Fire protection during a shutdown is a contract gap, not a site discipline problem

In the ten days to 11 September, the industrial fires that killed people happened on plant that was shut down or under repair. The ones on plant that was operating were contained in minutes. That is not a coincidence, and it is not a story about site discipline — it is a gap in how fire protection is scoped, sequenced and handed over.

Ten days, two states of plant

On 8 September a fire started in the high vacuum section of a refinery in Mexico while the plant was going through shutdown procedures ahead of scheduled maintenance. It originated in a heater coil, was extinguished in under six minutes, and injured nobody. On 9 September two 60-tonne product tanks burned at a refinery in Kazakhstan — roughly 120 tonnes of product and more than 200 square metres of fire. Portable monitors and foam held the three adjacent tanks. Again nobody was hurt.

The same week produced two very different outcomes. On 9 September an explosion tore through part of a hydroelectric station in southern Switzerland that was being modernised; new electrical equipment had recently been installed in the section where it happened. Two workers died, one of them an 18-year-old apprentice. On 10 September a bulk carrier under repair at a Chinese shipyard caught fire with 42 people aboard. At least 25 of them were killed.

Two of those facilities are process plant and two are not, which is the point. The variable separating the outcomes is not the industry and not the hazard inventory. It is whether the facility was in the state its fire protection was designed, tested and staffed for.

Every variable moves the wrong way

A unit under turnaround or construction is a different fire problem from the same unit in operation, and almost nothing about the change is favourable:

Ignition sources multiply. Hot work, temporary power, grinding and cutting, and equipment being energised for the first time in places that normally have none.
The fuel does not leave with the process. Residues, sludge, pyrophoric deposits and trapped hydrocarbon remain in equipment the schedule describes as empty.
Compartmentation is opened. Penetrations are cut, doors removed, fire stopping stripped for cable pulls — and restoration is a punch-list item rather than a milestone.
Fire water is sectioned for tie-ins, usually at the point where the work is concentrated.
Detection is inhibited to prevent spurious trips, and inhibits outlive the job that justified them.
Escape routes are obstructed by scaffolding, and the people using them arrived last week.
Headcount rises sharply. The vessel in the Qingdao shipyard had 42 people aboard — several times a normal complement.

None of this is exotic, and every project knows all of it. The question is who is accountable for the sum of them on any given day.

The gap is contractual

On a new build, permanent fire protection is commissioned late, because it is not needed until there is something to protect. Until then, protection is whatever the construction contractor’s HSE plan provides — permits, watches, extinguishers, a temporary main if somebody specified one. The operator’s emergency response is not yet mobilised. The result is a long period in which the site carries its highest transient hazard against its thinnest protection, managed by two different organisations under two different documents.

On a turnaround the failure is the mirror image. The permanent system is nominally in service, so protection is not treated as an open question — while the impairment register grows daily. Where impairment approval is delegated to whoever is on shift, that register stops being a control and becomes a log.

The underlying defect is the same in both cases. The contract defines fire protection performance for the operating plant. It rarely defines it for the plant as it exists during the work, and it rarely names one accountable party for that state.

Sequence protection against the hazard, not against the programme

The correction is a sequencing discipline, and it belongs in the contract rather than in a site procedure.

Mechanical completion and protection-in-service are different milestones. Schedules track the first. What matters is the second, and specifically its position relative to the hazard it exists to cover: fire water available before hydrocarbon is introduced; detection and alarm live before equipment is energised for the first time; fire stopping restored and verified before an area is handed to the next trade; foam and gaseous systems proven on the agent and the devices actually installed, not on the ones in the specification.

Written that way, protection becomes a predecessor to the hazard-introducing activity rather than a follower of the construction sequence. That one change converts fire protection from a punch list into a hold point — and a hold point is the only form of control that survives schedule pressure.

The two contained fires above are what the discipline looks like when it holds. A heater coil failure extinguished in six minutes, and a tank fire that did not reach the three tanks next to it, are not luck. They are protection and response that were live, matched to the state the plant was actually in, and owned by somebody.

What this means in practice

Four questions establish whether an EPC scope or a turnaround plan has this covered:

For each phase — construction, tie-in, commissioning, turnaround, decommissioning — what is the defined fire protection state, and which single organisation owns it?
Who approves an impairment, what compensating measure is mandatory while it stands, and what is the maximum duration before it escalates?
Which protection systems are hold points for hazard introduction, and do those hold points appear in the schedule or only in the fire safety philosophy?
On any outage running now: how many impairments are open, and how many have outlived the work that caused them?

A fire strategy describes either a plant that does not exist yet or one that is running normally. The weeks when neither is true are the weeks that fill incident reports.

Mainstream Petrochemical Instruments FZE provides fire safety engineering for high-hazard industrial facilities. This article is general technical commentary and is not a design recommendation for any specific facility.