and conduct a specific gravity test on the seat. It has been established that UHMWPE has a specific gravity less than one enabling it to float in water. The specific gravity test is accomplished by placing the UHMWPE seat in water. If the seat floats, the Project has achieved reasonable assurance they are getting UHMWPE. EDITORIAL NOTE: This may not provide reasonable assurance because other types of plastic such as; LDPE, LLDPE, MDPE all float. Supplier XYZ has adequate programmatic controls in their procurement, receipt inspection, and materials handling. Supplier XYZ also provides Material Test Reports (MTS) and (PMI) reports that accompany the valve. To validate these test reports Supplier XYZ performs PMI on the Body, End Caps, and Stem in accordance with their PMI testing procedure. # Method of Verification: Acceptance Criteria/Tolerances: Supporting Documentation: 1 Method 1 & 2: Verify supplier test results of the Body, End Caps, and Stem shall be of Stainless Steel material. 1. Verify supplier PMI test results Suppliers PMI Test Reports (Attachment X) 2 Method 1: Verify that UHMWPE seats float on water and are white in color. 1. Verify UHMWPE seats float on water. 2. Verify UHMWPE seats are white in color. DOE-HDBK-1230-2019 EXAMPLE 1 - COMMERCIAL GRADE DEDICATION FORM 61 3 Method 1: Perform Positive Material Identification (PMI). 1. Verify PMI results match supplier product literature of the material. Verify results of PMI reveal that the Body, Ball, End Caps, and Stem are 316, CF8M or CF3M Stainless Steel in accordance with ASTM-XX. The Body Bolts, Lock Nut, Valve Stop Bolt, and Valve Stop Sleeve are 304 or 300 Stainless Steel in accordance with ASTM-XX. Method 1 Form & Test Results (Attachment XX) # Verifying Organization: Print Name/Signature: Date: Comments: 1 QAE 2 QAT 3 QAT SECTION IV REFERENCES National Codes/Standards: ASME B16.25 ASME B16.34 Documented Safety Analysis (DSA): Report 13000, Rev. x "Project Documented Safety Analysis" ECN #: N/A Drawings/Other ECNs: N/A Modification Traveler No.: N/A Manufacturer/Supplier Information: Supplier XYZ 123 Any Street Any Town, ST ZIP (000) 000-0000 Supplier: Supplier X 456 Any Street Any Town, ST ZIP (000) 000-0000 Supplier Literature (Catalogs/Manuals/Drawings/Brochures): Quality Systems Manual, Rev. XX (Supplier Name) Quality Assurance Manual (Supplier Name) Quality System Manual, Rev. XX (Supplier Name) Supplier/Mfg. Website Information: DOE-HDBK-1230-2019 EXAMPLE 1 - COMMERCIAL GRADE DEDICATION FORM 62 Other Information: N/A SECTION V CONCLUSION Executive Summary: SECTION VI SUPPORTING DOCUMENTATION Additional Information: N/A Attachment Index: Attachment A Supplier XYZ Triad Series Ball Valve Catalog Attachment B Supplier XYZ Letter for Support Dimensional Tolerance for Valve Positioning Attachment C Method 1 Form (PMI Test Form) Attachment D ASTM A351 Attachment E ASTM A193 Attachment F Receipt Documentation Attachment G Suppliers PMI Test Reports Attachment H Certificate of Conformance Attachment I Project PMI Test Report

NOTE: Add Flow Charts, Drawings of Fully Assembled Valves, Material of Construction (Part Numbers/Material) and any other information that would be beneficial supporting the CGD Technical Evaluation and Acceptance Plan. DOE-HDBK-1230-2019 EXAMPLE 2 – AIR ACTUATED BALL VALVES 63 Example No. 2 (Air Actuated Ball Valves) This example demonstrates a Technical Evaluation and Acceptance Plan for the procurement of bulk Air Actuated Ball Valves. Methods 1 and 3 were selected as the acceptance methods. The format is different from Example Number 1 and provides another illustration of the information and level of detail necessary for a complete CGD package. Editor’s Note: The examples are provided to demonstrate an acceptable methodology for implementing the CGD process outlined throughout this handbook. The details contained in the examples were obtained through benchmarking efforts from the DOE/NNSA complex, however, engineering personnel should establish their own level of detail and engineering judgement to produce an acceptable CGD package. DOE-HDBK-1230-2019 EXAMPLE 2 – AIR ACTUATED BALL VALVES 64 SECTION 1 COMMERCIAL GRADE ITEM OR SERVICE Does the item/service meet the definition of a commercial grade item/service? ☒ Yes ☐ No This plan contains Export Control Items (ECI)? ☐ Yes ☒ No SECTION 2 CGD PLAN DESCRIPTION Brief Description of CGD Plan Air Actuated Ball Valves are tagged items implemented across various facilities at the Plant. The valves serve as isolation points within a piping system. Although all valves utilize pneumatic, spring loaded piston actuators, some valves are only required to maintain the pressure boundary. Others, however, have active safety functions: (1) returning to the intended state upon loss of pneumatic pressure and/or (2) providing indication of valve position. Fail closed valves must maintain isolation and fail open valves must maintain a fully open position. The air actuated valves included in this plan shall be shipped in three separate releases. These groupings are defined by construction needs. The valves are each constructed of the same design and materials. Using this knowledge, the valves are to be dedicated as one complete lot, independent of size or class. SECTION 3 PREPARATION, CHECKING, AND APPROVAL Prepared by: Print/Type Name Signature Date Checked by: Print/Type Name Signature Date SME Overcheck by: Print/Type Name Signature Date Approved by: Print/Type Name Signature Date SECTION 4 REVISION HISTORY Rev Rev Date Reason for Revision (PROVIDE REASON FOR REVISION) Document No.: EXAMPLE 2 Rev: 0 Title: Air Actuated Ball Valves – Supplier XYZ DOE-HDBK-1230-2019 EXAMPLE 2 – AIR ACTUATED BALL VALVES 65 SECTION 5 VISUAL AIDS Diagrams, Pictures, Schematics (Add Flow Charts, Drawings of Fully Assembled Valves, Materials of Construction (Part Numbers/Material) and any other information that would be beneficial supporting the CGD Technical Evaluation and Acceptance Plan). SECTION 6 PARENT COMPONENT INFORMATION If the specific end-use/application is multiple or not known, this Section is not applicable. ☒ Not Applicable (Refer to Section 7 Below) Parent Component Description Equipment Qualification Datasheet (EQD) No.: Title: Rev: Component Tag Number (CTN) Stock Code Number Design/safety classification of “Q” Parent Component ☐ safety class (SC) – Q ☐ safety significant (SS) – Q ☐ Non-Safety:

☐ WAI – Performance – Q ☐ Air Permit – Q ☐ Fire Protection Designated SC – Q ☐ Equipment Environmental Qualification (EEQ): ☐ Mild ☐ Harsh ☐ Equipment Seismic Qualification (ESQ): ☐ Seismic Class I ☐ Seismic Class II ☐ Seismic Class III ☐ Seismic Class IV ☐ Other: Design Function Function Mode “Q” Function ☐ Active ☐ Passive Rev: DOE-HDBK-1230-2019 EXAMPLE 2 – AIR ACTUATED BALL VALVES 66 SECTION 7 BOUNDED SCOPE OF USE Design Applications/Bounding Conditions Valves in this order are tagged items, thus, Project engineering has selected specific uses and accounted for both environmental and process conditions for the items in their selection SECTION 8 ITEM INFORMATION Item Description Air actuated on/off ball valves are manufactured by Supplier XYZ in accordance with ASME B16.34. Actuators are catalog items purchased from Supplier X. Safety related limit switches and solenoids are provided to the supplier as Q government furnished equipment (GFE). Item Description Ball Valves are of the following construction: - Body type: 2-piece, full bore - Inlet/Outlet size: ½" thru 8" - Pressure rating: Class 150 & Class 300 - Inlet/Outlet Connection type: Raised Face Flanges - Body material: CF8M & S31603 - Packing Material: Virgin TFM - Gasket Seal material: Virgin TFM - Bolting material: 316 SS - Stem material: 17-4PH Alloy Steel & A479 S31603 - Closure member type: full ball - Trim Size: full port Actuators are of the following construction: - Body and End Caps: BS EN 755-2 Gr. 6005A T6 / 6063 T6 / 6063 T66 Aluminum - Pistons: Dual Pistons, BS EN 1706 Gr. EN AC- 46500-D-F Aluminum, with internally threaded "rack" - Pinion: ASTM A582 Gr. AISI 303 Stainless Steel - Fasteners: BS 6105 Gr. A2-70 Stainless Steel - Springs: up to three springs per piston (inner, middle, & outer) dependent upon the actuator's part number selection, BS EN 10270-2 Gr. VDSiCr / TDSiCr Spring Steel - O-rings: Viton - Piston Guides: Nylon, Sebimid 6 L02 • Equipment Qualification Datasheet (EQD) No.: (Provide) Title: Equipment Qualification Datasheet for Actuated On/Off Valves, Outdoor Environment Rev: XX No.: (Provide) Title: Equipment Qualification Datasheet for Actuated On/Off Valves, (Active Safety, Mild Environment) Rev: XX No.: (Provide) Title: Equipment Qualification Datasheet for Actuated On/Off Valves, (Passive Mechanical Safety, Indoor) Rev: XX DOE-HDBK-1230-2019 EXAMPLE 2 – AIR ACTUATED BALL VALVES 67 Design Function I. How are the air-operated valves constructed? The air-operated valves consist of two major components: the valve and the actuator. Accessories such as positioners and signal transmitters can interface with both components. A. Ball Valves Ball valves are common industrial valves utilized to provide process isolation with leak-tight shutoff. The valve is operated by turning the valve stem 90 degrees to interchange between open and closed positions. Valves within this plan are full port valves utilizing TFM seats, which is a molecular variant of PTFE. B. Actuators Pneumatic actuators are devices that adjust control valves in response to a signal. Pneumatic actuators are manufactured in two major categories: (1) spring and diaphragm actuators and (2) piston actuators. Valves included in this plan are rotary piston actuators; thus, spring and diaphragm actuators will not be discussed. • Component Tag Number (CTN) • Stock Code Number AMR-YV-8002 AMR-YV-8004 AMR-YV-8005 AMR-YV-8006 AMR-YV-8007 AMR-YV-8008 AMR-YV-8026 AMR-YV-8030

• Manufacturer Name • Manufacturer Model/Part/Catalog Number Supplier XYZ Supplier XYZ Ball Valves ANH - H5M3Z - - G34- - P8XX ANH - H5M3Z - - G34- - P8YY ANH - H5L3Z - - - 34 - - P8ZZ Design/safety classification of “Q” Item ☐ safety class (SC) – Q ☒ safety significant (SS) – Q ☐ Non-Safety: ☐ WAI – Performance – Q ☐ Air Permit – Q ☐ Fire Protection Designated SC – Q ☒ Equipment Environmental Qualification (EEQ): ☒ Mild ☐ Harsh ☒ Equipment Seismic Qualification (ESQ): ☐ Seismic Class I ☐ Seismic Class II ☒ Seismic Class III ☐ Seismic Class IV ☐ Other: DOE-HDBK-1230-2019 EXAMPLE 2 – AIR ACTUATED BALL VALVES 68 i. Piston actuators Piston actuators exert large amounts of force for their compact size when a high-pressure air source is available. Force and motion are produced by applying pneumatic pressure to one side of the piston while exhausting pressure from the other. Spring-return actuators have pressure applied to the loading side of the piston, compressing the spring on the non-loaded side. This provides an inherent fail mode to an established position. The piston rod is guided by bushings in the actuator housing to provide alignment over the stroke. O-rings surrounding the piston retain air pressure passing through the casing. Travel stops for rotary actuators may be in the form of machine screws to limit motion. In spring-return designs, such as the ones being dedicated by this plan, cap screws limit rotation and can be tightened or loosened to establish travel limits. ii. Rotary Piston Actuators To convert linear to rotary motion, the pistons in this plan are constructed with an internally threaded "rack" to tum a centrally located pinion. The rack turns the pinion, which then turns the valve stem using a metallic coupler. This piston/rack/pinion mechanism converts pneumatic pressure to rotary torque. C. Solenoids For on/off applications, a switching device such as a solenoid valve can be used to control the pressure sent to the actuator. A four-way solenoid is typically used for piston actuators. When the inlet solenoid is energized, the solenoid opens, and instrument air system pressure is applied to the piston cylinder. This forces the valve open. When the valve must return to its previous position, a signal is sent to the outlet solenoid, pneumatic pressure is relieved, and the return springs force the pistons to their de-energized position. D. Limit Switches Limit switches are electrical switches that react to a mechanical input. The mechanical input in this application is valve position. A rotating shaft on top of the actuator provides valve position to the limit switch, which then interprets the position and outputs an electrical signal. II. What are an air actuated valve's application or use? Air actuated valves, also known as pneumatic control valves, are utilized in applications in which manual valve operation would not be appropriate. Many system designs require an integrated control system to operate without human intervention. Air actuated valves provide a powerful, safe, and adaptive method for isolating or throttling fluid within a piping system. Many of the valves utilized in this plan perform post-accident safety functions. Air actuated valves may directly prevent unsafe conditions that could harm the environment or co-located workers.

III. What are the specific types of valves, actuators, and auxiliary components utilized in this plan? Valves utilized in this plan are pneumatic rotary piston actuated floating ball valves with electrical position indication and solenoid control. The major components are listed below: A. Primary Components a. Floating type ball valve b. Pneumatic rotary piston actuator c. Electrically controlled 4-way pneumatic solenoids (furnished to the supplier as Q GFE) d. Electric Limit Switches (furnished to the supplier as Q GFE) B. Auxiliary Components a. Mounting Bracket b. Actuator/Valve Stem Coupler c. Electrical Conduit (non-safety) DOE-HDBK-1230-2019 EXAMPLE 2 – AIR ACTUATED BALL VALVES 69 d. Solenoid Filter/Regulator (non-safety) e. Needle Valves and Tubing (non-safety) IV. In what process conditions shall the valves be utilized? Process conditions were retrieved from each tagged item's valve data sheet. These datasheets are retrievable in the Project document management system. Relevant process conditions are summarized below: A. Valves shall provide isolation to the following process media: liquid ammonia, gaseous ammonia, demineralized water, process water, plant service air, and process service air B. Process temperatures range from -30°F to 150°F C. Process pressure range from -14.7 psig to 300 psig V. In what environments shall the items be utilized? Environments for the items are detailed in their respective Equipment Qualification Datasheets (EQDs). See the chart below for a brief summary of environmental conditions: Summary of Environmental Conditions VI. What are the design parameters of the items (material, class)? A. Ball Valves i. Sizes:½", ¾", 1”, 1-½", 2", 3", 4", and 8" ii. Valve Body Materials: 316L Stainless Steel, Dual Grade 316/316L Stainless Steel iii. Connections: 150 CL Flange. 300 CL Flange iv. Soft Goods: TFM Seats with EPR (ethylene propylene rubber) O-rings v. Valve Stems: 17-4PH steel B. Actuators i. Double-acting pneumatic piston actuators ii. 80 psig supply pressure iii.Aluminum body and pistons iv. Stainless steel pinion and structural components v. Viton® O-rings vi. Carbon steel springs Active Safety Passive Safety Indoor Outdoor Indoor Max/Min Temperature 145°F / 40°F 125°F / -30°F 145°F / 40°F Seismic Category SC-III SC-III SC-III Radiation 10 mRad/hr Ambient 0.5 mRad/hr Humidity 100% humidity for 1000 hours 100% humidity for 500 hours 100% humidity for 12.5 hours Snow Load N/A 15 lb/ft2 N/A Ash Load N/A 5 lb/ft2 for 20 days N/A Wind Load N/A 91 mph gusts at 33 ft. above ground for 3 second intervals N/A Precipitation N/A 2.5” rain for 6 hours N/A DOE-HDBK-1230-2019 EXAMPLE 2 – AIR ACTUATED BALL VALVES 70 Functional Mode “Q” Function ☐ Active ☒ Passive Maintain pressure/confinement boundary ☒ Active ☐ Passive Return to the prescribed state on loss of pneumatic pressure by: • Maintaining isolation for fail closed valves • Maintaining fully open position for fail open valves ☒ Active ☐ Passive Limit switches must provide an open or close indication for valves SECTION 9 FAILURE MODES/MECHANISMS AND EFFECTS Failure Mode/Mechanism Effects on Component/System “Q” Function Fracture or Deformation: - Corrosion - Temperature - Pressure Fracture of the valve or actuator components may lead to a loss of pressure boundary, a failure to isolate, an inability to fail in the intended position, or an inability to report valve position. In the event of a failure, system processes may enter unstable scenarios, causing equipment failure or exposure of harmful material to the environment and co-located workers.

Seizure: - Corrosion - Wear or Erosion - Seismic Force Seizure of the valve or actuator components may lead to a failure to isolate, an inability to fail in the intended position, or an inability to report valve position. In the event of a failure, system processes may enter unstable scenarios, causing equipment failure or exposure of harmful material to the environment and co-located workers. Basis for Selection of Failure Modes/Mechanisms Including Failure History (If Available from the Supplier) I. Valve Assembly Components and Classifications A. Ball Valve i. Critical components within the valves are those which ensure the items (1) maintain their pressure boundary and (2) provides isolation. ii. The ball valve's pressure boundary and isolation components include: (1) the body, (2) end fitting, (3) ball, (4) TFM valve seats, and (5) fasteners. Failure mechanisms for these components are fracture or deformation. B. Actuator i. Critical components within the actuator are those which ensure the actuator (1) positions the valve to its intended failure state upon loss of pneumatic pressure and (2) provides a mechanical position input to the limit switch. Failure mechanisms for actuator components are fracture, deformation, or seizure. ii. Actuator components used to position the valve upon loss of pressure are either dynamic or static. a) Static components: (1) the actuator body, (2) left & right stop bolts, (3) inward travel stop bolt (4) left & right end caps, (5) end cap screws, (6) pinion washer, and (7) pinion O-ring. b) Dynamic components: (1) the pinion, (2) left & right pistons, (3) inner, middle, and outer springs, (4) inward travel spring, (5) piston guides & guide bands, and (6) pinion bearings and fittings. iii. Actuator components used to provide a mechanical position input to the limit switch are those axially concentric with the pinion. DOE-HDBK-1230-2019 EXAMPLE 2 – AIR ACTUATED BALL VALVES 71 C. Limit Switch All safety related limit switches for the order are furnished to the commercial supplier as Q GFE. These limit switches are recognized as basic components and do not fall within the scope of commercial grade dedication. D. Solenoids All Q solenoids for the order are furnished to the commercial supplier as Q GFE. The solenoids were furnished as Q material by Valcor Engineering, an audited NQA-1 supplier which performed commercial grade dedication to procure the solenoids. These solenoids are recognized as basic components and do not fall within the scope of commercial grade dedication. E. Auxiliary Components i. Mounting Bracket The mounting bracket provides structural integrity to the valve/actuator assembly. Failure mechanisms for the brackets are fracture or deformation. ii. Actuator/Valve Stem Coupler The actuator/valve stem coupler transfers force from the actuator to the valve. The coupler is critical for the actuator to close the valve upon loss of pneumatic pressure. Failure mechanisms for the coupler are fracture or deformation. iii. Electrical Wire/Conduit (non-safety) Electrical wiring connecting the limit switches to the solenoids are non-safety related components and fall outside the scope of commercial grade dedication. The electrical wiring and conduit provide power to the solenoids. The solenoids open and close to supply or vent pneumatic pressure. Pneumatic pressure supply is not critical to the valve's safety function because the valve is designed to fail in the appropriate position upon loss of pneumatic pressure. Since the solenoids serve only to control pneumatic pressure supply, the solenoids' subcomponents do not contribute to the valve assembly's safety function.

iv. Solenoid Filter/Regulator (non-safety) Solenoid filter/regulators are non-safety related components and fall outside the scope of commercial grade dedication. The solenoid filter/regulators provide the solenoid and actuator with clean, regulated air. However, pneumatic pressure supply is not critical to the valve's safety function because the valve is designed to fail in the appropriate position upon loss of pneumatic pressure. Furthermore, instrument service air and plant service air shall supply clean, dry air at 110 psig. Under these conditions and requirements, there are no credible failure mechanisms which would affect the valve assembly's safety function. v. Needle Valves and Tubing (non-safety) Needle valves are manually operated valves utilized to modulate air supply pressure. These valves serve no safety function and are thus outside the scope of commercial grade dedication. II. Failure Statistics Air Actuated Valves are common and important assemblies within the nuclear industry. The Electric Power Research Institute (EPRI) wrote a technical report, NP 7412 - Air-Operated Valve Maintenance Guide, where an analysis of Failure Modes for these valves is done. An analysis of one-year failures among air operated valves was performed with percent of failures attributed to each component. DOE-HDBK-1230-2019 EXAMPLE 2 – AIR ACTUATED BALL VALVES 72 Subcomponent Failure from 6/1/94 to 6/1/95 Rank Sub-Component % of failures 1. Actuators 30.0 2. Solenoid Valve 22.0 3. Limit Switch 7.5 4· Positioner 3.2 5. Spring 3.2 6. Air Line 3.0 7. Maintenance Error 2.4 8. Design 2 .0 9. Stem 2 .0 10. Bolting 1.5 1 1. Coupling 1.5 Others 21.7 Probability of Component Failure in Safety related Actuators The highest statistical failures were within the actuator. For those failures, 35% were attributable to diaphragm failures, 29% to seal and O-ring failures, 13% to bolting related failures, and 4% to piston binding. The second highest component failures were accessory solenoid valves at 22%. For these failures, 56% were due to failure of the solenoid-operated valve (SOV) diaphragm, 16% due to coil failure, and 12% due to sticking problems, and 7% due to dirt or clogging. Limit switches accounted for 7.5% of the total failures with 63% of these failures due to vibration-related problems. The remainder of the failures are individually small contributors to the overall failures, but they accounted for 40.5% of AOV failures. This statistical analysis demonstrates that most failures occurring in air operated valves are non-catastrophic failures, likely due to failure of soft goods or mechanical seizure. These results are factored into selection of critical characteristics and establishing credible failure mechanisms. Ill. Credible Failure Modes A. Fracture or Deformation Fracture or deformation are credible failure mechanisms for load-bearing structures, systems, and components (SSCs). Fracture is a catastrophic failure mechanism in which a load-bearing material has fragmented from a single piece into multiple pieces. Deformation is a failure mode in which a critical dimension of the item has been overcome by an external load or from effects of corrosion. In either failure mode, one or multiple safety functions may not perform as designed. B. Seizure Seizure is caused by improper i