You signed off the factory tests last month. The crate arrived, the crew bolted the cell to the floor, and the first shift is standing there watching a cycle that will not hold rate. Compressed air is softer than the shop where the machine was built. The network drops packets, and an operator has already found a faster way around a guard.
That gap is what site acceptance testing has to close. It is not a second factory demo. The signed release has to prove the installed equipment can hold sustained production with your materials, your operators, your utilities, and your network, and the proof has to be a measured result against an approved protocol.
Table of Contents
- Where Site Acceptance Testing Fits Between FAT and SIT
- Turning Requirements Into Pass or Fail Criteria
- Plan and Run a Site Acceptance Test Step by Step
- What Site Acceptance Testing Catches on a Live Line
- Cybersecurity, Software and Data Checks Most Protocols Skip
- Documentation and Qualification Evidence for Regulated Lines
Where Site Acceptance Testing Fits Between FAT and SIT
A line leaves the supplier's workshop after passing its factory acceptance test, then fails to hold rate once connected to plant utilities and production equipment. Each acceptance test covers a different part of that risk.
Factory acceptance testing (FAT) runs at the supplier's workshop before shipment. It checks whether the system meets its specification in a controlled setting, with the supplier leading and the buyer witnessing. A factory acceptance test answers whether the equipment is ready to ship.
Site acceptance testing (SAT) takes place at the facility after installation. Industry guidance defines SAT as testing equipment and relevant documentation at the site of use against an approved protocol (industry guidance on FAT and SAT). Pharmaceutical GMP practice commonly supplements factory testing with site testing after equipment arrives, because factory conditions cannot fully prove compatibility with the production environment.
Site integration testing (SIT) checks whether machines, controls, and plant systems work together across their interfaces. That interface check does not establish whether the installed system can sustain production through a full shift.
IEC 62381 sets out a structured approach to testing automation systems. Its first full edition, IEC 62381:2006, was published on November 15, 2006, and its third edition was released on July 30, 2024 (IEC 62381 edition summary).
Acceptance test sequence compared
| Test | Where it runs | Main question answered | Usual owner |
|---|---|---|---|
| FAT | Supplier workshop, before shipping | Does the system meet its specification? | Supplier, with buyer witness |
| SIT | Plant, with connected equipment | Do machines, controls, and plant systems work together across interfaces? | Integrator and automation team |
| SAT | Plant, after installation and utility connection | Does the installed system perform in its real environment and meet the approved protocol? | Owner, with supplier support |
Practical rule: A factory signature authorizes shipment. It does not establish operational readiness.
The handover depends on keeping those responsibilities distinct. FAT covers the build before shipment, SIT covers connected systems, and SAT confirms the installed system is ready for its intended production use.
Turning Requirements Into Pass or Fail Criteria
A demonstration that the machine powers up is not a pass. A pass is a measured result inside a stated limit, traced back to something you already agreed.
IEC 62381 treats site acceptance testing as part of a structured sequence meant to show that the automation system conforms to the applicable specification. Its checklists cover hardware, software, operator interfaces, communication paths, and who among owner, buyer, and vendor owns each task. Every row in your protocol should point to a user requirement, a functional design requirement, or an approved drawing. Record the precondition, the test data, the expected result, the actual result, and the disposition. Keep a controlled punch list.
If site utilities, network connections, safety circuits, recipes, sensors, or upstream and downstream equipment differ from the FAT bay, a sequence that passed at the supplier can fail after installation. State the boundary in the plan. Loop checks, commissioning, and MES testing are not SAT. Untested scope must not be mistaken for acceptance.
A criterion has three parts: the check, the limit, and the evidence. A cycle time is judged over an agreed count of cycles, not one lucky run. An interlock is judged by whether the correct outputs trip and whether restart needs a deliberate action. A data exchange is judged by reconciling records at both ends, with no open items left. Mark each result pass, fail, or conditional. A conditional result becomes a dated punch-list item with a named owner.
Acceptance checks by test area
| Test area | Acceptance check | Limit | Evidence to keep |
|---|---|---|---|
| Power and utilities | Voltage, air pressure and network connections checked | Within installation specification | Calibrated meter readings with date and instrument ID |
| Emergency stops and guard interlocks | Every stop and guard tested in a challenge | Correct outputs trip; restart requires deliberate action | Signed challenge log for each device |
| Cycle time and throughput | Measured cycle time over the agreed cycle count | Within the agreed window, not a single run | Cycle log with start and end timestamps |
| Recipe and parameter control | Each recipe loaded and checked | Approved version and parameter values only | Recipe version record and parameter printout |
| Alarms and fault recovery | Each alarm triggered, displayed and cleared | Behaves as specified; restart returns to safe state | Alarm test record with fault and recovery times |
| Data exchange with other systems | Production records sent to upstream and downstream systems | Records reconcile at both ends with no open items | Message log and reconciliation check |
Copy the first column into your own protocol. Fill the limit and evidence columns with values the owner and supplier have already signed, the same way you lock automation system requirements before anyone writes code. If a limit is still a phrase like "runs well," you do not have a criterion yet.
A conditional pass with no owner and no date is a fail that nobody has to fix.
Plan and Run a Site Acceptance Test Step by Step
A cell can run cleanly in the vendor's bay and still fail to sustain production on the plant floor. Site acceptance testing (SAT) must prove readiness under operating conditions, with actual materials, operators, utilities, networks, and connected equipment. WHO GMP validation guidance describes testing at the user site against approved specifications and calls for documented plans, inputs, results, and failures, not only successful runs (WHO GMP validation guidance).
A power-up demonstration is not a release test. The protocol needs a step-by-step sequence, measurable pass criteria, and evidence for each result. That distinction matters on semi-automated cells, where operator timing and handoffs can determine whether the line holds its required rate.
Five actions locked in before delivery
- Define the ramp-up exit criterion. Set the production duration, required rate, quality target, loss classification, and escalation rule before delivery. Without agreed limits, a short successful cycle can be mistaken for production readiness.
- Assign an owner and signatory for each test area. Name who can pass or fail the rows covering utilities, safety, controls, quality, and production. A shared inbox cannot own a disposition.
- Write a traceable protocol. Link each test to a requirement or approved drawing. Specify the precondition, expected result, pass or fail field, and the products, recipes, tooling, and line configuration covered.
- Prepare production supplies and records. Confirm power, compressed air, network, and safety circuits are ready. Record software versions, parameters, and mechanical settings, and require sign-off for changes. Stage the correct material, tools, and trained staff.
- Set the boundaries and release rule. Define what SAT excludes, such as loop checks, commissioning, or MES testing. Identify punch-list items that block release, name plant and supplier witnesses, and state what counts as a pass.
System Engineering & Automation begins each engagement with a hands-on evaluation of the customer's current systems. Its turnkey project management covers work from concept to commissioning, including design, programming, installation, and support. The system is not considered finished until the customer is 100% satisfied. For SAT, that means the agreed exit criteria are met, not that the equipment has arrived.
On site, in order
- Confirm installation is complete. Verify that utilities are connected and site integration testing (SIT) is closed. Starting SAT on an unfinished installation creates avoidable failures and weakens confidence in the protocol.
- Check the plant supply. Measure the power, compressed air, production network, and safety circuits the cell will use. Temporary supplies can conceal problems in the actual installation.
- Run the functional tests. Check startup, normal cycles, operator screens, and each production mode. Include less common operating paths, not only the sequence used during programming.
- Challenge fault conditions. Test emergency stops, guard interlocks, alarms, communication loss, and restart behavior. Have the people who will operate the cell take part.
- Run the production-representative trial. Use real materials and trained operators for the duration set in step 1. Check maintenance access and station handoffs during the run. A brief sample cannot establish sustained production readiness.
- Record results during testing. Enter the test data, actual result, and disposition for every row as the work proceeds. Log deviations when they occur rather than reconstructing them from memory later.
- Resolve the punch list and sign. Close critical deviations before routine production. Release requires completed tests, dispositions for every deviation, and the named signatures.
If the ramp-up exit criterion is still a verbal promise, you are not ready to start the clock.
A signature marked “with comments” is incomplete unless each comment has an owner, due date, and clear decision on whether it blocks release. Without those terms, an unresolved condition can become part of the production standard.
What Site Acceptance Testing Catches on a Live Line
Say a semi-automated assembly cell sailed through FAT at its rated speed. On your floor it holds only about 70 percent of that rate. The plant air header sits below the pressure the vendor used in the workshop, so cylinders lag, sensors time out, and the cycle stretches. Correct the supply, log pressure on the next run, and the rate comes back. The factory could not have shown you that header.
The same pattern shows up in other symptoms. Each one has a cause you can name and a fix you can close.
Site failures, causes and corrective actions
| Site symptom | Likely cause | Corrective action |
|---|---|---|
| Cycle time slower than in FAT | Utility pressure or supply below the FAT setting | Correct the supply and re-run the cycle test while logging pressure |
| Sensor triggers falsely on the shop floor | Ambient light or vibration not present in the workshop | Re-aim or shield the sensor and repeat the trigger test under production lighting |
| Network drops during production | Plant traffic and network segmentation not present during FAT | Confirm the network design and run a communication-loss test under production load |
| Operators bypass a guard | Restart sequence too slow for the job | Revise the restart sequence, retrain operators and repeat the interlock challenge |
| Recipe loads with wrong values | Version mismatch between engineering and production computers | Lock the recipe version and record it in the protocol |
| Output drifts after two shifts | Heat build-up in an unclimatized bay | Log temperature, add ventilation and repeat the ramp-up run |
A sensor that was stable under workshop lighting starts false-triggering next to a skylight and a press. Re-aim it or add a shield, then repeat the trigger test under production lighting, not after you pull the blinds for the demo. Output that walks off after two shifts usually means heat in a bay with no climate control. Log the temperature, add ventilation, and repeat the ramp-up. Do not "tune it out" on a cool morning.
Operators will bypass a guard when the restart sequence eats more time than the job allows. That is not a discipline problem you can poster away. Revise the restart so it is safe and fast enough to use, retrain the crew, and repeat the interlock challenge with those operators in the room. If they still bypass it, the sequence is still wrong.
Some fixes take a day. Reloading the approved recipe, or re-aiming a sensor, fits in one shift if the parts and the programmer are on site. Others take weeks. A network that was never segmented for this cell, or a crew that has to be retrained across all shifts, will not close before the next production meeting. Put that distinction on the punch list so planning does not treat a redesign like a parameter tweak.
Most of these failures come from conditions the factory could not reproduce. Light, vibration, header pressure, heat, traffic on the plant network, and the way your people restart a station. Site acceptance testing is where those conditions get a name, a measurement, and a closed action.
Cybersecurity, Software and Data Checks Most Protocols Skip
A cell may pass its mechanical checks and still be unready for production. During FAT, the plant's network, user accounts, recipes, audit trails, backups, remote access, and connections to quality systems may be absent or unlike the site setup. SAT must verify these controls in the environment where the equipment will run.
What to prove on the control system
Acceptance requires evidence that the system runs predictably, records trustworthy data, fails safely, and can be restored. Put each check into the protocol with a pass criterion and a record of the result.
- Configuration baseline. Confirm that installed software and parameter files match the approved revisions.
- Account and role checks. Log in with operator and authorized accounts. Verify that operators cannot change restricted settings.
- Backup and restore. Back up the PLC and HMI, then restore to an agreed spare or non-production copy. Confirm that the restored system matches the approved configuration.
- Time synchronization. Compare clocks across machines and confirm that timestamps align closely enough to reconstruct events.
- Audit-trail review. Change a parameter or generate an alarm, then confirm the event is recorded with an identifiable user and timestamp.
- Communication-loss behavior. Interrupt the connection under controlled conditions. Verify the cell reaches its defined safe state and follows the documented restart sequence.
Set two ownership decisions before testing: who controls changes after SAT, and whether remote service access is allowed, logged, or disabled. Record the chosen arrangement and verify it on site. A verbal agreement leaves the next login without a clear control or record.
Scale the checks to the system. A standalone assembly station and a line that sends batch records to a quality system have different data and access needs. Keep the protocol focused on the connections and controls the equipment uses, while requiring evidence for each one.
Ask the supplier to demonstrate these five checks during SAT:
- The installed software and parameter files match the approved baseline.
- An operator account cannot edit restricted settings.
- A backup can be restored on site.
- Timestamps align across the machines in the cell.
- The cell responds safely to communication loss, and the restart path is documented and witnessed.
Documentation and Qualification Evidence for Regulated Lines
A line can pass SAT and still lack the evidence needed for qualification. Treat SAT as one stage in the equipment lifecycle: commissioning confirms installation and function, SAT records performance at the site, and qualification shows whether the system meets process requirements through installation qualification (IQ), operational qualification (OQ), and performance qualification (PQ). For a regulated line, keep those records connected without treating them as interchangeable.
Build a traceable record as the system moves from commissioning into qualification. Capture instrument identifiers and calibration status, software and recipe versions, interlock results, measured cycle time and repeatability, reject handling, data-integrity checks, and deviations. Each result should point to its requirement or drawing, with the outcome and approval recorded. This makes the evidence usable later, rather than forcing the team to reconstruct decisions from emails.
Records a device plant has to retrieve
For medical-device production, equipment records belong in the quality system. FDA's Quality Management System Regulation took effect on February 2, 2026, amended 21 CFR Part 820, and incorporates ISO 13485:2016 by reference (FDA overview of device regulation). Under 21 CFR 820.10, manufacturers document a quality management system that meets ISO 13485 and applicable regulatory requirements, including traceability where it applies (21 CFR 820.10). Keep equipment identity, control revisions, acceptance results, deviations, corrective actions, and approval signatures retrievable for complaint investigations and change control. Technical documentation standards support consistent records, whether or not an inspection is imminent.
Assess and close deviations affecting critical process parameters, safety functions, or electronic records before routine production. Otherwise, later PQ results may rest on an unproven installation baseline. The same discipline helps non-regulated plants investigate a batch problem months later: the acceptance record shows the cell's approved condition at startup.
Be ready to retrieve these records when an auditor or customer asks:
- The approved protocol, with each test traced to a requirement or drawing.
- Instrument IDs and calibration dates for each meter used.
- Software, recipe, and parameter versions used for the run.
- Challenge results for stops, guards, alarms, and communication loss.
- The ramp-up log, recording rate, quality, and loss classification.
- The punch list, with each item dispositioned, dated, and signed.
If records are scattered across inboxes, consolidate them before routine production. During the no-obligation consultation, you can discuss your installation and acceptance requirements before signing a purchase order. System Engineering & Automation develops custom engineering solutions, then supports projects through design, manufacturing drawings, material sourcing, installation, commissioning, and ongoing support. Learn more at System Engineering & Automation.
