ML17325B532

LER 99-S01-00:on 990308,discovered That Lock for Vital Gate Leading to Plant 4KV Switchgear Area Was Nonconforming & Vulnerable to Unauthorized Access.Caused by Inadequate Gate Design & Inadequate Procedures.Mods Are Being Made to Gate

ML17325B532
Person / Time
Site:	Cook
Issue date:	04/07/1999
From:	Berry L INDIANA MICHIGAN POWER CO.
To:
Shared Package
ML17325B531	List: ML17325B530 ML17325B532
References
LER-99-S01, LER-99-S1, NUDOCS 9904130267
Download: ML17325B532 (6)

Text

RC FnRM 366 U S NUCLEAR REGULAT OMMISSION-1998)This document does not conte afeguards Information LICENSEE EVENT REPORT (LER)(See reverse for required number of digits/characters for each block)APPROVED MB No.3150.0104 EXPIRES 06I30I2001 Estimated burden per response to comply with this mandatory hformation collection request: 50 hrs.Reported lessons learned are incorporated hto the licensing process and fed back to btdustry.Forward commenls regarding burden estimate to the Records Management Branch (TA F33), U.S.Nuclear Regulatory Commission, Washhgton.

DC 205550001, and to the Paperwork Reduction ProJect (31504104).

Office of Management and Budget,'Washington, DC 20503.If an Information co lection does not display a cunentfy valid OMB control number.the NRC may not conduct or sponsor.and a person is not required to respond to.the information collection.

FACILITY NAME (1)Cook Nuclear Plant Unit 1 DOCKET NUMBER (2)05000-315 PAGE (3)1 OF 3 TrrLB (4)Vulnerability in the Locking Mechanism of Four Vital Area Gates EVENT DATE (5)LER NUMBER (6)REPORT DATE (7)OTHER FACILITIES INVOLVED (8)MONTH DAY YEAR 1999 SEQUENTIAL NUMBER REVISION MONTH DAY YEAR NUMBER FACILITY NAME Cook Nuclear Plant Unit 2 FAG ILrfY NAME DOCKET NUMBER 05000-316 DOCKET NUMBER OPERATING MODE (9)POWER LEVEL (10)0 o THIS REPORT Is SUBMITTED PURSUANT To THE REQU 20.2203(a)(2)(v) 20.2201(b) 20.2203(al(3)(i)20.2203(a)(3)(ii)20.2203(a)(1) 20.2203(a)(2)(i)

IREMENTS OF 10 CFR Et (Check one or more)(11)50.73(a)(2)(viii) 50.73(a)(2)(i)50.73(a)(2)(x)50.73(a)(2)(ii) 50.73(a)(2l(iii), 73.71 20.2203(a)

(2)(ii)20.2203(a)(2)(iii) 20.2203(a)(2)(iv) 20.2203(a)

(4)50.36(c)(1) 50.36(c)(2)LICENSEE CONTACT FOR THIS LER (12)50.73(a)(2)(iv) 50.73(a)(2)(v)50.73(a)(2)(vii)X OTHER Specify in Abstract below or in NRC Form 366A NAME Lyle R.Berry, Regulatory Compliance Engineer TELEPHONE NUMBER Ilnciude Ares Code)(616)465-5901 X2637 CRIBED IN THIS REPORT (13)COMPLETE ONE LINE FOR EACH COMPONENT FAILURE DES CAUSE SYSTEM COMPONENT MANUFACTURER REPORTABLE TO EPIX CAUSE SYSTEM COMPONENT MANUFACTURER REPORTABLE TO EPIX SUPPLEMENTAL REPORT EXPECTED 14 YES (If yes, complete EXPECTED SUBMISSION DATE).X No EXPECTED MONTH DAY YEAR ABSTRACT (Limit to 1400 spaces, i.e., approximately 15 single-spaced typewritten lines)(16)On March 8, 1999, at approximately 1400 hours0.0162 days <br />0.389 hours <br />0.00231 weeks <br />5.327e-4 months <br />, with both units in Mode 5, the lock for a vital area gate leading to the Unit 1 4KV Switchgear area was discovered by the security captain and a locksmith to be nonconforming and vulnerable to unauthorized access.At 1546 hours0.0179 days <br />0.429 hours <br />0.00256 weeks <br />5.88253e-4 months <br />, it was determined that this constituted a failure, degradation or discovered vulnerability in a safeguard system that could allow unauthorized or undetected access to a protected area, material access area, controlled access area, vital area or transport for which compensatory measures have not been employed and was reportable as a safeguards event pursuant to the requirements of 10CFR73, Appendix G, paragraph l(c)and 10CFR73.71(b)(1).

An Emergency Notification System (ENS)report was made to NRC at 1645 hours0.019 days <br />0.457 hours <br />0.00272 weeks <br />6.259225e-4 months <br />.The analogous vital area gate for the Unit 2 4 KV Switchgear was inspected and determined to be operable.Three additional gates were discovered to be nonconforming during the extent of condition investigation and ENS notification updates were made.The apparent causes for this event were inadequate gate design and inadequate procedures.

Upon identification of the nonconforming gates, compensatory measures were promptly implemented.

Gate repairs/modifications are being made to eliminate nonconforming conditions.

Compensatory measures will remain in place until the gates are returned to operable.Procedures for testing and maintenance of security gates will be revised to prevent recurrence.

Follow-up investigations confirmed that the vital areas secured by the four gates were not compromised.

Therefore, there were no implications to the health and safety of the public as a result of this event.'I)904130267 9's)0407 PDR ADQCK 050003i5 (sr)p

C FORM 366A U.S.NUCLEAR RE TORY COMMISSION

.1999)This document does not contain Sefeguards information LICENSEE EVENT REPORT (LER)TEXT CONTINUATION FACILITY NAME (1)Cook Nuclear Plant Unit 1 DOCKET I2)05000-315 YEAR SEQUENTIAL NUMBER REVISION NUMBER LER NUMBER I6)PAGE I3)2 OF 3 1999 S001" 00 TEXT ilf more spaceis required, use additional copies of NRC Form 366A j I17)Conditions Prior To Event Unit 1 Mode 5 at 0%power Unit 2 Mode 5 at 0%power Descri tion Of The Event On March 8, 1999, at approximately 1400 hours0.0162 days <br />0.389 hours <br />0.00231 weeks <br />5.327e-4 months <br />, with both units in Mode 5, the lock for a vital area gate leading to the Unit 1 4KV Switchgear area was discovered, by the security captain and a locksmith, to be nonconforming and vulnerable to unauthorized access.At 1546 it was determined that this constituted a failure, degradation or discovered vulnerability in a safeguard system that could allow unauthorized or undetected access to a protected area, material access area, controlled access area, vital area or transport for which compensatory measures have not been employed.An Emergency Notification System (ENS)report was made to NRC at 1645 hours0.019 days <br />0.457 hours <br />0.00272 weeks <br />6.259225e-4 months <br />.The analogous vital area gate for the Unit 2 4 KV Switchgear Unit 2 was inspected and determined to be operable.Three additional gates were discovered to be nonconforming during the extent of condition investigation of other safeguard gates in the plant.During this investigation, it was identified that the entry gate into Unit 1 Upper Containment could not be inspected, due to a hose in the gate opening.However, this gate has had compensatory measures in place since May 1998, in support of plant activities which require it to be open.The vital area gates to Unit 2 West Motor Driven Auxiliary Feedwater Pump Room Access and Unit 2 Essential Service Water (ESW)Pump Room Access were discovered to be nonconforming at approximately 1637 and 1706 hours0.0197 days <br />0.474 hours <br />0.00282 weeks <br />6.49133e-4 months <br />, respectively, on March 8, 1999.An ENS update report was made to NRC at 1838 hours0.0213 days <br />0.511 hours <br />0.00304 weeks <br />6.99359e-4 months <br />.The gate to Unit 2 Access to the Spent Fuel Pit Area from the Auxiliary Cranebay was discovered to be nonconforming at approximately 0643 hours0.00744 days <br />0.179 hours <br />0.00106 weeks <br />2.446615e-4 months <br /> on March 9, 1999.A second ENS update report was made to NRC at 1139 hours0.0132 days <br />0.316 hours <br />0.00188 weeks <br />4.333895e-4 months <br /> on March 9, 1999.Compensatory measures were established upon Identification of each of the four gate vulnerabilities.

Review of alarm records did not identify uninvestigated alarms for these gates.Cause Of The Event The apparent causes for this event were inadequate gate design and inadequate procedures.

Information.

Notice 88-41,"Physical Protection Weaknesses Identified Through Regulatory Effectiveness Reviews" described deficiencies in gate design which could allow compromise.

Plant design reviews and gate modifications performed in response to IN 8841 were not adequate.Test procedures were inadequate because they did not include requirements or methods to verify gate integrity by prescribing nondestructive attempts to subvert security systems.Current test procedures require security personnel to test the function of alarm systems associated with each gate, but do not include steps which could identify other gate vulnerabilities.

Maintenance procedures did not adequately identify potential degradation of vital area accesses and associated vulnerabilities.

Security procedures that apply to the preventive maintenance of these gates did not address discovery of external wear that could provide the opportunity for compromise.

NRC FORM 366A (6-1999)

IIRC FORM 366A U.S.NUCLEAR REGULATORY COMMISSION 16.i 998)This document does not contein Sereguerds Informetion LICENSEE EVENT REPORT (LER)TEXT CONTINUATION FACILITY NAME (1)Cook Nuclear Plant Unit 1 DOCKET I2)05000-315 YEAR 1999 LER NUMBER I6)SEQUENTIAL NUMBER S001 PAGE I3)REvlsloN 3'OF 3 NUMBER 00 TEXT (If more spaceis required, use additional copies of NRC Form 366AJ{17)Current preventive maintenance procedures discus's the possibility of the malfunction of mechanical components, but do not specifically address vulnerability to tampering.

Anal sis Of The Event Commencing at approximately 1400 hours0.0162 days <br />0.389 hours <br />0.00231 weeks <br />5.327e-4 months <br /> March 8, 1999 and ending at approximately 0630 hours0.00729 days <br />0.175 hours <br />0.00104 weeks <br />2.39715e-4 months <br /> March 9, 1999, with Unit 1 and Unit 2 both in Mode 5, four vital area gates were identified which were nonconforming and vulnerable to possible compromise.

The identified conditions constituted a failure, degradation or discovered vulnerability in a safeguard system that could allow unauthorized or undetected access to a protected area, material access area, controlled access area, vital area or transport for which compensatory measures have not been employed.This event was reportable as a safeguards event pursuant to the requirements of 10CFR73,'Appendix G, paragraph l(c)and 10CFR73.71(b)(1)

(1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> ENS report).ENS reports were made to the NRC Operations Center at 1645 hours0.019 days <br />0.457 hours <br />0.00272 weeks <br />6.259225e-4 months <br /> and 1838 hours0.0213 days <br />0.511 hours <br />0.00304 weeks <br />6.99359e-4 months <br /> on March 8, 1999 and at 1139 hours0.0132 days <br />0.316 hours <br />0.00188 weeks <br />4.333895e-4 months <br /> on March 9, 1999.This report is being made pursuant to the requirements of 10CFR73, Appendix G, paragraph l(c)and 10CFR73.71(d)

(30 day report).Follow-up investigations indicate that the vital areas secured by the four gates were not compromised.

Therefore, there were no implications to the health and safety of the public as a result of this event.C CORRECTIVE ACTIONS Upon identification of the nonconforming gates, compensatory measures were promptly implemented.

Vital area access gates were inspected to investigate the extent of condition and determine whether similar vulnerabilities existed.Gate repairs/modifications are being made to eliminate identified nonconforming conditions.

Compensatory measures will remain in place until the gates are returned to operable.A new Operating Experience (OE)Program is being developed which will reside under the Regulatory Affairs Department.

The ingredients of the program will include benchmarking from other utilities that have proven, effective OE programs and is intended to better utilize industry operating experience, including information notices.Security vital area access test procedures will be revised to incorporate appropriate steps for non-destructive testing of security systems such as gates.Security preventive maintenance procedures will be revised to incorporate steps intended to identify and correct degradation of barriers which could lead to vulnerability to tampering.

Follow-up investigations were performed to verify that vital areas secured by the four nonconforming gates were not compromised.

SIMILAR EVENTS 316/97-S001-00,"Control of Vital Area Lost Due to Personnel Error," November 10, 1997.NRC FORM 366A I6 1998)