ML20216H270

Notice of Denial of Rulemaking PRM-50-65.Petitioner Requested That NRC Amend Regulations to Require Shutdown of Nuclear Facilities Not Compliant with date-sensitive computer-related Issues Re Y2K Issue

ML20216H270
Person / Time
Issue date:	08/23/1999
From:	NRC
To:
References
FRN-64FR45900, RULE-PRM-50-65 NUDOCS 9910010338
Download: ML20216H270 (9)

Text

45900 Proposed Rules red-a+i-Vol. 64, No.162 Monday, August 23, 1999 This section of the FEDERAL. REGISTER Material Safety and Safeguards, U.S. modiacations, and/or replacements of all contains notscos to the putsc of the proposed Nuclear Regulatory Commission, such systems are,in fact Y2K compliant.

issuance of rules and regulatons. The Washington, DC 20555-0001, telephone purpose of these notices is to give interested 301-415-7897, E-mail address The petitioner noted that in NRC persons an opportunity to participate in the Generic IAtter (GL) 98-01, " Year 2000

< 1@nic m e making prior to the adoption of the final yy Readiness of Computer Systems at Nuclear Power Plants, , dated May it.

Background 1998, the NRC has recognized the NRC received three related petitions Potential for date-related problems that NUCLEAR REGULATORY may affect a system or application (the COMMISSION for rulemaking (PRM-50-65, PRM 66, and PRM-50-67), each dated Y2K problem). These potential problems 10 CFR Parts 30,40,50, and 70 December 10,1998, submitted by NIRS include not representing the year concerning various aspects of Y2K Properly, not recognizing leap years,

@'*"'*#"E issues and nuclear safety. This petition and improper date calculations. These (PRM-50-65) requested that NRC adopt Problems could result in the inability of Nuclear information and Resource Service; Petition for Rulemaking Denial regulations that would require facilities computer systems to operate or to licensed by NRC under 10 CFR Parts 30, function properly. The petitioner stated AGENCY: Nuclear Regulatory 40,50, and 70 to be Y2K compliant. The that the Y2K problem could potentially Commission, second petition (PRM-50-66) requested interfere with the proper operation of ACTION: Petition for rulemaking: denial. that NRC adopt regulations that would computer systems, microprocessor-require facilities licensed by NRC under based hardware, and software or

SUMMARY

The Nuclear Regulatory 10 CFR Part 50 to develop and databases relied on at nuclear power Commission (NRC) is denying a petition implement adequate contingency and Pl ants. Further, the petitioner asserted for rulemaking (PRM-50-65) from the emergency plans to address potential that the Y2K problem could result in a Nuclear Information and Resource system failures. The third petition Pl ant trip and subsequent complications Service (NIRS). The petitioner requested (PRM-50-67) requested that NRC adopt in tracking post-shutdown plant status that NRC amend its regulations to regulations that would require facilities and recovery as a result of a loss of require the shutdown of nuclear licensed by NRC under 10 CFR Parts 50 emergency data collection.

facilities that are not compliant with and 70 to provide reliable sources of Additionally, the petitioner is also date-sensitive, computer-related issues back-up power. Because of the nature of concerned that power grids providing regarding the Year 2000 (Y2K) issue. these petitions and the date-specific offsite power to nuclear stations could The petitioner requested that NRC take issues they address, the petitioner be affected to the extent that localized this action to %sure that Y2K issues requested that the petitions be and widespread grid failures could will not causa the failure of nuclear addressed on an expedited schedule. occur.

safety systems and thereby pose a threat On January 25,1999, NRC published The petitioner acknowledged that to public health and safety. NRC is a notice of receipt of a petition for NRC has recognized the potential safety denying the petition because the rulemaking in the Federal Register (64 and environmental problems that could Commission has determined that the FR 3789). It was available on NRC's result if date-sensitive electronic actions taken by licensees to implement rulemaking website and in the NRC systems fail to operate or provide false a systematic and structured facility- Public Document Room.The notice of information. The petitioner asserted that specific Y2K readiness program and receipt of a p-tition for rulemaking NRC has required its licensees of reactor NRC's oversight of the licensees

• invited interested persons to submit and major fuel cycle facilities to report implementation of these Y2K readiness comments by February 24,1999. by July 1,1999, on their programs to programs provide reasonable assurance ensure compliance with Y2K issues. In cf adequate protection to public health The Petitio addition, the petitioner asserted that and safety. The petitioner requested that NRC NRC has not made explicit how it will ADDRESSES: Copies of the petition for adopt the following text as a rule: define compliance nor what it plans to rulemaking, the public comments Any ar d all facilities licensed by the do for licensees of facilities that cannot l received, and NRC's letters to the Nuclear l'egulatory Commission under to prove compliance. In the petitioner's l petitioners are available for public CFR Parts 30. 40,50 and 70 shall be closed sudested regulatory text, NIRS defined inspection or copying in the NRC Public by 12 pm Eastern Standard Time. December . compliance with Y2K issues as less and ea Document Room,2120 L Street, NW. 1

[98,Ed c p ,h, ,

(Lower Level), Washington, DC, as well computer systems, embe ded chips, and f

g,h sda) evaluation of all potential problems that may be safety-related, repair of all such as on NRC's rulemaking website at other electronic equipment that may be date- problems, and full-scale testing of all l

http://ruleforum.llnl. gov. sensitive to ensure that all such systems that solutions. The petitioner's proposed T) may be relevant to safety are Y2K compliant; regulation would also require full public /

FOR FURTHER INFORMATION CONTACT:

Matthew Chiramal, Office of Nuclear (b) repaired, rnodified, and/or replaced all disclosure of all evaluation, repair, and such systems that are not found to be Y2K Reactor Regulation, U.S. Nuclear testing data so that the information may %p Regulatory Commission, Washington, DC 20555-0001, telephone 301-415-fi7f$ tion ICI I pjbc

,o be examined by independent experts and repair, modification and/or replacement and the public. Finally, the petitioner's 2845. E-mail address <mxc@nrc. gov >, or of all such systems:(d) determ:ned, through proposed regulation would make it clear Gary W. Purdy. Office of Nuclear full-scale testing. that all repairs, that nuclear facilities will be closed

~

9910010338 990823 PDR PRM h( ~

50-65 PDR

Federal Register /Vol. 64 No.162/ Monday, August 23,1999/ Proposed Rules 45901 until they can demonstrate full their multiple failures are poorly I. Part 50 Operating Nuclear Power compliance with Y2K issues. understood, especially in the U.S. Plant Licensees The petitioner concluded by stating power grid.

A. Industry and NRCActivities t pr t ublic heal ds e d 4.The audits conducted by NRC staff Addressing Y2K are too ew, the environment. NIRS stated that To alert nuclear facility licensees to anything short of the suggested These comments are addressed the Y2K problem, NRC issued approach in the petition is insufficient specifically in the discussion of Information Notice (IN) 96-70, " Year to fulfill this obligation and that NRC " Reasons for Denial." 2000 Effect on Computer System

. should adopt the suggested regulation as Reasons for Denial S ftware," on December 24,'t996. IN soon as possible. .

96-70 described the potential problems Public Comments on the Petition-

. The NRC is denying the NIRS etition that nuclear power plant computer because the NRC has determine [that: systems and software may encounter as in response to the petition, NRC (1) the actions taken by licensees to a result of the change to the new century received 70 comment letters, including implement a systematic and structured and how the Y2K issue may affect NRC 1 letter signed by 25 individuals from facility-specific Y2K readiness program: licensees. IN 96-70 encouraged the State of Michigan,3 letters from and (2) NRC's oversight of licensees' licensees to examine their uses of industry groups,10 letters from utilities, implementation of these Y2K readiness computer systems and softwam well 13 letters from private organizations, programs together constitute an effective before the year 2000 and suggested that and 43 letters from private citie. ens. process for addressing Y2K issues such licensees consider appropriate actions Fifty-four letters supported the that there will continue to be reasonable for examining and evaluating their petition,40 of which were from private assurance of adequate protection of computer systems for Y2K citizens,13 were from private public health and safety. NIRS has not vulnerabilities.

organizations, and 1 that was signed by presented any information (and no in 1997, the nuclear industry began to 25 individuals. The comments public comments have been received) assess the Y2K challenge and work with supporting the petition addressed that demonstrates that: (1) the licensees, key Federal agencies to help nuclear concerns related to avoiding the activities are fundamentally incapable Power plant operators prepare for occurrence of a catastrophic nuclear of effectively addressing Y2K issues in continued safe operations at the start of accident, the reasonableness of the a timely fashion: (2) licensees are not the year 2000. In July 1997, the Nuclear petitioner's request, and opined that any adequately implementing the Y2K Utilities Software Management Group uncertainty is too great for the nuclear readiness programs:(3) NRC's (NUSMG), a nuclear industry working inspection, audit, and oversight 8muP, conducted the first industry-wide industry, Sixteen letters opposed the petition, activities are fundamentall incapable w rkshop on Y2K readiness.

of which 3 were from rivate citizens, 3 were from associate industries, and f idi d f 1 In October 1997, the Nuclear Energy w[respec o cense i plemen in Institute (NEI) and NUSMG issued a 10 were from utilities. The comments Y2K program plan guidance docmnent, fY2K di d (4) th' opposing the petition stated that the NRCis ot e f NEI/NUSMG 97-07,

• Nuclear Utility e yimple entingI nuclear power industry has taken a inspection, audit, and oversight Year 2000 Readiness , to all U.S.

coordinated approach to Y2K readiness, activities with respect to Y2K issues. nuclear power plant hcensees. This nuclear power plant licensees are d cument provides a step-b -step Finally, NIRS has not provided any method to identify, test, an repair.

Implementing a structured Y2K basis why the NRC's current regulato am NRC Y2K initiatives are Potential Y2K computer problems and prohrwa,y, NRC staffis monitoring ,#[*Iy to h which ins th 1 c n a ns detaned ums and un i order licensees t licensee activities, and current e s s for reso dng M issues, discontinue or modi their licensed based on the best utility practices.

regulations and license cortditions are activities if the NRC nds that NEI/NUSMG 97-07 presented a ade9unte to address Potential Y2K reasonable assurance of adequate strat for developing and sor e o$ letters supporting the Protection to public health and safety impl rfenting a nuclear utility Y2K etition, the authors included the w n t W provided because of Y2K program. The strategy recognizes o issues, will e inade te in view of the management, implementation, quality ollowing additional comments that m nth time period tween July I' assurance (QA) measures, regulatory provide information or request action 1999, when licensees are required to that was not contained in the petition. considerations, and documentation as inf rm the NRC of the status of their the fundamental elements of a These comments noted:

1. The date proposed in the petition, Y2K remediation activities and the successful Y2K project. The document December 1,1999, to shut down all non. December 31,1999, date, when Y2K- contains examples currently in use by induced problems are most likely to licensees and also recommends that the Y2K compliant nuclear power plants should be moved up 1 to 6 months begm occurnng. Y2K program be administered using before the year 2000. The reasons given Parts (a),(b), and (d) of the NIRS standard project management were to allow sufficient time to shut PmPosed rule are addressed below in techniques. The recomraended down and to provide additional safety. Sections I,II,III, IV, and V for Part 50 components for management planning

2. Power gnd failure would not allow operating nuclear power plants, Part 50 are management awareness, controlled shutdown of the plant and non-power reactors, Part 50 sponsorship. project leadership, project plants could experience problems like decommissioning nuclear power plants, objectives, the project management the Russians. The Y2K problem could major licensees under Parts 40 and 70, team, the management plan, project increase the chance of a core melt, and Part 30 and minor Parts 40 and 70 reports, interfaces, resources, oversight,

3. The problem of" embedded licensees, respectively. Part (c) of NIRS' and QA. The suggested phases of l

systems," microchips, microprocessors, proposed rule, concerning public access implementation are awareness, initial and such systems-within-systems are to Y2K information, is addressed for all assessment (which includes inventory, difficult to identify and the effects of types oflicensees in Section VI. categorization, classification,

45902 Federal Register /Vol. 64, No.162/ Monday, August 23,1999/ Proposed Rules prioritir.ation, and analysis ofinitial program activities and results includes 98-07, when properly implemented, as assessment), detailed assessment documentation requirements, project an acceptable approach for licensees tc (including vendor evaluation, utility- management documentation, vendor mitigate and manage Y2K-induced owned or utility-supported software documentation, inventory lists, events that could occur on Y2K-critical evaluation, interface evaluation, and checklists forinitial and detailed dates. In GL 98-01, NRC required all remedial planning), remediation, Y2K assessments, and record retention. NEU operating nuclear power plant licensees and validation, and notification. NUSMG 97-07 also contains examples to submit written responses regarding testink Y21 testing is used both as an of various plans and checklints as their facility specific Y2K readiness I

investigative tool to examine systems appendices that may be used or program in order to confirm that they and components to identify Y2K modified to meet the licensee's epecific are addressing the Y2K problem problems and as a validation tool to needs and/or requirements. effectively. Alllicensees have confirm that the corrective actions have After issuing NEUNUSMG 97-07, NEl responded to GL 98-01, stating that they eliminated the Y2K problem. Y2K. conducted workshops and other means have adopted a plant-specific Y2K testing in support of evaluation efforts of sharing the experiences on the use of readiness program based on the to determine whether a Y2K problem is the document. In November 1997, NEI guidance of NEUNUSMG 97-07, and the present is performed during detailed and NUSMG conducted the first in a scope of the program includes assessments. Systems and components series ofindustry wide workshops on identifying and, where appropriate, will then be repaired or teplaced in a Y2K issues for project managers in remediating, embedded systems, and process known as "remediation." Y2K charge of ensuring Y2K readiness at all provides for risk management and the testing subsequent to remediation is operating nuclear power plants. In development of contingency plans.

performed to determine whether the December 1997, NEI created an on-line GL 98-011 also requests a written remediation efforts have eliminated the bulletin board to share technical response, no later than July 1,1999, Y2K problem and no unintended information and experiences related to confirming that these facilities are Y2K functions are introduced. Y2K testing testing and repairing computers and ready with regard to compliance with may be performed at severallevels: equipment. the terms and conditions of their license

• Umt testing, which focuses on in January 1998, the NRC issued a and NRC regulations. Licensees that are functional and compliance testing of a draft generic letter for public comment not Y2K ready by July 1,1999, must single application or software module; which proposed: (1) that licensees of provide a status report and schedule for e Integration testing, which tests the operating nuclear power plants be the remaining work to ensure timely integration of related software modules required to provide certain information Y2K readiness. By July 1,1999, all and applications; and regarding their programs that address licensees responded to GL 98-01, e System testing, which tests the the Y2K problem in computer systems Supplement 1. The responses indicated hardware and software components of a at their facilities; and (2) to endorse the that 68 plants are Y2K ready and 35 system. guidance in NEUNUSMG 97-07 as one plants need to complete work on a few For systems, components, and possible approach in implementing a non-safety computer systems or devices equipment classified as safety-related or plant specific Y2K readiness program,if after July 1,1999 to be Y2K ready.

critical to operations, the Y2K augmented in the area of risk As part ofits oversight of licensee remediatior activitiesincluda Y2K management, contingency planning, and Y2K activities, NRC staff conducted testing. On one end of the spectrum. remediation of embedded systems sample audits of 12 plant specific Y2K there are th6 stand-alone, date-aware. [ Federal Register (63 FR 4498)). In the readiness programs. The objectives of f microprocessor-based components that absence of adverse comment on the the audits were to--

do not communicate digital information adequacy of the guidance in NEU

• Assess the effectiveness of to any other devices. Properly NUSMG 97-07, the NRC issued GL 98-- licensees' programs for achieving Y2K performed bench testing of these 01 on May 11,1998 [ Federal Register readiness and in addressing compliance devices, by the licensee or the vendor, (63 FR 27607)]. In August 1998 NEl with the terms and conditions of their coupled with software /firmware issued an industry document NEI/ license and NRC regulations and revision level verification of the field NUSMG 98-07, " Nuclear Utility Year continued safe operation.

devices as required,is adequate to 2000 Readiness Contingency Planning,"

• Evaluate program implementation establish their Y2K status. Repeating that provided additional guidance for activities to ensure that licensees are on .

this test in the field as part of a plant- establishing a plant-specific schedde to achieve Y2K readiness in l wide integrated test will not add any contingency planning process. NEU accordance with GL 98-01 guidelines.

additional benefits related to system NUSMG 98-07 addressed management e Assess licensees contingency Y2K readiness. On the other end of the controls, preparation of individual Pl anning for addressing risks associated spectrum, the most highly complex contingency plans, and development of with events resulting from Y2K systems, such as distributed control an integrated contingency plan that Problems. , ,

systems, may require in-plant testing of allows the licensee to manage internal The NRC determined that this the remediated system. This testing may and external risks associated with Y2K. approach was an appropriate means of ,

include a large portion of the plant induced events. External events that oversight oflicensee Y2K readiness J equipment. However, even in this case, should be considered for facility. efforts because: (1) all licensees had the maximum bounds of the test would specific contingency planning include committed to the nuclear power involve the individual system being electric grid / transmission / distribution system events, such as loss of off-site c i tested and the other devices and , g8y .2.(289,S , gy,,imed g ,,c systems with which it communicates power, gnd instability and voltage 3y, terns at Nuclear Power Plants. which provided digital /date-related informaion. fluctuations, load fluctuations and loss licensees with a voluntary alternate response to that NEl/NUSMG 97-07 specifies the QA of grid control systems loss of required by CL 98-01. The alternate response, also measures that will apply to the activities emergency plan equipment and due by Jul s of th in NEUNUSMG ,97-07 that apply services; loss of essential, services; and $',,,','Q]71,1999, 2 rea

, c,, con nshould a 8

provide inform primarily to project management and depletion of consumables. NRC operation that are not covered by the terms and 4 implementation. Documentation of Y2K considers the guidance in NEUNUSMG conditions of the license and NRC regulations.

Federal Register /Vol. 64, No.162/ Monday, August 23,1999/ Proposed Rules 45903 i Industry Y2K readiness guidance (NEI/ with the GL 98-01 target date, although September 30,1999, will be monitored NUSMG 97-07) in their first response to some plants will have some to ensure,that the schedules are NRC GL 98-01: and (2) the audit would remediation, testing, and final maintained. Completion of plant-verify that licensees were effectively certification scheduled for the fall 1999 specific items identified by licensees in implementing the guidelines. The audit outage. The NRC staff did not identify the generic letter responses will be sample of 12 licensees included large any issues that would prevent these documented in routine NRC inspection utilities such as Commonwealth Edison licensees from achieving Y2K readiness. reports. The licensees of the plants that and Tennessee Valley Authority as well Licensee Y2K contingency planning are scheduled to be Y2K ready after as small single-unit licensees such as efforts had not progressed far enough September 30 will receive additional North Atlantic Energy (Seabrook) and during the original 12 audits for a scrutiny on a case-by-case basis to Wolf Creek Nuclear Operating complete NRC staff review of the ensure that no Y2K deficiencies remain.

Corporation. The NRC staff selected a adequacy ofimplementation of the Y2K If, by September 30,1999,it appears variety of types of plants of different activities. Therefore, the NRC staff that Y2K readiness activities will not be ages and locations in this sample in audited the contingency planning efforts completed by December 31,1999 order to obtain the necessary assurance of six licensees different from the 12 tr'ansition such that there is sufficient that nuclear power industry Y2K included in the initial sample Y2K assurance that all license conditions and

' readiness programs are being effectively readiness audits. These audits focused relevant NRC regulations 2 are met, the implemented and that licensees are on on the licensee's approach b addressing NRC will take appropriate regulatory scheaule to meet the readiness target both internal and external Y2K risks to action, including the issuance of orders date of July 1,1999, established in GL safe plant operations based on the requiring specific actions,if warranted.

98-01. Also, NRC staff had not guidance in NEI/NUSMG 98-07. These NIRS presents no information or identified any Y2K problems in safety. audits were completed in June 1999. argument why these above actions by related actuation systems as part of its In addition to NRC staff activities the licensees and the inspection, audit activities, addressed above, NRC regional staff auditing, and oversight activities of the In late January 1999, the NRC staff reviewed plant specific Y2K program NRC are insufficient to address Y2K .

completed the 12 audits. At the implementation activities at all problems, such that actions required in conclusion of the audits, the NRC staff operating nuclear power plants. The NIRS' proposed rule are necessary.

had the following observations: regional staff used guidance prepared by e Plant-specific Y2K projects based NRC Headquarters staff, which B. The Needfor Y2K ,' Compliance,,, as on NE1/NUSMG 97-07 began in mid to conducted the 12 sample audits. These Opposed to ,' Readiness late 1997. Use of NEI/NUSMG 97-07 reviews were completed by July 1999. NIRS' proposed rule would require guidance results in an effective, One of the public comments received by that nuclear power plants be shut down structured program. The programs are NRC in response to the petition by December 1,1999, unless licensees generally on schedule for plants to be indicated that the audits conducted by demonstrate that Y2K compliance has Y2K ready by July 1,1999. However, at NRC staff are too few. On the basis of been achieved. However, NIRS has not some plants the licensees have the information above, the NRC staff has explained why "Y2K compliance," as scheduled some remediation, testing, reviewed the Y2K programs at all opposed to "Y2K readiness,"is and final certification for the fall 1999 CPerating nuclear power plants, thereby necessary. "Y2K compliant"is generally outage. addressing this comment. understood as referring to computer e Management oversight is vital for NRC staff will continue its oversight systems or applications that accurately program effectiveness. of Y2K issues at nuclear power plants process date/ time data (including but

. Sharing information through through the remainder of 1999. On the not limited to calculating, comparing, owners groups, utility alliances, the basis of the reviews of the licensee and sequencing) from, into, and Electric Power Research Institute, and responses to GL 98-01, Supplement 1, between the 20th an d 21st centur:es, the NEIis aiding the overall nuclear findings of the additional audits and years 1999 and 2000, and leap-year industry effort. reviews, and any additional calculations. "Y2K ready" is generally

. Independent audits and peer information, NRC will, by September understood as referring to a computer reviews of programs are very useful. 1999, determine the need for issuing system or application that has been e Safety system functions are usually orders to address Y2K readiness issues. determined to be suitable for continued not affected. There is limited computer including,if warranted, shutdown of a use into the year 2000 even though the use in safety related systems and plant. At this time, NRC believes that all computer system or application is not components. licensees w1P be able to operate their fully Y2K compliant. For "Y2K ready" e Failures identified in embedded plants safely during the transition from systems, licensees may have to rely devices have generally not affected the 1999 to 2000 and does not believe that upon work arounds and other activities functions performed but have led to significant plant-specific action directed to ensure that the systems, components, errors such as incorrect dates in by NRC is likely to be needed, printouts, logs, or displays. As discussed above, GL 98-01 set a a These regulations are--

. Central control of Y2K program date of July 1,1999, for licensees to 10 CFR 50.36. " Technical Specifications."

activities, effective QA (including the submit information on their efforts to paragraph (ex3). "Surveinance requirements." and use of existing plant procedures and complete their plant-specific Y2K paragraph (cXs). " Administrative controls."

controls), and independent peer reviews program. The July 1,1999, date was y0 CFR 50A7. " Emergency Plans." paragraph promote consistency across activities selected to ensure that there would be . ppendix B to 10 CFR Part 50. Criterion m.

and improve the proa, ram. adequate time for the Commission to -Design control." and criterion xvil. " Quality On tlie basis orthese audit determine wbat additional regulatory Assurance Records."

observations, the NRC staff concluded action,if any, would be necessary to

• Appendix E to 10 CFR Part 50.Section VI.

ensare that Y2K problems will not " Emergency Response Data System."

that the audited addressing Y2K issues licensees and are are effectively ' threaten adequate protection * ^E to

' ublic 5 undertaking the actions necessary to health and safety. Licensees of lants cuei((cb^1 InbPa, Genera ,n De*j'"

tr cDc 19. " control Room": and cDc 23.

• Protection achieve Y2K readiness in accordance with a projected completion da e by system railure Modes."

45904 Federal Register /Vol. 64, No.162 / Monday, August 23,1999/ Proposed Rules and equipment function as intended. remediated similar to safety related NRC disagrees with the commenter.

Prudence might lead to Y2K compliance systems. Safety functions performed b-f the as an objective for remedial activities in In sum, the NRC believes that the reactor protection system for shutting order to reduce licensee costs of actual scope of plant systems necessary down the reactor and by the engineered I

implementing workarounds and other to provide reasonable assurance of safety features actuation for rnitigating activities in the interim until full Y2K adequate protection to public health and accidents, cooling down the reactor, and compliance is achieved. However, safety, which are potentially susceptible providing emergency power to safety protection of public health and safety to Y2K problems, is relatively limited systems upon a loss of offsite power are does not necessitate establishment of and that the licensees' current activities not affectedby the Y2K problem.

Y2K compliance as a regulatory are sufficient to ensure that Y2K Although there is some concern that the requirement, and failure to achieve problems will not adversely affect reliability of the offsite power sources compliance should not require plant safety-related or balance-of-plant may be lower during the Y2K transition, shutdown, so long as Y2K readmess is systems. if a loss of offsite power were to occur achieved. Accordingly, the NRC does because of Y2K, the plant would trip D. Public Comments automatically because all nuclear plants not believe that a rule that requires Y2K compliance, or Y2K readiness, is One public comment in support of the are designed for such an event. The appropriate or necessary for ensuring NIRS petition stated that embedded emergency onsite power supply system reasonable assurance of adequate chips are difficult to identify and the would provide power to the safety protection at nuclear power plants after effects of their failures are poorly system equipment automatically. This December 1,1999. understcod, especially in the U.S. sequence of events is not affected by the power grid. When the NRC staff was Y2K problem because all these safety C. Limited Susceptibility of Nuclear developing GL 98-01, it recognized that systems do not rely upon computer-Power Plant Systems to Y2KProblems , mbedded systems pose a potential Y2K operated systems or components that NRC audits and reviews indicate that problem that must be recognized and are date-sensitive. For these reasons, the most nuclear power plant systems addressed in any successful Y2K effort. NRC disagrees that a Y2K problem necessary for shutting down the reactor Accordingly, GL 98-01 informed could increase the probability of a core and maintaining it in a safe shutdown licensees that Y2K programs should be melt accident at a nuclear power plant.

condition are not susceptible to Y2K augmented to address remediation of One public comment in support of the problems. The majority of commercial embedded systems. Licensees have petition indicated that the audits nuclear power plants have protection stated in their responses to the generic conducted by NRC staff are too few. The systems that are analog rather than letter that embedded systems are bein8 NRC has responded to this comment in digital. Because Y2K concerns are addressed in their Y2K programs, and section I.A.

associated with digital systems, analog these statements have been confirmed reactor protection system functions are by NRC audits to date. NRC understands E. Summary not affected by the Y2K issue. Errors that the electric utilities providing The NRC believes that licensees' Y2K such as incorrect dates in printouts, power to the grid have similar efforts activities and programs, considered logs, or displays have been identified by underway that are being monitored by together with NRC oversight activities, licensees in safety-related devices, but the North American Electric Reliability provide a reasonable approach for the errors do not affect the functions Council. ensuring that Y2K problems will not performed by the devices or systems. One public comment in support of the poso an unreasonable threat to public Most Y2K issues are in balance-of-plant petition indicated that the rule should health and safety. NIRS has not and other systems that have no direct require nuclear power plants to shut explained why this regulatory approach functions necessary for safe operation of down 6 months before the end of 1999 will not provide reasonable assurance of the reactor. to allow a safe period of time to shut adequate protection from any potential With respect to safety systems using down the plant. The NRC does not egree Y2K-initiated problems at operating digital electronics that are necessary for that it takes 6 months to safely shut nuclear power plants, such that the rule performing safe-shutdown and down a plant. Under normal conditions, proposed by NIRS is necessary.

maintaining the reactor in a safe it takes several hours to safely shut shutdown condition, licensees are II Part 50 Non-Power Reactor down a nuclear power plant by reducing Licensees undertaking the NEI/NUSMG 97-07 and reactor power gradually. However,in an j NEI/NUSMG 98-07 processes described emergency, the reactor can be shut NRC used several methods to inform I above for addressing Y2K problems. down safely within seconds, either all non-power reactor (NPR) licensees of With respect to balance-of-plant automatically or manually. The reactor the need to ensure that their facilities systems, licensees implementing their will be shut down automatically by the are ready for the year 2000. In 1996, plant-specific Y2K program are reactor protection system upon the NRC staff contacted all NPR licensees classifying important balance-of-plant sensing of an unusual condition. informing them of a potential for l and other non safety-related systems Moreover, the operator always has the problems in systems either controlling I

(such as those that support continued capability to manually shut down the or supporting the reactor because of f plant operations, provide information reactor using the reactor protection Y2K issues. In December 1996, NRC l and aid to the plant operators like system. Accordingly, the NRC does not issued IN 96-70 to alert nuclear facility

! sequence-of-events monitoring for - agree that it is necessary to shut down licensees to the Y2K problem. IN 96-70 tracking post-shutdown status of plants, nuclear power plants 6 months before described the potential problems that and whose failure could lead to a plant the end of 1999 in order to ensure a safe nuclear power plant computer systems transient or trip) as " mission-critical" oa shutdown of the plants. and software may encounter as a result "high." Systems and equipment A commenter in favor of the petition of the change to the new century and classified as mission-critical or high, stated that the Y2K problem could how the Y2K issue may affect NRC when found to be Y2K susceptible increase the chance of a meltdown. licensees. IN 96-70 encouraged all during the assessment stage of the Y2K However, the commenter did not licensees to examine their uses of program, are also scheduled to be provide any basis for this assertion. The computer systems and software well l

Federal Register /Vol. 64, No.162 / Monday, August 23,1999/ Proposed Rules 45905 before the year 2000. IN 96-70 also 2 MWt) and many of them operate at (based on the Zion mits) to begin suggested that licensees consider low temperatures in relatively large boiling 68 hours7.87037e-4 days <br />0.0189 hours <br />1.124339e-4 weeks <br />2.5874e-5 months <br /> after loss of the spent appropriate actions for examining and pools of water. The only safety function fuel pool cooling system. Boiling does evaluating their computer systems for that is generally required is for the not become a concern until the fuel rods Y2K vulnerabilities. reactor to scram. Thus, the Y2K concern begin to be uncovered by boil-off of NRC also coordinated with the poses very low risk. NIRS does not cooling water. Since fuel rods are Organization of Test, Research and explain why the licensees' Y2K program normally covered by 23 feet of water (for Training Reactors (TRTR) to distribute activities and NRC's oversight of the purposes of shielding), and it would information about the Y2K problem licensees' implementation of the take approximately two weeks or more through TRTR newsletters. These programs are inadequate such that the to begin uncovering the spent fuel rods newsletters were distributed to all rule proposed by NIRS is necessary to (assuming that no make-up water is members of the organization to focus provide reasonable assurance of added to the pool), the NRC believes attention on the Y2K problem and adequate protection. that there is sufficient time to recover related ongoing activities. The staff at all electrical power and/or rovide makeup 37 heensees with operating reactors III. Part 50 Decommissioning Nuclear Power Plant Licensees water to, prevent the fue rods from receive copies of the TRTR newsletter. uncovenng.

The TRTR newsletters articles included The suggested rule language in the The other threat to spent fuelis

" Concerns about the Millennium " petition would require that all facilities diversion and sabotage. Licensees of.

February 1997; " Year 2000 Concerns," not compliant with Y2K issues be shut decommissioning reactors are taking February 1998:"NRC Response on Year down by December 1,1999. Nuclear steps to ensure that Y2K problems will 2000," May 1998: "More on the Y2K power plants that are permanently not disable necessary security and Issue," August 1998; and "Another shutdown with fuel removed from the safeguards systems and controls.

Y2000 Notice " November 1998. NRC reactor core would, therefore, not be Licensees with computer-based site staff has confirmed through several subject to the rule as proposed by NIRS. security systems that have been telephone conversations and Ho wever, since the purpose of the identified as potentially Y2K vulnerable discussions during inspections that all propo, sed rule appears to be directed to have tested the system for Y2K, licensees of operating reactors are aware ensurmg that Y2K problems at all upgraded the system to be Y2K of the Y2K concerns and have ongoing nuclear power plants-both operating compliant, or will make the system Y2K actions to be Y2K ready by the end of and decommissionin8-will not pose a compliant before the end of 1999.

the year or sooner. threat to public health and safety, the With respect to the safety of Smce 1998, while conducting following discussion on the activities conducting dismantlement and inspections of NPR facilities, the NRC for addressing the Y2K problem at decommissioning activities, the NRC staffis also verifying that licensees are decommissioning nuclear power plants does not believe that these activities are addressing the Y2K problem with regard is provided. subject to Y2K problems that would to reactor safety. NRC staff has There are two potential adiological pose a threat to public health and safety inspected about 50 percent of the health and safety concerns with respect because the conduct of these activities operating reactors and intends to to Y2K problems at decommissioning in the field do not rely upon computer-complete the inspections of all plants: (1) spent fuel storage, including controlled devices to ensure protection operating NPRs by October 1999. These site security; and (2) the actual conduct against radiological dangers.

inspections will verify that the :icensees of dismantlement and decommissioning In sum, licensees of decommissioning have programs to deal with Y2K and activities. Of greater concern is the nuclear power plants are implementing that all digital safety equipment at these spent fuel storage. The concerns in this Y2K activities that address equipment facilities are considered in the program. area relate to providing sufficient and systems important to safety, such Moreover, most institutions that operate cooling to the spent fuel and providing that there is reasonable assurance of the NPRs have their own Y2K programs sufficiant security against diversion and adequate protection to public health and that include the NPRs. sabotage of the spent fuel. There are 21 safety.

The safety systems at most operating decommissioning nuclear power plants .

reactors are analog systems that are not that have been shut down more than a IV. Maior Parts 40 and 70 Licensees affected by the Y2K problem. Several year,6 of which have had spent fuel To alert major Parts 40 and 70 operating reactors have digital safety removed from the site. Accordingly, licensees of the potential Y2K problem, equipment that provides instrument there are only 15 decommissioning NRC issued Information Notice (IN) 96--

indication to the facility ope ator that is nuclear power plants where spent fuel 70, " Year 2000 Effect on Computer part of the licensee's Y2K program, storage is of concern. Although System Software," dated December 24, Also, seven of these reactors have digital licensees for all of these facilities are 1996. IN 96-70 described the potential reactor protection system functions also implementing Y2K programs,it is Y2K problems, encouraged licensees to considered in the licensee's Y2K unlikely that Y2K problems would pose examine their uses of computer systems program. These systems operate in a significant problem to providing and software well before the year 2000, parallel with the analog reactor sufficient spent fuel cooling. First, and suggested that licensees concider protection systems, which are not electrical and makeup water systems for appropriate actions to examine and affected by Y2K. Also, the digital spent fuel pools are not computer- evaluate their computer systems for Y2K systems initiate reactor scrams in case of controlled. Moreover, even if there was vulnerabilities.

a malfunction in the digital equipment. an interruption in electrical power, In order to gather Y2K information The analog systems generally provide there is a long time period for the regarding materials and major fuel cycle the required reactor safety functions. licensee to rs. pond to the problem facilities, NRC formed a Y2K Team The analog systems are independent of before integrity of the spent fuel rods within the Office of Nuclear Material the digital equipment and have built in becomes an issue because sufficient Safety and Safeguards (NMSS)in 1997.

redundancy to ensure that the reactor time is available to take compensatory From September 1997 through scrams. The power levels of these action before boiling starts. The spent December 1997, this NMSS Y2K Team reactors are low (up to a maximum of fuel pool is conservatively estimated visited a cross-section of materials

45906 Federal Register /Vol. 64, No.162/ Monday, August 23,1999/ Proposed Rules licensees and fuel cycle facilities and explained why "Y2K compliance" as problems and that upgrades for conducted Y2K interviews. Each opposed to "Y2K readiness"is treatment planning systems were licensee or facility visited by the team necessary. NIRS asserted that NRC has available. However, treatment planning indicated that they were aware of the not made explicit how it will define systems are regulated by the U.S. Food Y2K issue and were in various stages of "Y2K compliance." However, NRC and Drug Administration (FDA) and not implementing their Y2K readiness explicitly defined the terms "Y2K by NRC because the systems do not program, ready" and "Y2K compliant"in GL 98- contain licensed material. NRC has On June 22,1998, the NRC staff 03. "Y2K ready" was defined as a shared information on non-Y2K-issued Generic Letter (GL) 98-03, computer system or application that has compliant treatment planning systems "NMSS Licensees

• and Certificate been determined to be suitable for with the FDA. For materials licensees, Holders' Year 2000 Readiness continued use into the year 2000, even the NMSS Y2K Team did not identify Programs." This GL requested ma though the computer system or any Y2K issues for NRC-regulated Parts 40 and 70 licensees to subm(jortby application is not Y2K compliant. "Y2K material. As a result of the interviews September 20,1998, written resjionses compliant" was defined as a computer and site visits, NRC's focus has been to I regarding their facility specific Y2K system or application that accurately determine if any commercially available readiness program in order to confirm processes date/ time data (including, but devices (medical and industrial) have l that they were addressing the Y2K not limited to, calculating, comparing, potential Y2K vulnerabilities and to problem effectively. Alllicensees and sequencing) from,into, and ensure that licensees evaluate self-responded to GL 98-03 by stating that between the years 1999 and 2000, and developed systems, commercial off-the they have adopted a facility-specific beyond, including leap-year shelf software and hardware, and safety Y2K readiness program and that the calculations. Thus, by definition, systems.

scope of the program included systems that are "Y2K ready" are able In addition to Y2K interviews, identifying and, where appropriate, to perform their functions properly. materials inspectors have been remediating, hardware, software, and There is no discernable safety reason instructed to confirm receipt of NRC's embedded systems, and provided for why achieving Y2K readiness rather information notices, determine whether risk management and the development than Y2K compliance should result in the licensees have identified any of contingency plans. facility shutdown. Accordingly, there is potential problems associated with the GL 98--03 also requested a written no basis for requiring facility shutdown Y2K issue, and note any corrective response, no later than December 31, if a licensee cannot demonstrate Y2K actions taken by the licensees. Through {

1998, which confirmed that these compliance. the routine inspection process, NRC has 1 facilities were Y2K ready or provided a NIRS presents no information or made assessments of the Y2K status of status report of work remaining to be argument why those actions by the its materials licensees and continues to done to become Y2K ready, including licensees and NRC described above are do so. To date, only the treatment completion schedules. Alllicensees insufficient to address Y2K problems planning systems described above, dose provided a second response to GL 98- and to demonstrate that reasonable calibrators, and a tote position display 03, which identified work remaining to assurance of adequate protection will for an irradiator have been identified be done, including completion not be provided after December 1,1999, through the inspection process as schedules. Furthermore, following the so that facility shutdown is necessary. having Y2K problems. NRC materials second response, NRC requested a third inspectors have indicated that licensees written response, no later than July 1, V Part 30 and Minor Parts 40 and 70 i Ucensees are aware of available upgrades for 1999, which would confirm that these treatment planning systems and dose facilities are Y2K ready or would To alert Part 30 and minor Paits 40 calibrators. The irradiator tote position provide an updated status report. and 70 licensees, the NRC issued ins display is not a safety system. Further, On August 12,1998,IN 98-30 "Effect 96-70 and 98-30, which have been the irradiator tote position display of the Year 2000 Computer Problem on discussed in Section IV," Major Parts 40 system that had the Y2K problem was NRC Licensees and Certificate Holders," and 70 Licensees." a one-of-a-kind modification made by provided licensees additional In addition to the efforts by the NMSS the licensee (the licensee was information on the Y2K issue. IN 98-30 Y2K Team to gather information authorized by NRC to make the provided definitions of"Y2K ready" regarding materials licensees and major modification). The irradiator licensee is and "Y2K compliant," encouraged fuel facilities from September through updating the tote position display licensees to contact vendors and test December 1997, discussed under system to eliminate the Y2K problem.

their systems for Y2K problems, and Section IV. NMSS staff also conducted No generic Y2K issues for NRC-described elements of a Y2K readiness telephone interviews with device regulated material used by materials program, manufacturers and distributors. Further, licensees have been identified.

Between September 1997 and October NRC determined that few of NIRS asserted that NRC has not made 1998, the major Parts 40 & 70 licensees approximately 5,800 materials licensees explicit what it plans to do about those were also asked Y2K questions during use processes or have safety systems facilities that cannot prove compliance.

other inspections. Based on these Y2K that are computer-controlled, thus As discussed in Section IV, " Major Parts inspections, the licensees were aware of minimizing potential Y2K impacts. The 40 and 70 Licensees" above, NIRS has the Y2K problem and were adequately interviews and site visits confirmed that not explained why "Y2K compliance" addressing Y2K issues. There have been licensees were identifying and as rpposed to "Y2K readiness"is no identified risk-significant Y2K addressing potential Y2K problems. necessary. Furthermore, Y2K readiness concerns for major Parts 40 and 70 From the interviews conducted by the is not required for protection of public licensees. NMSS Y2K Team, NRC leamed that health and safety for Part 30 and minor NIRS' proposed rule would require early versions of some treatment Parts 40 and 70 licensees due to the that licensees be shutdown by December planning systems (computer systems for amount and type oflicensed material 1,1999, unless licensees demonstrate calculating dose to medical patients used by them. The risks to the public that "Y2K compliance" has been being treated with radiation or from these facilities are low. In addition, achieved. However, NIRS has not radioactive material) have Y2K NRC has determined that few of the

Federal Register /Vol. 64, No.162/ Monday, August 23,1999/ Proposed Rules 45907 approximately 5,800 materials licensees access to Y2K information beyond that use processes or have safety systems which the NRC has determined must be that are computer-controlled, thus submitted to the NRC in furtherance of ruinimirina otentialY2K Impacts, the NRC's regulatory oversight.

, thereis no basis for requiring ty shutdownif a licensee Conclusion cannot demonstrate "Y2K compliance." The rule proposed by NIRSis not NIRS presents no information or needed because the Commission has argument why those actions by the determined that the activities taken by licensees and NRC described above are licensees to implement a systematic and insufficient to address Y2K problems structured facility-specific Y2K and to demonstrate that reasonable'. readiness program, together with the assurance of adequate protection will NRC's oversight of the licensees' not be provided aAer December 1,1999, implementation of these Y2K readiness so that facility shutdown is necessary. p , provide rossonable assurance yg,page %% o e protection to public health and ty.

NIRS requested initem (c) ofits Forthese reasons, the Commission petition that NRC adopt regulations that denies the petition.

would require that licensees make Cvailtble to the public by December 1, Deted at Rockville, Maryland, this 17th day 1999,allinformation related to the ^"8**

• Cxamination and repair, modification, For the Nuclear Regulatory Commission.

and/or replamment of all computer ^"d' " I 8*****

systems, embedded chips, and other ActingSecretaryofthe Commission.

Clactronic equipment that may be date. [FR Doc. 99-21750 Filed &-20-99; 8:45aml sensitive. NIRS indicated that this rule sa.teso caos reau-a provision is necessary in order to allow

" independent experts" and the public to examine this information.

The NRC has already made available ta the public substantial information on Y2K and the status oflicensees' activities to address potential Y2K problems and will continue to make this information public.The audit reports of the NRC staff myiews of the 12 nuclear power plant-specific Y2K readiness project activities and documentation are publicly available both in the Public Document Rooms and the NRC Year 2000 Web site.The Y2K readiness information submitted in July 1999 by nuclear power plant limnsees under GL 98-01, Supplement 1. is available to the public, as with any other correspondence that is received from licensees. The reports documenting the NRC staff audits of the six nuclear power plant-speciSc contirigency planninir activities and the results of the facility-s fic Y2K program reviews of allopera nuclear power plants are cleo aval e to the public.The NRC inspection reports with Y2K .

Information from Parts 30,40, and 70

' licensees and the licensees' responses to GL 98-03 have been placed in the PDR.

Summaries of(t) inspection reports with Y2K information,(2) GL 98-03

. responses, and (3) interviews with a cross-section of materials and fuel cycle licensees on Y2K issues are available on I the NRC Year 2000 Web site.

In view of the information that has been made available and will be made available to the public, NIRS has not provided any basis for requiring licensees, by rule, to provide public

Printed on recycled paper Federal Recycling Program i

I m__ ------ - -.-------- - -- - - - _ - - - - - _ - - - - - - - . _ - - - - - - - - - _ _ - - - , - - - - - - - - - - - - - _ _ - _ - - - - --_-_---A