BSL-3 Laboratory Commissioning: FAT, SAT, IQ/OQ, Airflow Tests and Biosafety Acceptance

A controls contractor running a shutdown sequence during programming — without the commissioning agent present — produced a ceiling collapse, damaged lab gas piping, and pushed a planned September occupancy past its deadline at roughly a million dollars in rework. That outcome was not the result of a single technical failure; it was the result of an acceptance layer that was never sequenced into the project at the right time. The ceiling had been constructed, the controls were being programmed, and failure scenario testing had not yet been formally scoped or witnessed — a gap that only became visible under live conditions. Understanding which tests must be completed, in which order, and under whose documented authority is the judgment that separates a clean handover from one that reopens prior qualification records and delays occupancy by months.

FAT Evidence Before Site Installation Checks

Factory acceptance testing is where the commissioning sequence earns its credibility — or loses it quietly. When FAT scope is treated as a vendor sign-off rather than an evidence-generating phase, the gaps it leaves tend to surface at the worst possible moment: during site testing under live conditions, when rework is expensive and schedule pressure is highest.

The structural integrity of the ceiling assembly under pressure fluctuations is one of the most underestimated FAT criteria. In projects where suspended ceilings are used without structurally framed support, pressure changes during failure scenario testing can cause physical failure of the ceiling system itself. One documented project case resulted in over a million dollars in rework and a missed occupancy date after this condition was not tested or anticipated before construction reached near-completion. The consequence is not just physical damage — it is the forced reopening of installation qualification records and the re-running of airflow demonstrations that had already been considered closed.

A separate FAT criterion that requires more careful scoping than it typically receives is the balance between airtightness targets and directional airflow robustness. Higher airtightness reduces leakage, but under certain failure conditions — particularly during fan speed mismatches or controlled shutdowns — it can make directional airflow harder to maintain. If FAT scope does not include simulated pressure change scenarios that test this balance, the project may install a system optimized for static conditions that behaves unpredictably under the dynamic conditions that matter most for biosafety. Each of these pitfall patterns has a corresponding FAT verification criterion.

The practical implication is that FAT scope should be written with failure conditions in mind, not just normal operating parameters. A FAT package that documents only steady-state performance leaves the commissioning team without the evidence it needs to make a defensible case at any subsequent review.

SAT, IQ/OQ, Airflow Testing, and Alarm Response Sequence

Site acceptance testing, installation qualification, and operational qualification are not parallel activities that can be compressed or reordered without consequence. The sequence carries a logic: IQ confirms that what was installed matches the design intent; OQ confirms that it functions within specified ranges; SAT confirms that it performs under actual site conditions, including the failure scenarios that FAT may have approximated but not fully replicated. Collapsing these phases — or treating OQ sign-off as a proxy for failure scenario validation — is where most commissioning schedules accumulate hidden risk.

The CDC requirement for documented proof that no reversal of airflow occurs under normal operations 그리고 failure conditions is one of the clearest regulatory anchors in this sequence. Meeting that requirement on paper requires that the building automation system trending data be recorded at intervals small enough to demonstrate continuity of directional airflow through transitions, not just at steady state. OQ protocols that define trending increments too broadly leave a gap that is difficult to defend during a regulatory review, even if the system was functioning correctly at the time of testing. The ANSI/ASSE Z9.14 ventilation performance verification protocol provides additional context on how verification testing for BSL-3 systems should be structured to meet these documentation expectations.

Shutdown and restart sequences deserve specific attention in OQ because this is where airflow reversal most commonly occurs in practice. When supply and exhaust fans ramp down or up at different speeds — a condition that can result from default controller settings rather than deliberate design — the pressure differential across the room boundary can momentarily reverse. This is not a universal failure mode, but it is an operationally documented pattern that should be explicitly included in the SAT scenario matrix rather than assumed to be covered by general HVAC functional testing.

Static pressure transmitter failure is a different category of risk: not a transitional condition but a component failure that can persist undetected. In one documented case, a failed transmitter caused supply fans to continue operating after exhaust fan failure, over-pressurizing the room and damaging lab gas piping. The alarm response validation must include this scenario — not as a theoretical edge case but as a confirmed test condition with documented pass criteria. Alarm response testing that covers only sensor threshold exceedances without simulating sensor failure itself leaves a functional gap in the qualification record. The WHO Laboratory Biosafety Manual 4th Edition reinforces the containment intent behind these requirements, emphasizing that primary and secondary containment systems must maintain reliable function under failure conditions, not only under normal operating parameters.

The test scenario matrix above defines the minimum scope for a defensible OQ and SAT record. Any scenario not covered in formal testing remains an open question at handover — and open questions at handover tend to become deviations that reopen the qualification sequence.

Acceptance Layers That Prevent Open Handover Deviations

The phrase “acceptance layer” is sometimes used loosely to mean a signature on a checklist. In a BSL-3 commissioning sequence, each layer has a functional role: it generates evidence that gates the next phase and defines the conditions under which that phase can begin. When a layer is skipped or deferred, the consequence is rarely a clean gap — it is a cascade that forces retesting of phases that were considered complete.

The University of South Alabama case illustrates this with unusual clarity. Construction was 95% complete when independent verification was engaged for the first time. Failure scenario testing had not yet been executed. When a ceiling collapse occurred during that testing, it did not merely delay occupancy — it reopened installation records, required physical reconstruction, and compressed the remaining commissioning schedule into conditions that were poorly suited to the careful, witnessed testing that CDC-required airflow verification demands. The occupancy target of September 2013 was missed, and the rework cost approached a million dollars. The lesson is not that independent verification is expensive; it is that engaging it at 95% construction completion means every prior phase was completed without the oversight that failure scenario testing requires.

The practical structure that prevents this pattern is treating each acceptance layer as a condition that must be formally closed before the next phase begins — not as a parallel track that can be reconciled later. FAT evidence must exist before installation qualification begins. Installation qualification must be signed off before operational qualification starts. OQ records must reflect the full failure scenario matrix before SAT is executed under live site conditions. And SAT must be complete — with deviations formally dispositioned, not just noted — before any biosafety review can support a release recommendation. A deviation that is “in progress” at handover is not a minor administrative item; it is an open condition that blocks the release logic and often forces re-running the tests that generated it.

The BIBO commissioning checklist patterns documented in FAT, SAT, IQ, and OQ points that commonly get missed reflect a closely related set of acceptance layer gaps — many of which originate in the same sequencing failure: treating acceptance documentation as a post-hoc activity rather than a phase gate.

Factory Testing Versus Site-Heavy Commissioning Tradeoffs

The choice between investing heavily in factory testing versus absorbing more validation work on-site is a real project trade-off, but it is often poorly framed in the scope documents where it matters most. Both approaches carry risk. The question is which risk the project schedule and design maturity can tolerate.

Factory-heavy commissioning reduces site uncertainty by resolving airtightness performance, control logic behavior, and component failure responses before the system is installed in the facility. For modular BSL-3 systems — such as prefabricated module laboratory configurations where significant integration can be completed and tested before shipment — FAT can cover a meaningful portion of the scenario matrix that would otherwise be executed on-site. This compresses the site commissioning timeline and reduces the probability that a late-discovered failure, such as a ceiling structural issue under pressure cycling, surfaces during the compressed window when site conditions are hardest to control. Qualia Bio’s BSL-3/BSL-4 모듈 실험실 그리고 모바일 BSL-3/BSL-4 모듈 실험실 systems are designed with this integration logic in mind, allowing FAT to capture performance evidence that travels with the unit to site.

Site-heavy commissioning offers a different kind of flexibility: the ability to absorb late design changes, accommodate field conditions that diverged from drawings, and run integrated tests against the actual facility infrastructure. The problem is that this flexibility is consumed exactly when CDC-required failure scenario testing demands controlled, deliberate conditions. Shutdown and restart sequences, transmitter failure simulations, and power loss events are not tests that benefit from a compressed schedule or an uncoordinated site environment. The University of South Alabama case is a direct illustration of what happens when those tests are deferred to a late-stage, site-heavy phase: the conditions that make failure scenario testing safe and controlled are precisely the conditions that have been compressed away.

The decision criterion that resolves this trade-off in practice is not which approach is generally better but when in the project lifecycle the commissioning agent is engaged. Early involvement — from design phase — allows the FAT scope to be written against the actual failure modes that matter for the specific facility configuration. Late involvement reduces the commissioning agent to a reviewer of work that was already done under conditions they did not define.

Supplier and EPC Ownership of Integrated Room Tests

Ownership of integrated room performance tests is one of the most consistently unresolved friction points in BSL-3 commissioning, and the consequences of leaving it unresolved are not theoretical. When the controls contractor and the EPC are operating under separate scope definitions, both may assume the other party is responsible for coordinating live failure scenario testing. The result is that testing happens — but not under witnessed, controlled conditions with the commissioning agent present.

The ceiling collapse in the documented university project was a direct product of this coordination failure. The controls contractor performed a controlled shutdown during programming — a reasonable action within their scope — without notifying the commissioning agent or the design team. The test was not a formal failure scenario test by anyone’s definition; it was a programming step. But under live site conditions, with a suspended ceiling that had not been structurally validated under pressure change, it produced exactly the failure that formal testing was meant to catch in a controlled way. The distinction between “programming action” and “failure scenario test” was invisible to the controls contractor because no coordinating authority had defined that boundary.

The fix is contractual and procedural, not technical. The commissioning agent must be designated as the coordinating authority for any live test involving system shutdown, power interruption, or control sequence modification — regardless of whether that test originates from the controls contractor’s scope, the EPC’s commissioning checklist, or the owner’s verification plan. Any control sequence modification during integrated testing should require commissioning agent approval before implementation. These are not bureaucratic requirements; they are the mechanism that converts a programming step into a witnessed, documented test event.

The contract language that resolves this must be specific about notice requirements and joint execution — not just about who “owns” the test. Ownership without a defined escalation path for coordination failures reproduces the same gap.

Release Condition for BSL-3 Laboratory Occupancy

Release for use is not a milestone that can be declared on schedule and reconciled later. It is a conditional state that becomes available only when each critical function — directional airflow under failure conditions, alarm response to component failures, containment integrity under power loss — has a passed test record and a formally dispositioned deviation register. If either condition is absent, release has not been earned; it has been assumed.

The delayed occupancy at the University of South Alabama is useful here not as a regulatory citation but as a planning case. The occupancy date was targeted for September 2013. The ceiling collapse during failure scenario testing made that date impossible — not because the schedule was aggressive, but because the commissioning sequence had not been structured to ensure that all critical function tests were completed and witnessed before the occupancy declaration was made. The cost of the missed release was not only the rework; it was the compression of the remaining commissioning sequence into conditions where careful testing was hardest to execute. That downstream consequence — a compressed, high-pressure re-test environment — is the practical argument for treating release conditions as non-negotiable prerequisites rather than administrative formalities.

The WHO Laboratory Biosafety Manual 4th Edition frames biosafety verification as a condition that must be demonstrated before a containment facility is placed into service. That framing is consistent with the release logic that commissioning best practice supports: demonstrated performance under the full scenario matrix, with deviations closed and documented, before any occupancy. In practice, this means the release condition should be defined in the commissioning plan before construction begins — not negotiated at the end of the schedule when pressure to occupy is highest. Defining it early makes it harder to compress later. For projects involving VHP decontamination systems as part of the release sequence, the IQ/OQ/PQ logic described for hydrogen peroxide systems follows the same prerequisite structure: each qualification phase must close before the next begins, and PQ evidence must exist before the system is considered ready for use.

The single most defensible position at occupancy is a commissioning dossier in which every critical function test has a pass record, every deviation has a formal disposition, and the biosafety review has access to the complete airflow trending data — at the increment resolution that demonstrates no reversal. That is the evidentiary standard that makes a release declaration hold under regulatory scrutiny.

The sequencing logic in BSL-3 commissioning — FAT evidence, then installation qualification, then operational qualification, then SAT, then airflow and alarm response verification, then biosafety review — functions as a load-bearing structure, not a checklist. Each phase generates the evidence that makes the next phase defensible. When one layer is deferred or compressed, the impact does not stay contained to that phase: it propagates forward, forcing re-tests in phases that were already considered closed and creating exactly the kind of compressed, high-pressure commissioning environment in which critical failure scenario tests are hardest to execute carefully.

Before finalizing the commissioning plan for a BSL-3 project, the most important questions to confirm are: when the independent commissioning agent is engaged relative to design completion, who holds coordinating authority over live failure scenario tests, and whether the release conditions — including deviation disposition and BAS trending resolution — are defined in writing before construction begins. Answering those three questions early is what keeps the sequence intact when site conditions become complicated.

자주 묻는 질문

Q: What happens if the independent commissioning agent is brought in after construction is already complete?
A: Engaging the commissioning agent after construction is complete significantly increases the risk of costly rework and missed occupancy. At that stage, every prior phase — ceiling construction, controls programming, installation qualification — has already been executed without the oversight that witnessed failure scenario testing requires. When a failure surfaces during late-stage testing, as it did in the University of South Alabama case at 95% completion, it does not just delay one test; it forces reopening of installation records and re-running of phases already considered closed. The agent needs to be involved from the design phase to write FAT scope against the actual failure modes that matter for the specific facility configuration.

Q: If the project uses a modular BSL-3 system with extensive FAT coverage, does site-based OQ still need to include shutdown and restart sequences?
A: Yes — shutdown and restart sequences must still be executed and documented in the site OQ, even when FAT coverage is extensive. The reason is that fan ramping behavior under actual site infrastructure — including local power characteristics, BAS network latency, and field-installed controller settings — can differ from factory conditions. Airflow reversal during these transitions is an operationally documented failure pattern, and CDC requires proof of no reversal under failure conditions, not just under steady-state operation. FAT evidence reduces uncertainty but does not substitute for witnessed site verification of the same scenarios under live conditions.

Q: When does a deviation remain open long enough to block the release decision?
A: Any deviation that has not been formally dispositioned — meaning reviewed, assessed for impact on containment function, and closed with documented rationale — blocks release. An open deviation is not a minor administrative item at handover; it is an unresolved condition that prevents the commissioning dossier from meeting the evidentiary standard required for a defensible occupancy declaration. If the deviation affects a critical function such as directional airflow, alarm response, or containment integrity, it must be re-tested with a pass record before the biosafety review can support a release recommendation.

Q: Is it safer to assign integrated room test ownership entirely to the EPC rather than splitting it with the supplier?
A: Assigning ownership to a single party does not resolve the risk unless that party has explicit contractual authority to halt or approve any live test action — including programming steps by the controls contractor. The ceiling collapse documented in the article occurred because a programming action by the controls contractor, which was within their scope, was not treated as a test event requiring commissioning agent presence. Whether the EPC or supplier holds nominal ownership matters less than whether the commissioning agent is designated as the coordinating authority for any action involving system shutdown, power interruption, or control sequence modification, with defined notice requirements before implementation.

Q: How specific do release conditions need to be in the commissioning plan before construction starts?
A: Release conditions should be defined precisely enough that they cannot be renegotiated under schedule pressure at the end of the project. At minimum, the plan should specify the full failure scenario matrix required for SAT sign-off, the BAS trending increment resolution required to demonstrate no airflow reversal to CDC standards, the deviation disposition standard required before biosafety review, and the identity of the authority who signs the release recommendation. Vague language such as “all tests complete” creates the opening for compressed, end-of-schedule negotiations that erode exactly the conditions — deliberate, witnessed, documented — that critical failure scenario testing requires to be valid.