IR 05000346/1997005

Insp Rept 50-346/97-05 on 970324-28 & 0416-21.No Violations Noted.Major Areas Inspected:Inspector Reviewed Security Force Contingency Training,Equipment & Facilities & Held Interviews W/Security Supervisor Responsible for Training

ML20148B875
Person / Time
Site:	Davis Besse
Issue date:	05/08/1997
From:	NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION III)
To:
Shared Package
ML19063D042	List: IR 05000346/1997005
References
50-346-97-05, 50-346-97-5, NUDOCS 9705130397
Download: ML20148B875 (12)

Text

. . _ _ _ - . - - _ _ _ __ _ _ _ _ _ . . _ _ _ _ _ . ,

!

.  :

4 i

U.S. NUCLEAR REGULATORY COMMISSION I l

REGION lli l l

,

Docket No: 50-346

,

License No: NPF-3 J

l

,

,

Report No: 50-346/97005(DRS)

{

l Licensee: Toledo Edison Company l

.!

Facility: Davis-Besse Nuclear Power Station Location: 5503 N. State Route 2 ,

Oak Harbor, OH 43449 I

i Dates: March 24-28,1997 onsite April 16 and 21,1997 in NRC Region til Office i

inspector: G. Pirtle, Physical Security inspector !

Approved by: James R. Creed, Chief, Plant Support Branch 1 j Division of Reactor Safety l

!

9705130397 970508 PDR ADOCK 05000346 O PDR ,

_ - _ . _ . . _ _ - . _ _ ._ ._ _ _ - _ _ _ . .- -_ _._ .

,

t

'

.

!~

'

Renort Details

,

81 Conduct of Security and Safeguards Activities '

t

S1.1 Evaluation of Security Continaency Trainina (

) insnection Scone (81700)

!

j TN inspector reviewed the security force's contingency training, equipment, and

facilities. Extensive interviews were held with the security supervisor responsible i for the training pertaining to the outside hostile force threat.

! Observations and Findinas i .

!

Extensive effort has been expended by the security force to assure an adequate response to security related contingencies that the security force may be required l to counter. Procedural guidance and training for the most part was adequate for '

j the appropriate contingencies. However, some training scenarios required a

security post that had to be manned at all times to be abandoned. Contingency equipment required by the security plans was available and functiona The security management team identified several actions that require additional emphasis to assure timely completion. Examples include: operations department  !

support to review and approve target-set analysis and the potential development of ,

a mitigation plan to cope with the loss of some identified equipment; engineering and maintenance department's support to complete some delay mechanisms identified by the security staff, and to move specified containers and barriers to various locations identified by the security staff; and reanalysis of the protective strategy developed by the Security Department's staff to assure that adequate personnel are available to support the protective strategy. Completion of the above identified actions will be monitored as an inspection Followup item (50-346/97005-01(DRS)). Conclusions Contingency training was adequate. Security Department staff identified actions in support of their security contingency plans and capabilities were being implemente Status of Security Facilities and Equipment

]

S2.1 Effectiveness of Security Eauioment Inspection Scone (81700)

l The inspector reviewed the condition of security equipment and facilities required l by the security plan. The equipment observed included, but was not limited to, search equipment, intrusion alarm equipment, alarm assessment equipment, and {

i equipment within the security alarm stations. Facilities observed included the Main .

I

._ . ._ - ..- - . . - . .

.__ _ _ _ . _ _ . _ . _ - _ . . _ _ _ _ _ _ _ . _ _ _ . _ _ _ . _ _ ..___ _.__ _ _ _

t t ,

i

'

k Access Facility and Secondary Alarm Station. The inspector also observed

] scheduled testing of the explosive and metal detectors.

! Observations and Findinas i

j Maintenance support for security equipment was generally very good and -

l compensatory measures were seldom required for excessive periods of time. Two 4 l security system components were exceptions to the favorable trend.

l Between October 30,1996, and February 15,1997, the security force did not have

, a redundant security computer capability as required by Section 6.1.3 of the

'

Security Plan. The exact cause for the extended failure for the backup Central Processing Unit (CPU) was not fully known by personnel providing technical and i

maintenance support for the equipment. This situation causes significant concern because there are no effective compensatory measures for a failed backup CPU and l the potential for a plant safety concern (easy access through computer controlled

,

doors) is evident. Additionally, the need for compensatory measures in case of j security computer failure would have placed excessive demands on the security i forc ,

l J

'

The backup CPU's performance since February 15,1997, appeared to have stabilized. However, continued reliability of the security computer system, I maintenance support for the system, and adequacy and availability of parts and

,

components will be monitored as an inspection Followup Item (50-346/97005-02 ,

j (DRS)). I i l The failure to have a backup security computer capability between October 30,  !

i 1996 and February 15,1997,is a violation of Section 6.1.3 of the licensee's '

] Industrial Security Plan. This licensee identified and corrected violation is being j treated as a Non-Cited Violation, consistent with Section Vll.B.1 of the NRC '

Enforcement Policy (50-346/97005-03(DRS)).

! Excessive compensatory measures were implemented during a month period for

two perimeter alarm system zones which had experienced excessive false alarms 3 (The exact alarm system locations and deficiencies are considered Safeguards j information). During February 1997 two alarm system zones were comoensated

for 16 of 28 days. Although the number of days required to compensate the zones i has decreased in March 1997, the equipment alarm rate for the two zones has been

the highest since the two zones w 3re installed in 1991. The poor performance for j these two zones has been very sinnificant and has occurred within a two month 1 J'

period. The performance of the two specific zones, and the perimeter alarm system l l in general, will be monitored as an inspection Followup item to determine if the !

recent poor performance is an isolated problem or a precursor to greater adverse

performance problems (50-346/97005-04(DRS)).

, The inspector observed scheduled testing of the explosive and metal detectors within the Main Access Facility. The testing completed by the security shift

{1 l

~

!

!

)

- - - -- - .- - . . -- . . - .

_ . _ - _ _ _ . - _ . _ _ . _ _ . _ _ __

,

.

supervisor was in accordance with the appropriate procedures and the test results were correctly documente c. Conclusions Security equipment observed during the inspection was operable and functioned as designed. Maintenance support for security equipment was generally very good and compensatory measures were seldom needed. Exceptions to the very good maintenance support included the backup security computer CPU and two alarm zones of the perimeter alarm system. A Non-Cited Violation was noted in reference j to the security computer CPU issue. Observed testing was conducted in 3 accordance with appropriate procedure S3 Security and Safeguards Procedures and Documentation

. a. Insoection Scone (81700)

The inspector reviewed selected procedures pertaining to the areas inspected and also reviewed appropriate logs, records, and other document b. Observations and Findinas I

Procedures reviewed were well written and adequately described the tasks to be performed. The procedures were routinely reviewed and were changed when new work practices were implemented. Security related records, logs, and other  !

documents reviewed were accurat c. Conclusions

!

Security procedures and records reviewed were adequat i S4 Security and Safeguards Staff Knowledge and Performance a. Inspection Scone (81700)

The inspector toured various security posts and observed performance of dutie Security event logs and other records pertaining to security force performance were also reviewe b. Observations and Findinos Personnel observed on post and interviewed were very knowledgeable of the procedure requirements applicable to their duties. Security forms required by procedures were reviewed and found to be properly completed. The inspector also '

observed the processing of 42 visitors for a plant tour. The processing, search, control, and escort of the visitors were completed in a very effective manne Security supervisors maintained close liaison with security officers and were well lnformed of ongoing security activitie ,__ _ . _ . . _._ _ __. _ _ _ _ . _ _ _ . _ _ . _ . _ __ _ _ _ _ _ .

~

'

l t

Review of security event logs showed consistent good performance by the security

'

l force since the beginning of the year (1997). Security performance goals

. monitored by site licensee management (Windows Program) showed consistent or

"5 improved performance within the past six month : Conclusions

.

. Security officers and supervisors were very knowledgeable of duty responsibilities i

and no deficiencies were noted during post visits and interviews. Security force

performance was very good and consistent.

!

'

f- 87 Quality Assurance in Security and Safeguards Activities i

l Insnection Scone (81700) I

'

l The inspector reviewed the most recent audit report of the security program and '

, other documents and programs used by the security department for problem l l identification and correctio !

i

l Observations and Findinos '

t j The inspector reviewed the most recent Quality Assessment (QA) audit of the  !

security program (Audit AR-97-SECUR -01, dated March 11,1997). The audit was conducted between January 8 and 29,1997. The audit results concluded that the {

! '

j: security program was adequately and effectively implemented in accordance with I

regulatory and site program requirements. Licensee audit results included findings or observations pertaining to stress-test requalification, inadequate vehicle search,

-

l training material, personnel searches, and IDS testing. The security staff was

responding to the audit findings. The scope of the audit was adequate and the j audit results were adequately documented.

j The security staff developed other methods to assess performance and identify potential problems. The methodologies used (e.g. assigned supervisory tours and  ;

monthly evaluation of equipment operability and performance) offered flexibility and l early detection of adverse equipment performance trends. Nuclear Security compliance evaluations were addressed in security procedure IS-DP-00004, effective September 4,199 Conclusions i Self-assessment efforts were effective and offered flexibility . I S8 Miscellaneous Security and Safeguard issues S8.1 (Closed) Insoection Followun item (50-346/96005-05): Security related Updated Safety Analysis Report (USAR) Inconsistencies. The inspector identified a number of administrative type errors in USAR Section 13.7, " Industrial Security," to include: The specified frequency of tours within the security area, access control i

- . . --

.-

,

1 procedures for the marshlands within the site boundary, and incorrectly described management positions.

'

The licensee revised Section 13.7 (Revision 20) of the USAR which now just i references the station Industrial Security Plan and the Nuclear Security Emergency j Contingency Plan for detailed security measures.

(Closed) Unresolved item (50-346/96005-09): Possible compromise of safeguards

) information on a Local Area Network (LAN). The licensee identified a potential

"

vulnerability with the handling of safeguards information on a personal computer i

(PC). The concern was that LAN software applications could create temporary files

of safeguards information that might reside on non-safeguards protected computers i attached to the LAN.

.

) Review of Potential Condition Adverse to Quality Report No. 96-1089 and interviews concluded that all PCs known to have been used for producing safeguards information were checked with the appropriate software and no

safeguards information had been compromised. Production of safeguards information is currently limited to four machines.

i i S8.3 (Closed) Insoection Followuo item (50-346/96005-10: Non-security doors

! controlled by security computer system. About 12 non-security doors were locked l and controlled by the security computer and card readers, in case of computer or card reader failure, entry through the doors would have to be by hard key override

.' or open door commands from the alarm stations. The licensee initiated a joint

operations / security departments analysis to review the need for locking non-l security doors controlied by the security computer system and present the analysis

to the appropriate review board to determine if a potential safety concern existed.

! The joint analysis was presented to the Station Review Board (SRB) on August 2,

! 1996. The SRB agreed with the evaluation recommendation that the non-security l doors continue to be controlled by the security computer.

S8.4 (Closed) Insoection Followuo item (50-346/96005-11): NRC review of security computer transition plan. The licensee's security staff submitted a computer

transition security plan to the NRC for review in September 1996, with a projected site implementation date of March 1957. During this inspection, the security staff advised the inspector that implementation of the security computer upgrade project has been delayed for several reasons. The project implementation date was not known at the time of the inspection. The ecurity computer transition plan will be reviewed, if requested by the licensee, wnen a firm testing and implementation time frame is know S8.5 (Closed) Unresolved item (50-346/96005-12): Waivers for minimum physical and medical requirements for security force members. The Security Force Training and Qualification (SFT&O) Plan allowed the Manager, Security to waive medical and physical fitness requirements for security force personnel and allow them to continue to perform duties. Such waivers did not require evaluation, review, or

. . . -.. - - - - -. - . . - - . - - - . . - - - . - - . - . . .

,

t I

-.

i concurrence by medical services personnel. Additionally, there was no maximum time limit for which such waivers could be ' grante Resolution of this issue included review of past security related licensing documents for the SFT&Q plan to determine when this authority was approved. The review showed that the authority for the Security Director to waive certain physical and medical requirements has been part of the SFT&O Plan since at least 198 S8.6 (Closed) Insoection Followuo item (50-346/99005-13): Second appeal board review of an access authorization denial decision. During review of a contractor employee access denial which occurred in October 1994, the inspector noted that sanctions were imposed for circumstances'that were not addressed by licensee procedures. The initial appeal board review of the access denial upheld the determination of a positive FFD test result and denial of unescorted access. At the time of the decision, the appeal review board personnel were not aware that the positive determination by the Medical Review Officer was not in accordance with 10 CFR Part 26 ce the licensee program procedures in effect at the time of the access denial (Octowr 1994).

On July 18,1996, the access denial appeal board (Nuclear Security Committee)

reviewed the circumstances pertaining to the denial based upon the current knowledge that the Medical Review Officer was in error in declaring the initial FFD specimen a " positive" test result ur. der the licensee's existing criteria at the time of the incident and upheld their initial decision to deny unescorted access to the individual involve S8.7 (Closed) Unresolved item (50-346/96005-14): Chain-of-custody forms. While reviewing corrective actions for closure of a violation, it was noted that an individual designated by a contractor employee had completed a chain-of-custody form for the employee's Fitness-For-Duty (FFD) split urine sample. The processing of a chain-of-custody form by a designee is not addressed by 10 CFR Part 26 or by the licensee's procedures at the time of occurrence (October 1994). Therefore, it was unclear if chain of-custody forms completed with errors need to be retained by the licensee or the laboratory, and if the above actions constituted a violation of 10 CFR Part 2 NRC review of the above circumstances concluded that a violatioa of 10 CFR Part 26 had not occurre S8.8 A discovery of a licensee operating its facility in a manner contrary to the Updated Final Safety Analysis Report (UFSAR) description highlighted the need for a special focused review that compared plant practices, procedures, and/or parameters to the UFSAR descriptions. The inspector confirmed that administrative errors noted in the USAR and addressed in Inspection Report No. 50-346/96005, dated November 19,1996, were corrected (See Section S8.1). The inspector verified that the wording of the USAR was consistent with observed plant practices, procedures, and/or parameters within the areas inspecte . . __

.. - - - . _ .

. . .- - - _-_--_- - - . _ - . - . - . - . - . . - - - . . - - _ .

.

Manaaement Meetinas X1 Exit Meeting Summary The inspector presented the inspection results to members of the licensee management on March 27,1997. Licenses sta.'f members were advised that the inspection would continue onsite through March 26,1997 (Holiday for the licensee) with inspector observations of security shift activities. The Manager, Security wr.s also renuested to provide information pertaining to the maintenance and support effort expended to resolve the problems with the security computer CPU B. The information was received in the NRC Region til Office on April 16,1997. The licensee acknowledged the findings presente The inspector asked the licensee personnel present if the inspection findings discussed during the exit meeting should be considered as proprietary or safeguards information it was agreed that perimeter alarm performance problems and needed security contingency actions would not be safeguards information or proprietary information if addressed in the report in a broad general basis rather than specific detail . ._ . . _ . _ _ . __ . _ _ _ _--_. _ _ - _- ._ . _ ~ ._ _ _ . _ _ _ _ _ . _ . _ .

,

>

,

I

, PARTIAL LIST OF PERSONS CONTACTED i

'

Licensee a

D. Alley, Supervisor, Audit, Quality Assessment 1 L. Hannan, Nuclear Security Analyst f j L. Harder, Supervisor, Access Control

J. Hirsch, Senior Nuclear Projects Coordinator, Engineering and Services

! J. Lash, Plant Manager

,

l R. Mais', Supervisor, Security Shift I J. Michelilis, Manager, Maintenance

! D. Miller, Senior Engineer, Licensing T. Myers, Director, Nuclear Assurance A. Schumaker, Supervisor, Security Support G. Skeel, Manager, Security J. Theisen, Security Analyst J. Vetter, Auditor, Quality Assessment l

J. Waddell, Supervisor, Security Operations l J. Wood, Vice President, Nuclear  !

LBC S. Stasek, Senior Resident inspector

i l

8

. - . _ . . _ __

,

.

.

.

INSPECTION PROCEDURES USED

IP 81700 Physical Security Program For Power Reactors

! IP 92904 Followup - Plant Support

!

{ ITEMS OPENED AND CLOSED OPENED f 50-346/97005-01 IFl Some Planned Security Contingency Actions Need to be

<

Completed 50-346/97005-02 IFl Performance of Security Computer System Will Be Monitored 50-346/97005-03 NCV Backup Security Computer Capability was not Available for Several Months 50-346/97005-04 IFl Perimeter Alarm System Performance Will be Monitored l

CLOSED 50-346/96005-05 lFI Security Related USAR Inconsistencies 50-346/96005-09 URI Possible Compromise of Safeguards information on a Local Area Network (LAN)

50-346/96005-10 IFl Non-Security Doors Controlled by Security Computer System 50-346/96005-11 IFl NRC Review of Security Computer Transition Plan 50-346/96005-12 URI Waivers For Minimum Physical and Medical Requirements For Security Force Members 50-346/96005-13 IFl Second Appeal Board Review of an Access Authorization Denial decision 50-346/96005-14 URI Chain-of-Custody Forms 50-346/97005-03 NCV Backup Security Compute; Capability was not Available for Several Months l

. - - . _ _ - . .. ._ . - - - -. - - . .- . _ . - - .

.

I

"

.

'

LWT OF ACRONYMS USED

,'

IDS Intrusion Detection System IFl Inspection Followup item LAN Local Area Network MAF Main Access Facility NCV Non-cited Violation PC Personal Computer

QA Quality Assessment SRB Station Review Board SFT&Q Security Force Training and Qualification

,

UFSAR Updated Final Safety Analysis Report

USAR Updated Safety Analysis Report

.

PARTIAL LISTING OF DOCUMENTS REVIEWED Security incident Investigation Reports from January 1997 through March 11,1997 i Security Reportable log sheets from October 1996 through February 1997

Maintenance Log Sheet Report for the Period Between January 1997 and March 11,1997

'

Visitor Tour Authorization Forms and Log Entries for a tour of 42 Visitors Completed on March 26,1997 Weekly IDS Operability Test Forms (IS-DP-08917) for the period of January through March 1997 Internal Company Memorandum, Subject: Overview; dated July 25,1996, memorandum dated July 25,1996, Subje :t: Evaluation of Non-Security Doors Controlled by Cardreaders, and memorandum dated August 22,1996, Subject: Station Review Board 14eeting (Addressed evaluation results of nonsecurity doors being controlled by the security computer).

Internal Company Memorandum, Subject: July 18,1996 Meeting Minutes (Confidential);

dated July 19,1996, (Addressed access authorization decisions by the Nuclear Security Committee)

Potential Condition Adverse to Quality Report No. 9S-1089 (Addressed actions taken to prevent compromise of safeguards information processed by limited LAN systems)

Toledo Edison Quality Assessment Audit AR-97-SECUR-01, dated March 11,1997 (Addressed implementation and adequacy of the Nuclear Security and Fitness for Duty programs).

._ - . _ -_ _ - _ _ . _ _ _ _ . . . . _ _ . _ _ _ . _ _ . . _ _ _ _ . . . . _ . _ . _ . _ _ _ .

o

-

i ,

• i

!

Internal Company Memorandum, Subject: Security Self Assessment Program; dated i'

! January 21,1997 (Addressed the self assessment program developed for Nuclear

' Security)

i

'

Procedure IS-DP-OO518, " Reporting Requirements," Revision 9, Effective November 24, i 1996

! Procedure IS-DP-08917, " Weekly IDS Operability Test," Revision 5, Effective March 18, y 1996 l

.

Procedure IS-DP-OO504, " Personnel Control For ProtectedNital Areas," Revision 6, 1 Effective July 29,1996 Procedure IS-DP 08001, " Alarm Response Guidelines," Revision 2, Effective July 20,1994 l Procedure IS-DP-00504, " Personnel Control for Protected and Vital Areas," Revision 6, Effective August 26,1996 )

!

Procedure IS-DP 08003, " Guidelines For Alarm Station Operations," Revision 5, Effective

December 9,1993

!

! Procedure IS-DP 04005, " Operational Test For Walk Through Explosive Detector," Revision i

4, Effective January 20,1997

! Procedure IS-DP 04001, " Operational Test for the Walk Through Metal Detector," Revision i 2, Effective October 3,1996 1

l Procedure IS-DP 04004, " Performance and Operational Test for the Hand Held Metal Detector," Revision 2, Effective November 18,1994 i

i

!

e

,

-

!

i l

!

.

I

i l

f 4

!

J l

B

-

r-