PSM Vulnerabilities in Refinery Operations: Incident Comparison
Two recent incidents point to different but overlapping PSM vulnerabilities: Chevron El Segundo appears most closely tied to process-equipment failure within a jet fuel unit, while the CITGO Lake Charles event points to external natural-hazard exposure of a storage tank during a lightning storm. OSHA’s refinery PSM guidance suggests that both events should be examined through PHA, MOC, and Operating Procedures, with special attention to weather scenarios, emergency shutdown triggers, equipment integrity interfaces, and whether procedures matched actual operating conditions.
Incident comparison
Chevron’s El Segundo refinery fire broke out in the Isomax 7 jet fuel unit in October 2025, and later reports said the unit’s five-month outage was linked to a pipe failure; CBS Los Angeles separately reported Chevron identified a pump failure as the immediate cause of the blaze. Reuters and related coverage indicate no injuries were reported, but the event affected a major Southern California jet-fuel-producing unit and triggered a government investigation. CITGO’s Lake Charles fire occurred in July 2025 when a lightning strike ignited a storage tank at the refinery, and the company said the fire was extinguished the same day with no injuries and no broader refinery disruption. Reporting also indicates the affected tank was in a non-core operating area, but the event still demonstrates a credible weather-driven ignition scenario that refinery PHAs and emergency procedures are expected to consider.
PSM lens
OSHA states that a PHA must identify and evaluate process hazards, prior incidents with catastrophic potential, engineering and administrative controls, consequences of control failure, facility siting, and human factors. OSHA also says written operating procedures for refineries must address normal operations, upset conditions, temporary operations, emergency shutdown, emergency operations, safe work practices, and hazards, including severe weather, loss of containment, fires, and explosions.
For Chevron, the likely PSM focus is whether the PHA adequately captured failure scenarios involving pumps, piping, overpressure, leaks, ignition sources, and emergency operator actions in the jet fuel unit. For CITGO, the stronger PSM question is whether the PHA and operating procedures fully addressed lightning exposure, storm-driven ignition risk, tank protection systems, and operator actions for severe weather and post-strike verification.
Likely gap areas
| PSM element | Chevron El Segundo jet fuel unit fire | CITGO Lake Charles tank fire |
|---|---|---|
| PHA | Possible gap if the hazard review did not fully evaluate pump or pipe failure, leak escalation, ignition potential, or consequence severity in the Isomax unit. | Possible gap if lightning was treated as a low-detail external event rather than a specific tank ignition scenario with defined safeguards and recovery actions. |
| MOC |
Potential issue if prior equipment changes, repairs, operating envelope changes, or deferred corrective work altered risk without a fully documented hazard review. OSHA notes P&ID inaccuracies and unresolved deficiencies often indicate MOC weakness.
|
Potential issue if tank service changes, protection-system modifications, inspection interval changes, or storm-hardening decisions were made without formal MOC and updated risk review.
|
| Operating Procedures |
Key question is whether startup, upset response, emergency shutdown, and leak/fire response procedures were current, realistic, and practiced by operators.
|
Key question is whether severe-weather procedures identified clear triggers for tank monitoring, isolation, area control, and post-lightning inspection before return to normal status.
|
| Maintenance / integrity interface | Though not one of the three requested elements, the reported pump or pipe failure makes maintenance protocols central to the PSM review because OSHA flags unresolved equipment deficiencies, inadequate inspection, and weak repair practices as major refinery problems. | Weather protection depends on maintained lightning protection, grounding, bonding, roof/drainage condition, and tank inspection practices; weak maintenance could turn a foreseeable storm hazard into an ignition event. |
Audit checklist
PHA: Verify that the unit or tank PHA includes credible equipment-failure and external-hazard scenarios, including leak/fire escalation for process units and severe weather/lightning for storage assets.
Confirm that prior similar incidents, near misses, and industry events were reviewed and that recommendations were formally resolved, tracked, and closed.
Check whether safeguards were evaluated by the hierarchy of controls rather than relying mainly on administrative actions.
MOC: Review all recent changes to equipment, process conditions, throughput, temporary repairs, instrument settings, and inspection intervals for formal MOC documentation.
Confirm P&IDs, operating limits, alarm logic, and maintenance instructions were updated after each change before startup.
Test whether deferred repairs or temporary operating changes required risk review but bypassed MOC.
Operating Procedures: Confirm written procedures cover normal, startup, shutdown, upset, emergency shutdown, and emergency operations for the affected system.
Verify severe-weather triggers are explicit, including lightning/storm hold points, operator responsibilities, and post-event inspection requirements.
Check whether operators actually follow procedures in the field and whether annual and event-based reviews are documented.
Maintenance protocol checks: Examine work orders, overdue corrective actions, and repeat failures involving pumps, piping, valves, tank appurtenances, grounding, alarms, and fire protection systems.
Verify inspection locations, frequencies, corrosion monitoring, and repair acceptance criteria align with selected RAGAGEP and current service conditions.
Review whether any “temporary” repair remained in service without engineering review, expiry control, or compensating safeguards.
Recommended improvements
Refinery operators should strengthen PHA quality by explicitly modeling external hazards, such as lightning and severe weather, alongside traditional internal process failures, and then linking each scenario to engineered safeguards, alarm response, and emergency decision points. They should also tighten MOC discipline for equipment repairs, altered operating envelopes, temporary bypasses, and inspection-frequency changes, because OSHA identifies these documentation and follow-through failures as recurring refinery weaknesses.
Operators should update operating procedures so that severe-weather actions, leak isolation, emergency shutdown criteria, and post-event restart checks are specific rather than generic, and they should validate those procedures through drills and event-based reviews. Finally, they should integrate maintenance and PSM more closely by prioritizing chronic equipment defects, verifying lightning protection and tank grounding systems, improving the rigor of piping and pump inspections, and preventing deferred maintenance from becoming an unmanaged process risk.
At RskLess, our goal is to help you bridge PSM program gaps, ensuring you manage risk effectively and stay safer than yesterday.
At RskLess, our goal is to help you uncover hidden hazards, ensuring that your risk assessments are thorough and well understood to help you be safer than yesterday.
