A Hierarchy of Controls Analysis (HCA) is a highly structured risk-mitigation methodology. It is specifically required under CalARP Program 4, which applies to petroleum refineries operating within California.
While a standard Process Hazard Analysis (PHA) identifies risks and lists existing safeguards, an HCA forces a facility to systematically evaluate whether hazards can be eliminated or reduced using the most reliable, inherently safer design methods before relying on add-on equipment or human intervention.
During an HCA, a specialized analysis team will attempt to apply the highest-order controls possible and provide documented, legal justification if they are deemed infeasible. The hierarchy is structured as follows:
- First-Order Inherent Safety Measures:
Completely eliminating the hazard or substituting a hazardous material with a non-hazardous or less hazardous alternative. - Second-Order Inherent Safety Measures:
Redesigning the process to minimize, moderate, or simplify it (e.g., significantly reducing chemical inventories or lowering operating temperatures and pressures). - Passive Safeguards:
Physical structures or designs that mitigate a hazard without requiring moving parts, sensors, or power to function (e.g., blast walls, physical separation, containment dikes). - Active Safeguards:
Engineering controls that require detection and mechanical action to function (e.g., Safety Instrumented Systems, pressure relief valves, automated emergency shutdown systems). - Procedural Safeguards:
Administrative controls that rely solely on human consistency and action (e.g., standard operating procedures, manual block valves, personal protective equipment).
How HCA Differs from EPA STAA
An HCA is essentially California’s stricter, more prescriptive application of the federal “Safer Technologies and Alternatives Analysis (STAA)”.
While the federal EPA Risk Management Program required an STAA to identify inherently safer technologies, CalARP’s HCA framework is rigidly codified. If a facility under CalARP Program 4 determines that a First- or Second-Order Inherent Safety Measure is “infeasible” and chooses to rely on a lower-tier safeguard (such as a gas detector or operator intervention), the HCA report must contain formal, written justification proving exactly why the higher-order controls were rejected. Local regulatory agencies (CUPAs) heavily scrutinize these justifications during audits.