ML17325B532

LER 99-S01-00:on 990308,discovered That Lock for Vital Gate Leading to Plant 4KV Switchgear Area Was Nonconforming & Vulnerable to Unauthorized Access.Caused by Inadequate Gate Design & Inadequate Procedures.Mods Are Being Made to Gate

ML17325B532
Person / Time
Site:	Cook
Issue date:	04/07/1999
From:	Berry L INDIANA MICHIGAN POWER CO.
To:
Shared Package
ML17325B531	List: ML17325B530 ML17325B532
References
LER-99-S01, LER-99-S1, NUDOCS 9904130267
Download: ML17325B532 (6)

Text

RC FnRM 366 U S NUCLEAR REGULAT OMMISSION APPROVED MB No. 3150.0104 EXPIRES 06I30I2001

-1998) This document does not conte afeguards Information Estimated burden per response to comply with this mandatory hformation collection request: 50 hrs. Reported lessons learned are incorporated hto the LICENSEE EVENT REPORT (LER) licensing process and fed back to btdustry. Forward commenls regarding burden estimate to the Records Management Branch (TA F33), U.S. Nuclear Regulatory Commission, Washhgton. DC 205550001, and to the Paperwork Reduction (See reverse for required number of ProJect (31504104). Office of Management and Budget,'Washington, DC 20503.

If an Information co lection does not display a cunentfy valid OMB control number.

digits/characters for each block) the NRC may not conduct or sponsor. and a person is not required to respond to.

the information collection.

FACILITYNAME (1) DOCKET NUMBER (2) PAGE (3)

Cook Nuclear Plant Unit 1 05000-315 1 OF 3 TrrLB (4)

Vulnerability in the Locking Mechanism of Four Vital Area Gates EVENT DATE (5) LER NUMBER (6) REPORT DATE (7) OTHER FACILITIES INVOLVED (8)

MONTH DAY YEAR SEQUENTIAL REVISION MONTH DAY YEAR FACILITYNAME DOCKET NUMBER NUMBER NUMBER Cook Nuclear Plant Unit 2 05000-316 1999 FAG ILrfYNAME DOCKET NUMBER OPERATING THIS REPORT Is SUBMITTED PURSUANT To THE REQU IREMENTS OF 10 CFR Et (Check one or more) (11)

MODE (9) 20.2201(b) 20.2203(a)(2)(v) 50.73(a) (2)(i) 50.73(a)(2)(viii)

POWER 0 o 20.2203(a)(1) 20.2203(al(3) (i) 50.73(a)(2)(ii) 50.73(a) (2)(x)

LEVEL (10) 20.2203(a)(2)(i) 20.2203(a)(3) (ii) 50.73(a) (2l(iii) 73.71 20.2203(a) (2)(ii) 20.2203(a) (4) 50.73(a)(2)(iv) X OTHER 20.2203(a)(2)(iii) 50.36(c)(1) 50.73(a) (2) (v) Specify in Abstract below or in NRC Form 366A 20.2203(a)(2)(iv) 50.36(c) (2) 50.73(a) (2) (vii)

LICENSEE CONTACT FOR THIS LER (12)

NAME TELEPHONE NUMBER Ilnciude Ares Code)

Lyle R. Berry, Regulatory Compliance Engineer (616) 465-5901 X2637 COMPLETE ONE LINE FOR EACH COMPONENT FAILURE DES CRIBED IN THIS REPORT (13)

CAUSE SYSTEM COMPONENT MANUFACTURER REPORTABLE CAUSE SYSTEM COMPONENT MANUFACTURER REPORTABLE TO EPIX TO EPIX SUPPLEMENTAL REPORT EXPECTED 14 EXPECTED MONTH DAY YEAR YES X No (If yes, complete EXPECTED SUBMISSION DATE).

ABSTRACT (Limit to 1400 spaces, i.e., approximately 15 single-spaced typewritten lines) (16)

On March 8, 1999, at approximately 1400 hours0.0162 days <br />0.389 hours <br />0.00231 weeks <br />5.327e-4 months <br />, with both units in Mode 5, the lock for a vital area gate leading to the Unit 1 4KV Switchgear area was discovered by the security captain and a locksmith to be nonconforming and vulnerable to unauthorized access. At 1546 hours0.0179 days <br />0.429 hours <br />0.00256 weeks <br />5.88253e-4 months <br />, it was determined that this constituted a failure, degradation or discovered vulnerability in a safeguard system that could allow unauthorized or undetected access to a protected area, material access area, controlled access area, vital area or transport for which compensatory measures have not been employed and was reportable as a safeguards event pursuant to the requirements of 10CFR73, Appendix G, paragraph l(c) and 10CFR73.71(b)(1). An Emergency Notification System (ENS) report was made to NRC at 1645 hours0.019 days <br />0.457 hours <br />0.00272 weeks <br />6.259225e-4 months <br />. The analogous vital area gate for the Unit 2 4 KV Switchgear was inspected and determined to be operable. Three additional gates were discovered to be nonconforming during the extent of condition investigation and ENS notification updates were made.

The apparent causes for this event were inadequate gate design and inadequate procedures. Upon identification of the nonconforming gates, compensatory measures were promptly implemented. Gate repairs/modifications are being made to eliminate nonconforming conditions. Compensatory measures will remain in place until the gates are returned to operable.

Procedures for testing and maintenance of security gates will be revised to prevent recurrence.

Follow-up investigations confirmed that the vital areas secured by the four gates were not compromised. Therefore, there were no implications to the health and safety of the public as a result of this event.

'I)904130267 9's) 0407 PDR ADQCK 050003i5(sr)p

C FORM 366A U.S. NUCLEAR RE TORY COMMISSION

.1999) This document does not contain Sefeguards information LICENSEE EVENT REPORT (LER)

TEXT CONTINUATION FACILITY NAME (1) DOCKET I2) LER NUMBER I6) PAGE I3)

Cook Nuclear Plant Unit 1 05000-315 YEAR SEQUENTIAL NUMBER REVISION 2 OF 3 NUMBER 1999 S001 00 TEXT ilfmore spaceis required, use additional copies of NRC Form 366A j I17)

Conditions Prior To Event Unit 1 Mode 5 at 0% power Unit 2 Mode 5 at 0% power Descri tion Of The Event On March 8, 1999, at approximately 1400 hours0.0162 days <br />0.389 hours <br />0.00231 weeks <br />5.327e-4 months <br />, with both units in Mode 5, the lock for a vital area gate leading to the Unit 1 4KV Switchgear area was discovered, by the security captain and a locksmith, to be nonconforming and vulnerable to unauthorized access. At 1546 it was determined that this constituted a failure, degradation or discovered vulnerability in a safeguard system that could allow unauthorized or undetected access to a protected area, material access area, controlled access area, vital area or transport for which compensatory measures have not been employed. An Emergency Notification System (ENS) report was made to NRC at 1645 hours0.019 days <br />0.457 hours <br />0.00272 weeks <br />6.259225e-4 months <br />. The analogous vital area gate for the Unit 2 4 KV Switchgear Unit 2 was inspected and determined to be operable.

Three additional gates were discovered to be nonconforming during the extent of condition investigation of other safeguard gates in the plant. During this investigation, it was identified that the entry gate into Unit 1 Upper Containment could not be inspected, due to a hose in the gate opening. However, this gate has had compensatory measures in place since May 1998, in support of plant activities which require it to be open. The vital area gates to Unit 2 West Motor Driven Auxiliary Feedwater Pump Room Access and Unit 2 Essential Service Water (ESW) Pump Room Access were discovered to be nonconforming at approximately 1637 and 1706 hours0.0197 days <br />0.474 hours <br />0.00282 weeks <br />6.49133e-4 months <br />, respectively, on March 8, 1999. An ENS update report was made to NRC at 1838 hours0.0213 days <br />0.511 hours <br />0.00304 weeks <br />6.99359e-4 months <br />.

The gate to Unit 2 Access to the Spent Fuel Pit Area from the Auxiliary Cranebay was discovered to be nonconforming at approximately 0643 hours0.00744 days <br />0.179 hours <br />0.00106 weeks <br />2.446615e-4 months <br /> on March 9, 1999. A second ENS update report was made to NRC at 1139 hours0.0132 days <br />0.316 hours <br />0.00188 weeks <br />4.333895e-4 months <br /> on March 9, 1999.

Compensatory measures were established upon Identification of each of the four gate vulnerabilities. Review of alarm records did not identify uninvestigated alarms for these gates.

Cause Of The Event The apparent causes for this event were inadequate gate design and inadequate procedures.

Information. Notice 88-41, "Physical Protection Weaknesses Identified Through Regulatory Effectiveness Reviews" described deficiencies in gate design which could allow compromise. Plant design reviews and gate modifications performed in response to IN 8841 were not adequate.

Test procedures were inadequate because they did not include requirements or methods to verify gate integrity by prescribing nondestructive attempts to subvert security systems. Current test procedures require security personnel to test the function of alarm systems associated with each gate, but do not include steps which could identify other gate vulnerabilities.

Maintenance procedures did not adequately identify potential degradation of vital area accesses and associated vulnerabilities. Security procedures that apply to the preventive maintenance of these gates did not address discovery of external wear that could provide the opportunity for compromise.

NRC FORM 366A (6-1999)

IIRC FORM 366A U.S. NUCLEAR REGULATORY COMMISSION 16.i 998) This document does not contein Sereguerds Informetion LICENSEE EVENT REPORT (LER)

TEXT CONTINUATION FACILITY NAME (1) DOCKET I2) LER NUMBER I6) PAGE I3)

Cook Nuclear Plant Unit 1 05000-315 YEAR SEQUENTIAL NUMBER REvlsloN 3 'OF 3 NUMBER 1999 S001 00 TEXT (If more spaceis required, use additional copies of NRC Form 366AJ {17)

Current preventive maintenance procedures discus's the possibility of the malfunction of mechanical components, but do not specifically address vulnerability to tampering.

Anal sis Of The Event Commencing at approximately 1400 hours0.0162 days <br />0.389 hours <br />0.00231 weeks <br />5.327e-4 months <br /> March 8, 1999 and ending at approximately 0630 hours0.00729 days <br />0.175 hours <br />0.00104 weeks <br />2.39715e-4 months <br /> March 9, 1999, with Unit 1 and Unit 2 both in Mode 5, four vital area gates were identified which were nonconforming and vulnerable to possible compromise. The identified conditions constituted a failure, degradation or discovered vulnerability in a safeguard system that could allow unauthorized or undetected access to a protected area, material access area, controlled access area, vital area or transport for which compensatory measures have not been employed. This event was reportable as a safeguards event pursuant to the requirements of 10CFR73,'Appendix G, paragraph l(c) and 10CFR73.71(b)(1) (1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> ENS report).

ENS reports were made to the NRC Operations Center at 1645 hours0.019 days <br />0.457 hours <br />0.00272 weeks <br />6.259225e-4 months <br /> and 1838 hours0.0213 days <br />0.511 hours <br />0.00304 weeks <br />6.99359e-4 months <br /> on March 8, 1999 and at 1139 hours0.0132 days <br />0.316 hours <br />0.00188 weeks <br />4.333895e-4 months <br /> on March 9, 1999. This report is being made pursuant to the requirements of 10CFR73, Appendix G, paragraph l(c) and 10CFR73.71(d) (30 day report).

Follow-up investigations indicate that the vital areas secured by the four gates were not compromised. Therefore, there were no implications to the health and safety of the public as a result of this event.

C CORRECTIVE ACTIONS Upon identification of the nonconforming gates, compensatory measures were promptly implemented. Vital area access gates were inspected to investigate the extent of condition and determine whether similar vulnerabilities existed. Gate repairs/modifications are being made to eliminate identified nonconforming conditions. Compensatory measures will remain in place until the gates are returned to operable.

A new Operating Experience (OE) Program is being developed which will reside under the Regulatory Affairs Department.

The ingredients of the program will include benchmarking from other utilities that have proven, effective OE programs and is intended to better utilize industry operating experience, including information notices.

Security vital area access test procedures will be revised to incorporate appropriate steps for non-destructive testing of security systems such as gates. Security preventive maintenance procedures will be revised to incorporate steps intended to identify and correct degradation of barriers which could lead to vulnerability to tampering. Follow-up investigations were performed to verify that vital areas secured by the four nonconforming gates were not compromised.

SIMILAR EVENTS 316/97-S001-00, "Control of Vital Area Lost Due to Personnel Error," November 10, 1997.

NRC FORM 366A I6 1998)