Two reactors shut down because somebody held a candle to a wall.

•  A workman tested a seal with a lit candle.

•  The candle set fire to the seal itself.

•  It burned for seven hours in the cable trays.

•  Every plant in the country got new rules.

Browns Ferry, near Decatur, Alabama, holds three boiling water reactors, each designed to produce 1,067 megawatts. On 22 March 1975 Units 1 and 2 were running and Unit 3 was still being built. Units 1 and 2 shared a single control room, with a cable spreading room directly beneath it carrying every signal between that room and the plant.

Men were sealing air leaks around the cable penetrations in the wall between the Unit 1 reactor building and that spreading room. A pressure difference is held between the two sides, so air moves through any gap that is left. The way to find a gap was to hold a lit candle near the wall and watch the flame bend.

Nothing about the plant was irregular. The construction permit had been issued in 1966 and the operating licence reviewed between 1970 and 1972, both on the knowledge of the day. The general criterion on fire was met. No line in it said what a leak test could use as its instrument.

Every row below comes from one document: the review group report, NUREG-0050, written by the group the Nuclear Regulatory Commission appointed four days after the event and published in February 1976 under Stephen H. Hanauer. Column one is not a time. It is the thing picked up and used against the fire, in the order the report records each one being tried.

Read the bottom row against all the rest. Water was held back for more than five hours, on the general principle that water and electrical cables do not mix. When it was finally turned on, the report says the fire was out in a few minutes. Water was the answer all along.

Four things stood behind this, and the foam was only the first of them.

•  The instrument was an open flame. The report names the specific cause as a combustible material that was not in the design together with an unnecessary ignition source, and it calls that source the candle's use as a leak detector. Two days later a bulletin went to nine named plants on the control of ignition sources.

•  The material was never in the drawings. The polyurethane foam was not part of the original design. It was being stuffed into holes to stop leaks. Later tests showed seals containing it are highly flammable.

•  The draught that found the leak also fed it. The pressure difference between the two sides is what made the leak findable at all. The same flow pulled the flame into the foam and then fanned what it had lit.

•  The detectors answered a different question. Smoke in the spreading room did not reach the detector there, probably because the normal air flow carried it the other way. The control room units were an ionization type that did not respond to this smoke.

Nobody on site was seriously hurt, and no radioactivity above normal operating amounts was released. Both reactors were shut down and their cores kept covered by ordinary cooling equipment, because the systems held back for an accident were all out on Unit 1.

The plant took the damage. The operator counted 117 conduits, 26 cable trays and 1,611 cables damaged or assumed damaged, in a space about forty feet by twenty. Unit 2 was out of service for most of a year.

The rulebook took the rest. In November 1980 the agency published Section 50.48 and Appendix R, which is why separation of shutdown equipment is now written into the design of every plant. A second route, built on measured likelihood, followed in 2004.

•  The instrument can be the hazard. A candle is a good way to see which way air moves. It is also a flame held against the one material nobody had tested for how easily it lights.

•  What is not on the drawing is still in the building. The foam was a field fix for a problem the design had not anticipated. It was in the wall in quantity, and no document described it.

•  A detector answers only the question it was built for. The units in the control room sensed one kind of product of combustion. They worked exactly as designed and told nobody anything.

•  The obvious remedy was the one held back. Water was the answer for five hours before anyone would use it, and the reason was a rule of thumb nobody had checked against this case.

I watched a desk in 2001 hold a position open three days because the only man who could approve closing it was the man whose model had put it on.

Gold settles that differently: a bar is checked by weighing it, and the test leaves it exactly as it was.