ML17325B532: Difference between revisions

From kanterella
Jump to navigation Jump to search
(Created page by program invented by StriderTol)
(Created page by program invented by StriderTol)
Line 17: Line 17:


=Text=
=Text=
{{#Wiki_filter:RCFnRM366USNUCLEARREGULATOMMISSION
{{#Wiki_filter:RC FnRM 366 U S NUCLEAR REGULAT OMMISSION-1998)This document does not conte afeguards Information LICENSEE EVENT REPORT (LER)(See reverse for required number of digits/characters for each block)APPROVED MB No.3150.0104 EXPIRES 06I30I2001 Estimated burden per response to comply with this mandatory hformation collection request: 50 hrs.Reported lessons learned are incorporated hto the licensing process and fed back to btdustry.Forward commenls regarding burden estimate to the Records Management Branch (TA F33), U.S.Nuclear Regulatory Commission, Washhgton.
-1998)Thisdocumentdoesnotconteafeguards Information LICENSEEEVENTREPORT(LER)(Seereverseforrequirednumberofdigits/characters foreachblock)APPROVEDMBNo.3150.0104 EXPIRES06I30I2001 Estimated burdenperresponsetocomplywiththismandatory hformation collection request:50hrs.Reportedlessonslearnedareincorporated htothelicensing processandfedbacktobtdustry.
DC 205550001, and to the Paperwork Reduction ProJect (31504104).
Forwardcommenlsregarding burdenestimatetotheRecordsManagement Branch(TAF33),U.S.NuclearRegulatory Commission, Washhgton.
Office of Management and Budget,'Washington, DC 20503.If an Information co lection does not display a cunentfy valid OMB control number.the NRC may not conduct or sponsor.and a person is not required to respond to.the information collection.
DC205550001, andtothePaperwork Reduction ProJect(31504104).
FACILITY NAME (1)Cook Nuclear Plant Unit 1 DOCKET NUMBER (2)05000-315 PAGE (3)1 OF 3 TrrLB (4)Vulnerability in the Locking Mechanism of Four Vital Area Gates EVENT DATE (5)LER NUMBER (6)REPORT DATE (7)OTHER FACILITIES INVOLVED (8)MONTH DAY YEAR 1999 SEQUENTIAL NUMBER REVISION MONTH DAY YEAR NUMBER FACILITY NAME Cook Nuclear Plant Unit 2 FAG ILrfY NAME DOCKET NUMBER 05000-316 DOCKET NUMBER OPERATING MODE (9)POWER LEVEL (10)0 o THIS REPORT Is SUBMITTED PURSUANT To THE REQU 20.2203(a)(2)(v) 20.2201(b) 20.2203(al(3)(i)20.2203(a)(3)(ii)20.2203(a)(1) 20.2203(a)(2)(i)
OfficeofManagement andBudget,'Washington, DC20503.IfanInformation colectiondoesnotdisplayacunentfyvalidOMBcontrolnumber.theNRCmaynotconductorsponsor.andapersonisnotrequiredtorespondto.theinformation collection.
IREMENTS OF 10 CFR Et (Check one or more)(11)50.73(a)(2)(viii) 50.73(a)(2)(i)50.73(a)(2)(x)50.73(a)(2)(ii) 50.73(a)(2l(iii), 73.71 20.2203(a)
FACILITYNAME(1)CookNuclearPlantUnit1DOCKETNUMBER(2)05000-315 PAGE(3)1OF3TrrLB(4)Vulnerability intheLockingMechanism ofFourVitalAreaGatesEVENTDATE(5)LERNUMBER(6)REPORTDATE(7)OTHERFACILITIES INVOLVED(8)MONTHDAYYEAR1999SEQUENTIAL NUMBERREVISIONMONTHDAYYEARNUMBERFACILITYNAMECookNuclearPlantUnit2FAGILrfYNAMEDOCKETNUMBER05000-316 DOCKETNUMBEROPERATING MODE(9)POWERLEVEL(10)0oTHISREPORTIsSUBMITTED PURSUANTToTHEREQU20.2203(a)(2)(v) 20.2201(b) 20.2203(al(3)
(i)20.2203(a)(3)
(ii)20.2203(a)(1) 20.2203(a)(2)(i)
IREMENTSOF10CFREt(Checkoneormore)(11)50.73(a)(2)(viii) 50.73(a)(2)(i)50.73(a)(2)(x)50.73(a)(2)(ii) 50.73(a)(2l(iii),73.7120.2203(a)
(2)(ii)20.2203(a)(2)(iii) 20.2203(a)(2)(iv) 20.2203(a)
(2)(ii)20.2203(a)(2)(iii) 20.2203(a)(2)(iv) 20.2203(a)
(4)50.36(c)(1) 50.36(c)(2)LICENSEECONTACTFORTHISLER(12)50.73(a)(2)(iv) 50.73(a)(2)(v)50.73(a)(2)(vii)XOTHERSpecifyinAbstractbeloworinNRCForm366ANAMELyleR.Berry,Regulatory Compliance EngineerTELEPHONE NUMBERIlnciudeAresCode)(616)465-5901X2637CRIBEDINTHISREPORT(13)COMPLETEONELINEFOREACHCOMPONENT FAILUREDESCAUSESYSTEMCOMPONENT MANUFACTURER REPORTABLE TOEPIXCAUSESYSTEMCOMPONENT MANUFACTURER REPORTABLE TOEPIXSUPPLEMENTAL REPORTEXPECTED14YES(Ifyes,completeEXPECTEDSUBMISSION DATE).XNoEXPECTEDMONTHDAYYEARABSTRACT(Limitto1400spaces,i.e.,approximately 15single-spaced typewritten lines)(16)OnMarch8,1999,atapproximately 1400hours,withbothunitsinMode5,thelockforavitalareagateleadingtotheUnit14KVSwitchgear areawasdiscovered bythesecuritycaptainandalocksmith tobenonconforming andvulnerable tounauthorized access.At1546hours,itwasdetermined thatthisconstituted afailure,degradation ordiscovered vulnerability inasafeguard systemthatcouldallowunauthorized orundetected accesstoaprotected area,materialaccessarea,controlled accessarea,vitalareaortransport forwhichcompensatory measureshavenotbeenemployedandwasreportable asasafeguards eventpursuanttotherequirements of10CFR73,AppendixG,paragraph l(c)and10CFR73.71(b)(1).
(4)50.36(c)(1) 50.36(c)(2)LICENSEE CONTACT FOR THIS LER (12)50.73(a)(2)(iv) 50.73(a)(2)(v)50.73(a)(2)(vii)X OTHER Specify in Abstract below or in NRC Form 366A NAME Lyle R.Berry, Regulatory Compliance Engineer TELEPHONE NUMBER Ilnciude Ares Code)(616)465-5901 X2637 CRIBED IN THIS REPORT (13)COMPLETE ONE LINE FOR EACH COMPONENT FAILURE DES CAUSE SYSTEM COMPONENT MANUFACTURER REPORTABLE TO EPIX CAUSE SYSTEM COMPONENT MANUFACTURER REPORTABLE TO EPIX SUPPLEMENTAL REPORT EXPECTED 14 YES (If yes, complete EXPECTED SUBMISSION DATE).X No EXPECTED MONTH DAY YEAR ABSTRACT (Limit to 1400 spaces, i.e., approximately 15 single-spaced typewritten lines)(16)On March 8, 1999, at approximately 1400 hours, with both units in Mode 5, the lock for a vital area gate leading to the Unit 1 4KV Switchgear area was discovered by the security captain and a locksmith to be nonconforming and vulnerable to unauthorized access.At 1546 hours, it was determined that this constituted a failure, degradation or discovered vulnerability in a safeguard system that could allow unauthorized or undetected access to a protected area, material access area, controlled access area, vital area or transport for which compensatory measures have not been employed and was reportable as a safeguards event pursuant to the requirements of 10CFR73, Appendix G, paragraph l(c)and 10CFR73.71(b)(1).
AnEmergency Notification System(ENS)reportwasmadetoNRCat1645hours.Theanalogous vitalareagatefortheUnit24KVSwitchgear wasinspected anddetermined tobeoperable.
An Emergency Notification System (ENS)report was made to NRC at 1645 hours.The analogous vital area gate for the Unit 2 4 KV Switchgear was inspected and determined to be operable.Three additional gates were discovered to be nonconforming during the extent of condition investigation and ENS notification updates were made.The apparent causes for this event were inadequate gate design and inadequate procedures.
Threeadditional gateswerediscovered tobenonconforming duringtheextentofcondition investigation andENSnotification updatesweremade.Theapparentcausesforthiseventwereinadequate gatedesignandinadequate procedures.
Upon identification of the nonconforming gates, compensatory measures were promptly implemented.
Uponidentification ofthenonconforming gates,compensatory measureswerepromptlyimplemented.
Gate repairs/modifications are being made to eliminate nonconforming conditions.
Gaterepairs/modifications arebeingmadetoeliminate nonconforming conditions.
Compensatory measures will remain in place until the gates are returned to operable.Procedures for testing and maintenance of security gates will be revised to prevent recurrence.
Compensatory measureswillremaininplaceuntilthegatesarereturnedtooperable.
Follow-up investigations confirmed that the vital areas secured by the four gates were not compromised.
Procedures fortestingandmaintenance ofsecuritygateswillberevisedtopreventrecurrence.
Therefore, there were no implications to the health and safety of the public as a result of this event.'I)904130267 9's)0407 PDR ADQCK 050003i5 (sr)p  
Follow-up investigations confirmed thatthevitalareassecuredbythefourgateswerenotcompromised.
Therefore, therewerenoimplications tothehealthandsafetyofthepublicasaresultofthisevent.'I)904130267 9's)0407PDRADQCK050003i5(sr)p  


CFORM366AU.S.NUCLEARRETORYCOMMISSION
C FORM 366A U.S.NUCLEAR RE TORY COMMISSION
.1999)ThisdocumentdoesnotcontainSefeguards information LICENSEEEVENTREPORT(LER)TEXTCONTINUATION FACILITYNAME(1)CookNuclearPlantUnit1DOCKETI2)05000-315 YEARSEQUENTIAL NUMBERREVISIONNUMBERLERNUMBERI6)PAGEI3)2OF31999S001"00TEXTilfmorespaceisrequired, useadditional copiesofNRCForm366AjI17)Conditions PriorToEventUnit1Mode5at0%powerUnit2Mode5at0%powerDescritionOfTheEventOnMarch8,1999,atapproximately 1400hours,withbothunitsinMode5,thelockforavitalareagateleadingtotheUnit14KVSwitchgear areawasdiscovered, bythesecuritycaptainandalocksmith, tobenonconforming andvulnerable tounauthorized access.At1546itwasdetermined thatthisconstituted afailure,degradation ordiscovered vulnerability inasafeguard systemthatcouldallowunauthorized orundetected accesstoaprotected area,materialaccessarea,controlled accessarea,vitalareaortransport forwhichcompensatory measureshavenotbeenemployed.
.1999)This document does not contain Sefeguards information LICENSEE EVENT REPORT (LER)TEXT CONTINUATION FACILITY NAME (1)Cook Nuclear Plant Unit 1 DOCKET I2)05000-315 YEAR SEQUENTIAL NUMBER REVISION NUMBER LER NUMBER I6)PAGE I3)2 OF 3 1999 S001" 00 TEXT ilf more spaceis required, use additional copies of NRC Form 366A j I17)Conditions Prior To Event Unit 1 Mode 5 at 0%power Unit 2 Mode 5 at 0%power Descri tion Of The Event On March 8, 1999, at approximately 1400 hours, with both units in Mode 5, the lock for a vital area gate leading to the Unit 1 4KV Switchgear area was discovered, by the security captain and a locksmith, to be nonconforming and vulnerable to unauthorized access.At 1546 it was determined that this constituted a failure, degradation or discovered vulnerability in a safeguard system that could allow unauthorized or undetected access to a protected area, material access area, controlled access area, vital area or transport for which compensatory measures have not been employed.An Emergency Notification System (ENS)report was made to NRC at 1645 hours.The analogous vital area gate for the Unit 2 4 KV Switchgear Unit 2 was inspected and determined to be operable.Three additional gates were discovered to be nonconforming during the extent of condition investigation of other safeguard gates in the plant.During this investigation, it was identified that the entry gate into Unit 1 Upper Containment could not be inspected, due to a hose in the gate opening.However, this gate has had compensatory measures in place since May 1998, in support of plant activities which require it to be open.The vital area gates to Unit 2 West Motor Driven Auxiliary Feedwater Pump Room Access and Unit 2 Essential Service Water (ESW)Pump Room Access were discovered to be nonconforming at approximately 1637 and 1706 hours, respectively, on March 8, 1999.An ENS update report was made to NRC at 1838 hours.The gate to Unit 2 Access to the Spent Fuel Pit Area from the Auxiliary Cranebay was discovered to be nonconforming at approximately 0643 hours on March 9, 1999.A second ENS update report was made to NRC at 1139 hours on March 9, 1999.Compensatory measures were established upon Identification of each of the four gate vulnerabilities.
AnEmergency Notification System(ENS)reportwasmadetoNRCat1645hours.Theanalogous vitalareagatefortheUnit24KVSwitchgear Unit2wasinspected anddetermined tobeoperable.
Review of alarm records did not identify uninvestigated alarms for these gates.Cause Of The Event The apparent causes for this event were inadequate gate design and inadequate procedures.
Threeadditional gateswerediscovered tobenonconforming duringtheextentofcondition investigation ofothersafeguard gatesintheplant.Duringthisinvestigation, itwasidentified thattheentrygateintoUnit1UpperContainment couldnotbeinspected, duetoahoseinthegateopening.However,thisgatehashadcompensatory measuresinplacesinceMay1998,insupportofplantactivities whichrequireittobeopen.ThevitalareagatestoUnit2WestMotorDrivenAuxiliary Feedwater PumpRoomAccessandUnit2Essential ServiceWater(ESW)PumpRoomAccesswerediscovered tobenonconforming atapproximately 1637and1706hours,respectively, onMarch8,1999.AnENSupdatereportwasmadetoNRCat1838hours.ThegatetoUnit2AccesstotheSpentFuelPitAreafromtheAuxiliary Cranebaywasdiscovered tobenonconforming atapproximately 0643hoursonMarch9,1999.AsecondENSupdatereportwasmadetoNRCat1139hoursonMarch9,1999.Compensatory measureswereestablished uponIdentification ofeachofthefourgatevulnerabilities.
Reviewofalarmrecordsdidnotidentifyuninvestigated alarmsforthesegates.CauseOfTheEventTheapparentcausesforthiseventwereinadequate gatedesignandinadequate procedures.
Information.
Information.
Notice88-41,"Physical Protection Weaknesses Identified ThroughRegulatory Effectiveness Reviews"described deficiencies ingatedesignwhichcouldallowcompromise.
Notice 88-41,"Physical Protection Weaknesses Identified Through Regulatory Effectiveness Reviews" described deficiencies in gate design which could allow compromise.
Plantdesignreviewsandgatemodifications performed inresponsetoIN8841werenotadequate.
Plant design reviews and gate modifications performed in response to IN 8841 were not adequate.Test procedures were inadequate because they did not include requirements or methods to verify gate integrity by prescribing nondestructive attempts to subvert security systems.Current test procedures require security personnel to test the function of alarm systems associated with each gate, but do not include steps which could identify other gate vulnerabilities.
Testprocedures wereinadequate becausetheydidnotincluderequirements ormethodstoverifygateintegrity byprescribing nondestructive attemptstosubvertsecuritysystems.Currenttestprocedures requiresecuritypersonnel totestthefunctionofalarmsystemsassociated witheachgate,butdonotincludestepswhichcouldidentifyothergatevulnerabilities.
Maintenance procedures did not adequately identify potential degradation of vital area accesses and associated vulnerabilities.
Maintenance procedures didnotadequately identifypotential degradation ofvitalareaaccessesandassociated vulnerabilities.
Security procedures that apply to the preventive maintenance of these gates did not address discovery of external wear that could provide the opportunity for compromise.
Securityprocedures thatapplytothepreventive maintenance ofthesegatesdidnotaddressdiscovery ofexternalwearthatcouldprovidetheopportunity forcompromise.
NRC FORM 366A (6-1999)  
NRCFORM366A(6-1999)  


IIRCFORM366AU.S.NUCLEARREGULATORY COMMISSION 16.i998)ThisdocumentdoesnotconteinSereguerds Informetion LICENSEEEVENTREPORT(LER)TEXTCONTINUATION FACILITYNAME(1)CookNuclearPlantUnit1DOCKETI2)05000-315 YEAR1999LERNUMBERI6)SEQUENTIAL NUMBERS001PAGEI3)REvlsloN3'OF3NUMBER00TEXT(Ifmorespaceisrequired, useadditional copiesofNRCForm366AJ{17)Currentpreventive maintenance procedures discus'sthepossibility ofthemalfunction ofmechanical components, butdonotspecifically addressvulnerability totampering.
IIRC FORM 366A U.S.NUCLEAR REGULATORY COMMISSION 16.i 998)This document does not contein Sereguerds Informetion LICENSEE EVENT REPORT (LER)TEXT CONTINUATION FACILITY NAME (1)Cook Nuclear Plant Unit 1 DOCKET I2)05000-315 YEAR 1999 LER NUMBER I6)SEQUENTIAL NUMBER S001 PAGE I3)REvlsloN 3'OF 3 NUMBER 00 TEXT (If more spaceis required, use additional copies of NRC Form 366AJ{17)Current preventive maintenance procedures discus's the possibility of the malfunction of mechanical components, but do not specifically address vulnerability to tampering.
AnalsisOfTheEventCommencing atapproximately 1400hoursMarch8,1999andendingatapproximately 0630hoursMarch9,1999,withUnit1andUnit2bothinMode5,fourvitalareagateswereidentified whichwerenonconforming andvulnerable topossiblecompromise.
Anal sis Of The Event Commencing at approximately 1400 hours March 8, 1999 and ending at approximately 0630 hours March 9, 1999, with Unit 1 and Unit 2 both in Mode 5, four vital area gates were identified which were nonconforming and vulnerable to possible compromise.
Theidentified conditions constituted afailure,degradation ordiscovered vulnerability inasafeguard systemthatcouldallowunauthorized orundetected accesstoaprotected area,materialaccessarea,controlled accessarea,vitalareaortransport forwhichcompensatory measureshavenotbeenemployed.
The identified conditions constituted a failure, degradation or discovered vulnerability in a safeguard system that could allow unauthorized or undetected access to a protected area, material access area, controlled access area, vital area or transport for which compensatory measures have not been employed.This event was reportable as a safeguards event pursuant to the requirements of 10CFR73,'Appendix G, paragraph l(c)and 10CFR73.71(b)(1)
Thiseventwasreportable asasafeguards eventpursuanttotherequirements of10CFR73,'Appendix G,paragraph l(c)and10CFR73.71(b)(1)
(1 hour ENS report).ENS reports were made to the NRC Operations Center at 1645 hours and 1838 hours on March 8, 1999 and at 1139 hours on March 9, 1999.This report is being made pursuant to the requirements of 10CFR73, Appendix G, paragraph l(c)and 10CFR73.71(d)
(1hourENSreport).ENSreportsweremadetotheNRCOperations Centerat1645hoursand1838hoursonMarch8,1999andat1139hoursonMarch9,1999.Thisreportisbeingmadepursuanttotherequirements of10CFR73,AppendixG,paragraph l(c)and10CFR73.71(d)
(30 day report).Follow-up investigations indicate that the vital areas secured by the four gates were not compromised.
(30dayreport).Follow-up investigations indicatethatthevitalareassecuredbythefourgateswerenotcompromised.
Therefore, there were no implications to the health and safety of the public as a result of this event.C CORRECTIVE ACTIONS Upon identification of the nonconforming gates, compensatory measures were promptly implemented.
Therefore, therewerenoimplications tothehealthandsafetyofthepublicasaresultofthisevent.CCORRECTIVE ACTIONSUponidentification ofthenonconforming gates,compensatory measureswerepromptlyimplemented.
Vital area access gates were inspected to investigate the extent of condition and determine whether similar vulnerabilities existed.Gate repairs/modifications are being made to eliminate identified nonconforming conditions.
Vitalareaaccessgateswereinspected toinvestigate theextentofcondition anddetermine whethersimilarvulnerabilities existed.Gaterepairs/modifications arebeingmadetoeliminate identified nonconforming conditions.
Compensatory measures will remain in place until the gates are returned to operable.A new Operating Experience (OE)Program is being developed which will reside under the Regulatory Affairs Department.
Compensatory measureswillremaininplaceuntilthegatesarereturnedtooperable.
The ingredients of the program will include benchmarking from other utilities that have proven, effective OE programs and is intended to better utilize industry operating experience, including information notices.Security vital area access test procedures will be revised to incorporate appropriate steps for non-destructive testing of security systems such as gates.Security preventive maintenance procedures will be revised to incorporate steps intended to identify and correct degradation of barriers which could lead to vulnerability to tampering.
AnewOperating Experience (OE)Programisbeingdeveloped whichwillresideundertheRegulatory AffairsDepartment.
Follow-up investigations were performed to verify that vital areas secured by the four nonconforming gates were not compromised.
Theingredients oftheprogramwillincludebenchmarking fromotherutilities thathaveproven,effective OEprogramsandisintendedtobetterutilizeindustryoperating experience, including information notices.Securityvitalareaaccesstestprocedures willberevisedtoincorporate appropriate stepsfornon-destructive testingofsecuritysystemssuchasgates.Securitypreventive maintenance procedures willberevisedtoincorporate stepsintendedtoidentifyandcorrectdegradation ofbarrierswhichcouldleadtovulnerability totampering.
SIMILAR EVENTS 316/97-S001-00,"Control of Vital Area Lost Due to Personnel Error," November 10, 1997.NRC FORM 366A I6 1998)}}
Follow-up investigations wereperformed toverifythatvitalareassecuredbythefournonconforming gateswerenotcompromised.
SIMILAREVENTS316/97-S001-00, "ControlofVitalAreaLostDuetoPersonnel Error,"November10,1997.NRCFORM366AI61998)}}

Revision as of 09:22, 6 July 2018

LER 99-S01-00:on 990308,discovered That Lock for Vital Gate Leading to Plant 4KV Switchgear Area Was Nonconforming & Vulnerable to Unauthorized Access.Caused by Inadequate Gate Design & Inadequate Procedures.Mods Are Being Made to Gate
ML17325B532
Person / Time
Site: Cook American Electric Power icon.png
Issue date: 04/07/1999
From: BERRY L R
INDIANA MICHIGAN POWER CO.
To:
Shared Package
ML17325B531 List:
References
LER-99-S01, LER-99-S1, NUDOCS 9904130267
Download: ML17325B532 (6)


Text

RC FnRM 366 U S NUCLEAR REGULAT OMMISSION-1998)This document does not conte afeguards Information LICENSEE EVENT REPORT (LER)(See reverse for required number of digits/characters for each block)APPROVED MB No.3150.0104 EXPIRES 06I30I2001 Estimated burden per response to comply with this mandatory hformation collection request: 50 hrs.Reported lessons learned are incorporated hto the licensing process and fed back to btdustry.Forward commenls regarding burden estimate to the Records Management Branch (TA F33), U.S.Nuclear Regulatory Commission, Washhgton.

DC 205550001, and to the Paperwork Reduction ProJect (31504104).

Office of Management and Budget,'Washington, DC 20503.If an Information co lection does not display a cunentfy valid OMB control number.the NRC may not conduct or sponsor.and a person is not required to respond to.the information collection.

FACILITY NAME (1)Cook Nuclear Plant Unit 1 DOCKET NUMBER (2)05000-315 PAGE (3)1 OF 3 TrrLB (4)Vulnerability in the Locking Mechanism of Four Vital Area Gates EVENT DATE (5)LER NUMBER (6)REPORT DATE (7)OTHER FACILITIES INVOLVED (8)MONTH DAY YEAR 1999 SEQUENTIAL NUMBER REVISION MONTH DAY YEAR NUMBER FACILITY NAME Cook Nuclear Plant Unit 2 FAG ILrfY NAME DOCKET NUMBER 05000-316 DOCKET NUMBER OPERATING MODE (9)POWER LEVEL (10)0 o THIS REPORT Is SUBMITTED PURSUANT To THE REQU 20.2203(a)(2)(v) 20.2201(b) 20.2203(al(3)(i)20.2203(a)(3)(ii)20.2203(a)(1) 20.2203(a)(2)(i)

IREMENTS OF 10 CFR Et (Check one or more)(11)50.73(a)(2)(viii) 50.73(a)(2)(i)50.73(a)(2)(x)50.73(a)(2)(ii) 50.73(a)(2l(iii), 73.71 20.2203(a)

(2)(ii)20.2203(a)(2)(iii) 20.2203(a)(2)(iv) 20.2203(a)

(4)50.36(c)(1) 50.36(c)(2)LICENSEE CONTACT FOR THIS LER (12)50.73(a)(2)(iv) 50.73(a)(2)(v)50.73(a)(2)(vii)X OTHER Specify in Abstract below or in NRC Form 366A NAME Lyle R.Berry, Regulatory Compliance Engineer TELEPHONE NUMBER Ilnciude Ares Code)(616)465-5901 X2637 CRIBED IN THIS REPORT (13)COMPLETE ONE LINE FOR EACH COMPONENT FAILURE DES CAUSE SYSTEM COMPONENT MANUFACTURER REPORTABLE TO EPIX CAUSE SYSTEM COMPONENT MANUFACTURER REPORTABLE TO EPIX SUPPLEMENTAL REPORT EXPECTED 14 YES (If yes, complete EXPECTED SUBMISSION DATE).X No EXPECTED MONTH DAY YEAR ABSTRACT (Limit to 1400 spaces, i.e., approximately 15 single-spaced typewritten lines)(16)On March 8, 1999, at approximately 1400 hours0.0162 days <br />0.389 hours <br />0.00231 weeks <br />5.327e-4 months <br />, with both units in Mode 5, the lock for a vital area gate leading to the Unit 1 4KV Switchgear area was discovered by the security captain and a locksmith to be nonconforming and vulnerable to unauthorized access.At 1546 hours0.0179 days <br />0.429 hours <br />0.00256 weeks <br />5.88253e-4 months <br />, it was determined that this constituted a failure, degradation or discovered vulnerability in a safeguard system that could allow unauthorized or undetected access to a protected area, material access area, controlled access area, vital area or transport for which compensatory measures have not been employed and was reportable as a safeguards event pursuant to the requirements of 10CFR73, Appendix G, paragraph l(c)and 10CFR73.71(b)(1).

An Emergency Notification System (ENS)report was made to NRC at 1645 hours0.019 days <br />0.457 hours <br />0.00272 weeks <br />6.259225e-4 months <br />.The analogous vital area gate for the Unit 2 4 KV Switchgear was inspected and determined to be operable.Three additional gates were discovered to be nonconforming during the extent of condition investigation and ENS notification updates were made.The apparent causes for this event were inadequate gate design and inadequate procedures.

Upon identification of the nonconforming gates, compensatory measures were promptly implemented.

Gate repairs/modifications are being made to eliminate nonconforming conditions.

Compensatory measures will remain in place until the gates are returned to operable.Procedures for testing and maintenance of security gates will be revised to prevent recurrence.

Follow-up investigations confirmed that the vital areas secured by the four gates were not compromised.

Therefore, there were no implications to the health and safety of the public as a result of this event.'I)904130267 9's)0407 PDR ADQCK 050003i5 (sr)p

C FORM 366A U.S.NUCLEAR RE TORY COMMISSION

.1999)This document does not contain Sefeguards information LICENSEE EVENT REPORT (LER)TEXT CONTINUATION FACILITY NAME (1)Cook Nuclear Plant Unit 1 DOCKET I2)05000-315 YEAR SEQUENTIAL NUMBER REVISION NUMBER LER NUMBER I6)PAGE I3)2 OF 3 1999 S001" 00 TEXT ilf more spaceis required, use additional copies of NRC Form 366A j I17)Conditions Prior To Event Unit 1 Mode 5 at 0%power Unit 2 Mode 5 at 0%power Descri tion Of The Event On March 8, 1999, at approximately 1400 hours0.0162 days <br />0.389 hours <br />0.00231 weeks <br />5.327e-4 months <br />, with both units in Mode 5, the lock for a vital area gate leading to the Unit 1 4KV Switchgear area was discovered, by the security captain and a locksmith, to be nonconforming and vulnerable to unauthorized access.At 1546 it was determined that this constituted a failure, degradation or discovered vulnerability in a safeguard system that could allow unauthorized or undetected access to a protected area, material access area, controlled access area, vital area or transport for which compensatory measures have not been employed.An Emergency Notification System (ENS)report was made to NRC at 1645 hours0.019 days <br />0.457 hours <br />0.00272 weeks <br />6.259225e-4 months <br />.The analogous vital area gate for the Unit 2 4 KV Switchgear Unit 2 was inspected and determined to be operable.Three additional gates were discovered to be nonconforming during the extent of condition investigation of other safeguard gates in the plant.During this investigation, it was identified that the entry gate into Unit 1 Upper Containment could not be inspected, due to a hose in the gate opening.However, this gate has had compensatory measures in place since May 1998, in support of plant activities which require it to be open.The vital area gates to Unit 2 West Motor Driven Auxiliary Feedwater Pump Room Access and Unit 2 Essential Service Water (ESW)Pump Room Access were discovered to be nonconforming at approximately 1637 and 1706 hours0.0197 days <br />0.474 hours <br />0.00282 weeks <br />6.49133e-4 months <br />, respectively, on March 8, 1999.An ENS update report was made to NRC at 1838 hours0.0213 days <br />0.511 hours <br />0.00304 weeks <br />6.99359e-4 months <br />.The gate to Unit 2 Access to the Spent Fuel Pit Area from the Auxiliary Cranebay was discovered to be nonconforming at approximately 0643 hours0.00744 days <br />0.179 hours <br />0.00106 weeks <br />2.446615e-4 months <br /> on March 9, 1999.A second ENS update report was made to NRC at 1139 hours0.0132 days <br />0.316 hours <br />0.00188 weeks <br />4.333895e-4 months <br /> on March 9, 1999.Compensatory measures were established upon Identification of each of the four gate vulnerabilities.

Review of alarm records did not identify uninvestigated alarms for these gates.Cause Of The Event The apparent causes for this event were inadequate gate design and inadequate procedures.

Information.

Notice 88-41,"Physical Protection Weaknesses Identified Through Regulatory Effectiveness Reviews" described deficiencies in gate design which could allow compromise.

Plant design reviews and gate modifications performed in response to IN 8841 were not adequate.Test procedures were inadequate because they did not include requirements or methods to verify gate integrity by prescribing nondestructive attempts to subvert security systems.Current test procedures require security personnel to test the function of alarm systems associated with each gate, but do not include steps which could identify other gate vulnerabilities.

Maintenance procedures did not adequately identify potential degradation of vital area accesses and associated vulnerabilities.

Security procedures that apply to the preventive maintenance of these gates did not address discovery of external wear that could provide the opportunity for compromise.

NRC FORM 366A (6-1999)

IIRC FORM 366A U.S.NUCLEAR REGULATORY COMMISSION 16.i 998)This document does not contein Sereguerds Informetion LICENSEE EVENT REPORT (LER)TEXT CONTINUATION FACILITY NAME (1)Cook Nuclear Plant Unit 1 DOCKET I2)05000-315 YEAR 1999 LER NUMBER I6)SEQUENTIAL NUMBER S001 PAGE I3)REvlsloN 3'OF 3 NUMBER 00 TEXT (If more spaceis required, use additional copies of NRC Form 366AJ{17)Current preventive maintenance procedures discus's the possibility of the malfunction of mechanical components, but do not specifically address vulnerability to tampering.

Anal sis Of The Event Commencing at approximately 1400 hours0.0162 days <br />0.389 hours <br />0.00231 weeks <br />5.327e-4 months <br /> March 8, 1999 and ending at approximately 0630 hours0.00729 days <br />0.175 hours <br />0.00104 weeks <br />2.39715e-4 months <br /> March 9, 1999, with Unit 1 and Unit 2 both in Mode 5, four vital area gates were identified which were nonconforming and vulnerable to possible compromise.

The identified conditions constituted a failure, degradation or discovered vulnerability in a safeguard system that could allow unauthorized or undetected access to a protected area, material access area, controlled access area, vital area or transport for which compensatory measures have not been employed.This event was reportable as a safeguards event pursuant to the requirements of 10CFR73,'Appendix G, paragraph l(c)and 10CFR73.71(b)(1)

(1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> ENS report).ENS reports were made to the NRC Operations Center at 1645 hours0.019 days <br />0.457 hours <br />0.00272 weeks <br />6.259225e-4 months <br /> and 1838 hours0.0213 days <br />0.511 hours <br />0.00304 weeks <br />6.99359e-4 months <br /> on March 8, 1999 and at 1139 hours0.0132 days <br />0.316 hours <br />0.00188 weeks <br />4.333895e-4 months <br /> on March 9, 1999.This report is being made pursuant to the requirements of 10CFR73, Appendix G, paragraph l(c)and 10CFR73.71(d)

(30 day report).Follow-up investigations indicate that the vital areas secured by the four gates were not compromised.

Therefore, there were no implications to the health and safety of the public as a result of this event.C CORRECTIVE ACTIONS Upon identification of the nonconforming gates, compensatory measures were promptly implemented.

Vital area access gates were inspected to investigate the extent of condition and determine whether similar vulnerabilities existed.Gate repairs/modifications are being made to eliminate identified nonconforming conditions.

Compensatory measures will remain in place until the gates are returned to operable.A new Operating Experience (OE)Program is being developed which will reside under the Regulatory Affairs Department.

The ingredients of the program will include benchmarking from other utilities that have proven, effective OE programs and is intended to better utilize industry operating experience, including information notices.Security vital area access test procedures will be revised to incorporate appropriate steps for non-destructive testing of security systems such as gates.Security preventive maintenance procedures will be revised to incorporate steps intended to identify and correct degradation of barriers which could lead to vulnerability to tampering.

Follow-up investigations were performed to verify that vital areas secured by the four nonconforming gates were not compromised.

SIMILAR EVENTS 316/97-S001-00,"Control of Vital Area Lost Due to Personnel Error," November 10, 1997.NRC FORM 366A I6 1998)