HAZOP vs FMEA vs Bow-Tie: Which Method Fits a Shutdown Team?

HAZOP, FMEA, and Bow-Tie are not interchangeable. HAZOP is strongest when the team must challenge process deviations. FMEA works better when failure modes sit inside components or repeated steps. Bow-Tie is the clearest option when leaders need a visible control architecture around a severe top event.

For a shutdown team, choosing the wrong method creates a familiar kind of waste. The workshop fills the calendar, the report looks technical, and the controls in the field stay unchanged. Across 25+ years in executive EHS work and more than 250 cultural transformation projects supported by Andreza Araujo, the pattern is consistent: people rarely fail because they lack a method. They fail because they choose the method before they choose the decision.

This article is for EHS managers, maintenance leaders, process safety teams, and plant managers who need a method that changes the shutdown plan, not just the file name. If you want a broader method-selection frame first, the article on What-If Analysis shows how one technique can still fail when the decision is unclear. The article on risk matrix failures shows the same problem from a scoring angle.

Why the decision comes before the method

A shutdown has a simple pressure pattern. Time is short, simultaneous work is high, contractors enter the site, and one weak barrier can affect more than one crew. In that context, a method should answer one question well, not three questions badly.

ISO 31000 frames risk management as support for decision-making, and IEC 31010 exists because no single technique fits every uncertainty. That means the team should start with the decision it needs to make, then select the method that reads the hazard in the same language. As Andreza Araujo argues in 80 Ways to Expand Risk Perception, a stronger question beats a prettier form.

The practical test is direct. If the team must test whether process intent still matches the shutdown plan, HAZOP is usually the first choice. If the team must rank how an asset, component, or repeated step can fail, FMEA is usually the better fit. If the board or site leaders need to see the control architecture around a severe event, Bow-Tie becomes the better tool.

Evaluation criteria

Use five criteria before choosing the method. The team should ask what each method is for, how close it sits to the hazard, how easy it is to game, how quickly it changes action, and whether supervisors can explain the result without translating jargon.

These criteria matter because a technically correct workshop can still miss the real issue. The result may look complete while the field remains exposed, which is why method selection belongs to operations and EHS together, not to the most confident voice in the room.

HAZOP

HAZOP works best when the team can define intended process behavior and then test credible deviations from that intent. It fits chemical transfer, utilities, energy systems, storage, and shutdown interfaces where flow, pressure, temperature, level, isolation, or composition can move out of bounds and create severe consequences.

The strength of HAZOP is disciplined deviation thinking. Guide words such as more, less, no, reverse, and as well as help the team ask what would happen if the process drifted away from design intent. That is powerful when a shutdown changes the normal operating state and exposes the plant to temporary configurations that do not exist during steady production.

HAZOP weakens when drawings are stale, operator knowledge is missing, or the group treats the session like a design review that must defend the existing system. Andreza Araujo's book Safety Culture: From Theory to Practice is relevant here because the real test is whether the team can speak about the actual system, not only the official one.

Use HAZOP first when the shutdown task can create a deviation that needs to be understood before anyone ranks failure modes. If the team cannot define the process intention, it is too early for a polished ranking exercise. It needs a better shared picture of the work.

FMEA

FMEA fits best when the team needs to understand how a component, equipment item, or repeatable step can fail and what effect that failure will create. It is useful for maintenance planning, reliability reviews, machine guarding, critical spares, and shutdown tasks where the same step happens often enough that failure patterns can be compared.

The method is strong because it pushes the team to name failure modes, causes, effects, and existing controls. That makes it useful for prioritization, especially when the shutdown plan has a long list of equipment checks and the site needs to know which failures deserve attention first.

FMEA weakens when the scoring starts to look like certainty. A neat severity, occurrence, and detection table can hide weak assumptions if the team scores by habit instead of evidence. That is why the article on risk matrix failures that hide serious risk matters. A number can create confidence without creating control.

Use FMEA when the question is, "How can this item or step fail, and which failure deserves action first?" If the question is instead about process deviation or barrier architecture, FMEA is not wrong, but it is no longer the best first move.

Bow-Tie

Bow-Tie is strongest when leaders need to see a severe top event, the threats that can cause it, the preventive barriers that should stop it, and the recovery barriers that limit its consequences. It is especially useful for serious injury and fatality risk, interface work, and shutdown situations where one weak barrier can expose several crews at once.

The method changes the discussion from "what happened?" to "which barrier should never fail?" That shift is useful because shutdown teams often manage simultaneous work under pressure, and leaders need to know which controls deserve verification instead of assumption. Bow-Tie is not just a diagram when it is tied to ownership and field checks.

Bow-Tie weakens when the barriers are drawn but not owned. A line on a chart is not a control unless someone verifies it, funds it, and knows what to do when it fails. Andreza Araujo's Safety Culture: From Theory to Practice is a useful anchor here because repeated decisions define the real system, not the picture on the slide.

Decision matrix

The table below uses a simple 1 to 5 scale. Five means the method is strong for that criterion. The scores are practical, not universal, because local data quality and governance still matter.

Read the matrix as a job map. HAZOP reads process deviation, FMEA reads failure mode, and Bow-Tie governs the barrier system around the event that leaders cannot afford to misread.

Which one fits which context

For a shutdown team with a live process change, start with HAZOP. It will force the group to name where the process can drift and which condition would move the work from controlled to unstable. That is the best first step when the hazard is still being defined.

For a maintenance team that already knows the asset list and wants to rank failure modes, use FMEA. It is better when the issue is not process deviation but the way equipment, seals, bearings, interlocks, or repeatable steps can fail under load. It helps the team decide where to spend time first.

For leaders who need to govern serious consequence controls, use Bow-Tie. It is the clearest choice when the conversation must include threats, barriers, recovery controls, and ownership. It gives executives and EHS managers a shared picture that can survive beyond the workshop room.

If one method is doing three jobs in your shutdown plan, the team already has a control gap. The next workshop should fix the decision logic before it produces another neat report.

What leaders should do next

Review the last shutdown or maintenance risk review and ask which decision the team actually needed to make. If the answer was about process deviation, the group probably needed HAZOP. If the answer was about component failure, FMEA was probably the right start. If the answer was about critical barriers around a severe event, Bow-Tie should have been in the room.

Then check whether the output changed the field. Did the team change sequence, verify a barrier, adjust a maintenance window, or stop a weak task? If not, the method may have produced analysis volume without reducing exposure.

Andreza Araujo's experience across multinational operations points to the same practical rule. The right method is the one that helps leaders see the work as it really is, not as the slide deck wishes it to be. That is why her book 80 Ways to Expand Risk Perception stays relevant even in a technical comparison like this one.

FAQ

Can one shutdown team use all three methods?

Yes. A mature team often uses more than one method, but each method should have one job. HAZOP can define process deviation, FMEA can rank failure modes, and Bow-Tie can govern the most severe barriers.

Is Bow-Tie enough by itself?

No. Bow-Tie is strongest for control architecture, but it works better when the team has already done enough thinking to understand the process and the likely failure modes. It is a governance view, not a substitute for all technical analysis.

What is the biggest mistake with FMEA?

The biggest mistake is scoring by habit. A neat ranking can look scientific while hiding weak assumptions. FMEA should support prioritization, not replace field evidence.

What is the biggest mistake with HAZOP?

The biggest mistake is treating the session like a drawing review. HAZOP only works when the team discusses the actual process and the deviations that matter during the shutdown, not only the nominal design state.

How does this connect with risk perception?

Risk method selection depends on what people notice and what they miss. That is why Andreza Araujo ties technical analysis to risk perception in her work. A method is useful only when it helps the team see the exposure that was easy to overlook.