Stood up on cameras already mounted in your bays, in about an hour, a presence-counting layer can tell you how many people remain in a zone during an evacuation. That is the number a fire drill is actually about, and it is the one most muster processes cannot produce. The alarm sounding is easy to confirm. "Who is still inside" is the hard question, and a muster list nobody can verify is not a safety system. It is a liability document.
Walk through what happens at the assembly point during a real evacuation. A warden holds a clipboard or a badge-reader export and starts counting heads against a list. The list is wrong in predictable ways. A contractor who signed in at a gate three hours ago is on it but left for lunch. A visitor is not on it at all. Two people tailgated through one badge swipe this morning, so the system thinks one of them is still at reception. The warden shouts a name across a car park into site noise and hearing protection, gets no answer, and has to decide, in the one moment when the decision is irreversible, whether that silence means "safe and not listening" or "still inside."
The tension nobody states out loud
Camera-based headcount sits on a real tension, and pretending it doesn't is how these projects fail. On one side is accountability: during an evacuation you have a legitimate, time-critical need to know who is in which zone. On the other side is privacy: a system that counts and locates people is a surveillance capability, and your workforce, your union, and your data-protection obligations all have a stake in how it behaves the other 364 days a year.
The resolution is not technical, it is governance, and it has to be settled before a single camera is pointed. Who is authorised to see the live count? Is identity resolved to a name, or only to an anonymous presence tally per zone? What is retained after the all-clear, and for how long? Under what rule does the count become evidence, and who signs it? A presence-counting system deployed without those answers is a privacy problem wearing a safety badge. Deployed with them, it is the opposite: a tightly scoped capability that activates on alarm, counts what it needs to, and stands down.
Why badges and radios miss the people who matter most
The population a muster process most needs to account for is exactly the population existing systems track worst. Permanent staff are the easy case. The gaps are at the edges:
| Person | Why the badge system fails | Why it matters in a drill |
|---|---|---|
| Contractors | Signed in at a gate, not tracked by zone; often share or forget cards | Highest headcount variability on any given day |
| Visitors | Escorted, rarely badged into interior zones | Unfamiliar with routes and assembly points |
| Tailgaters | One swipe, two people through a door | System's count is silently wrong from that moment |
| Shift-change overlap | Two populations in the building at once | Peak occupancy, worst-case accounting |
Radios do not close the gap either — an 85-decibel floor and mandated hearing protection defeat a verbal roll call precisely when the stakes are highest. The common pattern is that the methods fail on the people who are least familiar with the site and least likely to self-report. A system that counts presence in a zone from overhead cameras does not care whether a person carries a card, because it is counting bodies, not badges.
The muster workflow, as a checklist
Turning this from a capability into a safety system means writing the workflow down before the drill, not during it. A defensible emergency-muster process built on existing CCTV has five decisions settled in advance:
- Zones. Define the counted areas and their mapping to assembly points. The count is per zone, not per building, so a warden knows where the remaining people are, not just how many.
- Identity source. Decide the resolution: anonymous presence tally, or identity resolved against an authorised roster. This is the central privacy decision and it is a policy choice, not a default.
- Trigger. The counting layer activates on alarm and only on alarm. It is dormant in normal operation, which is both the privacy safeguard and the thing your workforce needs to be shown.
- Override rules. A human warden can always overrule the count. The system informs the decision; it does not make it. Define who holds that authority.
- Evidence retention. What is recorded, who can access it, how long it is kept, and under what rule it becomes part of the incident record. Set the clock to the minimum your obligations require.
Each of those lines maps onto an obligation your regulators already expect you to meet. Singapore's Workplace Safety and Health framework and the SCDF's emergency-response-plan requirements expect a workable evacuation and accounting procedure; Malaysia's Fire Services Act, BOMBA, and DOSH expectations run the same way for drills and emergency response. None of them prescribes a camera. All of them ask whether your procedure actually accounts for everyone on site — and a drill-verification walkthrough almost always exposes the same gap: the procedure accounts for staff and loses contractors and visitors.
From clipboard to live board
The shift this enables is small to describe and large in a crisis. Instead of a warden reconciling a stale list under pressure, the assembly point gets a live board: zone by zone, how many bodies remain, decaying toward zero as people clear. The warden's job changes from counting to verifying — chasing the specific zone that still shows two people inside, rather than trying to account for the whole site at once. That is the difference between a muster you hope is right and one you can stand behind afterwards.
Hypernology's safety capability runs this on existing camera infrastructure, which is the point: no new sensors to mount, no new network to run, the governance decisions made by your EHS team rather than assumed by a vendor.
The rule
A muster list is only as good as your ability to verify it. If the process cannot account for the contractor who left at lunch, the visitor who was never badged, and the two people who shared one swipe, it is producing a number you cannot defend. Decide the governance first, then let the cameras you already own produce a count you can.
Send us one site's zone map and your current evacuation procedure, and within two weeks we return a muster-verification plan: which zones your existing cameras already cover for presence counting, the identity and retention policy options with their privacy trade-offs laid out, and where the gaps in your current headcount process sit. No contract until the plan survives your own EHS review.
Send a zone map and get a muster-verification plan, privacy trade-offs included, back in two weeks.
