ML20206N929

Contingency Plan for Year 2000 Issue in Nuclear Industry

ML20206N929
Person / Time
Issue date:	05/04/1999
From:	Clarence Breskovic, Chiramal M, Giitter J NRC (Affiliation Not Assigned), NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD), NRC OFFICE OF INTERNATIONAL PROGRAMS (OIP)
To:
Shared Package
ML20206N927	List: ML20206N923 ML20206N929
References
PROC-990504, NUDOCS 9905180106
Download: ML20206N929 (25)

Text

.- -

w.

8+#geneam%

y, 2

of u\ .

y ,

%, * ++# *\l\

U.S. Nuclear Regulatory Comrnission Contingency Plan for the Year 2'000 issue in the Nuclear Industry l

CHAIR l Joseph G. Glitter, AEOD l I

MEMBERS Clarence P. Breskovic, OIP Matthew Chiramal, NRR Elizabeth A. Hayden, OPA Gary W. Purdy, NMSS John C. Voglewede, OClO Jared S. Wermiel, NRR l

I HR52!sas7J88*

CORRESPONDENCE PDR ,

ENCLOSURE 2

5

1. INTRODUCTION The NRC is pursuing a comprehensive program for dealing with potential Year 2000 (Y2K) issues. We have been and will continue working with our licensees to ensure that potential Y2K issues have been Hentified and rectified and to ensure that our own computer-based systems will continue to function properly as we pass from 1999 into 2000. However, because of the nature of the Y2K issue, it is not possible to be 100 percent certain that all potential, problems will be corrected. For this reason, the NRC established a task force to develop a contingency plan for ensuring that public health and safety and the environment will continue to be protected, even if unforeseen Y2K issues occur.

In a statement she made on June 12,1998, to the Senate Special Committee on the Y2K technology problem, Chairn'1n Jackson said that the NRC recognizes "the nationalimportance of a broader focus that helps to ensure that potential concerns with electrical grid reliability are identified and resolved." To this end, the task force also explored contingency planning options for responding to regulatory and licensing issues that may result from grid reliability problems.

II. BACKGROUND Y2K-induced events are events that arise from a date-related problem that is experienced by a software system, a software application, or a digital device at a key rollover date when the system, application, or device does not perform its intended function. December 31,1999, to January 1,2000, and February 28,2000, to February 29,2000 are examples of key rollover dates. The nuclear utility industry is engaged in Y2K readiness programs at all nuclear power plant (NPP) facilities to seek out and correct Y2K issues that have any potential to affect facility operations. Despite these efforts, there is some risk of Y2K-induced events. Effective Y2K ,

contingency planning sets up a process for reducing such associated risks. The next section i describes how the Y2K issue could affect facilities and other entities regulated by the NRC.

Ill. PROBLEM STATEMENT A. REACTORS

1. Commercial Nuclear Power Plants The elebtricity production and delivery systems, as two of the more impodant elements of the North American economic and social infrastructure, must remain dependable during the i transition to Y2K. Every other critical element of infrastructure depends on the availability of an interconnected, reliable supply of electrical power. There is no doubt that cascading or even localized outages of generators and transmission facilities could have serious short- and long-  ;

term consequences. Continued safe operation of NPPs during the transition plays a major role j in maintaining reliable electrical power supply systems.

To ensure continued safe operation of NPPs during the Y2K transition, the NRC is engaged in l comprehensive evaluation of licensee Y2K readiness. On May 11,1998, the NRC sent Generic Letter 98-01 to all operational NPP licensees, requiring them to take a number of steps to address potential Y2K issues at their facilities. In addition, NRC is auditing a dozen NPPs (representing a cross-section by geographic location, type of design, and age of the plant) to ,

evaluate the effectiveness of measures those NPP licensees are taking to identify and correct j i

l

( Y2K issues at their facilities. NRC will use the results of these audits to determine if further regulatory action is required. By July 1,1999, all NPP licensees must confirm in writing that their plants are or will be Y2K ready by the year 2000 with regard to compliance with the terms and conditions of their license. Alllicensees have responded that they are implementing programs for Y2K readiness based upon industry guidance (Reference B.1) for Y2K readiness.

Industry has also prepared guidance (Reference B.2) to help NPP utilities develop Y2K i contingency plans. l IntemalFacility Risks The Y2K readiness program implemented by each NPP utility is intended to identify and fix-software-based items that could degrade, impair, or prevent operability of the facility. Safely-related instrumentation and control systems that perform safety function actuations do not present a Y2K issue because, in the vast majority of NPPs, these systems are analog hardwired j and therefore do not rely on software that may be subject to the Y2K issue. In those few cases in which such systems are computer based, the software does not have date-driven functions that may be affected by the Y2K issue. However, there remains some risk that plants could still be subject to a Y2K-induced event that has an effect on facility operations'.' Examples of such internal facility risks at NPPs are computer-based control systems for feedwater control, turbine  !

control, and generator voltage regulator control; plant process computer; control rod position information system; security computer system; and area radiation monitoring systems.

Contingency plans should identify failure modes and mitigation strategies for such risks. Y2K contingency planning should also consider the potential that the Y2K issue could potentially l affect many such systems and components.

ExtemalRisks Even if the intemal facility risks are small, there are still external risk:: to consider. External risks arise from conditions, circumstances, or events that are beyond the direct control of facility management. ' The task force identified electrical grid and telecommunications concerns as the significant external risk considerations; these and other concerns are discussed further in Section D.

As part of its contingency planning, the staff will attempt to identify those NPPs that may be most vulnerable to Y2K issues. Potential vulnerability will be determined on the basis of the information given in the second response to GL 98-01 and input from the Y2K program audits and other sources. ' Such an approach permits the staff to be better prepared to address potential Y2K issues at these particular plants in its contingency planning efforts.

2. Research and Training / Test Reactors Research and training / test reactor licensees have also established programs to evaluate and

- correct Y2K deficiencies. Many research reactors will be shut down on January 1,2000, as the institutions operating them (e.g., universities and laboratories) will be closed for the holiday.

Further, these reactors often have passive safety features and low power levels, which ensure minimal potential offsite consequences. In addition, the staff concluded that any research reactor in operation on January 1,2000, could be readily shut down manually using emergency

procedures and existing shutdown systems, even if their operational systems should experience a Y2K issue.

B. MATERIALS LICENSEES The Y2K issue may affect NRC's materials licensees in many different ways. Forixample, computer software that is used to calculate therapeutic dose or to account for radioactive decay may not recognize the turn of the century; this could lead to incorrectly calculated doses or exposure times for medical treatment planning. Other examples of software that may be affected are security control, radiation monitoring, technical specification surveillance testing, .

and accumulated burn-up programs. Also, equipment that licensees have purchased may _ ;

contain computer software susceptible to the Y2K issue. The prgbiem could occur not only in computer software or data acquimd from external sources, but also in programs developed by 1 licensees or consultants. In an effort to inform materials licensees of the Y2K issue, NRC has l issued three information notices (References A.3, A.4, and A.5) and one generic letter ]'

(Reference A.2).

1. Medical Licensees By interviewing licensees and manufacturers, the staff found that , devices containing byproduct material (high-dose-rate and teletherapy units) appear to be Y2K compliant. Manufacturers of some dose calibrators have found them nol Y2K compliant; also, some treatment planning 1 systems are not Y2K compliant. NRC is working with the U.S. Food and Drug Administration (FDA) to determine if there are any health and safety problems associated with medical devices that use byproduct material.

2. Manufacturers NRC interviewed a large manufacturer of radiopharmaceutical products. At the time of the interview, the manufacturer did not believe that the Y2K issue would affect health and safety.

The dose calibrators used at the manufacturing facility are Y2K compliant. The manufacturer believes that the Y2K issue will not affect product quality or accuracy of the measured activity.

3. Irradiators NRC has interviewed Sterigenics, a firm that operates 12 large irradiator facilities. Sterigenics' staff believes that there are no health and safety problems related to the Y2K issue. The interlock systems and source movement for the irradiators used at its facilities are not controlled by computers. NMSS will contact a large manufacturer of irradiators for more information.

4. Fuel Cycle Facilities NRC has conducted interviews at two fuel cycle facilities regarding the Y2K issue. All fuel cycle facilities have been inspected for Y2K concerns. The primary Y2K concern for fuel cycle facilities is diversion / theft of special nuclear material.

A generic letter (Reference A.2) was sent to fuel cycle licensees and certificate holders requesting (1) written confirmation of implementation of their Year 2000 Readiness Program; (2) written confirmation that the facilities are Y2K ready and in compliance with the terms and conditions of their license / certificate and NRC regulations; and (3) for facilities that are not Y2K ready on or before December 31,1998, a written response updating the status and schedule of the facilities' Year 2000 Readiness Program. Every fuel facility has sent written confirmation of j implementation of their Year 2000 Readiness program. 1 I

Risks for Fuel Facilities The Y2K readiness program implemented by each fuel facility is intended to identify and repair software, hardware, and embedded systems that could degrade,, impair, or prevent operability of the facility. The primary Y2K concern for fuel cycle facilities is diversion / theft of special nuclear ,

material. However, the risk of diversion / theft of special nuclear materialis highly unlikely and l poses no undo safeguards risk. In the unlikely event of.a complete facility blackout, the GDPs would shut down to a safe condition. However, the restart of the GDP could pose a slight risk to employees from a uranium hexafluoride (UF ) release. A release of UF in this scenario poses no risk to members of the public. Identification of Y2K problems with fuel cycle facilities will be done after all the responses to the Generic Letter are received. There is no identified risk-significant concern for fuel cycle facilities.

Risks for Other Materials Licensees For medicallicensees, overexposure or underexposure of patients represents the greatest risk.

Dose calibrators and some treatment planning systems have Y2K compliant problems. Due to the efforts of the manufacturers of dose calibrators and treatment planning systems, FDA, and the NRC, the risk to patients is considered to be low.

The risk of the Y2K issue affecting health and safety at manufacturers and irradiators facilities is low, Most of the safety systems at these facilities are not computer controlled.

If it is determined that a device has a Y2K issue that affects health and safety, NMSS will use current p,ocedures r for notifying licensees of unsafe devices. Notification will be sent directly to the affected licensees through use of the License Tracking System.

C. INTERNATIONAL lt is highly probable that Canada and Mexico will experience similar problems as described above, which could have negative effects on U.S. public health and safety, just as Y2K issues in the United States could affect Canada and Mexico. For these reasons, NRC must review cxisting emergency notification procedures with those countries and coordinate Y2K-related contingency plans.

D. INFRASTRUCTURE

1. Electrical Grid Concerns E

' External electrical grid system problems that could arise as a result of a Y2K issue are loss of offsite power, grid instability, voltage and frequency fluctuations, circuit breaker malfunctions, load fluctuations, and loss of grid control systems. The North American Electric Reliability Council released a report on September 17,1998, that evaluated the anticipated impacts of Y2K on electrical systems (Reference C.2). The initial findings of the report conclude that proper contingency planning on the part of electric utilities should alleviate widespread power outages.

However, the report also conceded that the Y2K issue would result in increased risk of isolated, local outages. .

One of .he major concerns raised in the NERC report is the lack of information on Y2K raadiness - about 25 percent of the electric utilities did not respond to the NERC Y2K rzadiness survey. However, the report also indicates that all NPP Y2K programs are on schedule to achieve Y2K ready status, largely owing to leadership from the Nuclear Energy institute (NEI) in this area. Another major concern raised in the report is the dependency of electrical power generation, transmission, and distribution on telecommun; cation system. One reason for this concern is that these telecommunication systems may be outside of the utility's control.

Interconnections There are four large electric grid Interconnections in North America as shown in Figure 1. The largest Interconnection is the Eastern Interconnection which covers the eastern two-thirds of the United States and much of Canada. .The Western Interconnection has connections into Mexico and covers the western U.S. and British Columbia and Alberta, Canada. The Quebec Interconnection (sometimes included as part of the Eastern Interconnection) covers the Canadian Province of Quebec and the Texas Interconnection covers most of Texas. The I

interconnections are mostly independent of each other, and are essentially ac/dc/ac inter-ties that filter out most, but not all, disturbances. A major disturbance within the interconnection has the potential to cascade to the entire interconnection. The North American Electric Reliability Council (NERC) has identified the following four critical areas that pose the greatest direct threat to power production and delivery. j l

1 l

l l

4 I

y

.s.

PowerProduction As discussed previously, power plants (including fossil and nuclear) must be able t$ stay online during the Y2K transition period to avoid major grid disturbances or outages. Newer plants with

, digital control systems may be the most vulnerable. The control and protection functions that the digital control systems perform often utilize time-dependerit algorithms, which can, if uncorrected, lead to unintentional generator trips.

, Y c::=

h c.

s -.

.- g

%_ )

JR8962EkB E -Westem Interconnection j G - Texas interconnection i O - Eastem Interconnection i E2 - Quebec Interconnection  ;

- Figure 1; Electrical Grid Interconnections in North America i

)

i l

4 l

l

Energy Management Systems Electric utility control centers monitor power system operations (including generating plants, transmission and distribution systems, and customer loads), retain historical data, and allow for the manual and automatic control of field equipment. The control center's energy management system includes supervisory control and data acquisition systems, automatic gene'rhtion control systems, energy management applications and databases, and graphical user interfaces.

Uncorrected Y2K issues in these systems could result in the I,oss of monitoring, dispatching, and  !

control functions. In addition, many energy management systems rely on precise time signals that may be provided by global positioning system (GPS) technology. GPS has a unique a.,d pressing problem: the clock used by this system will turn over to 0000 on August 22,1999.

Telecommunications As shown in Figure 2, the transmission and distribution of electrical power is highly dependent on microwave, telephone, and VHF radio communications. Telecommunications systems, in turn, are highly dependent on the availability of electrical power. Section D contains a discussion of how Y2K issues are being addressed by the telecomrnunications industry.

,j - - -......,,,*

loggg ...*

can c.&,,, .,

c, ,;

i.dik"uidst e mw-tz . . . . . . . . ,

'.q s 'N

__. \ *  ? ,

il j {llllllll'I r,-,, . ] [ll'l)l':ll\ 1 * ': ' . .

S*Su er -

g;;:l, -

4\_ M '\ ,.-

~

MM p M M ..~.u,..

v

\ - =:~

y, g m _.

- e.anc n-

"?O** cg* IT/ "' ]

Figure 2. The Generation, Transmission, and Distribution of Electricity Requires Telecommurications Systems

i l

Protection Systems 1

Many newer relay protection devices are digital and are vulnerable to Y2K issues. The concern i raised by NERC was the possibility of a common-mode failure in which all relays of a particular model fail at once, causing a large number of coincident outages in transmission facilities. <

2. Telecommunications As discussed previously, reliable telecommunications service is crucial to the production and l delivery of power. The Regional Bell Operating Companies (RBOCs), such as Bell Atlantic arid U.S. West, independent telephone companies, such as Aliant Communications, and .

interexchange carriers (IXCs) , such as AT&T, MCl Worldcom, and Sprint, have programs in l' place to ensure that their telephone networks will be Y2K compliant. For example, AT&T has committed approximately half a billion dollars to complete the assessment, revision, and testing of its voice, wireless, data, and government networks by December 31,1998. Major RBOCs are participants in the National Year 2000 Telco Forum, a consortium that has contracted with Bellcore to conduct interoperability testing of data and voice networks. In addition, both IXCs and RBOCs are in a partnership with the Alliance for Telecommunications industry Solutions (ATIS) to plan and conduct Y2K signaling interoperability tests. The testing, which is being organized by the ATIS Network Testing Committee (NTC), involves advancing the network clock and ensuring that the signaling between local exchange carriers (U.S. West, Ameritech, and GTE) and IXCs (Sprint and AT&T) is unaffected by the Y2K transition.

Although it appears that telecommunications providers are taking the necessary steps to ensure continued reliable operation of the public switched network (PSN) through the Y2K transition, the task force identified the following concerns:

• Although we know that many major telecommunications service providers are taking the necessary steps to address potential Y2K concerns, we know less information about the small local telephone companies. Many NPPs and fuel cycle facilities are located in rural areas that are serviced by small telephone companies.

• Although many utilities have corporate communication networks that tie into the PSN

" downstream" of the local telephone company, some utilities appear to rely extensively on the small local telephone company. The recently enacted Year 2000 Information ind Readiness Disclosure Act should help small local telephone companies get on the track of Y2K compliance.

• ' The PSN is so vast and complex that it is impractical to perform a rigorous quantitative reliability analysis. Despite the fact that recent studies conclude that the probability of a widespread outage is low, there have been two widespread outages within the last year caused by network signaling software problems. Both of these outages were attributed to a company that provides network signaling capability to small telephone companies.

NRC participates in a number of Government-wide emergency telecommunications initiatives.

Most of these are administered through the National Communications System (NCS). An cxample of a technology currently in use by NRC is the Government Emergency

l

' Telecommunications System (GETS), which provides authenticated access, enhanced routing, and priority treatment in long-distance telephone net'uorks. GETS presumes continued operation of public and Federal telephone networks during national emergencies when the  ;

volume of network traffic is expected to be very high. However, this system may not provide l protection in the event of a major network outage, p NCS has been working closely with the NTC to ensure that emergency telecommunications =

systems are included in the internetwork Y2K testing of the PSN. The NCS is also in the initial  !

stages of developing communication network alternatives in the event of a major PSN outage.

These attematives utilize high-frequency radio and dedicated land lines. The'NRC is exploring ~

the option of becoming a node on the special NCS Y2K contingency network.

2 ,

3. Flooding / Loss of Heat Sink 4 j

In the industry planning document (Reference B.2), loss of heat sink was identified as an external event that NPPs should consider for contingency planning purposes. This is a potential  ;

concern because systems used to control the amount of water released from a reservoir or j hydroelectric dam often rely upon computers or imbedded controllers that are susceptible to the  !

Y2K issue. Consequently, the task force examined the potential for a Y2K-induced loss of heat sink (or flooding) that could affect NRC-licensed facilities that are on rivers or flood plains. The )

staff has consulted with the U.S. Army Corps of Engineers (USACE) regarding this issue and i I

has teamed that, although there are potential Y2K issues that could prevent the operation of these systems, there are no identified failure mechanisms that could result in a substantial increase or decrease in the amount of water released. In addition, there is a capability to manually operate the hydroelectric plants or, if necessary, the sluice gates in a manner that l cnsures that minimum downstrea'm flows are maintained. However, another factor examined l by the task force was the need for reliable communication between nuclear power plant  !

operators and the USACE. For example, in January, ice jamming on the Missouri River can I r sult in reducod river water levels. Often when this occurs, NPP operators contact the USACE j and ask them to increase downstream flows. However, because the chain of events that j influences river water levels typically takes place over a number of days, this scenario would j only be a concern if there vilere a prolonged (i.e., at least several days) telecommunication l outage. Since this is highly unlikely, the task force concluded that loss of heat sink was not a l significa$t concern for NRC coiltingency planning purposes.  !

4. Consumables l l

Another concern raised by the task force was the potential that certain chemicals, diesel fuel oil, water, food, and other consumables may be difficult to obtain if the Y2K transition results in a breakdown of major infrastructures. As an example of this potential, a truck en route to the Turkey Point Plant to deliver water in the aftermath of Hurricane Andrew was diverted by local 1:w enforcement officials for another use.

IV. COORDINATION

- A. INDUSTRY l l

I

I i

i l

l In the summer of 1998, under the oversight of the Nuclear Energy Institute (NEI), the industry formed a Contingency Planning Task Force to provide NPP utilities with a " focused approach" to Y2K contingency planning. The primary product of that task force was a Y2K contingency plan guidance document entitled NEl/NUSMG 98-07, Nuclear Utility Yeai 2000 Readiness l

-Contingency Planning, dated August 1998. This document, which builds on Y2K readiness  ;

programs already in place, presents guidance that can be used by plant operating' staff to develop effective contingency plans for mitigating the potential unanticipated effsets of a Y2K  ;

issue. The guidance incorporates risks to safe plant operation resulting from potential Y2K l issues into the existing emergency procedures and emergency response organization at each _  ;

NPP. To a large extent, Y2K issue contingency planning will be plant specific or it will depend ' {

. on the specific systems and risks identified as affected by the Y2K hsue at the individual plant.

_ l

However, two generic areas of consideration for contingency planning identified in NEl/NUSMG j 98-07 are (1) augmentation of staff and (2) availability of consumables (e.g., emergency diesel  ;

f generator fuel oil and water chemistry control chemicals).

The staff contacted NEl concerning the need for further coordination of nuclear industry Y2K contingency planning efforts. NEl indicated that it does not plan additionai coordination of licensee contingency planning efforts because of the plant-specific nature of the issue. NEl stated that individual licensees will work with the NRC as riecessary in accordance w;th their existing emergency response procedures should they experience plant operability concerns due l to Y2K issues as they would for any unanticipated operating event. The staff has concluded that the existing emergency response capability at the nuclear facilities, supplemented to address

- the Y2K issue in accordance with NEl/NUSMG 98-07, provides the best approach to licensee j contingency planning for this issue. {

Due to the variety of operations, materials licensees have had to develop individual Y2K remediation plans. From a small sample of materials and fuel cycle licensees,it appears that  !

trrger facilities are aware of the Y2K issue and are addressing the issue. The NRC Office of the l j

Inspector General (OlG) conducted a survey that identified a lack of Y2K awareness among radiation safety officers of Priority 3 licensees. l B. OTHER FEDERAL AGENCIES

1. -

NRC is a member of the Emergency Services Sector (ESS) Working Group for Y2K, which is headed by the Federal Emergency Management Agency (FEMA). FEMA has been working closely with the private sector and with State and local governments to ensure that emergency services and emergency response will not be affected by the Y2K transition. The Catastrophic Disaster Response Group, which includes representatives of the 12 lead agencies of the Federal Response Plan, is working with constituent groups on issues of emergency preparedness and allocation of resources, j Although the focus for the CDRG is narrower than that for the ESS Working Group, the l activities a cemlimentary. The NRC is participating in monthly CDRG meetings on the Y2K issue. Basad on a survey by FEMA of State emergency managers, most State Emergency Operation Center systems are Y2K compliant and will be available for  ;

disaster response. There is less information about the countics level of readiness, including county police and 911 centers.

< l

4

2. The Department of Energy (DOE)is the principal Federat agency 'with oversight responsibility for Y2K issues in electricity supply systems. The NRC will coordinate with DOE on NRC/ DOE contingency plans.

3. NRC contacted the Federal Energy Regulatory Commission (FERC) to find out if they were considering Y2K contingency planning related to issues or potential prbblems associated with electricity supply systems. FERC is not developing such plans, but is relying on DOE Y2K contingency plans to address these issues.

4. The NRC is working closely with the National Communication System (NCS) to ensure that emergency response communications will not be affected by the Y2K transition.

NRC is exploring the option of becoming a node on the special NCS Y2K contingency network.

5. The NRC has consulted with the U.S. Army Corps of Engineers (USACE) concerning the potential for Y2K failures that could affect river water levels and flows.

6. The NRC is coordinating its activities regarding the international aspects of the contingency plan with FEMA, the Department of State, and the Environmental Protection Agency.

7. The NationalInteragency Fire Cache can provide emergency telecommunications equipment support to the NRC, including HF radios and mobile satellite equipment. Use of such equipment would require advance placement at a licensed facility or placernent within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after an incident. l

8. The NRC has discussed the Y2K readiness of FTS2001 services with the General Services Administration (GSA). GSA has assured NRC that the FTS2001 system will I be Y2K compliant.

i 1

9. NRC is coordinating activities regarding medical devices that use byproduct material with the U.S. Food and Drug Administration (FDA).

l C.  ; STATES To facilitate Agreement State efforts to address the Y2K issue, a link to State Government Year ,

2000 Websites has been provided by NRC. NRC's website identifies Y2K resources, notices, l conferences, and other related information. The States have been given the Internet address of )

this site. The NRC will make every effort to share with the States any issue involving the Y2K

~

issue and problems involving NRC materials licensees that may also affect Agreement States or  !

Agreement State licensees. NRC also requested that Agreement States share any information  ;

cbout Agreement State materials licensees that have identified a Y2K issue that could affect

)

NRC, other Agreement States, or their licensees.

l l

1 1

D. INTERNATIONAL REGULATORY BODIES AND lAEA/NEA

1. Multilateral Coordination Multilateral coordination takes place in the form of information exchange and coordination at international forums such as the International Atomic Energy Agency (IAEA) and the Nuclear Energy Agency (NEA). Both organizations have established programs to let IAEA member states exchange Y2K information in an effort to diagnose and remedy Y2K-related nuclear safety problems. The Office of International Programs will actively participate and monitor progress in these areas.

Intemational Atomic Energy Agency (IAEA) O At its 1998 General Conference, the IAEA adopted a U.S.-sponsored resolution (drafted by the NRC) to make the IAEA a clearinghouse and central point of contact for IAEA member states to exchange information regarding diagnostic and remediation actions being taken at NPPs, and at fuel cycle and medical facilities that use radioactive materials, to make these facilities Y2K ready. The resolution also urges Member States to share information with the IAEA regarding diagnostic and corrective actions being planned or implemented by operating and regulatory organizations and emphasizes that Member States should have contingency plans in place at operating and regulatory organizations well before December 31,1999, in order to handle potential problems that may arise at that time at those nuclear facilities, in response, the IAEA has created a special project to address nuclear.Y2K-related safety concerns and contingency planning for NPPs and research reactors, and plans to hold several Y2K workshops starting in December 1998. The IAEA'also recently sent a questionnaire to member states requesting info'rmation about their respective Y2K plans. The questionnaire was distributed to NRC technical offices and NRC will send the coordinated responses to the IAEA.

The U.S. is also providing a cost-free expert to the IAEA to assist in the establishment of IAEA Y2K guidelines. This expert is Morgan Libby, who co-authored the NEl paper titled " Nuclear Utility Year 2000 Readiness Contingency Planning." He will assist the IAEA on Y2K contingencV planning.

Y2K i'ssues were discussed in September 1998 at a special session of the international Conference on Topical issues in Nuclear, Radiation, and Waste Safety which met in Vienna and

.at the August 1998 meeting of the WER Regulators Group in Armenia.

At this time, NRC knows nothing about the IAEA contingency plan for the international emergency response system.

Nuclear Energy Agency (NEA)

In February 1998, the NEA sent a Y2K questionnaire to members of its Committee on Nuclear

- Regulatory Agencies (CNRA). A brief summary of the responses issued in May 1998 showed that all participating regulatory bodies were taking aggressive steps with licensees to identify and solve Y2K issues. In August 1998, the NEA finished its work on an international e-mail i

i

_A

notification system, enabling CNRA members to rapidly and confidentially exchange Y2K information. The NEA plans to make the e-mail system Y2K ready by setting up redundant computer and power supply systems. The CNRA members are Belgium, Canada, Czech l Republic, Finland, France, Germany, Hungary, IAEA, Japan, Netherlands, South Korea, Spain,  !

Sweden, Switzerland, United Kingdom, and United States. . l r j The NEA is also organizing a Y2K workshop in February 1999 (co-sponsored by the IAEA), and the NRC has proposed that regulators from the former Soviet Union and Central and Eastern Europe be invited to attend.  ? l

~ European Union l

l The European Commission sponsored a meeting of eastern / western European nuclear regulators in June 1998, at which the Y2K topic was reviewed; attendees spoke about progress in their industry.

. 2. Bilateral Coordination NRC's main focus of bilateral contingency planning efforts is on Canada and Mexico. The NRC enjoys close bilateral ties with both countries and special emergency procedures are in place permitting rapid and redundant communications should an emergency arise. Contingency planning for these countries will involve, among other things, the examination of existing

. procedures and communications channels. It may also be necessary to coordinate with U.S.

border States and Canadian and Mexican provinces.

Canada The Atomic Energy Control Board (AECB) of Canada is addressing the Y2K issue at Canadian NPPs and hopes to have all plants Y2K compliant by June 30,1999. Informal contacts with the AECB indicate that currently Canada has no plans to examine existing U.S.-Canadian emergency response procedures from a Y2K perspective. NRC will formally approach the AECB to discuss multilateral and bilateral aspects of Y2K contingency planning.

Mexico The status or existence of Y2K contingency plans in Mexico is not known at the moment. When informally approached, the Mexicans requested a formal communication, and that is being prepared.

IAEA .

NRC and IAEA will coordinate contingency plans for direct NRC-IAEA communications in case of a U.S. nuclear emergency.

Other Countries

- Countries with which the NRC has technicalinformation exchange arrangements will be individually _ contacted by NRC regarding Y2K issues as part of the ongoing emergency pre'paredness information exchange. NRC will explore the possibility of using existing bilateral means of communications as redundant communications channels should the regular

' international emergency response system fail. _

NRC will also encourage countries in earlier time zones, which will experience Y2K-related

. . problems before the U.S. does, to relate information about Y2K issues to the NRC in the quickest possible manner to enable U.S. licensees to avoid cdmmon-cause failures. This effort will be directed mainly at Far Eastern countries, such as Japan, South Korea, and Taiwan, ,

which operate U.S.-style reactors, but could also include certain European countries. The time differenr.e for these countries vs. EST or PST ranges from plus 1,2 fo 15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br /> (Far East) ahd 6 to 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> (Europe).- It may also be possible to coordinate this activity with FEMA'if a proposal by the Chairman of the U.S. Senate Committee on the Year 2000 to set up a Y2K "early warning" system is implemented.

Federal Agencies NRC is coordinating with the emergency response centers of all Federal agencies involved in the international nuclear emergency notification and response system, such as the Departments

.of State and Energy, the Environmental Protection Agency, the Federal Emergency Management Agency, the National Security Council, and the President's Council on Y2K Conversion.

3. International' Safeguards and Physical Protection The IAEA has instituted a program to examine all its safeguards systems (computers and cquipment) for Y2K compliance, and plans to have all systems under its control Y2K compliant by the end 'of 1998. It,will take 1onger to modify in'-field equipment because much of the software

- was developed by outside suppliers and because some of the equipment is built in to plant processes. The IAEA is working to resolv'e these problems.

NRC has also asked NMSS to investigate the contingency plans of foreign countries with respect to physical protection and to raise the issue of Y2K in future visits to study physical protection.

V. CONTINGENCY PLAN Ai SCENARIO

- p DEVELOPMENT The task fbree evaluated a range of possible scenarios. At the lowest end of the spectrum is a situation in which everything goes on as usual during the transition from 1999 to 2000. At the opposite end of the spectrum the task force hypothesized a worst-case scenario involving a

- widespread telecommunications outage, a co'mplete loss of the North American power grid, and

- several major incidents at NPPs (e.g., station blackout, loss of ultimate heat sink, loss of

' feedwater) in conjunction with risk-significant challenges at many other plants (e.g., loss offsite power or feedwater transients). The task force decided that the most prudent course of action W1.

W ...

+.4:-

4

. L was to identify a ' planning scenario" that falls somewhere between the two extremes. This

' planning scenario would encompass events that are beyond our current best estimate of likely

. consequences', but that would allow the staff to respond to unforeseen possibilities. After careful

' consideration of the current understanding of Y2K readiness and risk, as described in Section lit, the task force established the following planning assumptions:  :

• ' Y2K issues will lead to localized electrical grid disturbances and power outages within 1 ' one or more interconnectionsLHowever, there will not be major regional or nationwide

- electric power outages. >

• Local or regional telecommunications outages will occur, but there will not be a complete loss of the public switched network (PSN). Networks assocl5ted with Regional Bell Operating Companies (RBOCs),' major independent tele' phone companies, and -

interexchange carriers (IXCs) will remain functional.

'*- At least two NRC-licensed facilities will be affected directly or indirectly by a Y2K issue that requires an NRC response (e.g., loss of offsite power).

+ - Y2K issues will affect at least one NPP outside of the United States.

• - . Unforeseen Y2K issues will place a dozen or more licensees in situations that depart

' from a license condition or a technical specification.

_ B. INCIDENT RESPCNSE

. Response Mode.

l The task force determined that the backbone of the contingency plan should be the agency's well-established and well-tested incident Response Plan. On the basis of the planning scenario, L the agency would enter Standby mode or1 New Year's Eve 1999, in Standby mode, the Operations Center technical teams are completely staffed and a member of the Executive Team leads the agency's response. Ordinarily, the congressional and international liaison team

positions are not filled during S,tandby. However, as discussed below, the task force

- recomplends not only staffing'the intemational liaison team position, but augmenting it as well.

Attachment 1 provides a timeline of when the Operations Center would be staffed for Standby.

Operations Center Readiness

. Th{NRC Operations Center relies on three major interrelated systems to ensure the timely flow of information during an emergency: the Emergency Telecommunications System (ETS), the

Emergency Response Data System (ERDS), and the Operations Center information

Management System (OCIMS). ETS is the telecommunications network that NRC relies on for voice and data communication between the NRC Operations Center and the emergency response facilities (control room, technical support center, emergency operations facility)

' f associated with every NPP and maj( r fuel cycle facility. ERDS is a real-time data system that Tilows safety-related information to be downloaded from p ant computers at all commercial

, NPPs. . OCIMS is the primary means of creating,. storing, sending, and retrieving information in

the Operations Center. All three of these systems are considered mission critical. The staff is very confident that by the Office of Management and Budget (OMB) implementation milestone date of March 1999, these systems will be made Y2K compliant. Nonetheless, the staff has developed Y2K contingency plans for each of these systems. The contingency plans assume that electric power, telecommunications, and building support systems are available.

y Although a widespread communications outage that affected both the Regional Bell Operating Company (Bell Atlantic) and the FTS2000 network is considered extremely unlikely, the NRC is exploring the option of becoming a node on an emergency co'mmunications network being planned by the National Communication System in preparation for potential Y2K issues. This :

network may allow NRC to communicate with many of its licensees even if there is a regional telecommunications outage that affected the Washington, D.C. metropolitan area.

A localized outage (e.g., a problem at a central office) would be much less likely to affect NRC communications with its power plant and fuel cycle licensees. This is because the NRC's Emergency Telecommunications Systems (ETS) is designed to remain functional following a single fault or failure, barring a fire in the telephone cable room or some other common-mode failure. The trunk groups from the NRC private branch exchange (PBX) arb routed to two physically separate add / drop multiplexers (ADM.s) in the telephone cable room where they are added to the Synchronous Optical Network (SONET). To provide for diversity, one of the trunks is routed to a different central office (CO) than the others. Because SONET is "self healing" it should not be vulnerable to a single fiber cut. A limited number of Washington Interagency Telephone System (WITS) lines are'also provi_deo in the Operations Center in the event of a complete PBX failure. One of the trunks is dedicated to outgoing calls on the FTS2000 network.

The FTS2000 network, the largest private telephone network in the world, is essentially independent of the pub!ic switched network. Currently, dedicated lines are run to each NPP site from the closest FTS2000 point of presence. However, because the direct access line (DAL) circuits are often run parallel with commercial telephone lines (and are, therefore, susceptible to common-mode failure mechanisms), an alternate means has been established to reach each NPP's control room via a microwave link through the load dispatcher.

The Operations Center also has a dedicated emergency power system, including a dedicated emergencylliesel generator and several uninterruptible power supplies, and a dedicated heating,' ventilation, and cooling' system. The Facilities Branch within the NRC Office of Administration is working with the vendors of the support systems (environmental management and control system, tenant chilled and condenser water systems, air handling units, emergency power systems) to ensure that Y2K compliance meets the OMB-scheduled date of March 1999.

In addition, because a regional telecommunications or electric grid outage is a possibility, the staff recommends one additional contingency measure: a back-up operations center. The staff recommends that the Region IV Incident Response Center (IRC) be staffed with a small cadre of responders. Region IV was selected for several reasons:

• Region IV is the only regional office that is not in the Eastern interconnection A major grid outage in the Eastern Interconnection could affect Headquarters and Regions I, ll, and Ill.

b

• Region IV is the only regional office that has telecommunications systems comparable to  !

those at Headquarters. It was for this reason that the back-up to the Headquarters {

Automatic Notifica' ion System was placed in Regicn IV. I

- Region IV is one time zone removed from Headquarters and may be in a better position to respond to major problems on the East Coast that affected Headquarters.

Staffing Because NRC's response to an incident at a NPP requires a different type of expertise than an  !

incident at a fuel cycle facility, the response precedures are oriented to a particular type of )

facility. For example, if an event occurs at a reactor, the Reactor Safety Team and a Protective Measures Team with specialty in reactor safety are called to the Operations Center. However, )

f in order to respond to the Y2K planning scenario, a scaled-down multidisciplinary team of responders, as described in Attachment 1, is recommended. The total number of Headquarters responders, approximately 40, represents about half of the number who would typically l participate in a full-participation exercise. It is currently envisioned that the Region IV IRC would  !

be staffed with approximately 20 responders, which corresponds to the current number of  !

positions on the Region IV incident response roster. In their backup capacity, however, they (

would not be expected to carry out all of the responsibilities of the headquarters team. On the other hand, if the problems encountered during the Y2K transition are more significant than anticipated in the planning scenario, then Region IV could provide additional response support. ,

The task force also recommends that a resident inspector be on site during the Y2K transition. )

i information Brokers 1

This specialized response team would not only respond to any Y2K-related problems at NRC- j licensed facilities, but would also serve as a broker of safety-significant Y2K information that ]

could affect our licensees. Ideally, any Y2K problems that may begin to appear in Japan, Korea, {

i and other nations that are on the front end of the International Date Line could be communicated to NRC through IAEA. The response teams could then rapidly evaluate this information for applicability;to NRC licensees and communicate this information via fax, phone, or computer (Internet)/The task force also discussed the possibility that NRC could relay information related j I

to Y2Kiroblems experienced by facilities in the Eastern time zone, provided that licensees volun,teered this information as soon as possible and did not rely on the timing and threshold established by the 10 CFR 50.72 reporting requirements. Although,it is unlikely that licensees could take corrective actions on the basis of this information (indeed, it may not be prudent to take short-term actions without thoroughly analyzing the problem), it may assist licensees in implementing contingency measures. This information-brokering activity is further discussed in the timeline provided as Attachment 2.

In developing the "early warning" scenario permitted by time zone differences, the task force made several assumptions conceming the nature of the Y2K issue:

First, the Y2K issue is not limited to the transition that occurs at midnight, December 31,1999.

Other significant dates, including September 9,1999 (9/9/99) and February 29,2000 (a leap day), are discussed in Attachment 3. However, the task group concluded that the Y2K rollover l l

l l

is the most significant operating date. This assumption is consistent with the prioritization of transition date by groups such as the North American Electric Reliability Councilc Second, Y2K issues that originate with the midnight, December 31,1999, rollover may not be apparent at that time. For example, a control circuit that fails to reset for any date after 1999

^

may not exhibit this failure until a demand is placed on this circuit. This may not occur for days, weeks, or months after the transition date. The task force assumed that the greatest probability of failure, particularly for reactor safety systems, would occur. shortly (seconds, minutes, hours) a'r she transition date because such short processing times are involved with these systems.,

The general probability of failure wofd decrease with the passage ofjime, and risk factors involving simultaneous failures or failures involving infrastructure beyond the plant's control would also decrease. In any case, the task force recommends that the greatest emphasis be placed on facilities located in the time zone in which local midnight is occurring.

Third, some'Y2K issues involving safety systems may show up quickly enough and clearly enough to be positively identified. This information could be passed along to units containing similar systems in sufficient time to take some positive action. The likelihoo,d of such an event occurring and the usefulness of further distributing such information are cle'arly debatable.

'Nevertheless, the provision for early waming due to time zone differences appears to warrant i consideration in agency contingency plans.

C. REGULATORY RESPONSE As discussed in Section Ill, the nuclear industry is pursuing a program to identify and remediate Y2K problems that could affect facility operations. The program willincorporate effective contingency planning for reducing the risks associated with unanticipated Y2K-induced events.

Despite these activities, there remains some risk that software-based systems, components, or equipment will still be subject to Y2K-induced events at key rollover dates that affect facility operations. These risks are primarily external to the plant and are of particular concern with regard to electric grid availability (loss of offsite power). If such events were to occur, to continue to operate the nuclear plant safely generating electrical power during the transitional period, the plant licensee may have to (1) take actions that depart from a license condition or a technical specification and (2) seek immediate approval from the NRC for such a departure from a licenss condition or technical s'pecification. These actions may be in the best interest of maintaining public health and safety during the Y2K transition period.

The task force recognizes that the nexus between maintaining a reliable electric power grid and public health and safety is less clear and less direct than that which has traditionally been associated with NRC's statutory requirements under the Atomic Energy Act. However, because the potentialimp3ct of the Year 2000 problem is so widespread, the task force believes that failure to provide electricity to customers at this critical time may have adverse public health and safety consequences.

The potential for adverse impact on public health and safety results primarily from the fact that an unreliable grid can adversely affect NPP safety. An unreliable grid may result in a loss of offsite power at a NPP. A loss of offsite power requires NPPs to rely on their onsite sources of emergency power. Exclusive reliance on emergency power sources increases the overall plant i

risk from other, possibly Y2K-related, problems at the plant, in fact, probabilistic risk essessments frequently identify the loss of both onsite and offsite ac power, referred to as station blackout, as a situation that constitutes a major portion of the total plant risk.

In addition, failure to provide the electricity to the grid may also have an impact on public health and safety in a broader sense. For example, in mid-July 1995, a heat wave struck the upper ~

Midwest and contributed to a number of fatalities in the Milwaukee and Chicago areas. Many of the fatalities were directly attributed to the heat, and invo!ved people without a'ccess to air conditioning. A loss of the grid during this period would have likely r'esulted in an increased number of fatalities. In situations like this, grid reliability has a direct relationship to public health and safety.

In an effort to h'elp ensure reliable power to the electric grid during the transitional period of the

~

Y2K rollover date, as an important aspect of the protecticn of public health and safety in the broader sense discussed above, the task force recommends the following:

+ . The NRC examine whether the use of 10 CFR 50.54(x) by licensees in these circumstances may be appropriate.

- or -

• The NRC develop a revised enforcement discretion policy specific to the Y2K transition period with specific guidance on those circumstances under which continued plant operation would be permitted and no significant safety concern results.

• The NRC will provide support staff consisting of projects and enforcement personnelin the Operations Center to assist licensees in making prompt operability determinations during this transition period.

The NRC has determined that if the agency were to address Y2K problems affecting plant operability within the existing regulatory framework and procedures, continued safe operation of the facility could be unnecessarily adversely impacted, thereby potentially resulting in adverse impact on public health and safety by forcing an unnecessary plant shutdown. NRC approval for rdef from a t' echnical specification or license condition under current practices for notification of enforcement discretion would be too cumbersome and unworkable given the desire for prompt cction if the licensee determines that continued safe plant operation is possible. Consequently,

]

a 10 CVR 50.54(x)-type relief or a revised enforcement discretion policy will be considered.

The above options are currently under review and a final determination on the appropriate cpproach to address this issue will be made after consideration of stakeholder input.

VI. REFERENCES A. GENERIC COMMUNICATIONS

1. May 11,1998 - NRC Generic Letter 98-01: Year 2000 Readiness of Computer Systems at Nuclear Power Plants.

L . . . . .

2. June 22,1998 - NRC Generic Letter 98-03: NMSS Licensees' and Certificate Holders' Year 2000 Readiness Programs.

3. December 24,1996 - NRC information Notice 96-70: Year 2000 Effect on {

Computer System Software. t

4. August 6,1997 - NRC Information Notice 97-61: U.S. Department of Health and  ;

Human Services Letter to Medical Device Manufacturers on ths Year 2000 l Problem. ]

\

5. August 12,1998 - NRC Information Notice 98-30: Effect of the Year 2000 _

, Computer Problem on Material and Fuel Cycle Licensees and Certificate Holders.

B. INDUSTRY GUIDANCE DOCUMENTS

1. October 1997 - Nuclear Energy Institute and Nuclear Utilities Software Management Group Report NEl/NUSMG 97-07: Nuclear Utility Year 2000 Readiness.

2. August 1998 - Nuclear Energy Institute and Nuclear Utilities Software Management Group Report NEl/NUSMG 98-07: Nuclear Utility Year 2000 Readiness Contingency Planning. I C. OTHER RELEVANT DOCUMENTS

1. March 1997 - National Security Telecommunications Advisory Committee, Information Assurance Task Force: Electric Power Risk Assessment.

2. September 17,1998 - North American Electric Reliability Council: Preparing the Electric Power Systems of North America for Transition to the Year 2000, A Status Report and Work Plan.

3. August 13,1998 - Nuclear Regulatory Commission: Year 2000 Readiness Audit Plan (for NRC staff review of select nuclear power plants).

4. September 8,1998 - North American Electric Reliability Council: Year 2000 Contingency Planning and Preparations Guide (Draft).

5. September 1997 - U.S. General Accounting Office (GAO): GAO/AIMD-10.1.14,

" Year 2000 Computing Crisis: An Assessment Guide."

6. August 1998 - U.S. General Accounting Office (GAO): GAO/AIMD-10.1.19, " Year 2000 Computing Crisis: Business Continuity and Contingency Planning."

l

n M.

HEADQUARTERS MULTIDISCIPLINARY-TEAM OF RESPONDERS l.

Executive Team Member (Lead overall resoonse effort)

ET Chronology Officer Status Summary Officer ,

i

~ Reactor Scfety Team Director ,

Communicators (2) .

Reactor Systems Analyst (Reactor Safety Team) ,

Electrical /l&C Specialists (2)

. Foreign Reactor Experts (2) ~  ;;w m

.e e

Protective Measures Team'

. Director Communicators (2)

State Interface Emergency Planning Specialist Dose Assessment Analysts ,

Liaison Team p.f State Liaison Federal Liaisons (2)

International Liaisons (2)

Public Affairs (2)

Intelligence Community Liaison -

Operational Suocort Team . ..

Coordinator Word Processing Operator Electronic Mail Operator .-

Courier / Facsimile Operator Automatic Notification System Operator.

Jinformation Technoloav Succort Telecommunications Specialist

- Operation Center Information Management System Contractor l Facility Support Contractor (TECOM)

= bleadauartNs Operations Officers (2-3)

'.. ?Resoonse Coordination Team (2-3)

Reaulatorv Response Team Proiect Director <

Enforcement Specialist OGC Representative t

ATTACHMENT 1 L

3 REGION IV BACKUP TEAM OF RESPONDERS

~ 1. Base Team Manager

2. Base Team Secretary y

3. Director of Site Operations

4. Dose Assessor ~ a 3

5. - Emergency Notification System Communicator (Base Teap) .g[

6. Emergency Response Coordinator / Manager

' 7. Emergency Response Data System Operator (Base Team)

8. Environmental Dose Assessment Coordinator p

9. Government Liaison Coordinator / Manager

.v

10. Health Physics Network Communicator (Base Team)

11. Health Physics Specialist

12. Monitoring & Analysis Coordinator - FRMAC

13. Protective Measures Coordinator / Manager

14. Public Affairs Coordinator

15. Radiation Safety Coordinator

'16. peactor Safety Coordinator / Manager

-p r l 17.. Reactor Safety Operations Coordinator

18. Reactor Systems Specialist

19. . Resource manager /NRC Field Office Coordinator

20. " Safeguards / Security Coordinator (Position Under Review) f

21. Status Summary Communicator (Position Under Review)

Fr 4-

' TIMELINE FOR OPERATIONS CENTER STAFFING FOR STANDBY MODE Day Time Response Level

~12/31/99 1100' Relatively small cache of communicators, foreign reactor experts, electrical /l&C experts, and NRC representatives will asse'mble in the Operations Center in preparation for calls from IAEA and'other foreign regulatory bodies. Any reported Y2K-related j5 tant system problems, grid problems, or widespread telecommunication outages will be evaluated for relevancy and cbmmunicated to our licensees. ,

12/31/99 2300- Agency enters Standby response mode. . Operations Center is staffed r

with specialized response staff plus rep'e'ehentatives from OE, OG and NRR Projects to respond to emer@ ncy licensing issues.-

01/01/00 0000 Y2K transition begins.

01/01/00 0015 Operations Center communicators conduct? phone checks" of all NPPs and fuel cycle facilities in EST zone. Any Y2K problems are reported to licensees.

01/01/00 0115 Operations Center communicators conduct " phone checks" of all NPPs and fuel dyEle facilities in CST zon's. Any Y2K problems are reported to liceilsees. c 01/01/00 0215 Operations, Center communicators conduct " phone checks" of all NPPs and fuel cycle facilities in MST zone. Any Y2K problems are reported to licensees.

01/01/00 0315 Operations Center communicators conduct " phone checks" of all NPPs and fuel cycle facilities in PST zone. Any Y2K problems are reported to licensees.

0600 The Executive Team member would decide when the response 0.1/01/00 organization could stand down from Standby or if events warrant escalating the NRC response to initial Activation. Provided that there

- are no major Y2K-related problems, the NRC would continue to monitor for a couple of days with a small cadre of Y2K experts.

ATTACHMENT 2

.M

q k' j l

e, l

)

' CRITICAL DATES j (From " Circles of Risk" by Jay Golter and Paloma Hawry)

I 2

January 1,2000, is not the only date in the near future that may disrupt data-processing i systems.10ther dates that could cause disruptions are the following: I

$ I January 1,1999, One-Year-Look Ahead Date into Next Century Many computer programs process data by looking forward or!e year a'nd counting dates I back from that point. If such systems have two-digit date problems that are not corrected l In time, they may begin to malfunction or fail at the start of 1999. j f i

+

[$

August 22,1999,' GPS Rollover' 1

The Global Positioning System (GPS) is a constellation of 24 low-orbiting satellites that j continuously signal data that can be used to determine the exact location of any receiver

= on the surface of the earth. The data are alsoided by s~o me systems to establish the

- exact time of day for transaction logging. The clocks on this sy' stern report the time as .

the number of weeks since the launch of the system in 1980. O,n August 22,1999, this - 1 counter will overflow and return to 000.0 (as'would happen on the odometer of a car that

~ traveled 1 million miles).' At that poidisome systems, or egylhment, that use the GPS

. signals may malfunctionL Among the vulnerable devices are some cellular telephones, -

devices that track the location of freight shipments, and some navigational equipment.

However, many manufacture'rs of such devices have built their products to handle the rollover period correctly.  ?

i September 9,1999.(9/9/99)

A com'moln programming device was to enter 9999 as a signal that a stack of data had l

' reached its end. This signal may'sometimes have been programmed on date fields, with i

. the. result th'at the,date 9/9/99 will have a special and unintended meaning in a program.

Although the incidence of 1/1/2000 problems appears to be much greater than that of 9/9/pb problems,' systems should be checked for each.

f' t February 29,' 2000 (Uncommon Leap Year) w The year 2000_is ' divisible by four and is a leap year. However, years divisible by 100

. are'not leap years (1900 was not one) unless they are divisible by 400 (2400 will be

another, leap year).' Some programmers did not know about the hundred-year rule when -

i eyth wrote'their original codes, and those programs will run fine in 2000. Some z', programmers knew about the hundred-year rule, but not about the four-hendred-year l

. rule, and their programs are likely to fail.

~

December 31,2000 (366* Day of Uncommon Leap Year) 5Some programs _ operate by counting the days in the year. If the writers of these

programs were unaware of the uncommon-leap-year situation, their systems may not. fail until December 31,2000, the (unexpected) 366* day of the year.

ATTACHMENT 3 '

t

-;.'