IR 05000269/1997017

Insp Repts 50-269/97-17,50-270/97-17 & 50-287/97-17 on 971201-04.No Violations Noted.Major Areas Inspected: Aspects of Licensees Plant Support Activities,Including Physical Security Plan & Vital Area Access Control

ML15118A283
Person / Time
Site:	Oconee
Issue date:	12/31/1997
From:	Belisle G NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION II)
To:
Shared Package
ML15118A282	List: IR 05000269/1997017
References
50-269-97-17, 50-270-97-17, 50-287-97-17, NUDOCS 9802020181
Download: ML15118A283 (13)

Text

U.S. NUCLEAR REGULATORY COMMISSION

REGION II

Docket Nos:

50-269, 50-270, 50-287 License Nos:

DPR-38, DPR-47, DPR-55 Report No:

50-269/97-17, 50-270/97-17 50-287/97-17 Licensee:

Duke Energy Corporation Facility:

Oconee Nuclear Station, Units 1, 2, and 3 Location:

7812B Rochester Highway Seneca, SC 29672 Dates:

December 1-4, 1997

Inspector:

W. Stansberry, Safeguards Inspector Approved by:

G. Belisle, Chief, Special Inspection Branch Division of Reactor Safety

9802020181 971231 PDR ADOCK 05000269 G

PDR

EXECUTIVE SUMMARY Oconee Nuclear Station, Units 1, 2, and 3 NRC Inspection Report 50-269/97-17, 50-270/97-17, and 50-287/97-17 This special inspection included aspects of the licensee's plant support activities. The report covers a one-week period of an announced special inspection by a regional inspecto Plant Support

The licensee's compensatory measures implemented for the degraded security conditions at-the Control Room door were within the commitments of the Physical Security Plan (Section S1.3).

• The inspection of the October 30, 1997 event identified one non-cited violation concerning vital area access control (Section S2.6).

• The control room barriers which included the controlled access door met the Physical Security-Plan commitments and regulatory requirements (Section S2.7).

• Review of the appropriate records and reports revealed weaknesses in the General Employee Training program and the Physical Security.Plan (Section S3.4).

REPORT DETAILS S1 Conduct of Security and Safeguards Activities S1.3 Compensatory Measures a. Inspection Scope (81064)

The inspector evaluated the licensee's program for compensatory measures for degraded security equipment involved in an October 30, 1997'security event: This was to ensure the reliability of the physical protection of vital equipment and security-related devices in the Control Room (CR).

Also evaluated was the-licensee's compliance with the criteria in Section-4.3.1 of the Physical Security Plan (PSP).

b. Observations and Findnqs Compensatory measures, which are to equal the temporarily failed component of the security system, were reviewed. In this event, the vital area access control and portal barrier to the CR were temporarily being compromised. The CR door was open for an extended period of tim An armed security-officer was posted at the CR portal as a compensatory measure for the degraded barrier and access controls, and to insure that only authorized personnel entered the CR. Vendor personnel.were to enter the CR and move fixtures and furniture out of the C Consequently, the portal would be open longer than the access alarm system was calibrated to have the door open without an alarm. This compensatory measure was implemented to assure that the effectiveness of vital area integrity was not reduce c. Conclusions The licensee's compensatory-measures implemented for the degraded security conditions at the CR door were within the commitments of the PS S2 Status of Security Facilities and Equipment S2.6 Access Control - Personnel a. Inspection Scope (81070)

The inspector inspected the licensee's controls for personnel access to the CR to insure conformance with Section 6.2 of the PSP, appropriate procedures and directives, and regulatory requirements of 10 CFR 75.55(d)(7).

b. Observations and Findings Through observations of personnel entering the protected area at the protected area access portal, discussions with security personnel, and review of access documents and -records, the inspector verified the following:

-

that the licensee had-positive and-active control of all points of personnel access to the protected are that any penetrationeor attempted penetration of'the protected area personnel access portal was detected and annunciated in the access portal and in both alarm station that-all persons were properly identified, and that authorization was checked, before a badge was issue that the licensee had ascertained and verified the personal reliability of all contractors, nonemployee and noncontractor personnel -to whom the licensee had authorized unescorted access to the protected are that the licensee had established,,maintained, and used a numbered picture badge identification system for all personnel who were authorized unescorted access to the protected area and vital areas. The badges were coded to indicate the vital areas to which access was authorize that any picture badges issued to non-licensee personnel indicated areas and periods of authorized access and that no escort was required, and that such badges were returned upon personnel leaving the protected are that personnel requiring an escort were properly registered, including-name, date, time, purpose of visit, citizenship, employment affiliation, and name of individual to be visite that personnel entering the protected area were searched for firearms, explosives, incendiary devices, and unauthorized material by physical search or by search equipment capable of detecting such device As to verifying that the licensee controls personnel access to vital areas to meet regulatory requirements and the requirements of the PSP, the inspector found the following:

On October:30, 1997, the Oconee Operations group was notified by the Oconee Facilities Management group that a vendor would be onsite to move filing cabinets from the Unit 1 & 2 CR. Operations personnel were also informed that the vendor was not authorized "Control Room" access and would require an escort. Subsequently, the vendor was contacted by Operations concerning the need to provide an escort. The vendor stated that he was authorized unescorted access into the protected area but not into the'CR. Individuals granted unescorted access to the Oconee site are issued picture identification badges that are coded to indicate'

access to various applicable areas including:

Area 1 - Protected Area Only Area 2 - Vital Areas (excluding control rooms)

Area 3-Control Rooms Area 4 - Security Areas Operations arranged to meet the vendor employee at the Unit 1 & 2 CR to escort the individual into the area according to Section 6.2.1 of the

"Duke Power Company Nuclear Security and Contingency Plan" that states,

"Individuals not authorized unescorted access to Areas 2, 3 or 4 shall be escorted while within the area."

However, Operations failed to comply with Section 217.5.4 of Duke Power Company Nuclear System Directive (NSD) 217, "Nuclear Security Program" that states.,

"Individuals with picture badges cannot be escorted into an area that is not listed on their badge. If access to an additional area (e.g.,

control room or security area) is needed, a Security Badge Transaction Request form must be completed and approved for the necessary badge change. Exceptions to this may be granted based on limited access need for specific work activities. This exception must be approved by the shift supervisor (on a case by case basis)."

On October 30, 1997. at approximately 1000 hours0.0116 days <br />0.278 hours <br />0.00165 weeks <br />3.805e-4 months <br />, at the request of Operations personnel, a security officer was dispatched to the Unit 1 & 2 CR controlled access door (CAD) 511 to allow workers to move filing cabinets.through the door. At approximately 1002 hours0.0116 days <br />0.278 hours <br />0.00166 weeks <br />3.81261e-4 months <br />, a security officer, who was near the portal, arrived at CAD 511 of the Unit 1 & 2 C At approximately 1005.hours, the security officer assigned to provide compensatory measures for the CAD, opened the CAD to facilitate movement of filing cabinets from the area. At this point, the officer was responsible for ensuring that only authorized personnel were to enter the vital are At approximately 1005 hours0.0116 days <br />0.279 hours <br />0.00166 weeks <br />3.824025e-4 months <br />, a permanently badged vendor employee, authorized access to the protected area only, (involved in the movement O

of cabinets) with his three escorted visitors, approached the officer

positioned at the CD of the Unit 1 & 2 CR. The security officer positioned at the portal directed the vendor employee to "key" into the entry card reader of the CAD. !,However, the security-officer was not able to view whether the green light on the card reader illuminate The security officer asked the vendor employee if the green light on the card reader illuminated. Upon receiving,a positive response from the vendor employee, the officer allowed the vendor and escorted visitors to enter the-Unitl & 2 CR. At this time, the vendor was not complying with Section 5.4.1 of Nuclear System Directive 217, "Nuclear Security Program,:" that requires personnel not to attempt to enter plant areas not authorized.- To enter a CAD area (Control Room), the keycard should

---

be inserted into the card.reader next to the-door A green acknowledgment light illuminates which indicates that access is authorized. If agreen light is not received, the individual is to verify the area number at/on the door against.!the area numbers-listed on the back of the badge. In addition, the security officer failed to comply with Security Procedure 101. "General Security Duties and Responsibilities," that requires security force personnel to be responsible for the overall control of personnel entry into vital areas of the station. It further requires that control of personnel shall include maintaining positive access control in that only personnel that are properly authorized are allowed in a given area. In addition, the security officer failed to comply with Security Procedure 515,

"Controlled Access Door Officer." that requires an armed security officer to review each individual's badge for access authorization level to insure that persons are authorized access through a CAD. Had the CAD to the Unit 1 CR been closed and secured in the normal manner the security computer would not have allowed an unauthorized individual to enter the are At this time, an Operations employee, authorized into the area and positioned.at the Unit 1 & 2 CR door (interior to the control room) began accompanying the unauthorized vendor employee. The three escorted visitors were also under the indirect control of the Operations employee, however, documented transfer of escort responsibilities was not accomplished. At this time, the Operations employee failed.to comply with Section 5.2.2 of Nuclear System Directive 217 by not recording the escort transfer on the visitors' escort card The security officer positioned at the CAD was not aware that the authorized Operations employee was accompanying the unauthorized vendor employee within the Unit 1 & 2 CR. This unauthorized access violated 10 CFR 73.55 (d)(7)(I)(B) in that the licensee failed to positively control personnel access to a vital are Between approximately 1005 hours0.0116 days <br />0.279 hours <br />0.00166 weeks <br />3.824025e-4 months <br /> and 1008 hours0.0117 days <br />0.28 hours <br />0.00167 weeks <br />3.83544e-4 months <br />, a second permanently badged unauthorized vendor employee (also involved in the movement of filing cabinets from the CR) repeatedly attempted to "key" into the area at the Unit 1 & 2 CAD 511. During this period, the Security Central Alarm Station operator notified the security officer providing

compensatory measures that "Code Error Eaton" alarms were being received on the CAD to the Unit 1 & 2 CR. Subsequently, without having entered the Unit 1,& 2 CR, the second vendor employee left the area and returned to the security badging area to determine why his badge would not log him into the are At approximately 1034 hours0.012 days <br />0.287 hours <br />0.00171 weeks <br />3.93437e-4 months <br />, the second vendor employee's security badge was remade by security to allow access to the Unit 1 & 2 C At approximately10 42Thours, the second permanently badged vendor employee returned to the officer positioned at the CAD at the Unit 1.& 2 CR. This individual stated to the security officer that he had been required to get his badge remade because he was not authorized

"Control Room" access. The security officer then asked this individual if the first vendor :employee was authorized "Control Room" access and was informed that he was not authorized. The first vendor employee and assigned escorts were within the Unit 1 & 2 CR near the officer; however, they had not been constantly within the view or under the control of the officer. The security officer called out to the vendor employee and-escorted visitors, and instructed them to exit the Unit 1 & 2 C At approximately 1044 hours0.0121 days <br />0.29 hours <br />0.00173 weeks <br />3.97242e-4 months <br />, the unauthorized vendor employee and his escorted visitors exited the Unit 1 & 2 CR. Responsibility for escort of the three visitor badged individuals was transferred to the second vendor employee (who was now authorized access into the Unit 1 & 2 CR).

At approximately 1050 hours0.0122 days <br />0.292 hours <br />0.00174 weeks <br />3.99525e-4 months <br />, the Security Shift Supervisor was informed by the officer positioned at the CAD that an unauthorized individual had been allowed to enter the Unit 1 & 2 CR. A review by the licensee of the incident was conducted and it was determined that: (a)

the vendor employee possessed appropriate screening and clearance to be granted authorized access into the Unit 1.&

2 CR; (b)

the vendor employee possessed a valid work related need to access the area; (c)

the vendor employee thought he was being authorized into the Unit 1 & 2 CR by the security officer and did not enter the area with malevolent intent; and (d)

the vendor employee and assigned escorts, while not within the continuous view of the security officer, were working within the immediate area of the security officer positioned at the CAD. At the time of this review Security was unaware that the unauthorized vendor employee was being accompanied, not escorted, by an Operations employee who was authorized in the are At 1100 hours0.0127 days <br />0.306 hours <br />0.00182 weeks <br />4.1855e-4 months <br />, the first vendor employee's badge was remade by security to allow access to the Unit 1 & 2 CR. This action occurred after the Oconee Facilities Management group reviewed the vendor employee's work

related need to access the Unit 1& 2 CR and initiated the.authorization process through Securit At 1143 hours0.0132 days <br />0.318 hours <br />0.00189 weeks <br />4.349115e-4 months <br />, this event was recorded on the Oconee Quarterl Safeguards Event Lo On November 5,

.1997f at approximately 1215 hours0.0141 days <br />0.338 hours <br />0.00201 weeks <br />4.623075e-4 months <br />, after further review of the incident, the licensee decided to report the incident via the Emergency Notification System (ENS) based upon the language in 10 CFR 73 Appendix G subpart I (b): "An actual entry of an unauthorized person into a protected area, material access area, controlled access area, r vital area, or transport."

On November 5, 1997, at 1225 hours0.0142 days <br />0.34 hours <br />0.00203 weeks <br />4.661125e-4 months <br />, the ENS notification of the incident was conducte On November 6, 1997, at 1356 hours0.0157 days <br />0.377 hours <br />0.00224 weeks <br />5.15958e-4 months <br />, a revised ENS notification was conducte The inspector found no indication that:

-

-The Facilities Management and Operations employees acted with malevolent intent. Involved employees believed that an authorized employee could escort an unauthorized employee into a "Vital,"

"Control Room," "Security" or "Safety Shutdown Facility Degrade" are The vendor employee entered the Unit 1 & 2 CR with malevolent intent. The vendor employee was aware that he was not authorized

"Control Room Access," however, he believed that access to the area was acceptable: (a)

while being accompanied by an Operations employee who was authorized into the area; and (b)

after being directed by a security officer to "key" the CAD card reader before entering the Unit 1 & 2 CR. This instance was the first time that the vendor employee had attempted to "key" into an area using his security badge. When questioned by the security officer the vendor did not fully understand the question being asked and, therefore, incorrectly indicated that the green light on the card reader illuminate This event involves the following violation with three examples:

The licensee failed to comply with 10 CFR 73.55(d)(7)(I)(B) that requires licensees to positively control all points of personnel access to vital areas, in that:

-

The security officer.at the-Control Room door failed to comply with paragraphs 3.1 and 4.19(c) of Security Procedures 101 and paragraph 4.1a of Security Procedure 51 Operations personnel failed to comply with Section 5.4 and Section 5.2.2 of Nuclear System Directive 21 The vendor employee escorting the three visitors failed to comply with Section 5.4.1 of Nuclear System Directive 21 This non-repetitive, licensee identified, and corrected violation is being treated as a Non-Cited Violation (NCV>)consistent with Section VII.B.I of the NRC Enforcement Policy. This will be identified as NCV 50-269, 270/97-17-0 c. Conclusions The inspection of the October 30, 1997 event identified one non-cited violation concerning vital area access contro S2.7 Vital Area Barriers a. Inspection Scope (81054)

The inspector evaluated the licensee's installation and maintenance of the physical barriers surrounding the CR vital area to insure conformance with the PSP and regulatory requirements; and whether the physical barriers were adequate and appropriate for the intended functio b. Observations and Findings The inspector verified that the CR was designated a vital area in the PSP. CR physical barriers were separated from protected area physical barriers and provided penetration resistance to both forced and surreptitious entry. The walls, ceiling, floor, and doors of the CR were bullet resistant. The CR door involved in this event offered the same level of resistance to penetration as does the CR barrier Operating mechanisms of the door were intact, free of corrosion, and in good working conditio At the time of the event, the CR door was open to facilitate the entry and exit of personnel and equipment. An armed security officer was posted at the door as a compensatory measure for the loss of barrier integrity, to monitor keycard access control of the CAD in an access mode, and to prevent tailgating and unauthorized access to the C Conclusions The CR barriers which includ the CAD met the PSP commitments and regulatory requirement S3 Security and Safeguards Procedures and Documentation S3.4 Security-Records and Reports a. Inspection Scope (81038)

The inspector inspected the licensee's records-and reports program to ascertain whether the licensee was keeping the required records available for inspection for the time required by regulations. The inspector also inspected the program to determine if records and reports were adequate and appropriate for the intended functio b. Observations and Findings The inspector verified that the licensee kept the required records available for inspection for the time required by regulations. Records and reports were adequate and appropriate fortheir intended functio A separate log, Safeguards Event Log (SEL). was maintained to record security events that were reportable. This event was logged into the SEL at 1743 hours0.0202 days <br />0.484 hours <br />0.00288 weeks <br />6.632115e-4 months <br /> on October 30, 1997, within the 24-hour requiremen The inspector evaluated and reviewed the following records and reports concerning or involved in the October 30, 1997 event:

Security Personnel Training and Qualification Record Review of the involved security officer's training records indicated that he had been requalified in Task 1205. "Compensatory Measures,"

within-the annual required perio General Employee Training (GET)

Review of the GET training records indicated the following:

-

the involved Operations individual designated to escort the vendors in and around the CR had received the annual Unescorted Access training on November 13. 199 the vendor escorting the three visitors had received Unescorted Access training on September 25, 199 the security officer received Unescorted Access training on February 18, 199 Review of the GET Student Guide identified that it does not specifically cover the escort transfer responsibilities as stated in Section 5.4 of the Nuclear System Directive 217. This was identified as a weaknes Fitness for Duty (FFD) Testini Review of FFD records indicated that the Operations individual was last testeduon January 31, 1995, and. a security clearance was authorize The vendor escort was last tested on-June 18,' 1997, and a security clearance was authorized. The security officer was last tested on March 13, 1996, and a security clearance authorize Access Coitrol Program cords Review of the Security Badge Transaction Request forms indicated that area access transactions were completed as required for both of the escorting vendor Review of the Visitors Log indicated the three visitors were properly logged and issued Visitor Escorted Required Badges with Escort Change Records attached to each badg Review of the Escort Change Records indicated that the Operations designated escort did not sign these records indicating that the three visitors were transferred to Operations for escorting, as discribed in Section This is also addressed as part of NCV 50-269, 270/97-17-0 Testing and Maintenance Program Records of the Control Room Controlled Access Door 511 Review of Testing and Maintenance records indicated that the bi-monthly and monthly preventive maintenance inspection of the door, card reader and lock supports were done with no deficiencies foun Review of Failure Reports indicated that the door had three failure reports since May 1997. Each was attended in a timely manne Routine Activity Records Review of the Security Shift Support Documentation of the four night shifts indicated that the Seven-Day Security tests for CAD 511 were done and the door was functioning without exceptio Review of a Keycard Transaction printout indicated that the card reader was operating at the time of the event. The printout also indicated the escorting vendor did not keycard into the card reader as directed by the Security officer, as described in Section S2.6. This is also addressed as part of NCV 50-269, 270/97-17-0 Security Plan and Procedures Review of the PSP indicated that Section 6.2.1 was not specific on who can escort visitors in Areas 2, 3, and 4 and how this is to be accomplished (Nuclear System Directive 217). Section 6.2.2 of the PSP does not establish any vital area escort requirements. This was identified as a weaknes Conclusion Review of the appropriate records and reports revealed weaknesses in the GET program and the PS V. Management Meeting X1 Exit Meeting Summary The inspector presented the inspection results to licensee management at the conclusion of the inspection on December 4. 1997. The licensee acknowledged the findings presented. Although reviewed during this inspection, proprietary information is not contained in this repor Dissenting comments were not received from the license PARTIAL LIST OF PERSONS CONTACTED Licensee D. Durham, Security Specialist W. Foster, Safety Assurance Manager T. King, Security Manager E. Price, Regulatory Compliance Engineering M. Satterfield, Security Support Supervisor NRC M. Scott, Senior Resident Inspector INSPECTION PROCEDURES USED

IP 81038:

Security Records and Reports IP 81054:

Vital Areas Barriers IP 81064:

Compensatory Measures IP 81070:

Access Control - Personnel ITEMS OPENED, CLOSED, AND DISCUSSED OPENED 50-269, 270/97-17-01 NCV Licensees failed to positively control all points of personnel access to vital area (Section 2.6)

50-269, 270/97-17-01 NCV Licensees failed to positively control all points of personnel access to vital area (Section 2.6)