BSL-3/4 SAT Checklist for Integrated Systems: Utilities, Controls, Alarms, HEPA, VHP and EDS

Integrated BSL-3/4 systems fail SAT not because individual components are defective, but because the connections between them — utilities, controls, HEPA exhaust, VHP delivery, and EDS interfaces — were never tested under conditions that reflect how the building actually operates. The result is often unstable pressure during a first door-opening test, a VHP cycle that cannot complete because exhaust damper logic was never confirmed, or alarm records that cannot be traced back to calibrated sensors. Those failures are recoverable before qualification starts; they become expensive after IQ/OQ records are issued. The practical judgment this checklist supports is knowing which integrated behaviors must demonstrate pass records before qualification begins, and which unresolved items can transfer forward only if they carry a documented, risk-based disposition.

Installed utilities in SAT readiness checks

The most common reason SAT test records are later challenged is that testing started before the installed utilities were stable enough to support repeatable results. When supply pressure is inconsistent, exhaust flow is not balanced, or temporary connections are still in place, a failed test cannot be assigned to the system under evaluation — it may simply reflect the building’s unfinished state. That ambiguity is difficult to resolve downstream, particularly when the same records are expected to underpin IQ documentation.

Before SAT begins, the utility state that actually exists at the equipment interface should be confirmed, not assumed. That means verifying that supply air volumes and pressures are within the range the controls were configured to handle, that exhaust connections are permanent and balanced, that electrical feeds match the load requirements the equipment was factory-tested against, and that calibrated instruments are installed at the points where data will be recorded. Emergency power coverage and exhaust redundancy should also be in place, not scheduled — testing system behavior during a simulated utility disruption is only defensible if the backup systems are actually connected.

Envelope integrity is part of this readiness check. SAT is the first opportunity to walk joints, penetrations, door seals, pass-throughs, and glazing under as-installed conditions. Identifying a leaking penetration or a door gasket that was compressed out of specification during installation is straightforward to resolve at this stage. Discovering the same issue during pressure cascade testing, or worse, during a qualification run, converts a minor construction deficiency into a formal deviation that requires root-cause documentation and schedule recovery. The SAT readiness check is not a ceremonial precondition; it is a practical gate that determines whether subsequent test results will be assignable.

Controls and alarms verified before IQ/OQ

Pressure control systems that perform acceptably under static conditions can behave very differently during the disturbances that characterize normal BSL-3/4 operation. A door opening in the anteroom, a filter that has accumulated loading between maintenance cycles, or a temporary exhaust imbalance during a supply disruption can all expose weaknesses in pressure control logic that a single-setpoint check will never reveal. When those weaknesses are not caught during SAT, they tend to surface during qualification runs, where a failed pressure recovery test is a formal event with schedule and documentation consequences.

The verification focus for controls and alarms should go beyond confirming that setpoints are programmed correctly. Dynamic response logic — including alarm threshold sequencing, redundancy switchover, and the system’s ability to recover containment after an upset — needs to be demonstrated under disturbance conditions, not just at steady state. BMS integration also requires attention here: if alarm signals are not mapped correctly to the building management layer, or if the priority hierarchy does not match the facility’s intended response protocol, those gaps will not be apparent until a real alarm event occurs. ASTM E2500-25, which provides a science- and risk-based framework for specification and verification of pharmaceutical manufacturing systems, supports the principle that integration between control systems should be verified against defined functional requirements rather than inferred from equipment specification sheets alone.

The practical implication is that controls and alarm verification during SAT is the last stage where the supplier’s logic can be challenged and changed without generating a formal change control record against a qualified system. After IQ/OQ, any modification to alarm thresholds, interlocks, or BMS mapping is a validated system change. Teams that defer controls verification to qualification often find that the cost of a single logic revision — in documentation, re-testing, and schedule — exceeds what it would have cost to resolve the same issue during SAT.

HEPA, VHP and EDS interface records

HEPA, VHP, and EDS are often treated as separate commissioning workstreams, but their interfaces with the same building envelope create dependencies that SAT must verify jointly. A HEPA housing that was installed without confirming filter integrity test access, for example, may require partial disassembly before the first scan test can be conducted — converting a routine commissioning step into a mechanical modification that delays the entire qualification sequence. The Mise en sac Mise en sac filter housing configuration addresses this by design, but the interface between the housing, the exhaust duct, and the room pressure control system still requires site-specific confirmation during SAT.

VHP compatibility requires more than confirming that the generator delivered the specified hydrogen peroxide concentration at FAT. At site, the verification must establish that surface materials, gaskets, door seals, sensor housings, and any penetration fittings installed during construction are compatible with repeated VHP exposure. Material degradation from VHP chemistry is cumulative and typically not visible until a seal fails or a surface becomes difficult to clean. A Générateur de peroxyde d'hydrogène VHP can deliver consistent cycles, but if the room envelope includes components that were substituted during construction without a compatibility check, VHP distribution results will eventually become inconsistent. ISO 14644-3:2019, which governs cleanroom test methods including filter installation leak testing, provides a reference framework for the HEPA integrity testing methodology; VHP compatibility and EDS digital traceability are separate verification domains that sit outside its scope.

EDS interface records carry a specific audit function that is often underestimated during SAT. Event logs, integrated monitoring continuity, and trend data from the EDS are likely to be reviewed during regulatory inspections as evidence that liquid waste decontamination was functioning throughout the qualification period. If those records are not structured for digital traceability from the point SAT begins, the gap is retroactively difficult to fill.

The consequence of missing interface records is not primarily a qualification delay — it is a defensibility problem. An inspector who asks for the commissioning basis of a HEPA integrity scan result, a VHP distribution map, or an EDS event log from early in the qualification period is asking for evidence that should have been captured during SAT. If those records were not structured to support that question, the gap will require a formal explanation.

Shared punch list between supplier and facility teams

When supplier and facility teams operate from separate punch lists, items assigned to one side are frequently unknown to the other until a schedule conflict surfaces them. The result is that validation-critical milestones — pressure testing completion, controls handover, utility qualification sign-off — get treated as internal workstream closures rather than shared gates. By the time both teams try to reconcile their records before IQ, the discrepancies in acceptance criteria, responsible parties, and item status can take longer to resolve than the items themselves.

The procurement phase is the right time to establish shared accountability structure. Requiring bidders to identify long-lead items, site dependencies, and validation-critical milestones during proposal review — before contract award — makes schedule assumptions explicit rather than implicit. A responsibility matrix that assigns design, fabrication, installation, controls, and commissioning responsibilities to named parties gives both teams a reference they can use to resolve disputes without renegotiating scope. For complex integrated systems, this structure is not administrative formality; it is the mechanism that determines whether SAT can be executed as a joint activity with jointly defensible records. More detail on how these commissioning handover points are typically structured can be found in the commissioning your BSL-3 lab step-by-step guide.

Pre-SAT commissioning documents should define acceptance criteria that both teams can use to evaluate the same outcome. Generic language — “system performs as specified” or “controls are functional” — cannot support a disposition decision when a result is borderline. The only punch list items that can be carried forward as controlled open items are those where both teams have agreed on the criterion, recorded the actual result, and documented the risk basis for deferral. Items where the criterion was never defined cannot be closed, deferred, or dispositioned; they can only be argued about.

Open item disposition before qualification starts

The classification decision — determining which unresolved SAT items are genuinely blocking and which can transfer as controlled open items — is where integrated system qualification most often stalls unnecessarily, or proceeds with silent risk. Teams that apply a blanket hold until everything is resolved lose schedule on items that have no plausible path to affecting qualification outcomes. Teams that carry items forward without documented disposition create a qualification record that cannot withstand a document review asking how each open item was evaluated before IQ began.

The basis for disposition decisions is the design documentation package. If design basis documents define the operating intent, control philosophy, and configuration assumptions clearly, and if the as-built package reflects approved changes with traceable component schedules, then each open item can be evaluated against a known baseline. An item is blocking if its resolution affects a system behavior that will be tested during IQ or OQ. It is transferable as a controlled open item if it can be bounded, assigned, scheduled, and confirmed not to affect the test scope for the next qualification stage. That judgment requires documentation to exist; it cannot be made reliably in its absence. EudraLex Volume 4 Annex 15, which addresses qualification and validation principles including design documentation and change traceability, supports the broader principle that design intent and as-built records must be sufficiently complete to support subsequent qualification activities — though the specific workflow for BSL-3/4 open item disposition is an engineering judgment call rather than a prescriptively defined procedure.

Supplier documentation discipline is a reliable early indicator of how this stage will perform. A supplier that delivered design basis documents late, that logged FAT deviations informally, or that treated change management as an internal administrative function during fabrication is likely to have the same patterns in SAT documentation. That pattern matters because incomplete or ambiguous SAT records are not merely an inconvenience at disposition — they become the formal basis on which qualification decisions are made, and gaps in them cannot be retrospectively remediated without generating new records that auditors will scrutinize.

SAT threshold for integrated system acceptance

The absence of uniform national standards for high-containment laboratory design, commissioning, and operation — a gap noted in a 2013 GAO review — is a practical reason why acceptance criteria in SAT must be defined explicitly by the project team, not imported from generic compliance templates. When both the supplier and facility are working from internally consistent but mutually different interpretations of “acceptable performance,” the SAT record reflects agreement that was never actually reached. That document problem becomes a qualification problem when an inspector asks what criterion the system was accepted against and both teams give different answers.

Pressure cascade confirmation is the clearest example of where specific figures matter more than general statements. Defining that a room must maintain a nominal differential, with a specified tolerance band, and that it must recover to within that band within a defined time after a door disturbance, produces a testable criterion. Stating that the system must “maintain negative pressure” does not. The same logic applies to failure-mode behavior: the acceptance record should show that when a supply fan fault was introduced, the alarm sequence fired in the correct order, the redundant path activated within a defined interval, and the room pressure remained in the containment range throughout the transition. If that test was not run, the failure-mode behavior is unknown — and the qualification record that follows is built on an assumption, not a demonstration.

The BIBO commissioning checklist covering FAT, SAT, IQ, and OQ points that are commonly missed identifies several acceptance criteria gaps that recur specifically at the SAT-to-IQ transition, which is consistent with the broader pattern: generic acceptance language tends to pass internal review and fail external inspection, because internal reviewers know what was intended while inspectors can only evaluate what was written.

The decisions that determine whether an integrated BSL-3/4 system moves cleanly into qualification are not made during IQ or OQ — they are made during SAT, and most of them are made by how well the acceptance criteria were defined before testing started. A checklist that covers utilities readiness, pressure dynamic response, HEPA and VHP interface records, EDS traceability, and alarm integration gives both supplier and facility teams a common reference. But a checklist only functions as a decision gate if every item on it carries a measurable criterion and a named responsible party.

Before proceeding to qualification, the practical confirmation is straightforward: every critical SAT item either has a pass record against a defined criterion or carries a written risk-based disposition that both teams have approved. Items where the criterion was never written cannot be dispositioned; they can only be deferred into the qualification period, where resolving them will cost more in documentation, re-testing, and schedule than resolving them now.

Questions fréquemment posées

Q: Can SAT proceed if only some utilities are stable while others are still being finalized on site?
A: No — partial utility readiness creates test results that cannot be reliably assigned to the system under evaluation. If supply air, exhaust balance, or electrical feeds are not in their permanent, stable configuration when testing begins, a failed result may reflect the building’s unfinished state rather than a system deficiency. That ambiguity is difficult to resolve once the record exists, particularly when the same documentation is expected to underpin IQ. All utility interfaces should be confirmed at the equipment connection point before SAT test execution begins.

Q: After SAT closes, what is the immediate next step before IQ documentation can be initiated?
A: The immediate next step is formal open item disposition — every SAT item must carry either a pass record against a defined criterion or a written, risk-based disposition approved by both supplier and facility teams. IQ documentation cannot begin until that review is complete, because the design basis and as-built package used to evaluate open items is the same documentation that IQ will draw on to establish the qualification baseline. Attempting to initiate IQ while classification of blocking versus transferable items is still unresolved introduces ambiguity into the qualification record that is retroactively difficult to correct.

Q: At what point does the advice in this checklist stop applying — for example, for a BSL-3 facility that is modular or prefabricated rather than site-built?
A: The checklist logic still applies, but the boundary condition shifts. For a modular or prefabricated BSL-3 system, a more substantial portion of integration testing may have been conducted at the factory, which can compress certain SAT workstreams. However, the interfaces that are only established at site — utility connections, exhaust balancing to the building infrastructure, BMS alarm mapping, and EDS integration — cannot be verified at FAT and remain within SAT scope regardless of how much was pre-integrated. The SAT threshold does not shrink; it realigns around the interfaces that are genuinely new at installation.

Q: Is a third-party commissioning agent necessary for SAT on an integrated BSL-3/4 system, or can supplier and facility teams self-certify?
A: Self-certification is possible but carries a specific risk: when the same team that configured a system also accepts its own SAT records, the shared punch list and disposition decisions may not receive independent scrutiny. The practical failure mode is that acceptance criteria drift toward what the system can demonstrate rather than what the design basis required. Whether a third-party commissioning agent is justified depends on the regulatory exposure of the facility and the complexity of the BMS and interlock interfaces — but at minimum, the acceptance criteria and disposition decisions should be reviewed by someone without a schedule incentive to close items quickly.

Q: How should teams weigh the cost of resolving all SAT items before IQ against the schedule pressure to begin qualification earlier?
A: The comparison is not symmetric. Resolving a controls logic gap or an alarm mapping error during SAT costs engineering time and a revised test record. Resolving the same issue after IQ generates a formal change control event, requires re-testing against the qualified baseline, and produces a deviation record that will be visible during regulatory inspection. For items that affect any behavior tested during IQ or OQ — pressure cascade response, failure-mode alarm sequencing, VHP cycle completion logic — early resolution is consistently the lower-cost path. The schedule case for carrying those items forward only holds if a documented risk-based disposition can credibly argue that the unresolved item cannot affect the qualification test scope.