CHAPTER 1: HSE

Page 1 of 24
TU WE Manual Chapter 1 - HSE.doc
 Page 2 of 24
TU WE Manual Chapter 1 - HSE.doc
Topic 1: Managing HSE
1.1 SAFETY MANAGEMENT
There are three ways in which the management of a company can approach safety:

By not putting any employee into a potentially hazardous situation

By telling all employees that they are responsible for their own safety and leaving the
rest to them.
By accepting the responsibility for safety itself.

It does not take much thought to realise that every action we take between waking up in the
morning and falling asleep at night involves a certain amount of risk. We evaluate that risk,
usually at a subconscious level, and if it seems to be below a certain threshold level we
equate it to zero and carry on without further thought. The threshold level is very personal; it
also varies with time. As an example not many people consider taking a shower to be a
hazardous activity, but we probably all know someone who has slipped on the soap or on
smooth tiles and either had a near miss, or done something more serious such as spraining a
wrist or dislocating a shoulder. The conclusion is that there are no risk-free situations in
practice and the first method is not in fact an option at all.

The second method is very common in low technology jobs and until recently has been
common in the oil industry in jobs where an accident would not result in immediate major
damage to equipment. The thinking is that an employee will learn initially from his peers and
then by experience and will see the dangers for himself, or that he need only be shown once.
There are many reasons why this approach is not effective, for example:

Informal training given by peers can perpetuate bad practices as well as good.
"Learning by experience" really means learning not to repeat mistakes. Unfortunately
the consequences of the first mistake may be such that the worker is no longer in a
position to learn from it.
It may not be obvious to a worker how his actions may affect others.
The employee may not be able to evaluate how one change in a complicated set of
conditions may affect the risk to himself
No matter how experienced, an employee may come across a new situation with
risks which are not immediately obvious.

The major advantage of this approach is that it enables supervisors and managers to go
home with a clear conscience after an accident: "It was his own fault - I'm not responsible !". It
may seem to the newly recruited drilling engineer who is undergoing months of training,
including the safety aspects of specific operations and frequent reference to safety
management, that the approach is now obsolete. It should be, but it is an easy option and is
very seductive. As long as we continue to see accident reports in which the supervisor reports
the action he took to prevent recurrence as "I told him to be more careful", this method of
safety management is alive and well.

It is by now obvious to you that the only acceptable choice is that the top management of a
company accepts the responsibility for all the assets of a company, including as a major asset
the personnel. This acceptance of responsibility for damage to personnel as well as to the
other assets of a company may initially have been motivated by public relations - not wanting
to be seen as a company which injures a lot of people - but it also made good business
sense.

In the course of time no incompatibilities have been found between safety and production,
and it has become an accepted cornerstone of safety management that "safety is good
business." With lower overall accident rates:

Page 3 of 24
TU WE Manual Chapter 1 - HSE.doc
 less equipment will be damaged,
fewer small accidents in turn means fewer major accidents,
the operation will be closed down less for accident investigations
there will be lower costs for training replacement workers,
there will be lower costs for evacuating injured workers from remote locations
continuity in crews enhances teamwork and higher efficiency

1.2 ACCEPTANCE OF THE NECESSITY TO MANAGE

With the recognition of the safety responsibilities of management it became a Shell Group
policy that Safety, and later also Health and the Environment, must jointly be given equal
priority with the technical content of any operation. The most recent version of the Shell
Group's HSE Policy, endorsed by the Committee of Managing Directors in 1997, is shown in
Appendix 1, along with a statement affirming the Group's commitment to Health, Safety, and
the Environment.

Individual Operating Unit (OU) HSE policies are based on the Group policy. It is a primary
responsibility of the Management of an OU to ensure that all the contractors involved, as well
as all staff members, are aware of the OU policy, understand it, and are fully committed to
adhering to it.

The consequence of adopting this policy was that it became necessary to "manage" safety in
a more formal manner than previously and thus to have a "safety management system"
integrated into the overall management of the business in the same way as a "quality
management system" and a "finance management system".

The acceptance of safety, and later HSE, as an integral element of business activities is
reflected in the Group's Statement of General Business Principles (1994 version). An extract
from the 1994 version is shown below.

Extract from the Group's

Statement of General Business Principles

It is the policy of Shell companies to conduct their activities in such a way as to take foremost
account of the health and safety of their employees and of other persons, and to give proper
regard to the conservation of the environment. Shell companies pursue a policy of continuous
improvement in the measures taken to protect the health, safety and environment of those
who may be affected by their activities.

Shell companies establish health, safety and environmental policies, programmes and
practices and integrate them in a commercially sound manner into each business as an
essential element of management.

1.3 ENHANCED SAFETY MANAGEMENT

The concept of a Safety Management System (SMS) was not created overnight. An
intermediate step in the evolution of the SMS was a stage in which emphasis was placed on a
structured approach to managing safety but which did not go all the way to the formal
management and control system which SMS and today's HSE Management System
(HSEMS) later became. This was called Enhanced Safety Management (ESM) and was
driven purely by a concern within the Group that the accident rate was too high. There was
none of the legislative pressure, which later had an input into SMS. ESM was introduced in
1985 and was followed by the Environmental Management Guidelines (1987, revised 1992)
and the Occupational Health Management Guidelines (1989).

Page 4 of 24
TU WE Manual Chapter 1 - HSE.doc
ESM required that local management address the following specific concerns:

1) Safety consciousness (commitment/alertness of staff, safe personal behaviour)

2) Safety in engineering and in project management (planning, monitoring, design, lay-out)

3) Safety in technical operations (procedures and house-keeping in seismic, drilling,

production, maintenance)

4) Safety in supporting operations (transport, emergency, survival, fire/gas protection)

5) Safety in contractor activities (seismic, drilling, construction)

6) Safety audits/inspections (internal and external)

7) Safety performance monitoring

The first of the above points addresses safety in how the work is done; it relates to an
employee's attitude, alertness and interest. This attitude aspect is of overriding importance as
it will allow unsafe situations to be recognised and corrected at an early stage of their
development.

Points 2 to 5 address safety in what has to be done and applies in a specific way to each of
the disciplines that make up the total of EP activities. They should result in specifications,
procedures and instructions and will require appropriate training. In all these areas
management must demonstrate that safe practices have been planned and prevail.

Points 6 and 7 are management tools used to demonstrate the quality of company safety
activities and practices.

In order to be able to address the above concerns effectively and successfully it was
necessary for the management of an OU to comply with certain conditions, to provide
adequate resources and to provide staff with the appropriate tools. These requirements, all of
which have to be in place before safety can be effectively managed, have become known as
the eleven principles of ESM. They are listed below.

The eleven principles of ESM

1. Visible Senior Management Commitment

2. A sound HSE policy
3. Line responsibility for HSE
4. Competent HSE advisers
5. High, well-understood, HSE standards
6. Effective HSE training
7. Realistic HSE targets and objectives
8. Effective motivation and communication
9. Techniques for measuring HSE performance
10. Thorough accident investigation and follow-up
11. Audits of HSE standards and practices

ESM was successful in reducing the accident rate.

Page 5 of 24
TU WE Manual Chapter 1 - HSE.doc
Topic 2: The HSE Management System
2.1 SAFETY MANAGEMENT SYSTEMS
Major accidents, including the Piper Alpha accident (1988) and the Exxon Valdez oil spill
(1989), led to increased awareness within the industry and with the authorities that more
effective management systems should be in place to avoid major incidents. The Cullen
Inquiry Report (1990) on the Piper Alpha accident recommended safety management
systems and safety cases based on a full formal safety assessment. This led to the
development of the Safety Management System (SMS) in Shell E&P companies, guidance for
which was first issued in 1991.

With the growing momentum of safety management within the industry it very soon became
enshrined in the regulations of the more developed countries. The permission to operate
major facilities is now only given once management has demonstrated that it has taken
adequate steps to ensure safe operations. SMS provides a means of demonstrating this.

At the same time there were other important developments related to civil and criminal
liabilities. The European Union (EU) is contemplating strict civil liability for environmental
damage. Courts world-wide increasingly impose criminal liability for HSE non-compliance - for
instance, in 1992 criminal charges for HSE non-compliance were imposed by a Canadian
Court and an important set of 'Due Diligence' requirements were formulated.

The SMS thus evolved into the Health, Safety and Environment Management System
(HSEMS) to cover such requirements, and took account of external developments such as
Quality Management standards (ISO 9000) and Environmental Management standards (BS
7750).

For simplicity the remainder of this Topic refers only to HSE and HSEMS (except where
safety as such is meant, and with reference to ESM). It must be remembered however that
initially the main focus was on Safety with the Environment and Health (in that order) being
brought into the scope of the System at a later date. The system itself did not change
significantly with these additions (apart from the change of name).

2.2 THE HSE MANAGEMENT SYSTEM (HSEMS)

ESM provided a list of the principles for effective safety management and promoted the
necessary cultural environment for safety. It did not however provide a structured means for
implementing these principles within a company. Nor did it give explicit detail on the safety
management practices at line and supervisory level. HSEMS fulfils these roles; it does this by
formally assessing and documenting the management of those activities, which are critical to
HSE within the company. It should be emphasised here that the "critical activities" with
respect to drilling operations are not restricted to tasks carried out on the drilling unit - the
term encompasses every activity within the company which may have an impact on the HSE
aspects of those operations, from policy decisions by the General Manager of the OU to, for
example, the mechanics of a transport contractor.

Historically, HSE has been assessed by the absence of negative outcomes i.e. reactively.
The introduction of ESM within E&P started the move away from this reactive approach (after
the accident) towards a more proactive approach, i.e. taking preventive action before an
accident occurs. HSEMS has taken this further by providing the structure for improved
planning via the management of hazards.

Having accepted that HSE is part of the business and incorporating it into the Statement of
General Business Principles, the management of HSE becomes part of the overall system for
managing the business. (In other words the HSE Management System is not really a system

Page 6 of 24
TU WE Manual Chapter 1 - HSE.doc
but a sub-system.) It becomes subject to the same procedures and quality controls as any
other part of the business such as operations, finance, public relations, etc. The
accompanying box shows the Management System model included in EP 95-0310, derived
from ISO 9000, featuring the so-called "quality loop" i.e. Plan-Do-Check-Feedback-Improve.
This is accepted as applying, on the appropriate scale, to any business activity and therefore
applies equally well to HSE. Its purpose is to safeguard people and facilities by ensuring that
the activities of a company are planned, carried out, controlled and directed so that the HSE
objectives of the company are met.

It is very important to realise that although the HSEMS is a "Management System" it is not a
"Manager's System". Everyone in the OU, including contractors, from the highest level to the
lowest, has a part to play in the management of HSE. It is thus vital that the HSEMS must
be understandable at the appropriate levels in the company. It is also important that it
should be documented so that it can be audited and verified as effective.

2.3 POLICY AND STRATEGIC OBJECTIVES

The HSE policy of an operating company is the top management's statement of intentions
and principles of action. It must be widely published (helping to demonstrate compliance with
the first principle of ESM) including being translated into as many languages as are in
common use among the personnel of the company and its contractors. As previously stated, it
should be consistent with the Group policy by being based on the Statement of General
Business Principles and the Policy Guidelines on Health, Safety and the Environment.

The primary objective of good HSE management is to establish and maintain downward
trends in incident frequency, severity and cost. The company HSE programme should have
definite objectives on work incidents, property damage and business interruption losses.
These objectives may be quantified in absolute terms or trends. Similarly the objectives of an
environmental protection programme are to reduce the impact of the OU's operations on the
environment and they should be quantified in terms of the amounts of solid, liquid and
gaseous pollutants discharged and in terms of the effect of both pollutants and construction
work (including roads) on the local flora and fauna. Where appropriate noise, light and smell
should be considered as pollutants and corresponding objectives established.

The quantification of short and medium term occupational health objectives in terms of target
achievements is usually more difficult as the effects of poor practices may take years to

Page 7 of 24
TU WE Manual Chapter 1 - HSE.doc
manifest themselves. Normal practice is to set targets related to the implementation of
preventive measures. In some cases there may be medical problems which can be quantified
and for which short and medium term objectives may be set. An example of this would be the
incidence of malaria among the staff.

Again, having objectives is not sufficient - both objectives and results have to be published so
that everyone knows what the objectives are and whether they are being achieved.

2.4 ORGANISATION, RESPONSIBILITIES, RESOURCES,

STANDARDS AND DOCUMENTATION

2.4.1 ORGANISATION

The successful handling of HSE matters requires the participation of all levels of management
and supervision, including the "line" (see below), advisers (both functional and HSE) and
contractors, right down to the most exposed workers at "the sharp end" i.e the rig floor. This
has to be reflected in the organisational structure of the OU. This structure not only has to
define the relationships between the various positions in the company, but it also has to
define the number of people required to fulfil all the requirements of the organisation,
including those relating to HSE.

An important element in the development of an effective organisation is that everyone within it

should know what he/she is supposed to be doing, and how it should be done. This may
sound obvious, but in practice it is difficult to achieve. The solution is to have a written job
description for every position within the organisation, defining both the responsibilities and the
relevant reporting relationships. There must also be, within the organisation, a set of
documented equipment standards and standard procedures to cover every foreseeable
requirement. Job descriptions and standards have been a normal part of operations for many
years, what is relatively new is that an HSEMS calls for the HSE aspects of a job to be
formally included in a job description, and for HSE standards and procedures to be included
in the OU's reference documentation.

2.4.2 RESPONSIBILITY FOR SAFETY

The only person who can be responsible for doing a job safely is the
person who is responsible for doing the job properly.

The above statement is another way of stating the third principle of ESM. Each person in the
line is responsible to his supervisor for doing his job properly, which includes the jobs of his
own subordinates, if any, and which also therefore includes the safety of those subordinates.
"Line" in this context means the line (or chain) of command from the General Manager down
to the most junior employee.

This may seem self evident when set down in print, but it is surprising (or perhaps not) how
many people will try to avoid accepting responsibility for an accident to a subordinate.

It follows from the above that the General Manager of a company is ultimately responsible for
the accidents that happen to the most junior employee in the same way that he is ultimately
responsible for the quality of the company's products and the company's profitability. This
principle is illustrated in Appendix 3.

This is one of the basic principles behind the management of safety within the Shell Group.

Page 8 of 24
TU WE Manual Chapter 1 - HSE.doc
"Line" staff responsibilities

General Management

This is the level, which sets the policy and priorities, establishes the framework for
implementation, provides the resources, and monitors adherence and overall performance. It
is not however sufficient for the top management of an OU to perform its HSE responsibilities
behind closed doors it, and specifically the GM, must be seen to demonstrate strong
leadership and commitment. This visible leadership and commitment was the first principle of
ESM; it is so important because it creates the atmosphere in which the whole Management
System operates.

In order to create a culture in which there is a concern for HSE matters throughout the OU,
and in which individual contributions from employees and contractors have a part to play, it is
essential for the General Manager and the line managers to take an active personal interest
in the HSEMS. This interest must extend from the development of the system and the
preparation of the documentation to the implementation at the lowest level. It is the single
most important factor in the HSE performance of the OU. If, on the contrary, the management
of an OU is paying lip-service to HSE without being truly committed, that will become obvious
to the staff and contractors and will turn the HSEMS into a paper exercise with little effect on
the HSE performance.

Interest alone, vital though it is, is clearly not sufficient. The GM must demonstrate a
willingness to provide the funds required for sufficient resources (in this case, man-hours) to
develop, operate and maintain the HSEMS.

Operations Management

Line management establishes the framework for implementation, ensures that the HSE policy
is properly observed and monitors the attainment of targets. Line management should also
provide support and resources for local actions taken to protect health, safety and the
environment.

The Department Head

This is the level, which specifies the professional ways and means; which selects the
appropriate objectives, standards, specifications and procedures in the technical and HSE
disciplines; which verifies adherence to these (among OU and contractor staff) and which
organises resources and training to achieve the objectives. It is thus the Department Head
who puts into practice the fifth, sixth and seventh principles of ESM.

The Line Supervisor

This is the level, which activates, motivates and enforces safe practices at work. Line
supervisors set the example for the workforce.

The Crew

This is the level, which actually does the job. They must flag all unsafe conditions and
incidents, correct unsafe acts and give suggestions for improvements. It is also the
responsibility of each person in the crew to watch out for the safety of his work mates.

The Individual

In the last resort each individual is responsible for his own safety and should not rely on the
"systems" to take care of him.

Page 9 of 24
TU WE Manual Chapter 1 - HSE.doc
"HSE Advisor" staff responsibilities

HSE Advisors are not responsible for HSE matters. Such staff, sometimes known as "HSE
professionals", have a very specific rle to play in a company. They are specialists in the
techniques of HSE management and can provide details of HSE related standards and
specifications. In Shell terms they have a functional responsibility, which means that they give
advice to "line" staff when requested, but have no direct responsibility for the particular
operation. The availability within an OU of competent HSE advisors is the fourth principle of
ESM.

The following is a summary of the responsibilities of the various groups of advisory staff
involved in HSE management, including those at Group Management level and in Central
Offices:

At "Group" level

The Shell Group HSE policy is developed by the Steering Committee for Health, Safety and
Environment. This committee is chaired by one of the Managing Directors and its members
are Co-ordinators/Division Heads from all functions. The Steering Committee is supported by
three specialist committees with emphasis on the different areas:

Shell Safety Committee

Shell Product Safety and Occupational Health Committee
Shell Environmental Conservation Committee

Accountability

Accountability for unsafe and environmentally hazardous practices and resulting incidents,
injuries or fatalities applies right down the "line" to all levels of the organisation, within every
employee's own sphere of responsibility. All employees should therefore be aware of their
own specific role and responsibilities for HSE.

A common issue is how realistic it is to hold an individual worker accountable for a task that
has been carried out in the absence of proper supervision or procedures. The answer is that
an individual worker is responsible for the work he does but that his supervisor and the
company remain accountable for assuring that he has adequate supervision and procedures
to carry out the job safely.

Accountability thus requires that every manager or supervisor is able to demonstrate that he
has:

formally given relevant instructions to his subordinates,

taken the appropriate implementation measures,
provided the necessary resources (money, manpower and/or training as appropriate
to his level of authority)
regularly checked adherence.

Making staff accountable for HSE, in the same way that they are accountable for the technical
aspects of the job, means that career performance ranking is as dependent on HSE
performance as on technical performance.

2.5 HAZARDS AND EFFECTS MANAGEMENT

A crucial element in the management of HSE is the management of the hazards inherent in
the business, and their adverse effects. The Hazards and Effects Management Process
(HEMP) is the planning tool designed to do this. It provides a structured method of identifying

Page 10 of 24
TU WE Manual Chapter 1 - HSE.doc
hazards, assessing their importance, deciding on the steps which need to be taken to control
them (which could be by means of equipment specifications, standard procedures, system
defences and/or training) and of specifying the steps to take if something does go wrong.

The process is illustrated in the diagram below and is described in detail in Appendix 2. It is a
core element in the preparation of the Company's HSE Manual and in the HSE Cases
applicable to individual sites - the latter are also described in the following Topic.

Identify What is the root cause ?

What could go wrong ?

Assess How serious will it be ?

How probable is it ?

Control Prevent/eliminate Is there a better way ?

Reduce probability How to prevent it ?

Recover Mitigate consequences

Emergency response How to limit the consequences ?

Reinstate How to recover ?

Implementation of HEMP within the HSEMS will allow OUs to assure themselves,
shareholders and, where appropriate, regulators that:

the hazards inherent in their operations have been systematically identified;

arrangements are in place to control those hazards and to deal with the
consequences should the need arise;
the necessary information, training, auditing and improvement processes are in place.

2.6 PLANNING AND PROCEDURES

As previously stated the primary objective of good HSE management is to establish and
maintain a downward trend in incident frequency, severity and cost. To achieve this a clearly
defined programme should be drawn up and regularly reviewed and controlled by company
management. The programme should be developed throughout the company's organisation
as part of the normal planning cycle, and reflect the different responsibilities of the various
management levels. It should specify action plans where improvements are required in order
to meet the targets. The programme and the action plans need to be quantified wherever
feasible so that progress can be measured and achievements verified. Following the fifth
principle of ESM the programme should be based on high and well understood HSE
standards

2.7 IMPLEMENTATION
Implementation means ensuring that the practices and procedures specified in the planning
documents (HSE Manual and HSE Case) are used to achieve the Company's objectives. For
this to happen, the eighth principle of ESM is crucial.

Page 11 of 24
TU WE Manual Chapter 1 - HSE.doc
There is only one way to ensure that people do use procedures and systems and that is to
capture their hearts and minds. Their hearts have to be convinced from the start that the
objective of safety management is (contrary to what may have been implied earlier in this
document) not to achieve a low accident rate but to send them as individuals home in one
piece to their families and friends. Their minds have to be convinced that the specified
procedures are the best procedures. The latter is basically achieved by training, but it is also
very important to involve the people who use the procedures in writing them, and to take
seriously any suggestions they may have for modifications. Capturing the hearts can only be
achieved by creating a HSE culture which permeates the whole company. Every manager
and supervisor, at every level, must demonstrate by his own actions that the operation
achieves success through the use of the correct procedures. There must be briefing sessions
and HSE meetings to build and consolidate group motivation and to encourage individual
participation in discussion. Each person should be individually informed, by means of
newsletters, etc. of significant achievements within the company as a whole as well as within
his/her own group. Groups and individuals mentioned by name will be motivated to maintain a
high standard.

2.8 PERFORMANCE MONITORING

The ninth principle of ESM is to have effective performance monitoring techniques. These can
be used measures the effectiveness of management by the comparison of results with pre-set
targets. Overall safety performance is normally monitored using injury statistics and quantified
assessments of the safety of the workplace. Good performance is indicated by a decrease in
injury frequency and severity and an increase in the reporting of near misses and unsafe acts.

The pro-active element of an OU's performance, which is in effect the implementation of the
procedures specified in the hazard management process, has also to be verified and where
possible quantified. It should be remembered here that it is safety management, which is
being monitored, not accidents. This is done by:

programming drills, monitoring that they are being performed and analysing the
results,
monitoring the documentation related to each procedure, for example permits to
work, sling registers, journey management logs, minutes of HSE meetings.
monitoring the documentation related to equipment checks, including the "system
defences".
internal audits, or spot checks, that the documentation reflects the reality of the
situation.
monitoring the procedure that each supervisor uses to monitor the people he
supervises.
monitoring the first aid treatments carried out by the medic.

Much of this is done during regular rig visits by middle management and department heads.
Until the advent of formal HSE management the emphasis during such visits was on checking
the equipment, now it is on verifying that the checking is being done by the people whose job
it is and on verifying compliance with procedures.

Last but not least there is the tenth principle of ESM - accident investigation. Strictly speaking
this is not performance monitoring, however it is similar to monitoring in as much as any
accident or near miss is a positive indication that the HSE management system has failed and
provides feedback into the "corrective action" element of the quality loop.

With regard to accident investigations it can almost be said that the last thing to consider is
the committing of an unsafe act in isolation. If the preconditions are completely removed there
will be no more unsafe acts because people will be fresh, motivated and 100 % trained, they
will be given the time to do their job properly in a pleasant environment without distractions.
The danger then is complacency, but that can also be managed. System defences however
are still required because of "real" incidents, which are beyond management. For example an

Page 12 of 24
TU WE Manual Chapter 1 - HSE.doc
insect can fly into the eye of the driller at a critical moment, causing him to lose concentration
as he is raising the block. This is a distraction, which could not be foreseen, but the situation
is saved by the system defences. (Note, however, that if the incidence of flying insects is
known to be high on the drilling location that would definitely be a pre-condition to be dealt
with by HSE management.) Thus the object of an accident investigation is not primarily to
assign blame to someone who committed an unsafe act, but to determine what were the
preconditions that had an influence and which system defences failed, and why.

2.9 CORRECTIVE ACTION AND IMPROVEMENTS

Corrective action is an essential part of the feedback loop. The important point is that it has to
be specific and documented, so that everyone involved knows exactly what the problem is,
who is supposed to take action and a date by which the action has to be completed. The very
act of writing down the deficiency and how to remedy it may well bring realisation to the
supervisor that the deficiency in question is a merely a symptom of a problem which lies
elsewhere (preconditions).

You will already have realised that top management will be ensuring that the quality loop is
being closed by monitoring the corrective actions being taken by the operations management.

2.10 AUDITS
Regular audits are part of the normal business control cycle as specified in the eleventh
principle of ESM. In HSE management they serve to highlight areas where complacency has
crept in and to verify to top management that the operations management is acting effectively.
This is a theme which is common in HSE management as it is in any quality cycle - there is
no point in giving an instruction or setting up a system if compliance is not verified.

There are two levels of audits, internal and external. Internal audits are more thorough
versions of the routine rig visits, done by a larger team and taking longer. They will also look
at the procedures within the office organisation. The result will be a formal report which goes
further up the line than the rig visit reports.

External audits are done (at the request of the top management of the operating company) by
a team led by SIEP and include members from the operating company itself and from
partners, if there are any, and/or contractors. They are as comprehensive as possible taking a
team of four people up to two weeks to complete. There will be a formal report sent to the
operating company by SIEP over the signature of the EP co-ordinator, who will require regular
progress reports on the corrective actions taken. External audits will be done every three
years or so.

2.11 MANAGEMENT REVIEW

The final stage before re-commencing the business cycle is the management review in which
the external audit plays a large part. The review allows top management to focus on how the
top level policy decisions are affecting the HSE aspects of the workplace, and gives the
opportunity to revise those policies not only as part of the technical improvement process but
also in the light of changing legislation and public opinion.

Page 13 of 24
TU WE Manual Chapter 1 - HSE.doc
Topic 3: Health and Environment
3.1 INTRODUCTION
Having presented a relatively detailed introduction to the subject of Safety Management this
section gives an introduction to the other components of HSE, that is Health and the
Environment, and gives a very brief idea of the practical issues involved.

The key distinction to be made at the outset between Safety on the one hand and Health and
the Environment on the other is between acute and chronic conditions. Safety management is
mostly about acute problems while the management of health and the environment is mostly
concerned with the chronic condition. Both types of condition can be regarded as the result of
the release in some way of a potentially damaging hazard. The hazard can be an energy
source, a substance which is harmful to people and/or the environment, physical modification
of the environment. Whether this hazard is the result of a short term action or a long term
effect, the basic HEMP process of identification, assessment (or evaluation), control, and
recovery is equally applicable.

3.2 HEALTH
Health comes into HSE in two distinct areas.

It is part of the mitigation process within the safety process. In case someone is hurt medical
attention has to be quickly available.

Occupational health refers to the focusing on the chronic conditions mentioned above. The
major hazards which are relevant around a drilling location are:

Noise (very many of the older generation of drillers are deaf)

The effect of constant contact with drilling fluids
The breathing of drilling fluid chemical dust
The incorrect handling of radioactive material
Ergonomics

Within the industry there are trades with their own specific health hazards, such as:

Divers (the bends)

Welders (eye problems)

OCCUPATIONAL EXPOSURE LIMITS

One of the main tools for controlling occupational illnesses arising from contact with the
materials used in any activity is the concept of Occupational Exposure Limits (OELs).

These refer to airborne concentrations of chemical agents and levels of physical agents, and
represent conditions under which it is believed that nearly all workers may be repeatedly
exposed day after day without adverse effect. Because of wide variations in individual
susceptibility however, a small percentage of workers may experience discomfort from some
substances at concentrations at or below the exposure limit; a smaller percentage may be
affected more seriously by aggravation of a pre-existing condition or by development of an
occupational illness. Smoking of tobacco is harmful for several reasons. Smoking may act to
enhance the biological effects of chemicals encountered in the work place and may reduce
the body's defence mechanism against toxic substances.

Page 14 of 24
TU WE Manual Chapter 1 - HSE.doc
Individuals may also be hyper-susceptible or otherwise unusually responsive to some
industrial chemicals because of genetic factors, age, personal habits (smoking, alcohol, or
other drugs), medication, or previous exposures. Such workers may not be adequately
protected from adverse health effects from certain chemicals at concentrations at or below the
OELs.

OELs are based on the best available information from industrial experience, from
experimental human and animal studies, and when possible, from a combination of the three.
The basis on which the values are established may vary from substance to substance;
protection against impairment of health may be a guiding factor for some, whereas
reasonable freedom from irritation, narcosis, nuisance or other forms of stress may form the
basis for others.

OELs are guidelines or recommendations in the control of potential health hazards. THEY
ARE NOT FINE LINES BETWEEN SAFE AND DANGEROUS CONCENTRATION nor are
they a relative index of toxicity.

OELs may be found in national regulatory documentation such as the German "Maximale
Arbeitsplatzkonzentrationen und Biologische Arbeitsstofftoleranzwerte", the British Health &
Safety Executive's "Maximum Exposure Limits", the Dutch "MAC waarden", in European
Directives, in the American Conference of Governmental Industrial Hygienists' Threshold Limit
Values (TLVs) and Biological Exposure Indices (BEIs) booklet, and in Shell Safety and Health
Committee and Shell HSE publications.

HYGIENE

As well as medical attention and occupational health there is an area, somewhere between
the acute and the chronic, which is of great importance on a drilling unit either on- or off-
shore. That is hygiene. Inspecting kitchens, toilets, septic tanks and soak-aways is not a very
glamorous aspect of the industry but if the senior man on location does not take this seriously
and keep on top of it there can very quickly be a major problem.

3.3 THE ENVIRONMENT

The environment is currently the topic with the highest profile. The drilling business creates
two very different hazards for the environment; pollutants are discharged and, onshore, the
topology is modified. It is difficult to know which has the greater long term effect, both have to
be controlled and mitigated, and much has already been done in those respects.

The pollution resulting from blow-outs is what gets all the publicity, but that, thankfully, is rare
in our operations. What has not been rare, and only began to receive significant attention in
the early nineteen eighties, is the discharge of liquid drilling fluid. If the drilling fluid properties
started to deviate from what was required, usually by taking up clay from the drilled formation,
the easy option was to dump it and mix new drilling fluid. The chemicals used were simple
and cheap, and solids removal equipment was limited to the shakers, desanders and
desilters. The alternative was, and is, to use a more sophisticated system, easier to maintain
but more expensive to start with, and to use more efficient solids removal equipment so that
formation solids taken up by the drilling fluid are completely removed and are discarded dry.

As the Group became concerned about the effect of our operations on the environment - in
parallel with public pressure, not as a result of it - the weights in the balance changed and the
low discharge option became preferred. As usually happens in such cases, it turned out in the
end that when the appropriate engineering attention was turned on the subject the clean
option became no more expensive than the dirty option.

A land drilling operation is a major modifier of the topology of an area. In the short term the
cleared areas will obviously stand out like accusing fingers, but in the medium term bushes

Page 15 of 24
TU WE Manual Chapter 1 - HSE.doc
and trees will re-establish themselves - always assuming that the soil has not been
contaminated and that a waste pit of semi-liquid drilling fluid was not left behind. There is
however one situation with a long term effect, which may prevent the area ever returning to its
original state, That is a change to the natural drainage of the area. The natural drainage is an
equilibrium state, which has developed over geological time. A step change will not be
reversible and it is difficult to estimate what the final effect will be. An access road may for
example cut across a dry streambed. When the rainy season comes the stream may then
follow the road and create a completely new stream, in the process virtually destroying a
village, which had always relied on the original stream for irrigation. Building a dam to provide
drill-water may create changes, which will not revert to the original state when the dam is
eventually removed.

Actions which the Group is currently taking to minimise this type of environmental problem is
to promote the drilling of smaller hole sizes. This has many consequences.

There are less cuttings to dispose of

There is less drilling fluid used which has to be transported and then disposed of
Less water is required
Less casing is required, reducing both purchase and transport costs
A smaller rig is required which in turn has the following advantages:
o It weighs less, so transport and handling costs are lower
o Fuel costs are lower
o A smaller location is required
o Lower grade access roads can be used.

Page 16 of 24
TU WE Manual Chapter 1 - HSE.doc
 Appendix 1
THE ROYAL DUTCH/SHELL GROUP COMMITMENT TO
HEALTH, SAFETY AND THE ENVIRONMENT (HSE)
In the Group, we are all committed to:

pursue the goal of no harm to people;

protect the environment;
use material and energy efficiently to provide our products and
services;
develop energy resources, products and services consistent with
these aims;
publicly report on our performance;
play a leading role in promoting best practice in our industries;
manage HSE matters as any other critical business activity;
promote a culture in which all Shell employees share this
commitment.

In this way we aim to have an HSE performance we can be proud of, to earn the confidence
of customers, shareholders and society at large, to be a good neighbor and to contribute to
sustainable development.

THE ROYAL DUTCH/SHELL GROUP HSE POLICY

Every Shell Company:

has a systematic approach to HSE management, designed to

ensure compliance with the law and to achieve continuous
performance improvement;
sets targets for improvement and measures, appraises and
reports on performance;
requires contractors to manage HSE in line with this policy;
requires joint ventures under its operational control to apply this
policy, and uses its influence to promote it in its other ventures;
includes HSE performance in the appraisal of all staff and rewards
accordingly.

Page 17 of 24
TU WE Manual Chapter 1 - HSE.doc
Appendix 2
The Hazards & Effects Management Process
The Hazards and Effects Management Process (HEMP) consists of four basic steps:

Identify
Assess
Control
Recover

IDENTIFYING THE HAZARDS

The first step is to make a list of what might go wrong. This is done by people with experience
in each activity and covers the range of incidents from catastrophic to insignificant. It can be a
very long list, depending on the compilers, and it becomes a matter of judgement where the
lower cut-off should be. With experience a relatively standard list has emerged containing all
the hazards, which could conceivably be present in drilling and related operations.

To make the identification of the hazards more manageable the well construction activity is
broken down into elements corresponding to the elements of the EP business model. The
process is then applied to the relatively high level elements for the HSEMS Activities
Catalogue and to the lowest practicable level for the HSE Case Activities Catalogue.

In the drilling engineering field the process commences long before the well is spudded, at the
time when the Drilling Department receives a well proposal from the Geologists. At that stage
the Drilling Engineer has to identify the potential hazards on the basis of the depth, pressure,
temperature and lithological data given to him.

Around a drilling unit itself there are evidently a significant number of hazards - every piece of
equipment can break down and every person can make an error of judgement, and there are
natural hazards. These all have to be identified, but the list has to go on into permutations of
two or more unrelated events happening at the same time. Someone may make an error of
judgement at the same time that a system defence is (coincidentally) out of action. A specific
example is that a floating drilling unit has to control a kick during a storm.

One of the related activities which has to be included in the HEMP process is transport. Every
drilling operation is critically dependent on either land, water or air transport, with most
dependent on two of the three. Although most drilling operations are fairly standard, almost
every transport operation is unique in some way and documenting the possible hazards
becomes even more important.

ASSESSING THE HAZARDS

The next step is to assess the hazards, which effectively becomes a decision on their
probability, their potential for damage, and on the resources needed required to control them
relative to the benefit gained.

In the design phase the office based drilling engineer will take this step by estimating for
example the probability that a well will kick at a certain depth, what the formation fluid would
be and the well head pressures to be expected if it does so. If there is a very low probability of
a kick, the inflow would be water and the resultant well-head pressures would be very low, he
will assess that there is a low risk situation. If there is any possibility of a well kicking and
producing H2S with a very high well head pressure during an ineffective kick control

Page 18 of 24
TU WE Manual Chapter 1 - HSE.doc
procedure (because of either a faulty technique or an equipment breakdown) he will assess
that there is a high risk, or even potentially catastrophic, situation.

CONTROLLING THE HAZARDS

Controls have to be specified in terms of equipment, procedures and system defences. Note
that the "pre-conditions", such as the competence of personnel, should have been dealt with
at an earlier stage in the business model by a higher level of supervision than the drilling
engineer. In the example of the previous paragraph, for a low risk case the kick-control
procedure may be an adequate safeguard and the engineer will not modify his design or
specify any special hardware. For a high risk case he may specify a special well-head and
perhaps a BOP with additional redundancy in the control system, design the casing so that a
string is set just above the formation in question and specify a raised drilling fluid density. In a
potentially catastrophic case he would probably additionally specify that all equipment should
be checked prior to entering the formation in question, that non-essential crew members
leave the locations and that the drilling superintendent should be on the floor before drilling
ahead.

These steps have always been taken since blow-outs stopped being the primary method of
hydrocarbon detection. The difference under HSEMS is that the reasoning and the numbers
are documented so that it can be demonstrated that the hazard has been considered and
appropriate safeguards specified.

Note that one of the hazards which can be formally identified, and must therefore be
managed, is that the drilling engineer makes a mistake. How is that controlled ? Partly by
personnel procedures that only allow a position to be filled by someone who has been
properly trained, and partly by the "check and balance" of having each programme checked
and countersigned by the engineer's supervisor (who may also, by the way, make an error of
judgement such as, for example, "rubber stamping" the programme if everyone is waiting for it
and he is in a hurry to catch an inspection flight).

Equipment

The equipment aspect is relatively straightforward. Can the hazard be controlled by the
installation or use of a piece of equipment? If so the equipment has to be manufactured to a
certain accepted standard from identifiable (traceable) raw material, and it has to be
maintained properly. The manufacture of critical equipment may be monitored by a third party
inspection company on behalf of the OU, and its certificate that the standards were complied
with becomes part of the record. The maintenance will become part of the overall
(documented) maintenance procedures.

Procedures

Procedures are the most fallible of the possible controls, because they rely on people
following them when those people may not always understand the necessity to do so, and/or
may see an advantage in using their own judgement. For some there is no discussion - the
driller must have a procedure for handling kicks. Other procedures are put in place to guard
against circumstances which can be foreseen but which have a relatively low probability of
occurrence. These are the ones, which tend to be by-passed

The point about procedures is that someone with experience can set down how a task should
be accomplished without him being under pressure. He knows the consequences of what
may happen, can think about "what if", and can design out undesirable consequences. The
result is that the man in the field who may be under pressure, and who may not be fully aware
of the longer term consequences of his actions, can concentrate on applying a known general
procedure to the specific case which confronts him.

Page 19 of 24
TU WE Manual Chapter 1 - HSE.doc
All the procedures applicable to a certain drilling unit doing a certain job will be collected
together into one volume called the Operations Manual, and one of the higher level controls is
to ensure that the Operations Manual exists, that it has been properly authorised and
distributed, and that it is used.

It is not the purpose of this document to inform about specific procedures, but to point out how
they fit into HSEMS. It is in fact a sub-system of the HSEMS and is called the Permit to Work
system. There are a number of types of job on a drilling unit which may not be done without
first obtaining a permit to work. The principal items are listed in the accompanying box.

This procedure is used to control hazards which may arise when one crew member decides
to carry out an operation, within his own area of authority, but without realising what other
crew members are doing or are about to do. It is also used for operations, which are
themselves hazardous. An example combining both aspects would be that the rig electrician
notices that one of the lamps in the derrick is broken and decides to change the bulb.

Work subject to "Permits to Work"

Hot work
Entry into confined spaces
Heavy lifts
Work on high voltage equipment
Work requiring the isolation of safety systems
Non-routine work at height
Concurrent operations
The non-routine use of dangerous substances
The handling of radioactive material
The handling of explosives

Permits to Work can only be issued by the person in charge on location, or at least by a
named delegate who is fully aware of everything that is going on and has the authority to
decide which of two conflicting requests will get priority. If the rig mechanic wants to do some
pump maintenance this will only be allowed if the floor crew are not likely to require full pump
power for an operation the mechanic may not know about. With respect to the electrician and
the light bulb; before issuing a permit the rig superintendent would either know or make sure
that the driller was not going to start tripping out of the hole, and that no critical
instrumentation in the derrick would be affected when the electrician cut the power. He would
also ensure that the electrician used the correct procedures for working in the derrick, such as
wearing a harness, and he would give him a time period during which the work would have to
be done.

System Defences

These devices and controls are the last resort. People are not perfect and therefore the
designs and devices they produce, and the decisions they make, have elements of fallibility. If
the potential consequence of a failure is serious redundant equipment, safety valves
(including redundant safety valves), or automatic cut-outs are installed. Personal Protective
Equipment (PPE) is a system defence.

Page 20 of 24
TU WE Manual Chapter 1 - HSE.doc
RECOVERY FROM HAZARDOUS SITUATIONS

There are generally two levels of possible consequences, depending on the incident. If the
resultant situation is one of delay and inconvenience, but with a low probability of escalation
to a life-threatening situation, there will be an operational procedure designed to cope with it.
This type of situation includes low pressure kicks, drilling fluid losses, downhole equipment
failures, fishing jobs, etc. These procedures tend to be standard from one drilling unit to the
next.

If the situation is possibly life threatening, or could result in other unacceptable

consequences, a special procedure must be made and included in a collection of
Contingency Plans. Such situations, for which a contingency plan is required, include serious
injury, blow-out, oil spill, missing aircraft or other vehicle, storms offshore, etc., and will be
different according to the location.

One of the HSEMS controls is to ensure that a complete and properly drawn up set of
contingency plans is available on site before work starts and that regular drills are held with
the dual purpose of checking that the procedures work as intended and that everyone
involved becomes accustomed to carrying out their own part in the plan.

Page 21 of 24
TU WE Manual Chapter 1 - HSE.doc
Appendix 3
Responsibility for an accident
A strong point has been made that every supervisor within an OU is responsible for the safety
of the personnel who report to him, either directly or indirectly. The person who is therefore
ultimately responsible for every incident and accident in the OU is the most senior manager -
the General Manager or Managing Director. In this Appendix a typical accident is used to
illustrate the point.

At first sight it is quite obvious that the General Manager of an organisation cannot stop a
tanker being driven too fast round a corner and overturning. Or is it so obvious ?

It is the responsibility of the GM to ensure that the Technical Manager has a budget that will
enable him to purchase good quality, up-to-date, equipment which will perform up to
adequate standards, thus reducing the risk of brake fade or steering failure.

It is the responsibility of the GM to verify that the Technical Manager has taken steps to have
his equipment maintained according to the manufacturers recommendations. The Technical
Manager in turn must ensure that the workshop supervisors do the job properly by checking
that they have a schedule and that the trucks are serviced according to it. The Technical
Manager must also ensure that the workshop supervisors keep their equipment in good
condition and that the mechanics receive training according to a logical schedule. In this way
the risk of a mechanical failure is minimised.

It is the responsibility of the GM to ensure that the Personnel Manager has a system which
ensures that vacancies are filled with well qualified and experienced drivers who have a
record of dependable behaviour, and that the conditions of long-term service are attractive to
such drivers. The driver will thus be a person who accepts the necessity for standard
practices and procedures, and will see a direct relation between his driving style and his own
future.

It is the responsibilty of the GM to ensure that the Operations Manager has approved a
schedule for the drivers which will enable them to complete their route within normal working
hours and without excessive speed.

It is the responsibility of the GM to verify that the OM has had the route checked for any
unduly steep hills, sharp bends, blind spots, etc. and given the driver proper instructions to
deal with specific identified hazards

To complete this brief (and incomplete) illustration of one aspect of the technique of safety
management, it is also the responsibility of the GM to ensure that if, in spite of all precautions,
an accident does happen then the consequences are minimised. In this particular example he
should ensure that there is a journey management system and a contingency plan (which has
been practiced) so that the latter can be carried out when the former indicates that the truck is
overdue by a certain amount.

It must be emphasised that the GM does not have to check maintenance schedules, drivers
schedules, route inspections etc. himself. The point is that although the GM delegates
authority in specific areas down the line, he must operate a system of checks to ensure that
the authority is being used properly. He does not need not know how to execute the
operations but he does need to check that an operations manual has been prepared and is
being used. He does not need to know how to maintain equipment, but he does need to know
that a maintenance schedule has been prepared and to see, for example in a monthly report,
how the actual maintenance activities compare with the plan.

Page 22 of 24
TU WE Manual Chapter 1 - HSE.doc
Appendix 4
DEFINITIONS
Accident : An accident is an Incident that has resulted in actual injury or illness
and/or damage (loss) to assets, the environment or third parties.

Exposure Hours : Exposure hours represent the total number of hours of Employment
including overtime and training but excluding leave, sickness and
other absences.
Fatality : A fatality is a death resulting from:
an Occupational Illness, regardless of the time intervening
between the beginning of the illness and the occurrence of
death, or
a Work Injury, regardless of the time intervening between injury
and death.
First Aid Case (FAC) :
A first aid case is any one-time treatment and subsequent
observation of minor scratches, cuts, burns, splinters, and so forth,
which do not ordinarily require medical care by a physician.
Hazard : A hazard is the potential to cause harm, including ill health or injury;
damage to property, plant, products, or the environment; production
losses; or increased liabilities.
Incident : An incident is an unplanned event or chain of events that has or
could have caused injury or illness and/or damage (loss) to assets,
the environment or third parties.
Lost Time Injuries (LTI) :
Lost time injuries are the sum of Fatalities, Permanent Total
Disabilities, Permanent Partial Disabilities and Lost Workday Cases
resulting from injuries.
Lost Time Injury Frequency (LTIF) :
The Lost Time Injury Frequency is the number of Lost Time Injuries
per million Exposure Hours worked during the period. (Note: some
contractors base their LTIF on a period of 200,000 hours.)

Note that there does not have to be a particularly severe injury to result in an LTI.
In the case of offshore personnel, any requirement for a specialist examination,
which the site medic cannot do (e.g. an X-ray) will mean a trip ashore and almost
certainly a missed shift, even if no further treatment is required.

Lost Time Illnesses :

Lost time illnesses are the sum of Fatalities, Permanent Total
Disabilities, Permanent Partial Disabilities and Lost Workday Cases
resulting from occupational illness.
Lost Time Illness Frequency :
The lost time illness frequency is the number of Lost Time Illnesses
per million working hours worked during the reporting period.
Lost Workday Case (LWC) :
A Lost Workday Case is any Work Injury/Occupational Illness other
than a Permanent Partial Disability which renders the injured/ill
person temporarily unable to perform any regular Job or Restricted
Work on any day after the day on which the injury was received or
the illness started.
Medical Treatment Case (MTC) :
A Medical Treatment Case is any Work Injury that involves neither
Lost Workdays nor Restricted Workdays but which requires

Page 23 of 24
TU WE Manual Chapter 1 - HSE.doc
 treatment by, or under the specific order of, a physician or could be
considered as being in the province of a physician.
Near Miss : A Near Miss is an Incident which did not result in Injury or Illness
and/or Damage (Loss) to Assets, the Environment or Third
Party(ies).
Occupational Illness :
An Occupational Illness is any work-related abnormal condition or
disorder, other than one resulting from a Work Injury, caused by or
mainly caused by exposures at work.
The basic difference between an Injury and Illness is the single
event concept. If the event resulted from something that happened
in one instant, it is an injury. If it resulted from prolonged or multiple
exposure to a hazardous substance or environmental factor, it is an
Illness.
Permanent Partial Disability (PPD) :
A Permanent Partial Disability is a disability resulting from a work
injury/occupational illness which leads to:
the complete loss, or permanent loss of use, of any member or
part of the body, or
any permanent impairment of any member or part of the body,
regardless of any pre-existing disability of that member or part, or
any permanent impairment of physical/mental functioning,
regardless of any pre-existing impaired physical or mental
functioning, or
a permanent transfer to another job.
Permanent Total Disability (PTD) :
A Permanent Total Disability is a disability resulting from a work
injury/occupational illness which leads to permanent incapacitation
and termination of employment or medical severance.
Restricted Work Case (RWC) :
A Restricted Work Case occurs when an employee, because of a
work injury/occupational illness, is physically or mentally unable to
perform all or any part of his/her regular job during all or any part of
the normal workday or shift.
Restricted Workdays :
The number of Restricted Workdays is the total number of calendar
days counting from the day of starting Restricted Work until the
person returns to his/her regular job.
Severity : Severity is calculated as the total Lost Workdays resulting, and
where necessary estimated to be going to result, from Accidents
which occurred during the reporting period divided by the total of
Lost Workday Cases plus Permanent Partial Disabilities. It
represents average days away.
Total Reportable Cases (TRC) :
Total Reportable Cases are the sum of Fatalities, Permanent Total
Disabilities, Permanent Partial Disabilities, Lost Workday Cases,
Restricted Work Cases and, in the case of work injuries, Medical
Treatment Cases.
Total Reportable Case Frequency (TRCF):
The Total Reportable Case Frequency is the number of Total
Reportable Cases per million Exposure Hours worked during the
period.

Page 24 of 24
TU WE Manual Chapter 1 - HSE.doc