Factory acceptance test checklist for medical and laboratory equipment

Verify a written FAT test plan or inspection and test plan (ITP) exists and has been agreed by buyer and supplier before testing begins.

Without an agreed plan the pass/fail basis is disputable; testing to an unapproved plan invalidates the acceptance.

Verify the test plan lists each test, its acceptance criteria, the sequence, and the sign-off point for each stage.

A plan without explicit acceptance criteria per test lets marginal results pass unchallenged.

Verify the current buyer specification, purchase order and approved drawings are on hand at the test location and match the equipment presented.

Testing against a superseded spec or drawing revision is a common cause of accepted-then-rejected equipment.

Verify the revision numbers of the reference documents on the floor are the latest issued and that no open change requests affect the scope under test.

Uncontrolled or outdated document revisions defeat the purpose of witnessing against them.

Verify the utilities required for the planned tests — electrical supply, compressed air, water, cooling or fuel as applicable — are available and connected at the works.

Missing or under-rated site utilities routinely stall or truncate a FAT after attendees have travelled.

Verify the supplier utility supplies match the values needed by the equipment and the test plan in voltage, frequency, pressure, flow and quality.

A supply present but at the wrong parameters (e.g. voltage or air pressure) prevents valid performance testing.

Verify the supplier personnel needed to run the test — operators, and the responsible engineer or quality representative — are present and available for the duration.

Absent competent personnel forces improvised testing or rescheduling; confirm a supplier representative can authorise sign-off.

Verify all attendees have received the site safety induction and are issued the required personal protective equipment before entering the test area.

Un-inducted attendees on a live works floor are a safety and liability exposure and may be removed, halting the FAT.

Verify emergency arrangements for the test area — exits, assembly point, first aid and the site emergency contact — have been briefed to attendees.

Energised or pressurised acceptance testing carries real hazards; attendees must know the response before it is needed.

Verify a valid, in-date calibration certificate is available for every measuring instrument that will be used to judge FAT results.

Results measured with an uncalibrated or expired instrument are not defensible; check the calibration date has not lapsed.

Verify each test instrument's calibration is traceable to a recognised national or international standard and its accuracy is adequate for the tolerances being checked.

An instrument coarser than the tolerance it verifies cannot confirm conformity; traceability chain should be stated on the certificate.

Verify blank FAT result sheets or a witness record aligned to the agreed test plan are prepared to log outcomes and signatures as testing proceeds.

Recording results after the fact from memory weakens the acceptance record; capture readings and sign-offs live.

Verify a documentation transmittal or index list is provided and that every document it references is physically present in the pack.

An index with missing referenced items is the most common way an incomplete pack passes unnoticed. Tick each line against a physical document.

Verify the compiled test and inspection report covering the witnessed FAT results is included, signed and dated by the supplier.

This is the record the buyer relies on post-shipment. Confirm it is compiled into the pack; the underlying test results are witnessed and judged in the relevant technical modules, not here.

Verify material and component certificates required by the purchase order are present, legible and cross-referenced to the items they cover.

Presence, legibility and traceability into the pack only. Certificate content versus grade/thickness spec is verified in the materials module (mat), not here.

Verify operation and maintenance manuals are included and cover installation, operation, routine maintenance and troubleshooting.

A common shortfall is an operation-only manual with no maintenance or fault-finding sections.

Verify as-built drawings are included and reflect the unit as inspected, including any changes made during manufacture.

Supplied drawings are frequently the original design set, not as-built. Check revision markings against modifications observed on the unit.

Verify a spare-parts list is included and that each line carries a manufacturer part number sufficient to reorder without further enquiry.

Descriptions without part numbers, or internal codes the buyer cannot order against, make later replacement dependent on the supplier.

Verify recommended commissioning and first-service spares are identified in the spare-parts list and reconciled against what is being shipped with the unit.

The document side of the spares check. Physical presence of shipped spares in the crates is confirmed in the packing module (pack).

Verify the warranty terms are stated in writing, including duration, start-date basis, coverage and any exclusions or conditions.

A warranty whose start date, scope or conditions are undefined is difficult to enforce after shipment. Confirm against the purchase order terms.

Verify all deliverable documents are provided in the language required by the purchase order.

Manuals or certificates supplied only in Chinese are a frequent finding. Confirm the required language, and whether bilingual or translated copies were agreed.

Verify the equipment nameplate details recorded in the documents (model, serial number, rating) match the physical nameplate on the unit.

Documents describing a different serial or rating than the unit indicate a mismatched or reused pack.

Verify supplier and sub-supplier contact details for technical support, spares and warranty claims are stated in the pack.

Post-shipment support stalls when the buyer has no named contact route for parts or warranty.

Verify each document carries a title, revision or issue identifier and date so the buyer can confirm they hold the current edition.

Unversioned documents make it impossible to tell later whether a superseded copy is in use.

Confirm the pack is specific to this unit rather than a generic product-family manual that omits ordered options or variants.

Generic manuals are commonly substituted for a bespoke build; they describe standard options and omit or contradict what was actually supplied.

Confirm that where an electronic pack is provided, the files open, are complete and are not password-locked or corrupted, and that any promised native formats are included.

A USB or link handed over at FAT can hold scanned-only, locked or incomplete files. Open a sample and confirm agreed formats (e.g. editable drawings) are present.

Confirm the packing specification (or packing list) and the intended transit mode and route are available before packing is inspected.

The packing method must be judged against the declared mode (sea/air/road, container vs breakbulk) and destination; without the spec the packing cannot be assessed.

Verify the packing method and materials match the specification for the declared transit mode (seaworthy export crate, container-stuffed, or air freight as applicable).

Domestic-grade packing on a long sea leg is a common failure; export/seaworthy protection is often specified but substituted to save cost.

Inspect crate and case construction for adequacy — base skids/runners, bracing, fixings and closure — so the package will withstand handling and stacking in transit.

Judge build quality only; lifting points, slinging arrangements and tilt/shock indicators are assessed under the lifting & transport module.

Verify shipping marks on each package (consignee, order/contract reference, case number, port of destination) match the packing list and commercial invoice.

Mismarked cases are misrouted or delayed at consolidation; case-number sequence must be complete (e.g. 1/8 … 8/8).

Verify the gross and net weights and outer dimensions marked on each package agree with the packing list.

Declared weights drive freight booking, container/vehicle selection and handling gear; discrepancies cause re-handling and demurrage.

Verify handling and orientation markings (e.g. this-way-up, keep-dry, sling/no-sling positions, fragile) are present and correct for the contents.

ISO 780 pictograms are conventional; confirm they are present and consistent with the packing spec rather than citing the standard on the case.

Verify all loose-supplied items — spares, consumables, special tools, counterparts and accessories — listed in the contract/packing list are physically present and identified.

Loose supply is the most common short-shipment; missing commissioning spares or special tools can stall installation at site.

Where preservation is specified, verify it is applied — desiccant with a humidity indicator in sealed barrier/VCI wrapping, VCI on bare machined surfaces, and blanking of open ports, flanges and shaft ends.

Long sea transit and storage cause corrosion on unprotected surfaces; desiccant quantity and a moisture-barrier seal are routinely skimped.

Verify fluids are handled per the shipping requirement — systems drained or protective/preservation fill applied and stated, with drain points closed and no residual leakage.

Trapped water can freeze or corrode in transit; some units ship with a preservation charge that must be documented so site does not re-drain it.

Verify wooden packaging carries a valid ISPM-15 heat-treatment (HT) or fumigation mark with the producer's registration.

Unmarked or non-compliant timber is refused or destroyed at the destination port and can hold the whole consignment; applies to all solid-wood packaging.

Verify the equipment serial/tag number, model and quantity match the nameplate, the packing list and the commercial invoice.

Serial-number mismatch between the physical unit and the shipping/commercial documents is a fraud and customs-clearance exposure and can invalidate warranty.

Witness and obtain a dated photographic record of each unit as packed — internal blocking/bracing and preservation before closing, then the closed and marked package.

Once crates are closed the internal packing cannot be re-inspected; before-close photos are the only evidence for transit-damage and short-shipment claims.

Verify the material certificate pack is complete: one mill test certificate (MTC/MTR) is present for every grade of pressure- and load-bearing material used in the build, and each certificate is legible and traceable to a heat/cast number.

Confirm certificate type meets the PO requirement (e.g. EN 10204 3.1 with an independent 3.2 where the contract calls for one). A pack that is incomplete before the FAT usually stays incomplete after payment.

Verify a material traceability list (heat-number map) is available that ties each major fabricated component to the heat/cast number and certificate covering its material.

Without a component-to-heat map, heat-number trace-back on the floor is guesswork. Its absence is itself a finding.

Verify a working positive material identification (PMI) analyser (portable XRF or OES) with valid calibration and a certified reference sample is available for use during the FAT.

Check the analyser reads the reference sample correctly before trusting any part result. If no analyser is available, record that alloy grade could not be independently confirmed — do not sign it off from paperwork.

Cross-check each mill test certificate against the specified material: confirm grade/designation, and the certified chemical composition and mechanical properties (yield, tensile, elongation, and impact/Charpy where required) fall within the specified grade's limits.

A certificate that lists an equivalent-but-different grade, or that omits a required impact test, is a specification non-conformity even when the paperwork looks in order.

Perform a PMI analyser spot-check on a sample of parent material across the major fabricated components and confirm the measured alloy composition matches the grade claimed on the corresponding certificate.

This is the primary defence against grade substitution — e.g. carbon steel supplied where a low-alloy or stainless grade was specified, or a lower stainless grade (304) substituted for a higher one (316). Paper review cannot detect this. Sample coverage should follow an agreed plan; witness every reading yourself.

Trace heat/cast numbers back from the physical steel to the certificates: locate the hard-stamp or paint marking on a sample of components and confirm each traces to a heat number listed on a certificate in the pack.

Material with no transferable identity, or bearing a heat number not present in the certificate pack, cannot be shown to be the certified material. Watch for over-stamping or re-stamping of heat numbers.

Measure the thickness of key plate and the wall thickness / section size of key structural or pressure members and confirm they meet the specified nominal dimension and material tolerance.

Under-thickness plate or lighter sections than specified is a common cost-down substitution. Measure at several points; use ultrasonic thickness gauging where a face is inaccessible.

Measure the principal dimensions of key machined or fabricated components (bores, mating faces, hole patterns, critical lengths) and confirm they are within the tolerances stated on the component drawings.

Component-level dimensional conformity only; overall assembly conformance against the general-arrangement drawing is verified elsewhere.

Visually inspect a representative sample of welds for workmanship: confirm consistent profile and full fill, and freedom from undercut, overlap, visible cracks, unfilled craters, porosity clusters, arc strikes and excessive spatter.

Visual weld quality only. Weld conformance to a weld map, and non-destructive-examination records for pressure parts, are verified in their own modules and are not repeated here. Use a weld gauge for undercut/reinforcement where acceptance limits apply.

Visually inspect the applied coating/paint finish for continuity and workmanship: confirm even coverage with no runs, sags, blistering, dry spray, missed areas or exposed substrate, and confirm adhesion is sound at a spot check.

Visual coating quality only. Dry-film-thickness measurement against a coating specification is verified in the relevant structural / envelope module and is not duplicated here.

Inspect installed fasteners for grade and authenticity: confirm bolt heads carry the correct property-class marking and a manufacturer identification mark, threads and plating are clean and undamaged, and there is no sign of re-stamped, ground-off or mismatched head markings.

Counterfeit and substandard fasteners are widespread. Warning signs: blank heads on structural bolts, absent or inconsistent manufacturer marks, over-stamped grade markings, poor thread finish, and grade markings that do not match the specification (e.g. 4.8 marked or supplied where 8.8/10.9 is required). Stainless grade marking (A2/A4) applies where corrosion-resistant fasteners are specified.

On critical bolting, spot-check fastener authenticity by hardness test or PMI where feasible, and confirm the result is consistent with the marked property class or specified fastener material.

Head markings can be forged; a hardness or alloy check on a sample confirms the fastener is what it is stamped to be. Restrict to structural, pressure-retaining or safety-critical bolting.

Collect copies of the mill test certificates, the PMI spot-check report (readings with instrument and reference details), fastener certificates or conformity declarations, and any coating/paint application records generated for this equipment.

The PMI report and heat-map are the objective evidence that identity was verified, not merely certified. Retain them with the FAT pack.

Confirm no component carries a heat number that is absent from the certificate pack, and no supplied grade is a downward substitution of the specified grade justified only as an 'equivalent'.

Grade substitution and untraceable heats are the highest-consequence material fraud at FAT: they pass a paper review and only surface in service. Treat any mismatch between analyser, stamp and certificate as a hold point, not a documentation nit.

Confirm the equipment's rated supply (voltage, phases, frequency) on the nameplate matches the buyer's site supply and purchase order before any powered test.

A mismatch (e.g. 400 V/50 Hz build against a 480 V/60 Hz site) renders the unit uninstallable and can destroy it on first energisation.

Verify the current, dated approved schematic and panel-layout drawings are present at the FAT and match the drawing revisions on the buyer's order.

All build-versus-schematic checks are only as good as the drawing revision witnessed against; a superseded revision invalidates the comparison.

Compare the as-built panel against the approved schematic: device ratings, part numbers, contactors, breakers, fuses and cable cross-sections match the drawing and bill of materials.

Substituted or under-rated components are a common cost-cutting deviation and are hard to detect after the panel is closed and shipped.

Inspect conductor terminations for correct lugs/ferrules, no stray strands, no exposed copper beyond the terminal, and no damaged insulation.

Poor terminations cause loose connections, arcing and hot spots that appear only under load in service.

Witness torque verification on a sample of power terminals and busbar joints using a calibrated torque tool against the manufacturer's stated values, and confirm tightness-check marking is applied.

Under-torqued power connections are a leading cause of in-service overheating; over-torqued terminals crack. Torque values are device-specific.

Verify cable and conductor identification (wire numbers, phase colours, ferrules) is present, legible and agrees with the schematic wire numbering.

Missing or wrong wire numbers make site fault-finding and reconnection after shipment slow and error-prone.

Confirm cabinet and device rating, warning and identification labels (main switch, incoming supply, danger/voltage warnings, panel schedule) are fitted, in the agreed language, and durable.

Language and label content are order-dependent; absent voltage-warning labels are also a safety and acceptance issue at site.

Witness protective-earth (PE) and equipotential-bonding continuity from the main earth terminal to accessible exposed conductive parts (panel door, frame, motor bodies, enclosures).

Pass: Continuity confirmed with low measured resistance (typically ≤ 0.1 Ω, or the value stated in the buyer's spec/applicable standard) at each point tested.

Broken bonding leaves accessible metalwork live under an insulation fault. The pass threshold varies by standard and conductor length; confirm the value used.

Witness an insulation-resistance (IR) test on the de-energised power circuits at the appropriate test voltage, with electronics/sensitive devices disconnected or protected as required.

Pass: IR meets or exceeds the minimum stated in the buyer's spec or applicable standard for the circuit voltage (commonly ≥ 1 MΩ, with higher acceptance values typical for LV installations); no circuit fails.

Low IR indicates damaged, damp or pinched insulation and a shock/short risk. Acceptance value is voltage- and standard-dependent; verify the applied test voltage suits the equipment.

Witness a powered check of motor/drive rotation direction for each driven unit and confirm it matches the direction arrow and process requirement.

Pass: Observed rotation matches the marked direction arrow and the buyer's specified process direction for every motor tested.

Reversed phase sequence spins pumps, fans and conveyors backwards; on some equipment reverse running causes immediate damage. This is direction only — mechanical rotating-machinery checks are covered separately.

Verify overload and thermal-protection settings on motor starters and drives are set to the connected motor's full-load current and to the values on the coordination/settings documentation.

Pass: Each overload/thermal setting matches the motor full-load current and the documented setpoint; no device left at an arbitrary default.

Overloads left at maximum default provide no motor protection; set too low they nuisance-trip on start.

Confirm protective-device ratings and settings (main breaker, branch breakers, fuses, RCD/earth-fault where fitted) agree with the protection-coordination study or discrimination documentation supplied with the equipment.

Devices that do not match the coordination study can fail to clear a fault or trip out of sequence. This verifies protective settings against the design documents, not control logic.

Verify IP-rated enclosure integrity for electrical parts: gland plates fitted, unused entries blanked, no open knockouts, and doors/covers close on intact seals.

Open entries defeat the enclosure's ingress rating and expose live parts to dust, moisture and contact. Required IP rating is order-dependent.

Collect the completed electrical test records — insulation-resistance readings, earth/bonding continuity results, and torque-check sign-off — with the tester's identity and instrument details noted.

The signed record is the shipment-payment evidence that these safety-critical tests were actually performed and passed.

Collect valid calibration certificates for the insulation tester, earth-continuity/loop tester and torque tool used during the electrical tests.

Readings from out-of-calibration instruments are not defensible; expired calibration undermines the whole electrical test record.

Sample-check that internal wiring is not left connected to an incorrect phase or omitted where the schematic shows all three phases loaded, and that neutral and earth are not interchanged at terminals.

Neutral/earth swaps and dropped phases pass a quick visual and even a rotation check yet create a shock hazard and unbalanced loading; they surface only under systematic point-to-point verification.

Verify the current I/O list, control narrative or functional design specification, interlock (cause-and-effect) schedule and alarm list are on hand and match the equipment presented.

These are the reference documents every control test is judged against; without them I/O and logic outcomes cannot be declared conforming.

Verify the PLC/HMI program loaded on the equipment is the revision agreed for FAT and record its version, checksum or download date against the control documentation.

Testing an undocumented or superseded program means the witnessed behaviour may not match what ships; capture the identifier now so later changes are detectable.

Verify HMI screen tag names, labels, symbols and page navigation are consistent with the I/O list and control narrative, with no placeholder, mislabelled or orphaned objects.

Mismatched or leftover tags mislead the operator and often signal an incomplete or copied-from-another-project screen build.

Witness a point-to-point I/O check: force or actuate each input and output in turn and confirm it maps to the correct address, tag and HMI indication per the I/O list.

Pass: Every I/O point exercised corresponds to the address, tag and description on the I/O list, with the expected HMI state change and correct polarity (no swapped, inverted or dead points).

Crossed, inverted or unterminated I/O is the most common controls defect and can drive the wrong actuator on site; this checks the wiring-to-logic-to-screen chain, not sensor accuracy.

Witness each safety and process interlock and permissive by simulating its trip condition, and confirm the control system inhibits or halts the affected function and reports the cause.

Pass: Each interlock and permissive in the cause-and-effect schedule, when its condition is simulated, produces the specified control action (block start, stop, hold or trip) and the correct annunciation; none can be bypassed from the operator interface without the defined authorisation.

Interlocks are the logic that protects the equipment and operators; each branch of the cause-and-effect matrix must be proven individually, not assumed from a single successful run.

Witness alarm generation for a representative set of alarm conditions and confirm each raises, displays, time-stamps, acknowledges and clears correctly through the alarm list.

Pass: Each simulated condition raises the corresponding alarm at its configured setpoint with correct text, priority and time stamp; acknowledgement and return-to-normal behave per the alarm specification, and no alarm is stuck, duplicated or missing.

Alarms are the operator's window onto faults; wrong priority, missing text or an alarm that will not clear undermines fault response on site.

Verify the HMI display language, engineering units, number formats and time zone/clock are set as specified, and that the language set the buyer will operate in is complete on every screen.

Pass: All HMI text, alarms and prompts display in the specified language(s) with the specified units (e.g. metric/imperial) and formats; no screen reverts to the default factory language or shows untranslated or unit-mismatched fields.

Screens left in the manufacturer's default language or in the wrong units are a frequent and operationally serious miss for export equipment.

Witness operation through each control mode and operator command the equipment provides — such as manual/auto, start/stop, and any sequence or step control — and confirm the control system responds as described in the control narrative.

Pass: Each mode selection and command produces the response defined in the control narrative, transitions between modes are handled safely, and invalid commands are rejected or ignored rather than causing undefined behaviour.

Mode and sequence handling is where control logic gaps surface; confirm the documented behaviour, not just that the equipment moves.

Witness a demonstrated data exchange with each third-party or external system the control system must communicate with — such as a plant SCADA, upstream/downstream PLC or supervisory network — over the specified protocol.

Pass: For each specified interface the link establishes over the agreed protocol and address, representative signals are read and written correctly in both directions, and a communication loss is detected and annunciated by the control system.

Comms to other systems are hard to fix after shipment; confirm the actual mapped exchange and the loss-of-comms response, not merely that a cable is connected. If the counterpart system is unavailable at the works, record what could and could not be demonstrated.

Witness activation of each emergency stop through the control system and confirm the controller registers the stop, commands the outputs to their defined safe state, and annunciates the e-stop condition.

Pass: On each e-stop actuation the control system drives all outputs to the specified safe state, prevents restart until the e-stop is reset and the defined reset/acknowledge sequence is completed, and displays the e-stop as active.

This checks the control system's response to and annunciation of an e-stop and the inhibited restart; integrity of the hardwired safety circuit and stored-energy isolation is verified under the safety-systems module.

Collect the as-tested I/O list, interlock/cause-and-effect schedule and alarm list, marked up with the FAT witness results and any changes made during testing.

The marked-up control documents are the record of what was actually proven and the baseline for site commissioning; undocumented in-test changes are a frequent source of later disputes.

Verify no I/O points, interlocks or alarms remain forced, overridden, bypassed or disabled at the end of testing, and that any forces used during the FAT have been removed.

Forces applied for testing that are left in place ship a controller that ignores real inputs or defeated interlocks; confirm the force/override table is clear before sign-off.

Verify that signals presented as satisfied during interlock and functional tests are driven by genuine field conditions or agreed simulation, and confirm which inputs were physically actuated versus simulated in software.

A logic branch can appear to pass while the input is merely simulated in the program; record the method so simulated-only results are not mistaken for a proven physical response.

Verify the software and data deliverables agreed in the specification or purchase order — backups, program sources, version records, licences and credentials — are listed and available for the FAT to witness.

If the software hand-over scope is not itemised before witnessing, missing backups or licences surface only after commissioning.

Verify the tools, media and any programming cables needed to take and reload a backup are on hand at the test location, not held only by an absent contractor.

A backup that can only be taken with a specialist tool nobody present controls cannot be witnessed end to end.

Witness a full backup of the PLC program, HMI/SCADA application and current parameter and recipe set taken to buyer-supplied or independent media during the FAT.

Pass: A complete backup is produced to portable media, the operation reports success with no skipped items, and the backup file set is retained by the buyer.

Backups described in documents but never demonstrated to portable media are a frequent gap; the buyer must leave with a copy.

Witness a restore of the backup — reload the saved parameters and recipes (or restore to a spare/erased target where practical) and confirm the values return exactly as saved.

Pass: After restore the recovered parameter and recipe values match the pre-backup values field for field with no manual re-entry.

A backup is only proven by a demonstrated restore; suppliers commonly show the backup step but never the recovery, leaving restore-ability unverified.

Verify the data logging or historian records the data points, sample rate and retention required by the specification, by inducing sample values and confirming they are captured.

Pass: Each specified tag or field logs at the required interval with correct engineering units, and a change induced during the test appears in the log at the expected time and value.

Logging that omits required fields, records at the wrong interval, or drops units is often found only when the buyer later needs the data for a batch record or investigation.

Witness an export of the logged data and open the resulting file in a general-purpose tool the buyer controls to confirm the format is usable without proprietary software.

Pass: An export produces an open, documented format (such as CSV) that opens on the buyer's own machine with columns, timestamps and values intact and legible.

Historian data locked to a vendor viewer or an undocumented binary format is effectively unusable to the buyer after hand-over.

Verify that user access levels are enforced by logging in as a restricted (operator-level) account and confirming protected settings cannot be changed without elevated credentials.

Pass: A restricted account can operate the equipment but is denied access to parameter, recipe or configuration screens reserved for higher access levels.

Access levels present in a menu but not actually enforced let any operator alter protected parameters; confirm the block, do not just read the level list.

Verify the controller and HMI/SCADA time and date are correct and, where a time source or synchronisation is specified, that the clocks agree with it and with each other.

Pass: Displayed date, time and time zone are correct across controller and HMI, log timestamps reflect it, and any specified time synchronisation holds the clocks in agreement.

Wrong or unsynchronised clocks corrupt log timestamps and defeat any later attempt to correlate events across the machine or plant.

Collect a written record of the PLC and HMI/SCADA program versions and, where applicable, controller firmware versions, matching what is loaded on the equipment under test.

Without a recorded baseline version, the buyer cannot later tell whether the delivered software was altered or which revision to support against.

Collect the user access records — the defined access levels and their permissions, plus a controlled hand-over of administrator and account credentials to the buyer.

Credentials retained only by the supplier leave the buyer unable to administer, recover or re-secure the system after delivery.

Verify the software licence terms are documented and confirm any runtime, HMI/SCADA or historian licences are transferable to the buyer and cover the delivered configuration.

Non-transferable or seat-limited licences, or licences tied to the supplier's account, can leave the buyer unable to run or expand the system lawfully.

Confirm the witnessed backup can be reloaded using only tools, licences and documentation the buyer will possess after delivery — not solely the supplier's engineering seat.

Backups that only restore from a licensed engineering workstation the buyer never receives give false assurance of recoverability.

Confirm no undisclosed hardcoded, default or supplier-only administrator credentials remain, and that the highest access level is under the buyer's control.

Hidden default or vendor-only admin passwords are both a security exposure and a lock-out risk if the supplier relationship ends.

Confirm the parameter and recipe backup captures the actual as-tested values and is taken after final tuning, not an earlier or default set.

A backup taken before final commissioning tuning restores the wrong settings; take or re-take the backup once the accepted values are in place.

Confirm the safety-function test schedule identifies every protective function on the machine (each guard interlock, emergency stop, presence-sensing device, two-hand control and safety-rated mode) and states how each will be exercised.

Safety devices are frequently tested by sample rather than exhaustively; an incomplete function list lets an unverified interlock or e-stop ship.

Verify each emergency-stop actuator is a mushroom-head, latching, manually-reset red device on a yellow background, and that one is within reach of every operator position and control station.

Reach and correct actuator type are checkable statically; an operator position with no e-stop within reach is a common layout defect. ISO 13850 covers e-stop principles but only cite it if the buyer specification does.

Verify each movable guard has an interlock device fitted, positively mounted so it cannot be defeated by hand or with a simple tool, and that guarded openings do not permit reaching the hazard.

Physical fitment and defeat-resistance are static checks; the stopping function itself is verified below. Fitment of fixed guards over rotating parts belongs to the rotating-machinery module.

Verify light curtains and area scanners are the specified resolution and protected height, mounted at or beyond the calculated minimum safety distance from the hazard, with no gaps allowing undetected access around or behind the field.

Detection capability and mounting distance are dimensional and set the whole device's effectiveness; a curtain mounted too close leaves no time for the machine to stop. ISO 13855 gives the distance calculation but only cite it if the specification does.

Verify every hazardous-energy isolation point — electrical, hydraulic, pneumatic and stored gravity or spring — is provided, clearly identified, and can be locked in the isolated position.

Presence and lockability of each isolation point is verifiable at rest; a source that cannot be locked off cannot be made safe for maintenance.

Witness that opening each interlocked guard while the machine is running brings the guarded hazardous motion to a stop, and that the machine cannot be restarted with the guard open.

Pass: Opening any interlocked guard stops the associated hazardous motion, and no start command initiates motion while that guard remains open.

This is the physical stop-on-open behaviour of each guard; the safety-logic wiring and dual-channel monitoring behind it are verified in the controls module.

Witness that operating each emergency-stop device stops all hazardous motion, and confirm that resetting the device does not by itself restart the machine — a separate deliberate start action is required.

Pass: Every e-stop, when operated, halts all hazardous motion; releasing and resetting it does not restart motion without a separate start command.

Function and reset-does-not-restart behaviour are witnessed here; the control-system response time and stop category at the logic level belong to the controls module.

Witness that interrupting each light curtain or area scanner field during hazardous motion stops that motion, and that the machine cannot be restarted while the field remains broken.

Pass: Breaking the protective field stops the hazardous motion; motion does not resume while the field is obstructed, and restart requires a deliberate action.

The trip-to-stop behaviour is the core protective function of a presence-sensing device and must be witnessed for each field.

Where a presence-sensing device is muted or blanked during part of the cycle, witness that muting activates only during the intended non-hazardous phase, ends when that phase ends, and provides an indication that muting is active.

Pass: Muting or blanking engages only in the specified cycle phase, reverts to full protection outside it, and a muting indicator is active while muted.

Muting is the most abused safety feature: muting that stays on, triggers early, or has no indicator leaves the hazard exposed while the machine appears protected.

Where two-hand controls are fitted, witness that hazardous motion requires both actuators pressed within the permitted concurrency window and continuously held, and that releasing either one stops the motion.

Pass: Motion starts only with both actuators operated near-simultaneously and held; releasing either actuator, or operating one alone, does not initiate or sustain motion.

Attempt single-hand and tied-down operation as part of the test; a two-hand control that can be defeated by one hand or a wedge gives no protection. ISO 13851 covers two-hand controls but only cite it if the specification does.

Where the equipment includes a robot or programmable manipulator, witness that reduced-speed or safe-operating modes limit motion as specified and that entry into a defined safeguarded zone stops or slows the robot as intended.

Pass: Reduced-speed mode holds robot motion within the specified limit, and breaching a safeguarded zone produces the specified protective stop or speed reduction.

Safety-rated speed limits and zone monitoring are the primary safeguards for collaborative or fenced robot cells and are validated by the buyer's zone and speed specification.

For equipment containing a laser source, witness that opening the enclosure or defeating an access interlock removes laser emission, and confirm the enclosure is intact with no unintended apertures allowing beam escape.

Pass: Opening any interlocked access point or panel terminates laser emission; the enclosure shows no gaps or apertures permitting beam or reflected-beam escape.

Applies only to equipment with an enclosed laser source. Enclosure integrity and emission-off-on-open are the containment safeguards for an otherwise inaccessible beam. IEC 60825-1 governs laser safety but only cite it if the specification does.

Verify that isolating each energy source and following any specified residual-energy discharge step leaves no hazardous stored energy — confirm hydraulic and pneumatic pressure is vented, capacitors are discharged, and gravity or spring loads are supported or blocked.

Isolation alone does not remove trapped energy; an accumulator, sprung mechanism or suspended axis can release after the supply is locked off if no discharge or restraint step is provided.

Collect the safety-function validation records for the witnessed tests, together with any risk assessment, safety-device datasheets and laser-classification declaration provided for the machine.

These records evidence which protective functions were validated at the works and are needed for on-site commissioning and the machine's safety file.

Confirm no protective device has been bypassed, jumpered, taped, or otherwise defeated to ease commissioning — inspect for defeated interlocks, blocked curtains, and disabled e-stop or safety channels.

Safety functions are routinely defeated during factory build to speed adjustment and are sometimes not restored; a bypass left in place ships an unsafe machine that appears compliant.

Confirm safety hazard labels, laser-classification and aperture warnings, and isolation-point identification are present, legible, and in a language agreed with the buyer.

Missing, illegible or wrong-language safety and laser labelling is a frequent shipment defect and can block acceptance or import; laser labels are required only for laser-containing equipment.

Confirm an instrument list or tag schedule is available that names every fitted instrument by tag, type, range and required accuracy, and reconcile it against the instruments actually installed.

Without a reconciled tag list, missing or substituted instruments go unnoticed and no item below can be judged complete.

Confirm the reference instrument used for spot accuracy checks is itself in-date and of adequate accuracy for the tags being verified, and record its identity.

A reference no better than, or coarser than, the instrument under check cannot prove the reading; this is the fitted-instrument counterpart to the FAT test-equipment calibration checked under pre-FAT readiness.

Verify each tagged instrument's identification plate or label matches the tag schedule for tag number, model, range and units, and that the tag is legibly and durably marked on the instrument.

Untagged or mislabelled instruments cannot be maintained, recalibrated or trusted once the equipment is on site.

Verify the indicated engineering units and measurement range of each local gauge, dial and display match the buyer specification.

Instruments scaled in the wrong units (e.g. bar vs psi, degC vs degF) or with an unsuitable range are a frequent and easily missed non-conformity on export equipment.

Verify each sensor and instrument is installed at the location, orientation and process connection shown on the P&ID or general arrangement drawing, including isolation and any manifold or root valve.

Owns sensor placement only; the wiring back to the control system and the control response to the signal are checked under the electrical and controls modules respectively.

Verify the sensor mounting suits the measurement — flow elements have the specified straight-run and correct flow direction, thermowells are inserted to the specified depth, and level and pressure tappings are at the correct elevation.

Correct hardware installed incorrectly still reads wrong; poor placement is a built-in error that no downstream calibration removes.

Perform a spot accuracy check on each critical instrument by comparing its indication against the reference instrument at the process condition available during the FAT, and record both readings.

Pass: Difference between the instrument indication and the reference reading is within the instrument's stated accuracy or the tolerance in the buyer specification, at each point checked.

A single-point comparison at ambient or idle condition will not exercise the full span; note which points could be checked and which could not.

Where an instrument feeds a local or panel display, verify the value shown on the display agrees with the instrument's own indication and with the reference reading.

Pass: Displayed value tracks the reference reading within the combined stated accuracy of the loop, with no offset, wrong scaling or unit mismatch between field and display.

Verifies the reading is carried through to where the operator sees it; the display truth is in scope, but alarm and interlock behaviour driven by the value belongs to the controls module.

For any instrument that cannot be exercised at a representative process value during the FAT, witness or review a bench or loop calibration record covering its full span rather than a single point.

Pass: Documented calibration shows as-found and as-left errors within the instrument's stated accuracy across the specified span, with the calibration current and traceable.

Full-span coverage catches linearity and span errors that a single ambient spot check cannot; accept documentary evidence only where live checking is impractical.

Collect a valid, in-date calibration certificate for each fitted instrument that shows the tag number, the as-left result, the accuracy achieved and the calibration and due dates.

An instrument fitted without a current certificate has no evidence of correctness; a certificate that does not carry the tag number cannot be tied to the instrument on the equipment.

Verify each calibration certificate states traceability to a recognised national or international measurement standard through the reference equipment used.

A certificate with a result but no traceable chain is not defensible; ISO/IEC 17025 accreditation of the calibrating body is often required but only cite it where the buyer specification does.

Check for calibration certificates whose due date will lapse before the equipment is expected to be commissioned on site.

Instruments calibrated long before shipment can arrive out of calibration after transit and storage; flag short-dated certificates so recalibration can be planned before start-up.

Check that a certificate exists and reconciles for the specific serialised instrument fitted, not for a different unit of the same model, and that no tag has been left with a generic or template certificate.

A common substitution is a certificate for one serial number attached to a different installed instrument; match serial numbers, not just model numbers.

For instruments with a configurable range or scaling, confirm the range actually configured in the device matches its nameplate, its certificate and the buyer specification.

A transmitter can be calibrated correctly yet re-ranged afterwards; a field-configured range that disagrees with the specification produces plausible but wrong readings in service.

Confirm the rated-duty figures to be demonstrated — throughput or capacity, cycle time, consumption, and output-quality acceptance criteria — are written into the purchase order or datasheet and agreed in the FAT protocol before the run.

Without agreed numbers and a defined test method the performance run degrades into a vague 'ran at rated load' observation that proves nothing at payment time.

Confirm the run will use the specified test material, feedstock, or load and the rated operating conditions (speed, setpoints, product grade), and record any deviation from service conditions agreed for the test.

A performance figure achieved on an easy substitute material or a light load does not represent rated duty; substitutions must be declared and accepted, not discovered afterwards.

Confirm the instruments used to measure throughput, cycle time, and consumption (flow, power, air, and water meters, timers, counters, weighers) are identified and hold valid calibration for the test.

The performance result is only as trustworthy as the meters that produced it; sensor accuracy against a reference is verified under the instrumentation module, but calibration validity for this run must be confirmed here.

Witness a sustained run at rated capacity for the agreed test duration and record the achieved throughput over that period.

Pass: Averaged throughput over the full agreed duration meets or exceeds the rated capacity stated on the datasheet or purchase order, within any agreed tolerance, without slowing to sustain the rate.

Throughput group. A short burst at rated speed is not proof; the figure must hold across the agreed duration. Peak instantaneous rate is not the same as sustained capacity.

Measure the cycle time (or takt time) for representative cycles during the sustained run and record the values.

Pass: Measured cycle time meets or is below the specified cycle time on the datasheet or purchase order, within any agreed tolerance, and is consistent across the sampled cycles rather than met only occasionally.

Throughput group. Cycle time and throughput are separate claims: a machine can hit its cycle time on a single cycle yet miss sustained throughput once loading, indexing, and reset are included.

Confirm the unit holds rated output stably through the run without unplanned stoppages, throughput decay, or manual intervention to keep it running, and record any stoppage with its cause and duration.

Pass: Rated output is sustained for the agreed duration with no unplanned stop and no downward drift in rate; any stoppage is logged and, if not within the agreed allowance, the run is repeated.

Throughput group. Frequent micro-stops, creeping rate loss, or an operator nursing the machine all indicate the rated duty is not genuinely met even when the headline number is briefly reached.

Measure electrical power drawn by the unit while running at rated load and compare it against the declared consumption figure.

Pass: Measured power demand at rated load is at or below the declared/guaranteed consumption figure on the datasheet or purchase order, within any agreed tolerance.

Consumption group. Consumption is checked at load, not idle; an under-declared draw can overload the site supply or breach an energy guarantee. Measured against the declared figure only — connection-point sizing versus the interface drawing belongs to the utilities module.

Where the unit consumes compressed air, measure air consumption at rated load and supply pressure and compare it against the declared figure.

Pass: Measured air consumption (free air delivery) at the specified working pressure and rated load is at or below the declared figure, within any agreed tolerance.

Consumption group. Applicable only to air-using equipment. Understated air demand starves other equipment on a shared compressor and is a common source of on-site capacity shortfalls.

Where the unit consumes process or cooling water (or other declared utility), measure consumption at rated load and compare it against the declared figure.

Pass: Measured water/utility consumption at rated load and the specified supply conditions is at or below the declared figure, within any agreed tolerance.

Consumption group. Applicable only where a water or fluid utility is declared. Excess draw can exceed the site's supply or effluent capacity and inflate running cost against the quoted figure.

Confirm a sampling plan for output quality — sample size, sampling frequency, acceptance and rejection numbers — is agreed and recorded before the run begins.

Pass: A written sampling plan with defined sample size, frequency, and accept/reject criteria is fixed and signed off before output is sampled, not adjusted after results are seen.

Output-quality group. Agreeing the plan afterwards lets a marginal run be passed by relaxing the criteria. ISO 2859-1 governs attribute sampling by acceptance level and is cited only where the buyer's plan is built on it; otherwise use the agreed plan and set standardRef to null.

During the sustained run, sample the output to the agreed plan and check each sample against the buyer's output acceptance criteria, recording the result of each sample.

Pass: Sampled output meets the buyer's specified acceptance criteria and the run stays within the acceptance number of the agreed sampling plan; the lot is not accepted if the rejection number is reached.

Output-quality group. Throughput at rated speed is worthless if the product coming off is out of tolerance; output must be judged during the capacity run, not on a separate hand-picked sample.

Record the reject, scrap, or rework rate observed over the sustained run and compare it against the agreed maximum.

Pass: Reject/scrap rate over the run is at or below the maximum stated in the purchase order or agreed in the FAT protocol; if no figure is specified, the rate is recorded for acceptance by agreement.

Output-quality group. A machine that meets throughput only by producing a high scrap fraction has not met effective capacity; the good-output rate is the figure that matters on site.

Collect the signed performance test record — achieved throughput and cycle time, measured consumption figures, and the completed output-sampling results with reject rate — noting test material, operating conditions, and instruments used.

This signed record is the shipment-payment evidence that rated duty was actually demonstrated; without the test conditions and instruments noted, the figures cannot be defended or reproduced on site.

Confirm the demonstrated rate was not achieved by running above the specified operating parameters (over-speed, over-temperature, over-pressure, or a setpoint outside the datasheet) purely to pass the test.

Rated output is only valid at rated conditions; pushing the machine past its specified settings to reach the number hides a real capacity shortfall and shortens equipment life in service.

Obtain the hygienic-design specification for the product-contact surfaces — required contact-material grade, maximum surface roughness (Ra), acceptable elastomer/gasket materials, drainability requirement and any CIP/SIP regime — before beginning the checks.

Ra limits, permitted materials and cleaning regime are all buyer/PO-dependent. Without the declared targets the hygienic checks below can only be observed, not evidenced against a requirement.

Confirm a means of measuring surface roughness is available for the FAT — a calibrated surface-roughness gauge, or reference roughness comparator specimens — and record its identification and calibration status.

A stylus roughness gauge gives a numeric Ra; comparator specimens give a tactile/visual comparison only. Note which method is used, since a comparator result is a judgement, not a measurement.

Cross-check the contact-material certificates against the specification: confirm every product-contact metal component is covered by a material certificate stating the specified grade (e.g. the required stainless grade), and that the certified grade matches the requirement.

Substitution of a lower or non-specified grade on contact surfaces (e.g. a 304 grade where 316L is required for the process) is a hygienic and corrosion-resistance non-conformity that a paper glance can miss. This item confirms the certificate; independent analyser verification of the metal is item fat-mat-005 in the material module — cross-reference and do not repeat the analyser spot check here.

Measure the surface roughness (Ra) of product-contact surfaces at a representative sample of locations and confirm each reading is at or below the specified maximum Ra.

Pass: Measured Ra at every sampled contact-surface location is at or below the specified maximum (contact surfaces frequently specify Ra 0.8 um or finer; use the buyer's stated limit).

A rough contact surface harbours product residue and micro-organisms and cannot be reliably cleaned. Sample tanks/vessels internally, pipe bores and fittings where reachable; a polished sample coupon is not evidence for the actual built surfaces.

Inspect contact-side welds for hygienic finish: confirm process-side welds are full-penetration, continuous, and ground/polished flush where required, with no crevices, pin-holes, undercut, unfused root, discolouration/heat tint or embedded spatter on the product side.

Contact-side welds are a primary residue trap. This is the hygienic finish of the wetted weld face specifically; general weld workmanship and any NDT of the weld are owned by the material and pressure modules and are not duplicated here. Heavy heat tint on stainless indicates lost corrosion resistance and inadequate purging.

Walk down the product-contact circuit for drainability and freedom from dead legs: confirm the wetted path is self-draining to the intended low points at the installed orientation, and that branches, instrument tees and unused ports are within the specified dead-leg limit.

Pooled product and stagnant dead legs are not cleaned or sterilised by CIP/SIP and are a contamination source. Check slopes on the FAT stand match the installed condition, or note the orientation the drainability claim depends on. The permissible dead-leg ratio is buyer/standard-dependent.

Verify product-contact joints and fittings are of hygienic design: confirm connections are the specified sanitary type (e.g. hygienic clamp, orbital-welded or aseptic fittings) with correctly seated gaskets and no exposed threads, ledges, sharp internal corners or crevices in the wetted path.

Non-hygienic fittings, mis-seated or protruding gaskets and internal crevices defeat cleanability regardless of surface finish. Connection type and standard are specification-dependent.

Where the equipment includes an integral clean-in-place (CIP) system, witness a CIP cycle and confirm each cleaning phase runs as programmed and that spray devices wet the full contact surface with no shadowed areas.

Pass: The CIP cycle completes each programmed phase (pre-rinse, caustic, intermediate rinse, acid where used, final rinse) at the specified sequence, and full contact-surface coverage is confirmed (e.g. by riboflavin/coverage test or witnessed spray-pattern check) with no unwetted zones.

Include only where the equipment provides its own CIP capability. Witness the cycle as delivered; achieved flow/temperature/concentration/time against the CIP recipe are confirmed in the item below. Cleaning-result validation (e.g. swabbing) is a commissioning activity, not a FAT check.

Where a CIP or sterilise-in-place (SIP) regime is provided, witness and record the achieved cleaning/sterilising parameters — supply and, where relevant, return temperature, flow or supply pressure, chemical concentration, and phase duration — against the specified CIP/SIP recipe.

Pass: Recorded CIP/SIP parameters (temperature, flow/pressure, concentration, hold/exposure time for each phase) meet or exceed the values stated in the specified recipe, held for the full specified duration.

Under-temperature, low flow, weak concentration or a shortened hold leaves surfaces effectively uncleaned/unsterilised while the cycle appears to complete. For SIP, the exposure temperature and hold are the critical parameters. Recipe targets are buyer-dependent.

Collect the food-/product-contact conformity declarations for every elastomer, gasket, seal, O-ring and non-metallic contact part, and confirm each declared material is on the specified/permitted list and rated for the process temperature and any CIP/SIP chemicals.

Elastomer compliance is documentary — collect the manufacturer's food-contact declaration (the applicable regime, e.g. FDA 21 CFR 177 or EC 1935/2004, is buyer-jurisdiction-dependent, so record it rather than assuming one). An unlisted or unrated elastomer is a contact-material non-conformity even when the metalwork is compliant.

Collect the contact-material certificates, the surface-roughness (Ra) readings recorded at the FAT, the sanitary weld log / weld-finish records, and any surface-treatment (e.g. electropolish or passivation) certificate for the product-contact surfaces.

These are the objective records that the hygienic surfaces meet the requirement. Retain them with the FAT pack; passivation/electropolish certificates apply only where that treatment is specified.

Confirm there is no crevice, threaded fastener, blind gap or trapped-liquid pocket exposed to the product path, and that instrument penetrations, sight glasses and manway seals into the contact zone are flush-mounted and hygienically sealed.

Retrofitted instruments, exposed bolt threads and recessed or protruding seals are the most common hygienic defects that survive to the FAT because they pass a functional test — the equipment works, but the contact zone cannot be cleaned. Treat each as a hold point, not a cosmetic note.

Confirm the product-contact grade, surface finish and weld/joint quality are consistent across the whole wetted circuit, with no section built to a lower standard than the specified contact surfaces.

A frequent cost-down is a compliant main vessel or tank fitted with lower-grade or rougher pipework, valves or fittings on the same wetted path. Sample beyond the showpiece component; the weakest section of the contact circuit sets the cleanable standard.