ML20149E295
| ML20149E295 | |
| Person / Time | |
|---|---|
| Site: | Waterford  |
| Issue date: | 07/16/1997 |
| From: | Beckendorf E, Leonard T ENTERGY OPERATIONS, INC. |
| To: | NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM) |
| References | |
| LER-97-S02, LER-97-S2, W3F1-97-0183, W3F1-97-183, NUDOCS 9707180157 | |
| Download: ML20149E295 (8) | |
Text
,
. ~....
~
yn arar.,
Killona, LA 70066-0751 Tel 504 464 3120 1
T.R. "Ted" Leonard GeneralManager Plant Operations i
Waterfcet13 I"'
W3F1-97-0163 A4.05 PR 4
July 16,1997 j
U.S. Nuclear Regulatory Commission Attn: Document Control Desk Washington, D.C. 20555
Subject:
Waterford 3 SES Docket No. 50-382 License No. NPF-38 Reporting of Security incident Report e
Gentlemen:
l a
4 Attached is Security Incident Report (SIR) Number 97-S02-00 for Waterford Steam Electric Station Unit 3. This report docu'ments an occurrence on June 16,1997, where Waterford 3 security personnel determined that two individuals inappropriately entered a vital area due to a faulty security keycard reader.
l l
This condition is being reported pursuant to Appendix G to 10CFR73 (c).
~
Very truly yours,
~
l TT
(
T.R. Leonard General Manager Plant Operations
[4k TRl)GCS/tjs Attachment 9707180157 970716" PDR ADOCK 05000382 h{f \\h kh!k 1
a<
. - ~.-
=.
. y,
- p. Qc k, ',
8 s
y
)
i c 4' '
Reporting of Security incident Report (SIR 97-S02-00)
W3Fiv97-0183 il Page 2 i-July 16,1997 t.
l' cc:
E.W. Merschoff (NRC Region IV)
C.P. Patel (NRC-NRR),
A.L. Garibaldi
/
J.T. Wheelock - INPO Records Center t-J. Smith J
N.S. Reynolds NRC Resident inspectors Office Administrator - LRPD a
(
e 4
w 3
i NRC FORM 366 U.S. NUCLEAR REGULATORY ColAMISSION APPROVED BY OMB NO. 31504104 149til' EXPtRES 04f30/98 ESilMATED BLRDEN PER RESPONSE TO COMPLY WITH THl3 MANDATORY NFORMATION COLLEPTich REQUEST. 500 HRS. REPORTED LESSONS LEARNED ARE
, LICENSEE EVENT REPORT (LER)
"jo,"g*;E,0 0, QN5m,G OC,S,5 AN ; D 8Ac
" 8T u
9 w
THE MA d
s RECORDS MiNAGEMENT BRANCH (T 8 F33L U.S. NUCLEAR REGULATORY COMMISSION, (see reverse for required number of WA$rdNGTON, DC 205 % 0001 AND TO THE PAPERWORK REDUCTION PROJECT C1150 digits / characters for each block)
Ni. ECE OF MANANNT AND BUDE WA$hNGTON, DC 2M PACE.fTV NAndE tH DOCKET NUMtKR (2)
PAGE C3)
WATERFORD STEAM ELECTRIC STATION UNIT 3 05000 382 3 op 6 mta m UNDETECTED ENTRY INTO PLANT VITAL AREA EVENT DATE (5)
LER NUMBER (6)
REPORT DATE (7)
OTHER FACILITIES INVOLVED (8) j f ACiUTY NAME DOCKET NUMBER SEQU IAL RE 8 MONTH DAY YEAR YEAR MONTH DAY YEAR N/A 05000 NU tACIUTY NAME DOCKET NUMBER 06 16 97 97 " S02
" 00 07 16 91 N/A 05000 OPERATIN 5
""*".*2203(an2nv)
MODE (9) 20.2201(b) 20 50.73(a)(2)(i)
. 50.73(a)(2nvm) 20.2203(a)(1) 20.2203(ansni) 50.73(an2)oi) 50.73(a)(2)(x)
POWER LEVEL (10) 000 20.2203(an2ni) 20.2203(an3nii) 50.73(an2nm) y 73.71 20.2203(a)(2)(ii) 20.2203(a)(4) 50.73(a)(2)0v)
OTHER 20.2203(an2)(m) 50.36(c)(1) 50.73(a)(2)tv)
Specify in Abstract below
^
20.2203(a)(2niv) 50.36(c)(2) 50.73(a)(2nvii)
LICENSEE CONTACT FOR THIS LER O2)
NAME TELLPHONE NUMBER (include Area Codel E.G. BECKENDORF (504) 739-6340 COMPLETE ONE LINE FOR EACH COMPONENT FAILURE DLSCRIBED IN THIS REPORT 03)
R R
^8 CAUSE SYSTEM COMPONENT MANUFACTURER CAUSE SYSTEM COMPONENT MANUFACTURER 0 PRD 0 PR0 SUPPLEMENTAL REPORT EXPECTED (14)
NH DAV MAR EXPECTED YES SUBMISSION NO DATE 0 5)
(if yes, complete EXPECTED SUBMISSION DATE).
y ABSTRACT (Limit to 1400 spaces, i.e., approximately 15 single-spaced type.wntten lines) (16)
On June 16,1997, Waterford 3 security personnel determined that two individuals inappropriately entered a vital area. The individuals did not have unescorted access to the vital area. There was no malevolent intent involved with the entries. The cause of the event was a faulty security keycard reader that gave individuals access to the vital area, The security keycard reader was repaired and the vital area entered was searched to ensure that no unauthorized personnel were in the area.
Following an investigation into this event, it was determined that there were no unauthorized entries into the vital area. The event did not compromise the health and safety of the public or plant personnel. This Security Incident Report is being submitted per Appendix G to 10CFR73 (c).
CRC FORM 386 (4861
a e;
b REQUIRED NUMBER OF DIGITS / CHARACTERS FOR EACH BLOCK BLOCK NUMBER OF NUMBER DIGITS / CHARACTERS 1
UP TO 46 FACILITY NAME DOCKET MBER 3 IN ADDIT N TO 05000 3
VARIES PAGE NUMBER 4
UP TO 76 TITLE
^
5 EVENT DATE 2 PER BLOCK 7 TOTAL 2 FOR YEAR 6
LER NUMBER 3 FOR SEQUENTIAL NUMBER 2 FOR REVISION NUMBER 7
REPORT DATE 2 PER BLOCK UP TO 18 - FACILITY NAME 8
^
8 TOTAL - DOCKET NUMBER 3 IN ADDITION TO 05000 9
i OPERATING MODE 10 3
POWER LEVEL I
Ql N OF 10 CFR CHECK BOX THAT APPLIES UP TO 50 FOR NAME 12
"^
14 FOR TELEPHONE CAUSE VARIES 2 FOR SYSTEM 13 4 FOR COMPONENT EACH COMPONENT FAILURE 4 FOR MANUFACTURER NPRDS VARIES A
ORT EMECTED CHECK BOX THAT APPLIES 15 EXPECTED SUBMISSION DATE 2 PER BLOCK Y
NRC FORM 366A U.S. NUCLEAR REGULATORY COMMISSION c
LICENSEE EVENT REPORT (LER)
TEXT CONTINUATION FACIUTY NAME (1)
DOCKET LER NUMBER (6)
PAGE (3)
"a!P 72 0
=
05 WATERFORD STEAM ELECTRIC STATIION UNIT 3 382 97 - S02 00 TEXT (It more space is required, use additional copies of NRC Form 366A) (17)
REPORTABLE OCCURRENCE Due to a faulty security keycard reader, two individuals inappropriately entered a vital area. The individuals did not have unescorted access to the vital area. In addition, due to the faulty security keycard reader, there was a potential for other individuals to enter into this area who were not authorized access. This event is being reported pursuant to Appendix G to 10CFR 73 (c) as a discovered vulnerability in a safeguards system that could allow undetected access to the vital area. On June 16,1997, a one hour report of this event was issued per the same requirement.
INITIAL CONDITIONS i
During this occurrence, Waterford 3 was in Mode 5 (Cold Shutdown). Unknown to plant personnel, the keycard reader at door 34A was inoperable at the time of this event.
EVENT DESCRIPTION On June 16,1997, Waterford 3 security personnel determined that two individuals inappropriately entered a vital area. The individuals did not have unescorted access to the vital area. There was no malevolent intent involved with the entries.
During this event Waterford 3 was in refuel outage 8. In support of the outage, new containment boundary perimeters were established. Special entry / exit keycard readers were installed to facilitate the processing of plant personnel into the containment area through Door 34A (west side access point). Door 34A was kept open and positive entry / exit control was maintained by a posted armed security officer. Door 35 (located inside the containment boundary area) was not used for entry / exit, since its neighboring storm door (Door 36) is kept open and placed in access mode.
On June 15,1997, at approximately 1256 hours0.0145 days <br />0.349 hours <br />0.00208 weeks <br />4.77908e-4 months <br />, the armed security officer posted at Door 34A reported to Central Alarm Station (CAS) that the entry keycard reader was malfunctioning and inoperable. The Officer compensated for the malfunction by NRC FORM 366A 1495)
NRC FORM 366A U.S NUCLEAR REGULATORY COMMISSION (4 951
- LICENSEE EVENT REPORT (LER)
TEXT CONTINUATION FACILITY NAME 0)
DOCKET LER NUMBER (6)
PAGE (3)
- $uMIf "EEE 0
0 WATERf0RD STEAM ELECTRIC STATION UNIT 3 97 --
S02 -- 00 1_,,_..,...,,,,.o..._,..,C,.,_,n,,
manually logging authorized entries. In addition, a condition identification, a document used to correct the deficiency, was generated. The keycard reader was repaired by the l&C department and placed back in service. Per site security procedure PS-012-109,
" Security Equipment inspection and Testing," an operability test was again performed which confirmed that the proper entry proceed lights were being displayed.
On June 16,1997 at approximately 0623 hours0.00721 days <br />0.173 hours <br />0.00103 weeks <br />2.370515e-4 months <br />, the security officer posted at Door 34A reported to CAS that the entry keycard reader was again malfunctioning. Since the previous condition identification was not completely administratively closed, repairs were completed under the same condition identification by the I&C Department, and the keycard reader was returned to an operable condition. An operability test was performed which confirmed that the proper entry proceed lights were being displayed.
At approximately 1007 hours0.0117 days <br />0.28 hours <br />0.00167 weeks <br />3.831635e-4 months <br /> an alarm was generated by an employee attempting to exit the containment boundary area through Door 161 located on the - 4 level of the Reactor Auxiliary Building (RAB). During the course of the initialinvestigation, at approximately 1051 hours0.0122 days <br />0.292 hours <br />0.00174 weeks <br />3.999055e-4 months <br />, another alarm was generated by an employee attempting to exit the containment boundary area through Door 21 located on the +21 level of the RAB. A computerized card history was generated on the employees' keycard usage, revealing that neither employee had logged into the containment entry keycard reader at Door 34A. However, the report did display that the employees had logged into a keycard reader located at Door 35. Since the containment boundary perimeters were configured for the refueling outage and Door 35 was not being used, the report should not have indicated entry into door 35. A test of the keycard reader at Door 34A was
]
performed by having the posted security officer insert his keycard through the keycard i
reader and verifying the log-in with CAS. The computerized card history report generated by CAS displayed the officer's keycard as being logged into the i
Unit / Area / Sector assigned to the keycard reader at Door 35, rather than the Unit / Area / Sector assigned to the keycard reader at Door 34A. A card history report generated on the entry / exit keycard readers for Door 34A, covering the time periods between June 15,1997 at 1400 hours0.0162 days <br />0.389 hours <br />0.00231 weeks <br />5.327e-4 months <br /> and June 16,1997 at 1100 hours0.0127 days <br />0.306 hours <br />0.00182 weeks <br />4.1855e-4 months <br />, determined no unauthorized entries into the containment area were made. However, the reports did NRC FORM 306A 14FJi
NRC FORM 306A U.S. NUCLEAR RE;ULATOHY CC MISSION 84 951
- LICENSEE EVENT REPORT (LER)
TEXT CONTINUATION FACILTTY NAME (1)
DOCKET LER NUMBER (6)
PAGE (3)
N R
NU WATERFORD STEAM ELECTRIC STATION UNIT E O
O 97 -- S02
-- 00 TEXT lit more space is required. use additional copies of NRC Form 366A) (17) reveal that employees who were using the keycard reader at Door 34A were being registered as logging into the keycard reader at Door 35. The reports also indicated a number of employees had exited Door 34A, but none had been logged in as having entered Door 34A.
The report revealed that the Unit / Area / Sector address number associated with Door 34A entry was not recognizing the containment entry authorized access level, but was recognizing an access level of a lower value (non-containment boundary access level number). Because of this problem, the security officer posted at Door 34A was instructed to manually log all plant employees seeking access into the containment boundary area, after ensuring positive identification and authorized access level. A request was made to the I&C Department to repair the entry keycard reader at Door 34A. After the repairs were made, the posted officer tested the keycard reader and verified with CAS that the correct Unit / Area / Sector address was being displayed for Door 34A. At the completion of the tests and verification that the keycard reader was working properly, the manuallog method was discontinued and use of the keycard reader at Door 34A was resumed.
A review of the Area Access Change Request Authorization forms disclosed, that both employees who had entered containment without the proper access level on June 16,1997, had been granted containment access. However, access had expired on June 14,1997. Per the requirements of Security Procedure PS-011-107, " Badge / Key Card Assignment and Control," the individual's containment access was terminated in the security computer 15 minutes after it had expired.
CAUSAL FACTORS A Root Cause Analysis (RCA) team was formed to investigate this event. The team determined the root cause to be an inadequate test acceptance criteria. If the acceptance criteria had included a requirement to ensure the security keycard reader had been assigned the proper address, then the problem with the keycard reader would have been discovered prior to placing it in service. Site Procedure UNT-005-002, NRC TORM 366A I4 951
1 NRC FORM'366A U.S. NUCLEAR REGULATORY COMMISSION 84 PJi LICENSEE EVENT REPORT (LER)
TEXT CONTINUATION FACILITY NAME (1)
DOCKET LER NUMBER (6)
PAGE (3)
NU8R NU 0
WATERFORD STEAM ELECTRIC STATION UNIT 3 382 97" S02
- 00 TEXT (1f more space ss required, use additional copies of NRC Form 366A) (17)
" Condition Identification," does not require equipment identified for repair under the minor maintenance category to have detailed work instructions or procedures in place for repairs. Keycard readers are identified under the minor maintenance category, therefore the l&C Department was not required to maintain procedures outlining testing criteria to be performed on the keycard readers after repairs (other than a manufacturer's technical specification manual). The l&C Department depends on the field acceptance test (performed by the security department) for validation of the repaired equipment. Security's procedure PS-012-109, " Security Equipment inspection and Testing," did not identify criteria for ensuring address assignment on repaired keycard readers are correct prior to accepting keycard readers back into service.
CORRECTIVE MEASURES in addition to the corrective measures discussed above, all remaining keycard readers throughout the plant were tested to ensure the correct Unit / Area / Sector had been properly assigned. Furthermore, a complete containment walk down search was performed to ensure that there were no personnel in the area without the approved authorized access levels. The search revealed no one was present who was not authorized.
The keycards of the two employees were inactivated, the employees were escorted out of the Protected Area and statements were taken.
Central Alarm Station / Secondary Alarm Station (CAS/SAS) personnel were instructed, via the " Security Information (SI) File," that testing criteria for accepting any keycard reader as operable shall include verification that the keycard reader has the correct address assignment.
A Security Operations Bulletin will be issued outlining the testing criteria to be performed on keycard readers after maintenance.
NRC FORM 386A H 951
NRC, FORM 366A U.S. NUCLEAR REGULATORY COMMfSSION (4 951 LICENSEE EVENT REPORT (LER)
TEXT CONTINUATION FACILITY NAME (1)
DOCKET LER NUMBER (6)
PAGE (3)
NU R j
WATERFORD STEAM ELECTRIC STATION UNIT 3 05000 6OF6 382 97 - 502 00 l
TEXT fit more space is required, use additional copies of NRC Form 366A) (17)
Security Procedure PS-012-iO9, " Security Equipment inspection and Testing," will be revised to incorporate the additional steps verifying the assignment of proper addresses. In addition, other testing criteria within that procedure will be evaluated for adequacy. If inadequacies are identified, they will be remedied by incorporating the criteria in the revision also.
A The l&C Department will implement a process whereby prior to placing a keycard reader into service they will ensure that the keycard reader address assignment switch is not malfunctioning.
Additionally, security will monitor in service equipment testing for one year within the scope of the self assessment program.
SAFETY SIGNIFICANCE The two employees who gained undetected access had previously been granted i
unescorted containment access, but our administrative controls voided this access on a pre-determined date. Their entry in the area was not malevolent, but was done as part of an assigned task.
Subsequent to the discovery of this event, security tested the remaining keycard readers and determined that they were fully functional. In addition, a complete containment walk down search was performed to ensure that no unauthorized personnel were in the area. The search revealed no unauthorized activities.
This event did not compromise the health and safety of the public and the safe operation of the plant.
SIMILAR EVENTS No similar events reported as SIRS were identified.
NRC FORM 306A (495)