9.2 FAT, IST, SAT, and Commissioning

You cannot inspect quality into a DCS after first feed. Knowledge area 2.F expects you to know what each test proves and, just as important, what it cannot prove. The exam loves a stem where a sequence passed in the shop and then failed on the unit—usually because the shop never saw the field.

Factory acceptance test (FAT)

FAT happens at the vendor (or integrator) facility. The system is on a shop floor. I/O is simulated, or wired to a test panel of switches, lamps, and a simulation computer. FAT is the right place to prove:

• I/O configuration against the I/O list (tag, type, range, fail direction).
• Control configuration against the narrative and cause-and-effect matrix.
• Graphics against P&ID tags and the alarm philosophy.
• CPU and network redundancy failover of the architecture that is actually in the cabinets.
• Historian collection of those tags, time sync, and user accounts.
• System diagnostics the vendor shipped: I/O channel faults, controller status, network storms the shop can generate.

FAT does not prove field installation. It will not catch an impulse line that slopes back toward the transmitter so condensate collects. It will not catch tap location, heat tracing, cable-tray fill, shield grounds at one end only, classified-area gland sealing, real actuator bench set, packing friction, actual process lags, site fiber loss, or wireless spectrum at the unit. If the stem is a wet-leg or slope problem after a clean FAT, the answer is not 'FAT was skipped.' The answer is that FAT never saw the pipe.

Integrated system test (IST)

IST (sometimes staged as an integrated FAT) puts more than one subsystem on the same floor: DCS plus SIS, compressor PLC, analyzer shelter, custody skid, maybe an operator-training simulator. IST proves interface contracts that a single-system FAT can miss: permissive bits, watchdog or heartbeat timing, sequence-of-events order across systems, third-party Modbus or OPC maps, and which system is time master. A DCS FAT alone will not find that the compressor PLC expects a 200 ms heartbeat while the DCS sends a 1 s pulse. IST is still usually a simulated or packaged process. It still will not catch impulse-line slope or a sticky valve on the pipe rack.

Site acceptance test (SAT) and commissioning

SAT is at the plant after mechanical completion, or after a defined subset of loops is landed. I/O is real, or at least real wiring to junction boxes and real field devices on the loops being tested. SAT proves installation integrity: loop checks, communications over plant fiber, real valve stroke, real trip solenoids, grounding, and that the cabinets still run within temperature after site power and HVAC are the real ones. SAT still may not include hydrocarbons, every rare interlock combination, or long-term reliability. A passed SAT is a contractual gate, not a promise that the unit will never surprise you.

Commissioning is broader than SAT. It includes loop checkout, water batch or inert commissioning, first feed, performance tuning, punchlist closeout, as-built drawings, and turnover to operations. SAT asks 'does the installed system match the spec?' Commissioning asks 'can this plant run?' Tuning a level loop on water and then on a foaming hydrocarbon are different jobs; only commissioning sees the second.

Loop, logic, sequence, and fail-safe tests

These four tests get mixed on the exam. Keep the energy path in mind.

• A loop check proves the signal path: field device through wiring and I/O to the faceplate, and output back to the actuator—range, polarity, engineering units, and fail direction of the signal. You can loop-check at SAT with the process isolated.
• A logic test proves Boolean: permissives, interlocks, cause-and-effect. FAT with simulated I/O is an excellent logic test. It still assumes the simulated input is the real process.
• A sequence test proves steps, transitions, timers, holds, aborts, and restarts (SFC, batch, compressor start). If a transition is 'wait 2 s for the valve to open,' the test is only as honest as the actuator model.
• A fail-safe test removes energy—air, hydraulic pressure, electrical power, or communication—and confirms the device goes to the designated fail position and that the logic treats the loss correctly. Watching a faceplate while you type a 50% PV is not a fail-safe test.

System diagnostics belong in every stage: channel fault bits at FAT, network error counters at IST, grounding and noise at SAT, and drift or sticky-valve signatures after startup (the next section).

Worked example — FAT pass, SAT fail on stroke time

A compressor anti-surge recycle sequence is tested at FAT. The analog output drives a simulated valve that goes 0–100% in one controller scan. A 2 s timer expires, the sequence declares the recycle valve open, and the load/unload steps continue. The cause-and-effect and the SFC both pass. At SAT the real 8-inch valve, with a pneumatic actuator and a booster that is not as fast as the datasheet implied, takes about 12 s to stroke. The 2 s timer times out while the valve is still mostly shut. The machine either trips on a sequence fault or is left without recycle when a surge approaches.

The logic was not 'wrong' in the Boolean sense. The timing basis was wrong. FAT proved the sequence against a near-instant actuator. SAT revealed process dead time plus real stroke time. The professional fix is not to blame SAT. Use valve position feedback (or a generous timer plus feedback) as the transition, include actual stroke plus margin in any backup timer, and put real stroke tests in the SAT procedure—not only simulated I/O in the shop. The same pattern shows up on ESD trip solenoids, MOV stroke limits, and damper drives.

free PE Control Systems practice questionsPractice questions with detailed explanations

Exam traps: calling FAT a field-installation proof; treating IST as optional when packages handshake; using a simulated one-scan valve to validate a timed sequence; calling a faceplate PV entry a fail-safe test.