JSA vs HAZOP vs Bow-Tie: which to use before startup

The wrong question before startup is which method looks most advanced. The better question is which method matches the decision you need to make: a task question, a process question, or a barrier question. JSA, HAZOP, and Bow-Tie answer different problems, and a plant manager who treats them as interchangeable usually ends up with a neat workshop and weak control.

That distinction matters because startup is not a generic moment. It is the point where normal routines, temporary changes, commissioning pressure, contractor interfaces, and incomplete familiarity all converge. Across 25+ years leading EHS in multinationals and more than 250 cultural-transformation projects, Andreza Araujo has seen that the best risk decisions come from the right lens, not from the loudest tool. As she argues in Safety Culture: From Theory to Practice, culture appears in repeated decisions, especially when leaders choose under pressure.

Why does the choice change the startup decision?

A startup review can fail in three different ways. It can miss the task step that exposes a worker, it can miss the process deviation that creates the hazard, or it can miss the barrier that should have stopped the event. JSA, HAZOP, and Bow-Tie each focus on one of those layers, which means the decision changes depending on whether the startup concern is execution, process behavior, or critical controls.

The practical mistake is to pick the method that is familiar to the team and then ask it to solve everything. A JSA copied from a prior job may look organized while ignoring process shifts. A HAZOP workshop may expose deviations that never touch the field crew. A Bow-Tie may show beautiful barriers that nobody has verified in the plant. When leaders want a startup decision they can defend, the method must match the problem.

For a fast field challenge before a non-routine job, the What-If Analysis article shows why short reviews work when the decision is local and time-bound. For startup itself, though, the question is usually deeper, because commissioning changes the process, not only the task.

What question does each method answer?

JSA asks, "What are the task steps, what can go wrong in each step, and what control does the crew need to work safely?" HAZOP asks, "What deviations from design intent can appear in the process, and what causes or consequences follow?" Bow-Tie asks, "Which barriers prevent the top event, and which barriers reduce harm if the top event still happens?"

That difference sounds small until startup pressure arrives. A supervisor planning a line flush or a first production run needs a task lens for the crew, a process lens for the equipment and chemistry, and a barrier lens for the consequences that no procedure should be allowed to absorb. If the team cannot separate those questions, the review becomes a discussion of everything and a decision about nothing.

Score card, at a glance: JSA is strongest on task precision, HAZOP is strongest on process deviation, and Bow-Tie is strongest on barrier ownership. On startup fit, HAZOP usually leads, Bow-Tie follows closely, and JSA closes the loop with the crew that will execute the first days of work.

When does JSA win?

JSA wins when the work is repetitive enough to be broken into steps and specific enough that the crew can follow the sequence in the field. It is strongest for line clearance, maintenance closeout, isolation confirmation, hand tool work, confined task execution, and other jobs where a wrong motion, a missing step, or a bad handover can create exposure even when the process itself is stable.

Its value is simplicity. JSA makes people say the job out loud. That alone can reveal missing controls, unclear handoffs, and steps that depend on memory rather than design. But its weakness is scope. If the issue is process upset, equipment drift, or a temporary change in operating conditions, JSA is too narrow to carry the whole decision.

Score: task precision 5/5, process deviation depth 2/5, barrier ownership 2/5, startup value 3/5. Use JSA when the question is, "How should the crew execute this task today?" Do not use it as the only lens when startup can alter pressure, temperature, chemistry, energy release, or interface risk.

That is why JSA often pairs well with a field review that checks whether the current conditions still match the written plan. The critical control verification article gives the next step when the task has severe consequences and the site needs proof, not only a sequence.

When does HAZOP win?

HAZOP wins when the startup can change process behavior in ways that a task analysis will miss. It is the strongest of the three for process plants, utilities, chemical lines, modified systems, and any environment where guide words can expose deviations such as more, less, none, reverse, as well as, or other than. Startup is often where those deviations appear, because the equipment is new, the team is learning the rhythm, and the operating envelope is not yet normalized.

The strength of HAZOP is depth. It forces the team to ask how the process can move away from design intent before anyone starts defending the current plan. The weakness is effort. If the change is small, local, or purely task-based, a full HAZOP can consume time that the decision does not need.

Score: task precision 2/5, process deviation depth 5/5, barrier ownership 3/5, startup value 5/5. If the startup decision could create a runaway condition, loss of containment, wrong routing, overpressure, or unsafe interaction between systems, HAZOP should lead.

It also helps leaders who need a disciplined bridge between design intent and reality. For a broader comparison of short versus deep pre-job review, the What-If Analysis article shows where lighter methods stop and where deeper analysis starts. The point is not to inflate the workshop. The point is to protect the first operating run before the plant proves the issue the hard way.

When does Bow-Tie win?

Bow-Tie wins when the question is not only what can go wrong, but which barriers must be trusted before startup and which barriers must still work if the top event breaks through. It is the strongest lens for major hazards, critical controls, executive assurance, and SIF-credible exposure, because it keeps the organization focused on prevention and mitigation rather than on a long list of possible causes.

The weakness of Bow-Tie is false confidence. A neat diagram can hide a weak barrier if no one has tested the barrier in the field. That is why Bow-Tie should never stand alone. It needs verification, ownership, and a direct link to how the crew will start the job. Otherwise the plant gets a polished map and still depends on luck.

Score: task precision 2/5, process deviation depth 3/5, barrier ownership 5/5, startup value 4/5. Use Bow-Tie when the startup question is, "Which controls must survive if the process deviates?"

Bow-Tie also connects well to the LOPA protection layers article, because both methods force the team to ask whether a barrier is independent, available, and credible under real operating pressure. If the control only exists on paper, the diagram has not protected anyone yet.

Decision matrix

The table below is the practical test. It compares the three methods by the decision they support, the evidence they need, and the failure mode that hurts the startup most.

The matrix makes one point clear. Startup should not be forced into a single method. The plant manager needs HAZOP to challenge the process, Bow-Tie to test the controls, and JSA to make sure the crew can actually execute the first days of work.

What should a plant manager choose before startup?

If you can only lead one review before startup, choose HAZOP when the process can behave in a new or uncertain way. Choose Bow-Tie when the main concern is whether critical controls are strong enough to survive the top event. Choose JSA when the startup plan is already defined and the remaining risk sits in execution discipline.

In practice, the plant manager should sequence them. Start with HAZOP if the change is process-heavy. Translate the serious scenarios into Bow-Tie so the barrier owners are clear. Finish with JSA so the shift supervisor can brief the crew on the first real task in the field. That sequence is more work than a single workshop, but it is also more honest about how risk moves from design to operation.

Across more than 250 cultural-transformation projects supported by Andreza Araujo, the pattern is consistent: the safest organizations do not ask one tool to save them from all error. They choose the right lens, then they make the next decision visible. That is the difference between a safety file and a controlled startup.

For leaders who want the startup question to stay connected to the broader operating system, the risk register cleanup article shows why the register must reflect the decision, not just the hazard list. A good startup review only helps if the record that follows still tells the truth.

What traps make the comparison fail?

The first trap is tool loyalty. Teams defend the method they already know instead of the method the startup actually needs. The second trap is workshop theater. People collect sticky notes, leave with action items, and never verify whether the barrier or task control changed. The third trap is scope confusion. JSA gets used for process design, HAZOP gets used for routine field work, and Bow-Tie gets treated as a poster instead of a control model.

The fourth trap is forgetting the human side. A method can be technically correct and still fail because the supervisor, contractor, or operator was not in the room, or because the decision owner had no authority to change the plan. Andreza Araujo's work in A Ilusão da Conformidade, glossed in English as The Illusion of Compliance, fits this point well: a signed process does not prove a safe result if the field never changed.

The fifth trap is stopping at the matrix. A startup decision is only credible when it reaches the field, the permit, the briefing, the control test, and the escalation rule. If the team cannot show one concrete change in the plant, the review was probably more comfortable than useful.

Every startup review that ends with a nice summary but no changed control leaves the next shift to discover the real answer under pressure, which is the most expensive moment to learn that the wrong method was chosen.

Conclusion

JSA answers the task question, HAZOP answers the process question, and Bow-Tie answers the barrier question. Before startup, HAZOP usually leads, Bow-Tie follows as the control check, and JSA closes the loop with the crew that will run the work.

The useful rule is simple. If the question is, "How will this process behave?" use HAZOP. If the question is, "Which controls must survive?" use Bow-Tie. If the question is, "How will the crew execute tomorrow morning?" use JSA. Plant managers who keep those roles separate make better decisions, because the method stays close to the risk and the startup stays close to reality.

For a deeper operating discipline around risk, culture, and field verification, Andreza Araujo's books and safety culture work give leaders a way to turn analysis into control. Start there, then make the startup decision with the right lens instead of the most familiar one.