FAT vs SAT for BSL and Containment Equipment: What Should Be Tested Before Shipment and On Site

Qualification delays in containment projects rarely announce themselves at the start. They accumulate quietly in the gap between what was signed off at the factory and what actually works when the equipment is installed — and by the time the gap becomes visible, the schedule pressure to close SAT and move forward is already significant. The most common version of this failure is treating FAT sign-off as evidence that site performance is resolved, when in practice pressure cascade stability, alarm relay logic, and BMS integration have never been tested against the live facility. Remediation at that stage is expensive not just in cost but in the qualification record: retesting after installation introduces ambiguity about which results belong to which configuration. The judgment that prevents this is knowing precisely which functions are factory-verifiable in any meaningful sense, and which ones depend on conditions that cannot exist until the equipment is connected to the building it will operate in.

Factory-verifiable functions before shipment

The strongest candidates for FAT are functions that depend only on the equipment itself — where the factory environment does not introduce a material gap between test conditions and operational conditions. Safety interlock sequences fall into this category. A centrifuge lid interlock that prevents motor start with the lid open, and holds the lock until the rotor has stopped, can be verified completely at the factory because its logic depends on the control system and mechanical assembly, not on site utilities or room airflow. If that interlock fails at SAT, the failure is almost always a transport or reassembly issue, not a gap in the original FAT design — and that distinction matters for how you scope the investigation.

Documentation review carries no site dependency at all. Verifying that material certificates, electrical schematics, and component nameplates match the approved specification is a factory task by definition. Deferring it to SAT wastes site time and often surfaces discrepancies that should have blocked dispatch. For projects with complex multi-component assemblies — OEB4/OEB5 izolatörleri with integrated gloveport arrays and control panels, for instance — document alignment at FAT is the point where component-level errors are cheapest to catch.

SMEPAC containment testing at FAT requires more careful framing. Running it at the factory produces useful baseline data and can catch gross containment failures before the equipment ships. The trade-off is that SMEPAC results are sensitive to the specific conditions under which they are generated — the surrogate compound, activity duration, equipment configuration, and airflow environment all affect the output. If any of those conditions differ materially between the factory test setup and the actual site process, the FAT result provides limited forward reference for qualification. It is baseline data, not site performance evidence.

Site-dependent interfaces that require SAT evidence

Some test categories only become meaningful once the equipment is installed and connected. Attempting to resolve them at the factory, even partially, produces data that cannot be used with confidence in the qualification record.

Utilities integration is the clearest example. A control interface between an isolator or BSL-3/BSL-4 module laboratory and a site SCADA, PLC, or DCS system cannot be fully tested until the factory equipment is connected to the live site network. Protocol compatibility, signal handshaking, alarm relay routing, and interlock acknowledgement sequences all depend on the actual site control architecture. A factory simulation using a representative PLC may catch gross configuration errors, but it cannot confirm that the installed system behaves correctly under site operating conditions, failover scenarios, or concurrent load from other connected assets. SAT is the only valid verification point for those behaviours.

Environmental performance — differential pressure stability, air change rates, particle counts, filter integrity, and temperature and humidity distribution — depends on the installed HVAC system and the actual room geometry. ISO 14644 cleanroom classification is a function of the installed environment, not the factory test chamber. These measurements belong in SAT, referenced against the site-specific URS, not carried forward from factory conditions that may differ significantly in supply air volume, exhaust resistance, or room pressurisation strategy.

SMEPAC testing under actual process conditions carries specific risk if deferred on the assumption that FAT data is sufficient. The API type, activity duration, and equipment configuration used in production may not match what was simulated at the factory. If they differ, the FAT result is not a valid forward reference, and assuming it is creates a containment gap that may not surface until an exposure event or audit review.

Tests that should not be repeated without rationale

The principle is straightforward and is reflected in the framework EudraLex Volume 4 Annex 15 establishes for leveraging prior verified data: if a function was tested rigorously at FAT and transport or installation has not affected the tested condition, repeating the test at IQ/OQ adds procedural burden without adding qualification confidence. The difficulty is that this permission requires a documented basis, not an assumption.

The burden falls on the qualification team to demonstrate that the conditions tested at FAT remain intact after shipment and installation. For control logic, interlock sequences, and alarm configurations that are software-defined and unaffected by physical transport, that case is relatively easy to make, provided the FAT protocol and results are complete and the software version has not changed. For physical measurements — filter integrity, seal continuity, mechanical alignment — the case requires a post-installation inspection that either confirms the condition is unchanged or identifies where retesting is necessary.

The mistake pattern here is not excessive retesting. It is using Annex 15’s efficiency principle as a default rationale for skipping site checks without confirming the transport and installation assumption. Qualification teams under schedule pressure tend to treat the FAT record as a bank of results they can draw on freely, when in practice each draw requires a documented rationale that the tested condition was preserved. Where that rationale cannot be produced, retesting is the only defensible position.

Transport and installation assumptions affecting IQ/OQ

Transport introduces physical risk to equipment that passed FAT in a controlled, static factory environment. The risk is not always visible. Vibration during road or air freight can shift HEPA filter cassettes, displace gaskets, or loosen threaded connections — none of which produces obvious external damage but all of which can alter containment integrity or pressure performance in ways that are only detectable through testing.

For SMEPAC containment data specifically, transport vibration and reassembly of modular components are the two mechanisms most likely to invalidate FAT results without a visible indicator. A HEPA filter that was correctly seated and leak-tested at the factory may arrive with a compromised seal after transit. A VHP geçiş kutusu or transfer isolator reassembled on site after shipping may have door seal geometry that has shifted from the factory-qualified position. In neither case does a visual inspection reliably detect the problem. Functional and containment retesting at SAT is the appropriate response, not an assumption that the factory result carries forward.

The IQ/OQ implication is that the transport damage assessment at SAT is not a formality. If damage is found — or if the inspection cannot confirm the system arrived in the same condition it left — FAT functional results for the affected systems should be treated as conditional rather than confirmed, and retesting should be scoped accordingly.

Punch-list closure between FAT and SAT

Non-conformances identified at FAT that are not closed before dispatch do not disappear — they become disputes. Once equipment is on site, the contractor’s leverage to require factory remediation is reduced, the client’s tolerance for schedule slippage is lower, and the default pressure on both parties is to accept the open item with a deviation rather than resolve it properly. That dynamic is where quality records accumulate entries that are difficult to defend at inspection.

The mechanism for preventing this is straightforward but requires discipline: every non-conformance identified during FAT must be logged, assigned, and either closed with documented evidence or formally deferred with a written rationale before equipment is released for dispatch. The turnover package — which typically includes a summary of deficiencies and open items — establishes the shared reference point between the manufacturer and the client. When that document is absent or incomplete, what constitutes a closed item becomes a matter of interpretation on site, which is exactly the environment in which punch-list disputes take root.

The practical implication for procurement and QA teams is that FAT sign-off should not be treated as the point at which the client accepts the equipment unconditionally. It is the point at which both parties agree on what has been verified, what remains open, and under what conditions dispatch is appropriate. Projects that conflate FAT sign-off with final acceptance consistently face more contested SAT closures. For guidance on how these commissioning checkpoints interact across BIBO systems, the BIBO commissioning checklist covers the specific IQ and OQ points that are most frequently missed.

Handover rule for unresolved site acceptance items

SAT closure is the legal and technical transition point between the commissioning phase and the defects liability period. Until the SAT certificate is jointly signed by the owner’s engineer and the contractor, that transition has not occurred — and without it, responsibility for any defect or failure that emerges is genuinely ambiguous. The signed certificate is not a formality added at the end of a process that is otherwise complete. It is the mechanism that defines completion.

The operational risk of premature closure is downstream, not immediate. If SAT is signed before all utilities, interlocks, alarms, and installed interfaces have either passed or carry a formally approved deviation, the unresolved items are absorbed into the qualification record without a clear remediation path. When those items surface — during OQ, PQ, or routine operation — the project has no clean accountability structure for who resolves them or at whose cost. For containment-critical equipment, where a failed pressure interlock or an unverified BMS alarm relay can affect operator safety or regulatory standing, that ambiguity is not a minor administrative problem.

The standard for closure should be that the SAT summary report lists every required test with its outcome, and that any item not passing holds a formally approved deviation with a documented rationale and remediation plan. An approved deviation is a legitimate closure mechanism. An item that is simply not listed, or listed as pending without a signed deviation, is an open item — and an open item at SAT closure is a future inspection finding waiting for a date.

The FAT-to-SAT boundary is where qualification assumptions either get tested or get buried. A well-structured FAT does real work: it confirms factory-built functions, closes documentation gaps, and creates a credible baseline that SAT and IQ/OQ can build on rather than duplicate. The problem is not FAT — it is the tendency to extend FAT’s authority into territory it cannot cover, treating sign-off in a factory environment as evidence of performance in a facility the equipment has not yet entered.

Before SAT is scheduled, the qualification team should be able to answer three questions with documented evidence: which FAT results are being carried forward and on what basis; which site-dependent interfaces have not yet been verified; and what the punch-list status is for every non-conformance identified at FAT. If any of those answers is unclear or assumed rather than documented, SAT planning has started from an incomplete foundation — and the gaps will become visible at the worst possible point in the project timeline.

Sıkça Sorulan Sorular

Q: Can FAT and SAT be combined into a single site acceptance event to compress the project schedule?
A: Combining them is only defensible for a narrow subset of equipment where no factory-to-site condition gap exists — which is rarely true for containment systems. Pressure cascade stability, BMS alarm relay routing, and HVAC-dependent environmental performance cannot produce valid qualification data until the equipment is connected to the live facility. Collapsing FAT into SAT does not eliminate those dependencies; it removes the earliest opportunity to catch factory-built defects before they become site remediation problems, and it leaves the qualification record with no clean boundary between what was verified under controlled factory conditions and what was verified under installed conditions. For isolators, BSL modules, or any system with utility interfaces, the schedule saving rarely survives the first unresolved SAT punch-list dispute.

Q: If SMEPAC testing was completed at FAT and the surrogate compound and activity duration were representative, does it still need to be repeated at SAT?
A: Yes, unless the qualification team can document that every material condition — API type, equipment configuration, airflow environment, and activity duration — is confirmed identical at the installed site, and that transport and reassembly did not affect seal or filter integrity. In practice, that confirmation requires post-installation inspection evidence, not an assumption. Transport vibration can displace HEPA cassettes or shift door seal geometry without producing visible damage, and either change invalidates the FAT containment data without a clear indicator. Where that inspection cannot affirmatively rule out transport effects, SAT SMEPAC testing is the only defensible position in the qualification record.

Q: At what point does a formally approved deviation become an unacceptable substitute for a passing SAT test result?
A: A deviation is only a legitimate closure mechanism when it carries a documented rationale and a defined remediation plan with an assigned owner and deadline. It stops being acceptable when it is used to absorb items that were never tested — rather than items that were tested and produced a managed non-conformance — or when the remediation plan has no realistic completion path before the equipment enters operational use. For containment-critical functions such as pressure interlocks, BMS alarm relays, or installed HEPA integrity, a deviation that defers verification indefinitely is functionally an open item, and an open item at SAT closure will appear as a finding when the qualification record is reviewed under Annex 15 or ASTM E2500-25 criteria.

Q: Who carries the burden of proof when a post-SAT failure is traced back to a function that was signed off at FAT — the manufacturer or the owner’s qualification team?
A: The burden is shared in a way that depends entirely on how the FAT-to-SAT handoff was documented. If the FAT protocol clearly covers the function, the results show a pass, and the SAT transport damage assessment confirms the system arrived intact, the failure is most likely a site installation or utility integration issue — and accountability sits with the commissioning contractor or facility team. If the transport assessment was cursory, the installation assumption was undocumented, or the FAT result was carried forward without a written rationale confirming the tested condition was preserved, the qualification team cannot cleanly separate manufacturing liability from installation liability. That ambiguity is what a complete turnover package and a rigorous post-installation inspection are specifically designed to prevent.

Q: Is there a threshold of equipment complexity below which the FAT-SAT split becomes unnecessary overhead rather than genuine risk management?
A: For standalone, self-contained equipment with no site utility interfaces, no BMS integration, and no ISO 14644-classified environmental performance requirements, a simplified single-phase acceptance protocol can be justified — provided the qualification rationale documents why site-dependent variables are absent. That threshold is almost never met by containment isolators, BSL module laboratories, or integrated pass-through systems, which by design have pressure, exhaust, HVAC, and control interfaces that are only resolvable on site. The overhead of maintaining the FAT-SAT structure scales with interface complexity, not equipment size. A compact VHP geçiş kutusu installed as a standalone transfer station may require less SAT scope than a full isolator line, but its door seal integrity and VHP cycle performance after installation still require site verification that factory testing cannot substitute for.