| |
Search Options | |||
| Index | Site Map | FAQ | Facility Info | Reading Rm | New | Help | Glossary | Contact Us | |
|||
UNITED STATES
NUCLEAR REGULATORY COMMISSION
OFFICE OF NUCLEAR MATERIAL SAFETY AND SAFEGUARDS
WASHINGTON, D.C. 20555-0001
June 22, 1998
| NRC GENERIC LETTER 98-03: | NMSS LICENSEES' AND CERTIFICATE HOLDERS' YEAR 2000 READINESS PROGRAMS |
Addressees:
| For Action: | All licensees or certificate holders for uranium hexafluoride production plants, uranium enrichment plants, and uranium fuel fabrication plants, except those that have permanently ceased operations. | |
| For Information: | None |
Purpose:
The U.S. Nuclear Regulatory Commission NRC is issuing this generic letter to: (1) notify all addressees of the need for Year 2000 (Y2K) Readiness Programs to address the Y2K problem in computer systems at their facilities; (2) request all action addressees to implement the actions described herein; and (3) require all action addressees to provide NRC with a written response to this letter.
Description of Circumstances:
As discussed in this Generic Letter, "Y2K Ready" is defined as a computer system or application that has been determined to be suitable for continued use into the year 2000, even though the computer system or application is not Y2K Compliant. A Y2K Readiness Program is a plan for a facility to become Y2K Ready. "Y2K Compliant" is defined as a computer system or application that accurately processes date/time data (including, but not limited to, calculating, comparing, and sequencing) from, into, and between the years 1999 and 2000, and beyond, including leap-year calculations.
The Y2K problem pertains to the potential inability of computers to correctly recognize dates beyond December 31,1999. This problem results from computer hardware and/or software that uses two-digit fields to represent the year. These systems may misread the year 2000 and cause the systems to fail, generate faulty data, or act in an incorrect manner. The Y2K problem has the potential to interfere with the proper operation of any computer system, hardware that is microprocessor-based (embedded software), software, or database. As a consequence, there is a risk that affected plant systems and equipment may fail to function properly.
The Y2K problem is urgent because it has a fixed, non-negotiable deadline that is quickly approaching. This matter requires priority attention because of the limited time remaining to assess the magnitude of the problem, assess its associated risks, and implement programs that will achieve a satisfactory resolution of the Y2K problem.
Existing reporting requirements under 10 CFR Part 21 provide for notification to NRC of deficiencies, non-conformances, and failures, such as the Y2K problem in safety-related systems. Examples of systems that may be affected include:
To alert licensees and certificate holders to the Y2K problem, NRC issued Information Notice (IN) 96-70, "Year 2000 Effect on Computer System Software," on December 24, 1996. In IN 96-70, the staff described the potential problems that computer systems and software may encounter as a result of the change from the year 1999 to the year 2000 and how the Y2K issue may affect NRC licensees and certificate holders. IN 96-70 encouraged licensees and certificate holders to examine their uses of computer systems and software well before the year 2000 and suggested that they consider appropriate actions to examine and evaluate their computer systems for Y2K vulnerabilities.
As part of NRC's response to the Y2K problem, NRC assembled a Y2K team to gather more information on the Y2K Readiness Programs of materials and fuel cycle licensees and certificate holders. In addition, materials and fuel cycle inspectors have been instructed to confirm receipt of NRC's IN 96-70, by materials and fuel cycle licensees and certificate holders; determine whether the licensees and certificate holders have identified any potential problems associated with the Y2K issue; and note any corrective actions taken by the licensees and certificate holders.
Discussion:
There are several concerns associated with the potential impact of the Y2K problem because of the variety and types of computer systems and software in use. For example, the role and use of computers and embedded systems in: (1) scheduling of maintenance and surveillance requirements; (2) programmable logic controllers and other commercial off-the-shelf software and hardware; (3) document control systems; (4) process control systems; (5) engineering calculations; and (6) systems for the collection of operating and post-accident site parameter data.
Applications that have no apparent date manipulation algorithms may still be affected by a Y2K problem. For example, a subroutine that date-stamps the header information in archival tapes, regardless of the rest of the content of the tape, may be affected. In addition, individual systems may be "date safe," but the integrated operations that the systems support may be vulnerable to the Y2K problem. Therefore, after testing a subsystem for Y2K Readiness, a functional test of the entire system should be performed.
The following elements can be used to aid in the development of a successful Y2K Readiness Program: (1) management planning; (2) implementation; (3) quality assurance (QA); (4) regulatory considerations; and (5) documentation. The components for planning include management awareness, sponsorship, project leadership, project objectives, project management team, management plan, project reports, interfaces, resources, and oversight. The phases of implementation include: awareness; initial assessment (e.g., inventory, categorization, classification, prioritization, and analysis); detailed assessment (e.g., vendor evaluation, software evaluation, interface evaluation, remedial planning); remediation; testing and validation; and notification. The features of QA include project management QA as well as implementation QA. The aspects of regulatory considerations include the performance and documentation of appropriate reviews and/or evaluations. The elements of documentation of activities and results include project management documentation, vendor certifications, inventory lists, checklists, and record retention.
There are three reference documents that may help licensees and certificate holders with their Y2K Readiness Programs. The General Accounting Office published "Year 2000 Computing Crisis: An Assessment Guide," in September 1997 and "Year 2000 Computing Crisis: Business Continuity and Contingency Planning. Exposure Draft," in March 1998 <http://www.gao.gov/special.pubs/publist.htm> as general business tools; and the Nuclear Energy Institute published NEI/NUSMG 97-07, "Nuclear Utility Year 2000 Readiness," in October 1997 <http://www.nrc.gov/NRC/Y2K/NRCNEI/NEI9707.html> to assist nuclear power plants in the development of their Y2K Readiness Programs. Even though the latter is geared towards commercial nuclear power plants, the general discussion of the elements in Y2K Readiness Program could be beneficial to other business entities.
NRC is also preparing its Nuclear Material Management Safeguards System (NMMSS) to be Y2K Compliant. For NRC licensees and certificate holders required to report nuclear material transactions to NMMSS, from May 1, 1998, through mid-1999, NMMSS will operate in a manner that allows all nuclear material transaction reports to NMMSS to be either in the current two-digit year reporting format or in the Y2K Compliant four-digit year format. After mid-1999, only the Y2K Compliant format will be acceptable.
Licensees and certificate holders that use their own software to input data into NMMSS will have to modify it themselves, to be Y2K compliant.
Requested Action:
Action addressees are requested to complete their Y2K Readiness Program by December 31, 1998. Action addressees' facilities are requested to be Y2K Compliant by December 31, 1999.
Required Response:
To gain the necessary assurance that action addressees are effectively resolving the Y2K problem and are in compliance with the terms and conditions of their licenses or certificates, and NRC regulations, NRC requires that all action addressees submit a written response to this Generic Letter, as follows:
| (1) | Within 90 days of the date of this Generic Letter, submit a written response indicating whether you have pursued and are continuing to pursue a Y2K Readiness Program. Present a brief description of the program that has already been completed, is being conducted, or is planned, to ensure Y2K Readiness of the computer systems at your facility. This response should address the program's scope, assessment process, and plans for corrective actions, including schedules for testing and validation. If an addressee chooses not to take the requested action(s), provide a description of any proposed alternative course of action, the schedule for completing the alternative course of action (if applicable), and the safety basis for determining the acceptability of the planned alternative course of action. |
| (2) | Upon completing your Y2K Readiness Program, or, in any event, no later than December 31, 1998, submit a written response confirming that your facility is Y2K Ready and in compliance with the terms and conditions of your license or certificate, and NRC regulations; or, if your facility is not Y2K Ready by December 31, 1998, then submit a written response that contains a status report of work remaining to be done to become Y2K Ready, including completion schedules. For systems that may affect safety and safeguards, contingency plans to become Y2K Ready and Y2K Compliant should be included in your response. |
| (3) | For facilities that are not Y2K Ready on or before December 31, 1998, submit a written response, by July 1, 1999, updating the status and schedule of your Y2K Readiness Program submitted in (2), above. The response should contain a status report of work remaining to be done to become Y2K Ready, including completion schedules. For systems that may affect safety and safeguards, contingency plans to become Y2K Ready and Y2K Compliant should be included in your response. |
If you determine, as your review evolves, that your facility is not Y2K Ready after submitting information in response to this Generic Letter that states that your facility is Y2K Ready, submit a written response containing the information as requested in (3) above. The written responses should include sufficient detail to assess the licensee's or certificate holder's Y2K Readiness Program.
Address the required written responses to the U.S. Nuclear Regulatory Commission, ATTN: Document Control Desk, Washington, D.C. 20555-0001, under oath or affirmation under the provisions of Section 182a, Atomic Energy Act 1954, as amended. Include the docket number for the facility on the first page of any response. In addition, submit a copy to the appropriate Regional Administrator.
Backfit Discussion:
(This section is applicable only to uranium enrichment plants with certificates of compliance under 10 CFR Part 76.) This generic letter only requests information from addressees under the provisions of Section 182a of the Atomic Energy Act of 1954, as amended. The requested information will enable NRC to verify that uranium enrichment plants are implementing effective plans to address the Y2K problem and provide for safe operation of the facilities before and after January 1, 2000, and are in compliance with the terms and conditions of their certificates, and NRC regulations. NRC regulations in 10 CFR Part 76 provide the basis for this request.
Paperwork Reduction Act Statement:
The information collections contained in this request are covered by the Office of Management and Budget clearance number 3150-0011, which expires September 9, 2000. The public reporting burden for this collection of information is estimated to average 250 hours per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing this burden, to the Information and Records Management Branch, U.S. Nuclear Regulatory Commission, Washington, D.C. 20555, and to the Desk Officer, Office of Information and Regulatory Affairs, NEOB-10202, (3150-0011), Office of Management and Budget, Washington, D.C. 20503.
If you have any questions about this matter, please contact one of the technical contacts listed below or the appropriate regional office.
| /s/'d
by
Elizabeth Q. Ten Eyck, Director |
| Contacts: | Gary Purdy, NMSS/IMNS (301) 415-7897 E-mail: gwp1@nrc.gov Harry Felsher, NMSS/FCSS |
Attachments: List of Recently Issued NRC Generic Letters