Two contractors died last week during preventive maintenance at a refinery in Greece, and there was no fire. On plant under maintenance, the fire and gas scope is the one safety deliverable procured as engineering, while the hazard that actually kills the workforce — stored pressure and the integrity of an isolation — is procured as a procedure. That asymmetry is a contracting defect, not a site behaviour problem.
What happened, and what did not
On 9 October, during a preventive maintenance operation at a refinery west of Athens, a pressurised gas system was being worked on. The national broadcaster reported that depressurisation of the system tore a metal cap off the line. Two men employed by an external contractor were critically injured. One died the same day; the second died two days later. The operator reported no fire and no damage to the facility, and the refinery continued to run. The cause is under investigation.
Read that sequence back. A fatal event, inside the fence, on a hydrocarbon plant, during planned work — and every instrument the fire protection design would have brought to bear was irrelevant. No detector would have initiated. No deluge would have helped. The energy was mechanical, the exposure was a couple of metres away, and the event was over before any system could respond.
That is not an unusual shape for a maintenance fatality. In February the US Chemical Safety Board published its final report into a release at a refinery in Texas that killed two contract workers. A maintenance crew opened a flange on hydrogen sulphide piping, having intended to open a different flange about five feet away. More than 27,000 pounds of hydrogen sulphide escaped over nearly an hour. Again, no fire. The CSB found the plant had no reliable way to positively identify the correct flange — drawings and flange lists could not distinguish nearly identical piping, and the tag on the correct flange was out of view — and that one broad permit covered several jobs of differing hazard with no clear hold points.
In each case the fatal mechanism was the opening of containment that was not in the state the crew believed it was in.
The Gulf is about to run a great many of these windows
This is not a European problem. Figures reported on 8 October put GCC project awards at $204.1bn for the first nine months of 2026, with gas awards up 59.9% to $13.5bn and chemicals awards at $3.5bn — close to five times the prior year. Gas processing and petrochemicals are where the regional capital is going.
Every one of those trains eventually enters a maintenance cycle. The commissioning workforce becomes the turnaround workforce, with the plant live on the other side of a block valve. The frequency of the activity that killed two men last week tracks how much new process plant the region is building now.
One hazard is engineered, the other is supervised
Look at how the two are bought on the same brownfield package.
The fire and gas scope arrives as engineering: a design basis, layout drawings, hydraulic calculations, equipment schedules, a cause-and-effect matrix, a document register, a named technical reviewer, a witnessed functional test, a signed handover.
Isolation arrives as paperwork: a method statement, a permit form, a lock-out register, a toolbox talk. No drawing register, no calculation, no independent technical review, no witnessed test of the as-built arrangement against the configuration the crew will actually face.
Yet positive isolation is a designed property of the plant, not a behaviour. Whether there is a double block and bleed on that line. Whether there is a drain at the low point and a vent at the high point of the section being broken. Whether permanent pressure indication exists downstream of the block, so a crew can prove zero before breaking containment rather than infer it from valve position and elapsed time. Whether the blind list reconciles line by line against the P&ID. Whether two adjacent lines of the same size and service can be told apart at the flange by anything other than someone’s memory of a drawing.
None of that is site discipline. It is drawings and tags, decided in engineering and installed by a contractor. Where they are absent, the permit is compensating for an engineering omission, and its only mechanism for doing so is the attention of one man standing at a flange at the end of a shift.
The interface makes it worse. On a typical scope split the isolation philosophy sits between process engineering, which owns the P&ID, operations, which owns the permit system, and HSE, which owns the procedure. Three owners is no owner. The fire and gas package gets a technical reviewer and a hold point; the isolation arrangement gets a signature.
Then the second-order effect, which matters more than either. A complete fire and gas scope reads like safety assurance and gets cited as evidence that the shutdown is covered. It is evidence of nothing about it. A fire protection system is a mitigation barrier; a maintenance fatality is a prevention failure. A thick document on one side does not cover a missing one on the other.
What this means in practice
Five questions establish whether a brownfield scope has this right — worth asking of the next package and of any outage running now.
- Is the isolation and depressurisation arrangement an engineering deliverable with a document number and a technical reviewer, or a line in the contractor’s method statement?
- For each line that will be broken: can the crew prove zero pressure at the point of work with permanent instrumentation, or only infer it from valve position and elapsed time?
- Can two adjacent lines of the same size and service be distinguished at the flange by permanent, legible, in-view identification, without reference to a drawing held in an office?
- Does each permit cover one job with one hazard, and does it contain hold points that stop work until an operator is present?
- When the fire and gas scope is offered as evidence that the maintenance window is safe, which barrier is it — prevention or mitigation — and what covers the other one?
A fire protection system earns its cost on the day containment is lost. Nothing in it prevents containment from being opened by hand at the wrong flange, or at the right flange on a line that was never actually depressurised. That requires a plant designed to be isolated, and a contract that buys the design rather than assuming the procedure.
Mainstream Petrochemical Instruments FZE provides fire safety engineering for high-hazard industrial facilities. This article is general technical commentary and is not a design recommendation for any specific facility.
Sources
- One person dies, one in serious condition after Greek refinery incident — Reuters via ThePrint
- Toll in Greek refinery accident rises to two — Neos Kosmos
- One worker died after an explosion at the refinery — Athens News, citing ERT
- CSB releases investigation report on fatal hydrogen sulfide release at the PEMEX Deer Park refinery — US Chemical Safety Board
- GCC project awards rise on gas and chemicals surge — Arab News