Factory Acceptance Testing

Why test in the shop

A wiring error found on the shop floor is fixed in ten minutes with the panel open on a bench. The same error found at the site is found at three in the afternoon with a crane waiting, a contractor billing, and the old system already disconnected. A logic error found in the shop is a conversation; found at startup it is an overflow. The FAT exists to move the discovery of errors to the place where they are cheap, and it works only if it is a real test rather than a demonstration.

Before the test

• The panel is complete, inspected against the drawings, and has passed its own shop checks: point-to-point wiring, insulation, and power-up.
• The program is complete against the narrative and has been checked by someone other than its author.
• The control narrative, the sequences, the cause and effect matrix, the I/O list, and the HMI displays are at an approved revision. Testing against a draft produces a punch list of arguments.
• The FAT procedure is written, reviewed by the owner, and issued, with a step for everything that will be tested and an expected result for every step.
• The simulation is built: switches and signal sources for the I/O, or a simulation program that stands in for the field, and the means to fail things on purpose.
• The witnesses are named and the schedule agreed. A FAT nobody from the owner attends is a shop test.

What is tested

1. 1

   Hardware inspection.

   Against the drawings and the bill of materials: every component, its rating, its label, every wire number, the enclosure type and its markings, the SCCR label, and the UL listing mark if the panel is listed.

2. 2

   Power and distribution.

   Power up in stages. Confirm every voltage at every distribution point, every fuse and breaker sized as drawn, and every supply within its load.

3. 3

   Every I/O point.

   Each input driven from the simulation and observed in the program and on the HMI; each output commanded and observed at the terminal. Every point on the I/O list, with a checkmark against it.

4. 4

   Analog scaling.

   Each analog input at 4, 12, and 20 mA, reading the expected engineering value; each analog output commanded to 0, 50, and 100 percent and measured.

5. 5

   Modes and sequences.

   Hand, off, and auto for each piece of equipment behave as the narrative says. Each sequence walked step by step, each transition forced, each timeout allowed to expire and its response observed.

6. 6

   Interlocks and trips.

   The cause and effect matrix row by row: force the cause, confirm the effects, confirm the reset.

7. 7

   Alarms.

   Every alarm raised, seen on the HMI with the right priority and text, acknowledged, cleared. Notification to the dialer or the messaging system, if it is in scope.

8. 8

   HMI.

   Every display, every navigation path, every adjustable value against its range, every permission level.

9. 9

   Communications.

   To SCADA, to drives, to remote I/O, to whatever the panel talks to, with the real protocol and a simulated or real partner.

10. 10

    Failure modes.

    Fail each transmitter out of range. Disconnect each communication link. Remove power and restore it in each state. Fault the processor. Observe the behavior the narrative specifies.

Simulation

The field is not in the shop, so something has to stand in for it. For a small panel, a box of toggle switches on the discrete inputs and a loop calibrator on the analog inputs is enough, and the outputs are watched at the terminals. For a larger system, a simulation routine in a second controller or in the same controller behind a simulation flag models the process well enough that a pump start raises a flow and a level falls as the pump runs, so that sequences can run end to end without a person clicking through each transition. The simulation is removed or disabled before shipment, and the removal is a step in the procedure.

The record

Each step in the procedure is marked pass or fail, with the initials of the tester and the witness and the date. A failed step generates a punch list item with a number, a description, an owner, and a due date. Items are fixed and re-tested, and the re-test is recorded. At the end, the parties sign that the test was performed against the listed document revisions with the listed punch list open. A FAT sign-off with open items is normal; the sign-off says what those items are, and shipment proceeds or waits depending on them.

What the FAT does not prove

It proves the panel and the program against the documents and against a simulated field. It does not prove the field wiring, the instruments, the real process dynamics, the real network, or the operators. Those are the site acceptance test. A system that passed its FAT and fails at site failed in one of those places, which is a useful thing to know at the site.