Refinery power loss: shutdown, flaring and the path to a safe restart

What happened at Joliet

At about 3:30 p.m. Central Time on 13 September 2026, a power outage led to a plant-wide shutdown at ExxonMobil's Joliet refinery in Illinois. The company said power was restored around 7 p.m. and the refinery's safety flare was activated during the upset.

On 14 September, ExxonMobil was assessing site status and investigating the cause. It also reported air monitoring and contact with the appropriate agencies. No detailed monitoring results or technical cause were public at revalidation.

IIR Energy told Reuters that units were being stabilized and estimated normal service by the end of the week. That is an industry estimate, not an ExxonMobil commitment or a unit-by-unit schedule.

Direct answer: restored electricity does not mean a ready refinery

Voltage may return in seconds or hours, but the process must demonstrate a known condition. A power loss does not erase pressure, heat, chemical inventory, reactions, levels or stored mechanical energy. It may also interrupt equipment that normally controls those variables.

Restart is therefore not the reverse of a blackout. It is a process decision supported by reliable information, available equipment, correct line-up, satisfied permissives, current procedures and prepared people.

How a utility loss can cascade

Power, controls, instrument air, cooling water, steam, fuel, lubrication, seals, pumps, compressors, ventilation, detection and communications form an interdependent network in a continuous plant. One failure can affect other functions.

This is a conceptual chain. Public information confirms a power loss at Joliet, not the loss of every utility or any particular instrument. A reconstruction would require electrical and process records that are not public.

Normal shutdown, emergency response and ESD differ

A normal shutdown follows a planned sequence. An upset response may mix operator action and automatic protection. An emergency shutdown system moves defined parts of a process to predefined states when criteria are met.

Safe does not mean every valve closes: some close, others open, and selected equipment may need to continue running. Public reporting confirms a plant-wide shutdown, but not which actions were automatic or manual.

Why flares appear during upsets

A flare receives streams that must be relieved or depressurized and routes them to controlled combustion. Conceptually, the path may include relief or blowdown devices, a header, liquid separation where applicable and the flare itself.

Flaring does not mean the refinery itself was on fire. Nor does it prove excess pressure across the whole site. Unit-level data would be needed to identify which streams reached the system and why.

Dark smoke does not diagnose the cause

Flame and plume appearance depends on flow, composition, air mixing, steam or air assist and combustion conditions. A dark plume may reflect sootier combustion during a period, but it cannot identify the electrical cause or establish an environmental violation by itself.

The company said air monitoring was underway. Without published results, monitoring cannot be turned into a claim that air was safe or normal everywhere and at all times.

Emergency power protects essential functions, not full production

Industrial designs may use UPS, batteries, generators or other sources for selected functions such as SIS/ESD, control and logging, fire and gas detection, alarms, communications, emergency lighting, critical actuators, lubrication, seals and containment systems.

These are conceptual examples, not Joliet's load list. Emergency sources have finite capacity and autonomy; their purpose may be to reach and maintain a safe state rather than power normal production loads.

Cogeneration does not make a refinery blackout-proof

ExxonMobil's fact sheet confirms cogeneration at Joliet. It does not show that cogeneration failed, was available, could support the full refinery or could island from the grid. Fault location, synchronization, black start and internal distribution are unknown.

Redundancy creates resilience only when alternatives are independent, capable, tested, available and protected from common cause. Counting sources without mapping dependencies proves little.

Stabilized does not mean producing

Stabilization brings pressure, temperature, level, inventory, circulation and equipment to controlled, understood conditions. It may mean holding a unit safely down—not returning it to service.

After an upset, teams may need to examine equipment, instruments, valves, rotating machinery, seals, lubrication, utilities, line-ups, permissives, alarms and protection layers. The exact scope belongs to each unit and is not a remote restart recipe.

Restart is a demanding transient operation

Startups and shutdowns pass through temperature, pressure, composition and flow combinations unlike steady operation. Equipment enters service in sequence, inventories change, alarms may accumulate and teams need a shared understanding of plant state.

CSB lessons emphasize current procedures, communication, training, management of change and readiness reviews during transients. Those are general lessons, not evidence of a Joliet deficiency.

Readiness and pre-startup review

A readiness review asks whether equipment is fit, procedures are available, critical actions are closed, training is complete and safeguards are operable. Under OSHA PSM, a formal PSSR is required in defined circumstances, including new facilities or qualifying modifications.

Public evidence does not establish that the Joliet event alone created a specific regulatory PSSR duty. The engineering principle remains sound: do not restart until affected conditions are verified.

Facts, estimate and open questions

Published facts are the outage timing, restoration around 7 p.m., plant-wide shutdown, flare activation, site assessment, cause investigation, air monitoring and agency contact.

IIR's stabilization and end-of-week outlook is attributed industry information. The cause, external or internal origin, trip sequence, flaring units, cogeneration status, emergency sources, detailed air data, damage, repairs and official unit schedule remain unknown.

Questions that still need evidence

Questions define the evidence needed; they are not accusations.

• Where did the electrical interruption originate and how far did it propagate?
• Which units and protection layers acted, and in what sequence?
• Which streams reached the flare?
• Which essential sources remained available?
• What was cogeneration status, without presuming its role?
• What checks preceded each restart?
• What do the air-monitoring records show?

Conclusion: restored power is only the beginning

The Joliet event still has no publicly determined cause. The defensible picture is of a refinery that lost power, shut down, used a safety barrier and began assessing its state.

Electrical availability, safe condition, stabilization and operational readiness are separate milestones. Restart may begin after power returns, but it should progress only when data, verification and clear authority show that the plant is ready to change state.