Across Hypernology's 47 production contracts, hot-work operations — welding, grinding, cutting, and brazing in or near production areas — are among the most consistently under-monitored high-risk activities in routine maintenance schedules. The permit-to-work process is well understood. The fire-watch requirement is documented. The gap is between what the permit says should happen and what the monitoring record can confirm actually happened.
This post covers what the fire-watch requirement means in practice, why permit documentation creates liability without watch verification, how AI presence monitoring on existing CCTV closes the continuity gap, and what this approach aligns with under Singapore's WSH Act hot-work requirements and Malaysia's DOSH and Fire Services Act framework.
The permit is not the control
A hot-work permit documents that a risk assessment was conducted, that the work area was inspected and cleared, that flammable materials were removed or shielded, and that a fire-watch was assigned. It is a process document. It records that the administrative controls were in place at the time the permit was issued.
It does not record what happened during the work window.
The fire-watch requirement is continuous human presence in the work area for the duration of the hot work and for the post-work observation period, which under typical industrial safety standards runs 30–60 minutes after the work stops. The watch is required to observe the work area, hold a charged extinguisher, and maintain a clear line of sight to the ignition source. The watch is not authorised to perform concurrent work tasks that interrupt observation.
These requirements are well established. The enforcement challenge is time. A maintenance window for a routine vessel repair might run 4–6 hours. The fire-watch duty is continuous throughout. Watch coverage lapses. The watch steps out for a comfort break. A supervisor pulls the watch person for 10 minutes to help with an adjacent task. The watch logs 6 hours of coverage on the permit close-out form because that is the permit duration, not because 6 hours of uninterrupted watch coverage was verified.
The permit close-out form shows the work was completed. It does not show that the watch held position throughout.
From asserted coverage to a verified record
A Busan-based manufacturer running scheduled quarterly maintenance reviewed their permit close-out forms at year end and found 100% of their 34 hot-work permits showed "watch present for full duration." That was the form. When they added camera-based presence monitoring during the following quarter's maintenance schedule, the first 6-week run of permit monitoring produced a different picture: 12 coverage gaps across 8 permits, all between 2 and 11 minutes in duration. No extended absences. No incidents. But the difference between the asserted record and the verified record was visible for the first time. Their EHS manager described it as "the gap between paperwork safety and observed safety." Both existed in parallel — the paperwork said one thing, the camera log said another, and neither had previously been compared.
The 12 gaps were not evidence of negligence. The watch assignments were filled by experienced, diligent workers. The gaps were caused by the routine pressures of a busy maintenance window. They were correctable once visible. The point is that they were invisible before the coverage log existed.
The corrective action was specific because the data was specific. Not "remind the crew about fire-watch duties during the pre-work briefing" — a generic response to a generic problem. Instead: "The three longest gaps occurred in the afternoon session, between 13:45 and 16:00. The watch during that window was the same person across all three permits. We reassigned the watch role for afternoon sessions and the pattern did not recur." Generic problems get generic responses. Specific data gets specific fixes.
The relationship between hot-work permits and the broader permit-to-work system
Hot-work permits are one category of a broader permit-to-work system that most industrial facilities operate. The same camera coverage that monitors fire-watch presence during a hot-work window can run presence and zone rules during confined-space entry permits, height-work permits, and electrical isolation permits — wherever the permit requires a specific person to maintain continuous presence or a specific zone to remain clear of unauthorised entry.
The monitoring configuration for each permit type follows the same pattern: define the zone, set the presence rule (required or excluded), configure the threshold and alert routing. The permit log becomes the coverage log. The permit authority receives the same alert interface regardless of the permit type.
For EHS teams managing multiple concurrent permit types during a planned maintenance shutdown — where hot-work permits, confined-space entries, and height-work permits may all be active simultaneously in different parts of the plant — the shared camera infrastructure means the monitoring coverage scales with the existing camera estate, not with the number of permits.
The liability structure of a permit without watch verification
When fire investigators and WSH inspectors review incidents that occurred during permitted hot work, the pattern they document is not permit-system failure — it is watch-coverage failure. The permit was issued. The precautions were noted. The watch was assigned. The fire developed in the window when the assigned watch was not in position.
Under Singapore's WSH (Risk Management) Regulations and the Fire Safety Act, a hot-work permit issued for work in an occupied building or production facility requires that the appointed fire-watch maintains continuous observation for the duration of the work. The WSH Act imposes duties on the occupier and the contractor to ensure safe work procedures are followed — not just documented. A permit form showing a watch was assigned satisfies the documentation requirement. It does not satisfy the duty to ensure the watch was maintained.
The distinction between documentation and verification is where liability concentrates. The permit creates a record that the host knew hot work was occurring. If an incident occurs and the investigation shows the watch was absent, the permit record is evidence against the host, not for it. The permit said a watch was assigned. The investigation shows the watch left. The permit becomes the liability document.
A permit without verified watch coverage is a liability receipt.
Under Malaysia's DOSH framework and the relevant provisions of the Fire Services Act 1988 governing fire prevention in industrial workplaces, the principal contractor and occupier's duty to maintain safe conditions during permitted hot work extends to verification that the fire-watch duty was performed, not just assigned. The coverage log produced by camera-based monitoring addresses this verification requirement directly.
How AI presence monitoring closes the continuity gap
HyperQ AI Safety runs on existing ONVIF-compatible CCTV in under 1 hour. For hot-work monitoring, the relevant camera is the one covering the work area — already installed as part of the plant's safety surveillance network in most cases. The monitoring configuration for a hot-work window involves three elements:
A work-zone presence rule, active for the permit duration. The zone covering the hot-work area is configured to require continuous human presence. If the zone is detected as unoccupied for longer than a defined threshold — typically 3–5 minutes, configurable to the plant's safe work procedure — an alert routes to the permit authority and the EHS officer.
A fire-watch coverage log. For each minute of the permit window, the system records whether the presence rule was satisfied. The log shows gaps, their duration, and when the alert was generated and acknowledged. At permit close-out, the log attaches to the permit record.
A post-work observation period continuation. After the hot work stops, the presence rule continues for the configured observation period. If the watch leaves the area before the observation period ends, an alert is generated regardless of whether the physical work has stopped.
None of this replaces the fire-watch. The watch is still a person, still required to hold the extinguisher, still required to observe the work area. The AI layer monitors the watch's presence in the zone, not the quality of the observation. It provides the continuous coverage verification that the permit record currently lacks.
What happens when the watch leaves
The most common trigger for the presence alert is not negligence. It is the quiet escalation of a competing priority during a long maintenance window. A 5-hour vessel repair generates a permit window that overlaps with a shift handover, a supervisor check-in, a spill in the adjacent bay. The watch is the most mobile person in the area. They get pulled.
The AI alert routes to the permit authority within the configured threshold. The standard response: the permit authority radios the watch, who returns to position within minutes. The alert is acknowledged in the monitoring interface, the gap is logged with the acknowledgement time, and the permit close-out record includes the gap entry alongside the acknowledgement.
This changes the permit close-out from "watch was present for duration" — asserted and unverified — to a log showing, for example, one 2-minute gap at 14:23, acknowledged at 14:25, watch restored at 14:27 per the clip. A verified record with one documented gap and a clean response is more defensible than an asserted perfect record, because it shows the monitoring was operating and the response worked.
Where the watch is absent for an extended period — above the escalation threshold, which most plants set at 10–15 minutes — the alert routes to the next level: site safety officer, shift manager, or the contractor's supervisor. Extended absence without acknowledgement triggers permit suspension guidance to the permit authority.
Permit stage monitoring checklist
The following maps each stage of a hot-work permit to the manual requirement, the AI monitoring layer, and the documentary output it produces.
| Permit stage | Manual requirement | AI monitoring layer | Documentary output |
|---|---|---|---|
| Pre-work area inspection | Permit authority clears flammables; inspects the zone | Camera baseline: zone is clear before permit window opens | Pre-work zone clear confirmation with timestamp |
| Work window — active phase | Fire-watch in position, extinguisher charged, continuous observation | Presence rule active; alert if zone empty beyond threshold | Coverage log — presence confirmed per minute of window |
| Watch absence — short gap | Watch returns before alert escalates | Alert generated; acknowledged within threshold | Gap log: duration, alert time, acknowledgement time |
| Watch absence — extended | Permit authority contacted; suspension evaluated | Escalation alert to next level; suspension recommended | Extended-gap log with escalation routing record |
| Post-work observation period | Watch remains in area 30–60 min after hot work stops | Presence rule continues through observation period | Observation period coverage log with work-stop timestamp |
| Permit close-out | Permit authority signs off; form filed | Full coverage log exported | Permit record with verified coverage timeline attached |
Hardware cost for maintenance window monitoring
For a scheduled maintenance shutdown, the hot-work monitoring requirement typically covers multiple concurrent permit windows: welding on a vessel, grinding near an exhaust stack, cutting work in the maintenance cage. Each permit has an assigned watch; each watch position is a monitoring point.
If each monitoring point required dedicated hardware, the cost scales with permit count. Camera-based monitoring on the existing ONVIF network does not scale the same way: the cameras covering the permit areas are already installed. Configuring a new permit window takes minutes.
The 30–50% hardware cost reduction from running on existing cameras, versus installing a proprietary hardware-locked monitoring system, shows most clearly in scheduled maintenance shutdowns where multiple permit areas need simultaneous coverage for a defined period. The coverage comes from configuration, not from additional hardware.
For plants where existing cameras do not fully cover all active permit areas, additional cameras can be added at standard ONVIF-compatible hardware pricing rather than proprietary system pricing. The monitoring layer runs on whatever ONVIF camera covers the zone.
Where camera monitoring does not substitute for the watch
Presence monitoring verifies that someone was in the zone. It does not confirm that the fire-watch was observing the work area rather than looking at a phone. It does not confirm that the extinguisher is charged. It does not confirm that the watch would recognise the early signs of heat transfer through a bulkhead.
Those aspects of the fire-watch requirement are not addressable by camera monitoring. The watch requirement exists because response to a developing fire needs a trained person with the right equipment in the right position. The AI layer confirms the person was in position. It does not replace any other element of the duty.
The practical value is that watch absence during the permit window — the most common failure mode — is directly addressed. The watch who is trained, equipped, and positioned correctly generates a coverage log that reflects this. The watch who is absent for extended periods is identified by the same log, and the permit authority has a documented basis for the follow-up conversation.
For plants using a contractor-managed fire-watch — where the watch is the contractor's worker rather than the host plant's EHS staff — the coverage log addresses the audit question about contractor safety management: the host plant can show that the contractor's assigned watch was in position for the permit window, or show the specific gaps and responses, without relying on the contractor's own close-out form.
This connection between hot-work watch coverage and the broader contractor safety programme links to the contractor gate and site-access monitoring architecture: the same ONVIF camera network that verifies PPE at the gate verifies watch presence during the permit window. Two control points on one infrastructure.
For the broader question of what camera monitoring evidence satisfies under the ISO 45001 continuous monitoring and measurement of operational controls requirement, the hot-work coverage log is a documented, timestamped output that maps directly to Clause 9.1 monitoring obligations for high-hazard operations.
Send us your hot-work permit log from the last month — we'll identify where coverage gaps typically appear in your maintenance schedule and show you which camera positions cover each active permit zone. Two weeks to a working coverage log; no contract until you've seen the verified record on your own infrastructure.