Rulemaking petitions: Nuclear Information and Resource Service,
[Federal Register: August 23, 1999 (Volume 64, Number 162)]
[Proposed Rules]
[Page 45900-45907]
From the Federal Register Online via GPO Access [wais.access.gpo.gov]
[DOCID:fr23au99-20]
Proposed Rules Federal Register
This section of the FEDERAL REGISTER contains notices to the public of the proposed issuance of rules and regulations. The purpose of these notices is to give interested persons an opportunity to participate in the rule making prior to the adoption of the final rules.
[[Page 45900]]
NUCLEAR REGULATORY COMMISSION
10 CFR Parts 30, 40, 50, and 70
[Docket No. PRM-50-65]
Nuclear Information and Resource Service; Petition for Rulemaking Denial
AGENCY: Nuclear Regulatory Commission.
ACTION: Petition for rulemaking; denial.
SUMMARY: The Nuclear Regulatory Commission (NRC) is denying a petition for rulemaking (PRM-50-65) from the Nuclear Information and Resource Service (NIRS). The petitioner requested that NRC amend its regulations to require the shutdown of nuclear facilities that are not compliant with date-sensitive, computer-related issues regarding the Year 2000 (Y2K) issue. The petitioner requested that NRC take this action to ensure that Y2K issues will not cause the failure of nuclear safety systems and thereby pose a threat to public health and safety. NRC is denying the petition because the Commission has determined that the actions taken by licensees to implement a systematic and structured facility-specific Y2K readiness program and NRC's oversight of the licensees' implementation of these Y2K readiness programs provide reasonable assurance of adequate protection to public health and safety.
ADDRESSES: Copies of the petition for rulemaking, the public comments received, and NRC's letters to the petitioners are available for public inspection or copying in the NRC Public Document Room, 2120 L Street, NW. (Lower Level), Washington, DC, as well as on NRC's rulemaking website at http://ruleforum.llnl.gov.
FOR FURTHER INFORMATION CONTACT: Matthew Chiramal, Office of Nuclear Reactor Regulation, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, telephone 301-415-2845, E-mail address ‹mxc@nrc.gov›, or Gary W. Purdy, Office of Nuclear Material Safety and Safeguards, U.S. Nuclear Regulatory Commission, Washington, DC 20555-0001, telephone 301-415-7897, E-mail address ‹gwp1@nrc.gov›.
SUPPLEMENTARY INFORMATION:
Background
NRC received three related petitions for rulemaking (PRM-50-65, PRM-50-66, and PRM-50-67), each dated December 10, 1998, submitted by NIRS concerning various aspects of Y2K issues and nuclear safety. This petition (PRM-50-65) requested that NRC adopt regulations that would require facilities licensed by NRC under 10 CFR Parts 30, 40, 50, and 70 to be Y2K compliant. The second petition (PRM-50-66) requested that NRC adopt regulations that would require facilities licensed by NRC under 10 CFR Part 50 to develop and implement adequate contingency and emergency plans to address potential system failures. The third petition (PRM-50-67) requested that NRC adopt regulations that would require facilities licensed by NRC under 10 CFR Parts 50 and 70 to provide reliable sources of back-up power. Because of the nature of these petitions and the date-specific issues they address, the petitioner requested that the petitions be addressed on an expedited schedule.
On January 25, 1999, NRC published a notice of receipt of a petition for rulemaking in the Federal Register (64 FR 3789). It was available on NRC's rulemaking website and in the NRC Public Document Room. The notice of receipt of a petition for rulemaking invited interested persons to submit comments by February 24, 1999.
The Petition
The petitioner requested that NRC adopt the following text as a rule:
Any and all facilities licensed by the Nuclear Regulatory Commission under 10 CFR Parts 30, 40, 50, and 70 shall be closed by 12 pm Eastern Standard Time, December 1, 1999, unless and until each facility has: (a) fully and comprehensively examined all computer systems, embedded chips, and other electronic equipment that may be date-sensitive to ensure that all such systems that may be relevant to safety are Y2K compliant; (b) repaired, modified, and/or replaced all such systems that are not found to be Y2K compliant; (c) made available to the public all information related to the examination and repair, modification and/or replacement of all such systems; (d) determined, through full-scale testing, that all repairs, modifications, and/or replacements of all such systems are, in fact, Y2K compliant.
The petitioner noted that in NRC Generic Letter (GL) 98-01, ``Year 2000 Readiness of Computer Systems at Nuclear Power Plants,'' dated May 11, 1998, the NRC has recognized the potential for date-related problems that may affect a system or application (the Y2K problem). These potential problems include not representing the year properly, not recognizing leap years, and improper date calculations. These problems could result in the inability of computer systems to operate or to function properly. The petitioner stated that the Y2K problem could potentially interfere with the proper operation of computer systems, microprocessor-based hardware, and software or databases relied on at nuclear power plants. Further, the petitioner asserted that the Y2K problem could result in a plant trip and subsequent complications in tracking post-shutdown plant status and recovery as a result of a loss of emergency data collection. Additionally, the petitioner is also concerned that power grids providing offsite power to nuclear stations could be affected to the extent that localized and widespread grid failures could occur.
The petitioner acknowledged that NRC has recognized the potential safety and environmental problems that could result if date-sensitive electronic systems fail to operate or provide false information. The petitioner asserted that NRC has required its licensees of reactor and major fuel cycle facilities to report by July 1, 1999, on their programs to ensure compliance with Y2K issues. In addition, the petitioner asserted that NRC has not made explicit how it will define compliance nor what it plans to do for licensees of facilities that cannot prove compliance. In the petitioner's suggested regulatory text, NIRS defined compliance with Y2K issues as evaluation of all potential problems that may be safety-related, repair of all such problems, and full-scale testing of all solutions. The petitioner's proposed regulation would also require full public disclosure of all evaluation, repair, and testing data so that the information may be examined by independent experts and the public. Finally, the petitioner's proposed regulation would make it clear that nuclear facilities will be closed
[[Page 45901]]
until they can demonstrate full compliance with Y2K issues.
The petitioner concluded by stating that NRC is obligated to act decisively to protect public health and safety and the environment. NIRS stated that anything short of the suggested approach in the petition is insufficient to fulfill this obligation and that NRC should adopt the suggested regulation as soon as possible.
Public Comments on the Petition
In response to the petition, NRC received 70 comment letters, including 1 letter signed by 25 individuals from the State of Michigan, 3 letters from industry groups, 10 letters from utilities, 13 letters from private organizations, and 43 letters from private citizens.
Fifty-four letters supported the petition, 40 of which were from private citizens, 13 were from private organizations, and 1 that was signed by 25 individuals. The comments supporting the petition addressed concerns related to avoiding the occurrence of a catastrophic nuclear accident, the reasonableness of the petitioner's request, and opined that any uncertainty is too great for the nuclear industry.
Sixteen letters opposed the petition, of which 3 were from private citizens, 3 were from associated industries, and 10 were from utilities. The comments opposing the petition stated that the nuclear power industry has taken a coordinated approach to Y2K readiness, nuclear power plant licensees are implementing a structured Y2K program, NRC Y2K initiatives are underway, NRC staff is monitoring licensee activities, and current regulations and license conditions are adequate to address potential Y2K computer issues.
In some of the letters supporting the petition, the authors included the following additional comments that provide information or request action that was not contained in the petition. These comments noted:
-
The date proposed in the petition, December 1, 1999, to shut down all non-Y2K compliant nuclear power plants should be moved up 1 to 6 months before the year 2000. The reasons given were to allow sufficient time to shut down and to provide additional safety.
-
Power grid failure would not allow controlled shutdown of the plant and plants could experience problems like the Russians. The Y2K problem could increase the chance of a core melt.
-
The problem of ``embedded systems,'' microchips, microprocessors, and such systems-within-systems are difficult to identify and the effects of their multiple failures are poorly understood, especially in the U.S. power grid.
-
The audits conducted by NRC staff are too few.
These comments are addressed specifically in the discussion of ``Reasons for Denial.''
Reasons for Denial
The NRC is denying the NIRS petition because the NRC has determined that: (1) the actions taken by licensees to implement a systematic and structured facility-specific Y2K readiness program; and (2) NRC's oversight of licensees' implementation of these Y2K readiness programs together constitute an effective process for addressing Y2K issues such that there will continue to be reasonable assurance of adequate protection of public health and safety. NIRS has not presented any information (and no public comments have been received) that demonstrates that: (1) the licensees' activities are fundamentally incapable of effectively addressing Y2K issues in a timely fashion; (2) licensees are not adequately implementing the Y2K readiness programs; (3) NRC's inspection, audit, and oversight activities are fundamentally incapable of providing adequate regulatory control with respect to licensee implementation of Y2K readiness programs; and (4) the NRC is not effectively implementing its inspection, audit, and oversight activities with respect to Y2K issues. Finally, NIRS has not provided any basis why the NRC's current regulatory approach, which retains the regulatory authority to order licensees to discontinue or modify their licensed activities if the NRC finds that reasonable assurance of adequate protection to public health and safety will not be provided because of Y2K issues, will be inadequate in view of the 6-month time period between July 1, 1999, when licensees are required to inform the NRC of the status of their Y2K remediation activities and the December 31, 1999, date, when Y2K-induced problems are most likely to begin occurring.
Parts (a), (b), and (d) of the NIRS proposed rule are addressed below in Sections I, II, III, IV, and V for Part 50 operating nuclear power plants, Part 50 non-power reactors, Part 50 decommissioning nuclear power plants, major licensees under Parts 40 and 70, and Part 30 and minor Parts 40 and 70 licensees, respectively. Part (c) of NIRS' proposed rule, concerning public access to Y2K information, is addressed for all types of licensees in Section VI.
-
Part 50 Operating Nuclear Power Plant Licensees
-
Industry and NRC Activities Addressing Y2K
To alert nuclear facility licensees to the Y2K problem, NRC issued Information Notice (IN) 96-70, ``Year 2000 Effect on Computer System Software,'' on December 24, 1996. IN 96-70 described the potential problems that nuclear power plant computer systems and software may encounter as a result of the change to the new century and how the Y2K issue may affect NRC licensees. IN 96-70 encouraged licensees to examine their uses of computer systems and software well before the year 2000 and suggested that licensees consider appropriate actions for examining and evaluating their computer systems for Y2K vulnerabilities.
In 1997, the nuclear industry began to assess the Y2K challenge and work with key Federal agencies to help nuclear power plant operators prepare for continued safe operations at the start of the year 2000. In July 1997, the Nuclear Utilities Software Management Group (NUSMG), a nuclear industry working group, conducted the first industry-wide workshop on Y2K readiness.
In October 1997, the Nuclear Energy Institute (NEI) and NUSMG issued a Y2K program plan guidance document, NEI/NUSMG 97-07, ``Nuclear Utility Year 2000 Readiness,'' to all U.S. nuclear power plant licensees. This document provides a step-by-step method to identify, test, and repair potential Y2K computer problems and contains detailed procedures and checklists for resolving Y2K issues, based on the best utility practices.
NEI/NUSMG 97-07 presented a strategy for developing and implementing a nuclear utility Y2K program. The strategy recognizes management, implementation, quality assurance (QA) measures, regulatory considerations, and documentation as the fundamental elements of a successful Y2K project. The document contains examples currently in use by licensees and also recommends that the Y2K program be administered using standard project management techniques. The recommended components for management planning are management awareness, sponsorship, project leadership, project objectives, the project management team, the management plan, project reports, interfaces, resources, oversight, and QA. The suggested phases of implementation are awareness, initial assessment (which includes inventory, categorization, classification,
[[Page 45902]]
prioritization, and analysis of initial assessment), detailed assessment (including vendor evaluation, utility-owned or utility- supported software evaluation, interface evaluation, and remedial planning), remediation, Y2K testing and validation, and notification.
Y2K testing is used both as an investigative tool to examine systems and components to identify Y2K problems and as a validation tool to confirm that the corrective actions have eliminated the Y2K problem. Y2K testing in support of evaluation efforts to determine whether a Y2K problem is present is performed during detailed assessments. Systems and components will then be repaired or replaced in a process known as ``remediation.'' Y2K testing subsequent to remediation is performed to determine whether the remediation efforts have eliminated the Y2K problem and no unintended functions are introduced. Y2K testing may be performed at several levels:
‹bullet› Unit testing, which focuses on functional and compliance testing of a single application or software module;
‹bullet› Integration testing, which tests the integration of related software modules and applications; and
‹bullet› System testing, which tests the hardware and software components of a system.
For systems, components, and equipment classified as safety-related or critical to operations, the Y2K remediation activities include Y2K testing. On one end of the spectrum, there are the stand-alone, date- aware, microprocessor-based components that do not communicate digital information to any other devices. Properly performed bench testing of these devices, by the licensee or the vendor, coupled with software/ firmware revision-level verification of the field devices as required, is adequate to establish their Y2K status. Repeating this test in the field as part of a plant-wide integrated test will not add any additional benefits related to system Y2K readiness. On the other end of the spectrum, the most highly complex systems, such as distributed control systems, may require in-plant testing of the remediated system. This testing may include a large portion of the plant equipment. However, even in this case, the maximum bounds of the test would involve the individual system being tested and the other devices and systems with which it communicates digital/date-related information.
NEI/NUSMG 97-07 specifies the QA measures that will apply to the activities in NEI/NUSMG 97-07 that apply primarily to project management and implementation. Documentation of Y2K program activities and results includes documentation requirements, project management documentation, vendor documentation, inventory lists, checklists for initial and detailed assessments, and record retention. NEI/NUSMG 97-07 also contains examples of various plans and checklists as appendices that may be used or modified to meet the licensee's specific needs and/ or requirements.
After issuing NEI/NUSMG 97-07, NEI conducted workshops and other means of sharing the experiences on the use of the document. In November 1997, NEI and NUSMG conducted the first in a series of industry-wide workshops on Y2K issues for project managers in charge of ensuring Y2K readiness at all operating nuclear power plants. In December 1997, NEI created an on-line bulletin board to share technical information and experiences related to testing and repairing computers and equipment.
In January 1998, the NRC issued a draft generic letter for public comment which proposed: (1) that licensees of operating nuclear power plants be required to provide certain information regarding their programs that address the Y2K problem in computer systems at their facilities; and (2) to endorse the guidance in NEI/NUSMG 97-07 as one possible approach in implementing a plant-specific Y2K readiness program, if augmented in the area of risk management, contingency planning, and remediation of embedded systems [Federal Register (63 FR 4498)]. In the absence of adverse comment on the adequacy of the guidance in NEI/NUSMG 97-07, the NRC issued GL 98-01 on May 11, 1998
[Federal Register (63 FR 27607)] . In August 1998, NEI issued an industry document, NEI/NUSMG 98-07, ``Nuclear Utility Year 2000 Readiness Contingency Planning,'' that provided additional guidance for establishing a plant-specific contingency planning process. NEI/NUSMG 98-07 addressed management controls, preparation of individual contingency plans, and development of an integrated contingency plan that allows the licensee to manage internal and external risks associated with Y2K-induced events. External events that should be considered for facility-specific contingency planning include electric grid/transmission/distribution system events, such as loss of off-site power, grid instability and voltage fluctuations, load fluctuations and loss of grid control systems; loss of emergency plan equipment and services; loss of essential services; and depletion of consumables. NRC considers the guidance in NEI/NUSMG 98-07, when properly implemented, as an acceptable approach for licensees to mitigate and manage Y2K- induced events that could occur on Y2K-critical dates. In GL 98-01, NRC required all operating nuclear power plant licensees to submit written responses regarding their facility-specific Y2K readiness program in order to confirm that they are addressing the Y2K problem effectively. All licensees have responded to GL 98-01, stating that they have adopted a plant-specific Y2K readiness program based on the guidance of NEI/NUSMG 97-07, and the scope of the program includes identifying and, where appropriate, remediating, embedded systems, and provides for risk management and the development of contingency plans.
GL 98-01 ‹SUP›1‹/SUP› also requests a written response, no later than July 1, 1999, confirming that these facilities are Y2K ready with regard to compliance with the terms and conditions of their license and NRC regulations. Licensees that are not Y2K ready by July 1, 1999, must provide a status report and schedule for the remaining work to ensure timely Y2K readiness. By July 1, 1999, all licensees responded to GL 98-01, Supplement 1. The responses indicated that 68 plants are Y2K ready and 35 plants need to complete work on a few non-safety computer systems or devices after July 1, 1999 to be Y2K ready.
\1\ On January 14, 1999, NRC issued GL 98-01, Supplement 1, ``Year 2000 Readiness of Computer Systems at Nuclear Power Plants,'' which provided licensees with a voluntary alternate response to that required by GL 98-01. The alternate response, also due by July 1, 1999, should provide information on the overall Y2K readiness of the plant, including those systems necessary for continued plant operation that are not covered by the terms and conditions of the license and NRC regulations.
As part of its oversight of licensee Y2K activities, NRC staff conducted sample audits of 12 plant-specific Y2K readiness programs. The objectives of the audits were to--
‹bullet› Assess the effectiveness of licensees' programs for achieving Y2K readiness and in addressing compliance with the terms and conditions of their license and NRC regulations and continued safe operation.
‹bullet› Evaluate program implementation activities to ensure that licensees are on schedule to achieve Y2K readiness in accordance with GL 98-01 guidelines.
‹bullet› Assess licensees' contingency planning for addressing risks associated with events resulting from Y2K problems.
The NRC determined that this approach was an appropriate means of oversight of licensee Y2K readiness efforts because: (1) all licensees had committed to the nuclear power
[[Page 45903]]
industry Y2K readiness guidance (NEI/NUSMG 97-07) in their first response to NRC GL 98-01; and (2) the audit would verify that licensees were effectively implementing the guidelines. The audit sample of 12 licensees included large utilities such as Commonwealth Edison and Tennessee Valley Authority as well as small single-unit licensees such as North Atlantic Energy (Seabrook) and Wolf Creek Nuclear Operating Corporation. The NRC staff selected a variety of types of plants of different ages and locations in this sample in order to obtain the necessary assurance that nuclear power industry Y2K readiness programs are being effectively implemented and that licensees are on schedule to meet the readiness target date of July 1, 1999, established in GL 98- 01. Also, NRC staff had not identified any Y2K problems in safety- related actuation systems as part of its audit activities.
In late January 1999, the NRC staff completed the 12 audits. At the conclusion of the audits, the NRC staff had the following observations:
‹bullet› Plant-specific Y2K projects based on NEI/NUSMG 97-07 began in mid to late 1997. Use of NEI/NUSMG 97-07 guidance results in an effective, structured program. The programs are generally on schedule for plants to be Y2K ready by July 1, 1999. However, at some plants the licensees have scheduled some remediation, testing, and final certification for the fall 1999 outage.
‹bullet› Management oversight is vital for program effectiveness.
‹bullet› Sharing information through owners groups, utility alliances, the Electric Power Research Institute, and NEI is aiding the overall nuclear industry effort.
‹bullet› Independent audits and peer reviews of programs are very useful.
‹bullet› Safety system functions are usually not affected. There is limited computer use in safety-related systems and components.
‹bullet› Failures identified in embedded devices have generally not affected the functions performed but have led to errors such as incorrect dates in printouts, logs, or displays.
‹bullet› Central control of Y2K program activities, effective QA (including the use of existing plant procedures and controls), and independent peer reviews promote consistency across activities and improve the program.
On the basis of these audit observations, the NRC staff concluded that the audited licensees are effectively addressing Y2K issues and are undertaking the actions necessary to achieve Y2K readiness in accordance with the GL 98-01 target date, although some plants will have some remediation, testing, and final certification scheduled for the fall 1999 outage. The NRC staff did not identify any issues that would prevent these licensees from achieving Y2K readiness.
Licensee Y2K contingency planning efforts had not progressed far enough during the original 12 audits for a complete NRC staff review of the adequacy of implementation of the Y2K activities. Therefore, the NRC staff audited the contingency planning efforts of six licensees different from the 12 included in the initial sample Y2K readiness audits. These audits focused on the licensee's approach to addressing both internal and external Y2K risks to safe plant operations based on the guidance in NEI/NUSMG 98-07. These audits were completed in June 1999.
In addition to NRC staff activities addressed above, NRC regional staff reviewed plant-specific Y2K program implementation activities at all operating nuclear power plants. The regional staff used guidance prepared by NRC Headquarters staff, which conducted the 12 sample audits. These reviews were completed by July 1999. One of the public comments received by NRC in response to the petition indicated that the audits conducted by NRC staff are too few. On the basis of the information above, the NRC staff has reviewed the Y2K programs at all operating nuclear power plants, thereby addressing this comment.
NRC staff will continue its oversight of Y2K issues at nuclear power plants through the remainder of 1999. On the basis of the reviews of the licensee responses to GL 98-01, Supplement 1, findings of the additional audits and reviews, and any additional information, NRC will, by September 1999, determine the need for issuing orders to address Y2K readiness issues, including, if warranted, shutdown of a plant. At this time, NRC believes that all licensees will be able to operate their plants safely during the transition from 1999 to 2000 and does not believe that significant plant-specific action directed by NRC is likely to be needed.
As discussed above, GL 98-01 set a date of July 1, 1999, for licensees to submit information on their efforts to complete their plant-specific Y2K program. The July 1, 1999, date was selected to ensure that there would be adequate time for the Commission to determine what additional regulatory action, if any, would be necessary to ensure that Y2K problems will not threaten adequate protection to public health and safety. Licensees of plants with a projected completion date by September 30, 1999, will be monitored to ensure that the schedules are maintained. Completion of plant-specific items identified by licensees in the generic letter responses will be documented in routine NRC inspection reports. The licensees of the plants that are scheduled to be Y2K ready after September 30 will receive additional scrutiny on a case-by-case basis to ensure that no Y2K deficiencies remain. If, by September 30, 1999, it appears that Y2K readiness activities will not be completed by December 31, 1999 transition such that there is sufficient assurance that all license conditions and relevant NRC regulations ‹SUP›2‹/SUP› are met, the NRC will take appropriate regulatory action, including the issuance of orders requiring specific actions, if warranted. NIRS presents no information or argument why these above actions by the licensees and the inspection, auditing, and oversight activities of the NRC are insufficient to address Y2K problems, such that actions required in NIRS' proposed rule are necessary.
\2\ These regulations are--
‹bullet› 10 CFR 50.36, ``Technical Specifications,'' paragraph (c)(3), ``Surveillance requirements,'' and paragraph (c)(5), ``Administrative controls.''
‹bullet› 10 CFR 50.47, ``Emergency Plans,'' paragraph (b)(8).
‹bullet› Appendix B to 10 CFR Part 50, Criterion III, ``Design Control,'' and Criterion XVII, ``Quality Assurance Records.''
‹bullet› Appendix E to 10 CFR Part 50, Section VI, ``Emergency Response Data System.''
‹bullet› Appendix A to 10 CFR Part 50, General Design Criterion (GDC) 13, ``Instrumentation and Control''; GDC 19, ``Control Room''; and GDC 23, ``Protection System Failure Modes.''
-
The Need for Y2K ``Compliance,'' as Opposed to ``Readiness''
NIRS' proposed rule would require that nuclear power plants be shut down by December 1, 1999, unless licensees demonstrate that Y2K compliance has been achieved. However, NIRS has not explained why ``Y2K compliance,'' as opposed to ``Y2K readiness,'' is necessary. ``Y2K compliant'' is generally understood as referring to computer systems or applications that accurately process date/time data (including but not limited to calculating, comparing, and sequencing) from, into, and between the 20th and 21st centuries, the years 1999 and 2000, and leap- year calculations. ``Y2K ready'' is generally understood as referring to a computer system or application that has been determined to be suitable for continued use into the year 2000 even though the computer system or application is not fully Y2K compliant. For ``Y2K ready'' systems, licensees may have to rely upon work arounds and other activities to ensure that the systems, components,
[[Page 45904]]
and equipment function as intended. Prudence might lead to Y2K compliance as an objective for remedial activities in order to reduce licensee costs of implementing workarounds and other activities in the interim until full Y2K compliance is achieved. However, protection of public health and safety does not necessitate establishment of Y2K compliance as a regulatory requirement, and failure to achieve compliance should not require plant shutdown, so long as Y2K readiness is achieved. Accordingly, the NRC does not believe that a rule that requires Y2K compliance, or Y2K readiness, is appropriate or necessary for ensuring reasonable assurance of adequate protection at nuclear power plants after December 1, 1999.
-
Limited Susceptibility of Nuclear Power Plant Systems to Y2K Problems
NRC audits and reviews indicate that most nuclear power plant systems necessary for shutting down the reactor and maintaining it in a safe shutdown condition are not susceptible to Y2K problems. The majority of commercial nuclear power plants have protection systems that are analog rather than digital. Because Y2K concerns are associated with digital systems, analog reactor protection system functions are not affected by the Y2K issue. Errors such as incorrect dates in printouts, logs, or displays have been identified by licensees in safety-related devices, but the errors do not affect the functions performed by the devices or systems. Most Y2K issues are in balance-of- plant and other systems that have no direct functions necessary for safe operation of the reactor.
With respect to safety systems using digital electronics that are necessary for performing safe-shutdown and maintaining the reactor in a safe shutdown condition, licensees are undertaking the NEI/NUSMG 97-07 and NEI/NUSMG 98-07 processes described above for addressing Y2K problems. With respect to balance-of-plant systems, licensees implementing their plant-specific Y2K program are classifying important balance-of-plant and other non-safety-related systems (such as those that support continued plant operations, provide information and aid to the plant operators like sequence-of-events monitoring for tracking post-shutdown status of plants, and whose failure could lead to a plant transient or trip) as ``mission-critical'' or ``high.'' Systems and equipment classified as mission-critical or high, when found to be Y2K susceptible during the assessment stage of the Y2K program, are also scheduled to be remediated similar to safety-related systems.
In sum, the NRC believes that the actual scope of plant systems necessary to provide reasonable assurance of adequate protection to public health and safety, which are potentially susceptible to Y2K problems, is relatively limited and that the licensees' current activities are sufficient to ensure that Y2K problems will not adversely affect safety-related or balance-of-plant systems.
-
Public Comments
One public comment in support of the NIRS petition stated that embedded chips are difficult to identify and the effects of their failures are poorly understood, especially in the U.S. power grid. When the NRC staff was developing GL 98-01, it recognized that embedded systems pose a potential Y2K problem that must be recognized and addressed in any successful Y2K effort. Accordingly, GL 98-01 informed licensees that Y2K programs should be augmented to address remediation of embedded systems. Licensees have stated in their responses to the generic letter that embedded systems are being addressed in their Y2K programs, and these statements have been confirmed by NRC audits to date. NRC understands that the electric utilities providing power to the grid have similar efforts underway that are being monitored by the North American Electric Reliability Council.
One public comment in support of the petition indicated that the rule should require nuclear power plants to shut down 6 months before the end of 1999 to allow a safe period of time to shut down the plant. The NRC does not agree that it takes 6 months to safely shut down a plant. Under normal conditions, it takes several hours to safely shut down a nuclear power plant by reducing reactor power gradually. However, in an emergency, the reactor can be shut down safely within seconds, either automatically or manually. The reactor will be shut down automatically by the reactor protection system upon the sensing of an unusual condition. Moreover, the operator always has the capability to manually shut down the reactor using the reactor protection system. Accordingly, the NRC does not agree that it is necessary to shut down nuclear power plants 6 months before the end of 1999 in order to ensure a safe shutdown of the plants.
A commenter in favor of the petition stated that the Y2K problem could increase the chance of a meltdown. However, the commenter did not provide any basis for this assertion. The NRC disagrees with the commenter. Safety functions performed by the reactor protection system for shutting down the reactor and by the engineered safety features actuation for mitigating accidents, cooling down the reactor, and providing emergency power to safety systems upon a loss of offsite power are not affected by the Y2K problem. Although there is some concern that the reliability of the offsite power sources may be lower during the Y2K transition, if a loss of offsite power were to occur because of Y2K, the plant would trip automatically because all nuclear plants are designed for such an event. The emergency onsite power supply system would provide power to the safety system equipment automatically. This sequence of events is not affected by the Y2K problem because all these safety systems do not rely upon computer- operated systems or components that are date-sensitive. For these reasons, the NRC disagrees that a Y2K problem could increase the probability of a core melt accident at a nuclear power plant.
One public comment in support of the petition indicated that the audits conducted by NRC staff are too few. The NRC has responded to this comment in section I.A.
-
Summary
The NRC believes that licensees' Y2K activities and programs, considered together with NRC oversight activities, provide a reasonable approach for ensuring that Y2K problems will not pose an unreasonable threat to public health and safety. NIRS has not explained why this regulatory approach will not provide reasonable assurance of adequate protection from any potential Y2K-initiated problems at operating nuclear power plants, such that the rule proposed by NIRS is necessary.
-
-
Part 50 Non-Power Reactor Licensees
NRC used several methods to inform all non-power reactor (NPR) licensees of the need to ensure that their facilities are ready for the year 2000. In 1996, NRC staff contacted all NPR licensees informing them of a potential for problems in systems either controlling or supporting the reactor because of Y2K issues. In December 1996, NRC issued IN 96-70 to alert nuclear facility licensees to the Y2K problem. IN 96-70 described the potential problems that nuclear power plant computer systems and software may encounter as a result of the change to the new century and how the Y2K issue may affect NRC licensees. IN 96-70 encouraged all licensees to examine their uses of computer systems and software well
[[Page 45905]]
before the year 2000. IN 96-70 also suggested that licensees consider appropriate actions for examining and evaluating their computer systems for Y2K vulnerabilities.
NRC also coordinated with the Organization of Test, Research and Training Reactors (TRTR) to distribute information about the Y2K problem through TRTR newsletters. These newsletters were distributed to all members of the organization to focus attention on the Y2K problem and related ongoing activities. The staff at all 37 licensees with operating reactors receive copies of the TRTR newsletter. The TRTR newsletters articles included ``Concerns about the Millennium,'' February 1997; ``Year 2000 Concerns,'' February 1998; ``NRC Response on Year 2000,'' May 1998; ``More on the Y2K Issue,'' August 1998; and ``Another Y2000 Notice,'' November 1998. NRC staff has confirmed through several telephone conversations and discussions during inspections that all licensees of operating reactors are aware of the Y2K concerns and have ongoing actions to be Y2K ready by the end of the year or sooner.
Since 1998, while conducting inspections of NPR facilities, the NRC staff is also verifying that licensees are addressing the Y2K problem with regard to reactor safety. NRC staff has inspected about 50 percent of the operating reactors and intends to complete the inspections of all operating NPRs by October 1999. These inspections will verify that the licensees have programs to deal with Y2K and that all digital safety equipment at these facilities are considered in the program. Moreover, most institutions that operate the NPRs have their own Y2K programs that include the NPRs.
The safety systems at most operating reactors are analog systems that are not affected by the Y2K problem. Several operating reactors have digital safety equipment that provides instrument indication to the facility operator that is part of the licensee's Y2K program. Also, seven of these reactors have digital reactor protection system functions also considered in the licensee's Y2K program. These systems operate in parallel with the analog reactor protection systems, which are not affected by Y2K. Also, the digital systems initiate reactor scrams in case of a malfunction in the digital equipment. The analog systems generally provide the required reactor safety functions. The analog systems are independent of the digital equipment and have built- in redundancy to ensure that the reactor scrams. The power levels of these reactors are low (up to a maximum of 2 MWt) and many of them operate at low temperatures in relatively large pools of water. The only safety function that is generally required is for the reactor to scram. Thus, the Y2K concern poses very low risk. NIRS does not explain why the licensees' Y2K program activities and NRC's oversight of the licensees' implementation of the programs are inadequate such that the rule proposed by NIRS is necessary to provide reasonable assurance of adequate protection.
-
Part 50 Decommissioning Nuclear Power Plant Licensees
The suggested rule language in the petition would require that all facilities not compliant with Y2K issues be shut down by December 1, 1999. Nuclear power plants that are permanently shutdown with fuel removed from the reactor core would, therefore, not be subject to the rule as proposed by NIRS. However, since the purpose of the proposed rule appears to be directed to ensuring that Y2K problems at all nuclear power plants--both operating and decommissioning--will not pose a threat to public health and safety, the following discussion on the activities for addressing the Y2K problem at decommissioning nuclear power plants is provided.
There are two potential radiological health and safety concerns with respect to Y2K problems at decommissioning plants: (1) spent fuel storage, including site security; and (2) the actual conduct of dismantlement and decommissioning activities. Of greater concern is the spent fuel storage. The concerns in this area relate to providing sufficient cooling to the spent fuel and providing sufficient security against diversion and sabotage of the spent fuel. There are 21 decommissioning nuclear power plants that have been shut down more than a year, 6 of which have had spent fuel removed from the site. Accordingly, there are only 15 decommissioning nuclear power plants where spent fuel storage is of concern. Although licensees for all of these facilities are implementing Y2K programs, it is unlikely that Y2K problems would pose a significant problem to providing sufficient spent fuel cooling. First, electrical and makeup water systems for spent fuel pools are not computer-controlled. Moreover, even if there was an interruption in electrical power, there is a long time period for the licensee to respond to the problem before integrity of the spent fuel rods becomes an issue because sufficient time is available to take compensatory action before boiling starts. The spent fuel pool is conservatively estimated (based on the Zion units) to begin boiling 68 hours after loss of the spent fuel pool cooling system. Boiling does not become a concern until the fuel rods begin to be uncovered by boil- off of cooling water. Since fuel rods are normally covered by 23 feet of water (for purposes of shielding), and it would take approximately two weeks or more to begin uncovering the spent fuel rods (assuming that no make-up water is added to the pool), the NRC believes that there is sufficient time to recover electrical power and/or provide makeup water to prevent the fuel rods from uncovering.
The other threat to spent fuel is diversion and sabotage. Licensees of decommissioning reactors are taking steps to ensure that Y2K problems will not disable necessary security and safeguards systems and controls. Licensees with computer-based site security systems that have been identified as potentially Y2K vulnerable have tested the system for Y2K, upgraded the system to be Y2K compliant, or will make the system Y2K compliant before the end of 1999.
With respect to the safety of conducting dismantlement and decommissioning activities, the NRC does not believe that these activities are subject to Y2K problems that would pose a threat to public health and safety because the conduct of these activities in the field do not rely upon computer-controlled devices to ensure protection against radiological dangers.
In sum, licensees of decommissioning nuclear power plants are implementing Y2K activities that address equipment and systems important to safety, such that there is reasonable assurance of adequate protection to public health and safety.
-
Major Parts 40 and 70 Licensees
To alert major Parts 40 and 70 licensees of the potential Y2K problem, NRC issued Information Notice (IN) 96-70, ``Year 2000 Effect on Computer System Software,'' dated December 24, 1996. IN 96-70 described the potential Y2K problems, encouraged licensees to examine their uses of computer systems and software well before the year 2000, and suggested that licensees consider appropriate actions to examine and evaluate their computer systems for Y2K vulnerabilities.
In order to gather Y2K information regarding materials and major fuel cycle facilities, NRC formed a Y2K Team within the Office of Nuclear Material Safety and Safeguards (NMSS) in 1997. From September 1997 through December 1997, this NMSS Y2K Team visited a cross-section of materials
[[Page 45906]]
licensees and fuel cycle facilities and conducted Y2K interviews. Each licensee or facility visited by the team indicated that they were aware of the Y2K issue and were in various stages of implementing their Y2K readiness program.
On June 22, 1998, the NRC staff issued Generic Letter (GL) 98-03, ``NMSS Licensees' and Certificate Holders' Year 2000 Readiness Programs.'' This GL requested major Parts 40 and 70 licensees to submit by September 20, 1998, written responses regarding their facility- specific Y2K readiness program in order to confirm that they were addressing the Y2K problem effectively. All licensees responded to GL 98-03 by stating that they have adopted a facility-specific Y2K readiness program and that the scope of the program included identifying and, where appropriate, remediating, hardware, software, and embedded systems, and provided for risk management and the development of contingency plans.
GL 98-03 also requested a written response, no later than December 31, 1998, which confirmed that these facilities were Y2K ready or provided a status report of work remaining to be done to become Y2K ready, including completion schedules. All licensees provided a second response to GL 98-03, which identified work remaining to be done, including completion schedules. Furthermore, following the second response, NRC requested a third written response, no later than July 1, 1999, which would confirm that these facilities are Y2K ready or would provide an updated status report.
On August 12, 1998, IN 98-30, ``Effect of the Year 2000 Computer Problem on NRC Licensees and Certificate Holders,'' provided licensees additional information on the Y2K issue. IN 98-30 provided definitions of ``Y2K ready'' and ``Y2K compliant,'' encouraged licensees to contact vendors and test their systems for Y2K problems, and described elements of a Y2K readiness program.
Between September 1997 and October 1998, the major Parts 40 & 70 licensees were also asked Y2K questions during other inspections. Based on these Y2K inspections, the licensees were aware of the Y2K problem and were adequately addressing Y2K issues. There have been no identified risk-significant Y2K concerns for major Parts 40 and 70 licensees.
NIRS' proposed rule would require that licensees be shutdown by December 1, 1999, unless licensees demonstrate that ``Y2K compliance'' has been achieved. However, NIRS has not explained why ``Y2K compliance'' as opposed to ``Y2K readiness'' is necessary. NIRS asserted that NRC has not made explicit how it will define ``Y2K compliance.'' However, NRC explicitly defined the terms ``Y2K ready'' and ``Y2K compliant'' in GL 98-03. ``Y2K ready'' was defined as a computer system or application that has been determined to be suitable for continued use into the year 2000, even though the computer system or application is not Y2K compliant. ``Y2K compliant'' was defined as a computer system or application that accurately processes date/time data (including, but not limited to, calculating, comparing, and sequencing) from, into, and between the years 1999 and 2000, and beyond, including leap-year calculations. Thus, by definition, systems that are ``Y2K ready'' are able to perform their functions properly. There is no discernable safety reason why achieving Y2K readiness rather than Y2K compliance should result in facility shutdown. Accordingly, there is no basis for requiring facility shutdown if a licensee cannot demonstrate Y2K compliance.
NIRS presents no information or argument why those actions by the licensees and NRC described above are insufficient to address Y2K problems and to demonstrate that reasonable assurance of adequate protection will not be provided after December 1, 1999, so that facility shutdown is necessary.
-
Part 30 and Minor Parts 40 and 70 Licensees
To alert Part 30 and minor Parts 40 and 70 licensees, the NRC issued INs 96-70 and 98-30, which have been discussed in Section IV, ``Major Parts 40 and 70 Licensees.''
In addition to the efforts by the NMSS Y2K Team to gather information regarding materials licensees and major fuel facilities from September through December 1997, discussed under Section IV, NMSS staff also conducted telephone interviews with device manufacturers and distributors. Further, NRC determined that few of approximately 5,800 materials licensees use processes or have safety systems that are computer-controlled, thus minimizing potential Y2K impacts. The interviews and site visits confirmed that licensees were identifying and addressing potential Y2K problems.
From the interviews conducted by the NMSS Y2K Team, NRC learned that early versions of some treatment planning systems (computer systems for calculating dose to medical patients being treated with radiation or radioactive material) have Y2K problems and that upgrades for treatment planning systems were available. However, treatment planning systems are regulated by the U.S. Food and Drug Administration (FDA) and not by NRC because the systems do not contain licensed material. NRC has shared information on non-Y2K-compliant treatment planning systems with the FDA. For materials licensees, the NMSS Y2K Team did not identify any Y2K issues for NRC-regulated material. As a result of the interviews and site visits, NRC's focus has been to determine if any commercially available devices (medical and industrial) have potential Y2K vulnerabilities and to ensure that licensees evaluate self-developed systems, commercial off-the shelf software and hardware, and safety systems.
In addition to Y2K interviews, materials inspectors have been instructed to confirm receipt of NRC's information notices, determine whether the licensees have identified any potential problems associated with the Y2K issue, and note any corrective actions taken by the licensees. Through the routine inspection process, NRC has made assessments of the Y2K status of its materials licensees and continues to do so. To date, only the treatment planning systems described above, dose calibrators, and a tote position display for an irradiator have been identified through the inspection process as having Y2K problems. NRC materials inspectors have indicated that licensees are aware of available upgrades for treatment planning systems and dose calibrators. The irradiator tote position display is not a safety system. Further, the irradiator tote position display system that had the Y2K problem was a one-of-a-kind modification made by the licensee (the licensee was authorized by NRC to make the modification). The irradiator licensee is updating the tote position display system to eliminate the Y2K problem. No generic Y2K issues for NRC-regulated material used by materials licensees have been identified.
NIRS asserted that NRC has not made explicit what it plans to do about those facilities that cannot prove compliance. As discussed in Section IV, ``Major Parts 40 and 70 Licensees'' above, NIRS has not explained why ``Y2K compliance'' as opposed to ``Y2K readiness'' is necessary. Furthermore, Y2K readiness is not required for protection of public health and safety for Part 30 and minor Parts 40 and 70 licensees due to the amount and type of licensed material used by them. The risks to the public from these facilities are low. In addition, NRC has determined that few of the
[[Page 45907]]
approximately 5,800 materials licensees use processes or have safety systems that are computer-controlled, thus minimizing potential Y2K impacts. Accordingly, there is no basis for requiring facility shutdown if a licensee cannot demonstrate ``Y2K compliance.''
NIRS presents no information or argument why those actions by the licensees and NRC described above are insufficient to address Y2K problems and to demonstrate that reasonable assurance of adequate protection will not be provided after December 1, 1999, so that facility shutdown is necessary.
-
Public Information
NIRS requested in item (c) of its petition that NRC adopt regulations that would require that licensees make available to the public by December 1, 1999, all information related to the examination and repair, modification, and/or replacement of all computer systems, embedded chips, and other electronic equipment that may be date- sensitive. NIRS indicated that this rule provision is necessary in order to allow ``independent experts'' and the public to examine this information.
The NRC has already made available to the public substantial information on Y2K and the status of licensees' activities to address potential Y2K problems and will continue to make this information public. The audit reports of the NRC staff reviews of the 12 nuclear power plant-specific Y2K readiness project activities and documentation are publicly available both in the Public Document Rooms and the NRC Year 2000 Web site. The Y2K readiness information submitted in July 1999 by nuclear power plant licensees under GL 98-01, Supplement 1, is available to the public, as with any other correspondence that is received from licensees. The reports documenting the NRC staff audits of the six nuclear power plant-specific contingency planning activities and the results of the facility-specific Y2K program reviews of all operating nuclear power plants are also available to the public. The NRC inspection reports with Y2K information from Parts 30, 40, and 70 licensees and the licensees' responses to GL 98-03 have been placed in the PDR. Summaries of (1) inspection reports with Y2K information, (2) GL 98-03 responses, and (3) interviews with a cross-section of materials and fuel cycle licensees on Y2K issues are available on the NRC Year 2000 Web site.
In view of the information that has been made available and will be made available to the public, NIRS has not provided any basis for requiring licensees, by rule, to provide public access to Y2K information beyond that which the NRC has determined must be submitted to the NRC in furtherance of the NRC's regulatory oversight.
Conclusion
The rule proposed by NIRS is not needed because the Commission has determined that the activities taken by licensees to implement a systematic and structured facility-specific Y2K readiness program, together with the NRC's oversight of the licensees' implementation of these Y2K readiness programs, provide reasonable assurance of adequate protection to public health and safety.
For these reasons, the Commission denies the petition.
Dated at Rockville, Maryland, this 17th day of August, 1999.
For the Nuclear Regulatory Commission. Andrew L. Bates, Acting Secretary of the Commission.
[FR Doc. 99-21750Filed8-20-99; 8:45 am]
BILLING CODE 7590-01-P
