Testing, Commissioning and Acceptance
Insulation and earth tests, I/O and loop checks, drive and safety tests, fault injection, FAT, SAT and acceptance criteria.
A test plan
Work through the machine in stages. Each step proves one thing and makes the next safer. Write the plan from the specification (see Requirements, Specification and Project Stages): each requirement links to a test with a pass criterion, a method, the people who do it and a place for the record.
| Stage | Proves | Record |
|---|---|---|
| 1. Inspection | The build matches the drawings | Checklist, photographs |
| 2. Power-off tests | The wiring is safe and correct before power is applied | Insulation and continuity values |
| 3. Power-up in stages | The supplies and the controllers start | Voltages, firmware versions |
| 4. I/O check | Every signal reaches the right tag | I/O list ticked off |
| 5. Loop checks | Analog signals read correctly in engineering units | Readings against the injected values |
| 6. Drives and motors | Direction, parameters, limits, brakes | Parameter list and tuning |
| 7. Safety functions | Each safety function works, with faults | Validation report |
| 8. Sequences and faults | The machine does what the specification says, and fails safely | Test sheets |
| 9. Performance run | Rate, quality and reliability | Production log |
Inspection and power-off tests
- Compare the panel against the drawings: devices, ratings, wire numbers, terminal numbers, labels, earth connections; check the terminal torque and the cable glands.
- Check the protective bonding (earth continuity) from the PE bar to every exposed metal part: a low-resistance connection (typically below 0.1 Ω) with a test current of at least 0.2 A (IEC 60204-1 specifies a limit related to the conductor’s length and section).
- Measure the insulation resistance of the power circuits at 500 V DC: at least 1 MΩ between the live conductors and the protective circuit (IEC 60204-1), after isolating or disconnecting electronics, drives and surge protectors that the test voltage could damage.
- Check the supply (voltage, phase sequence, frequency) before connecting the panel, and the earth-fault loop impedance at the machine (see Grounding, Shielding and Noise).
- Check the 24 V circuits for shorts before the supply is switched on: a short at power-up is much easier to find with the supply off.
Worked example: insulation and earth tests
| Circuit (500 V DC) | Reading | Result |
|---|---|---|
| Power circuits to PE | 85.00 MΩ | pass |
| L1–L2–L3 between phases | 120.00 MΩ | pass |
| Heater circuit to PE | 0.62 MΩ | fail: find the fault (moisture in the heater is common) |
- The two passes are far above 1 MΩ; the heater circuit at 0.62 MΩ fails. A reading in this range is usually moisture in a heater element, a damaged cable or a connector with water in it, and it must be cleared before power is applied (dry out the heater, replace the cable).
- Earth continuity: a measured 0.04 Ω from the PE bar to a motor frame, in a circuit that may carry 10 A of fault current, drops 0.40 V: low enough. A reading of 1 Ω would drop 10 V and allow a dangerous touch voltage.
- Record every value with the test voltage, the instrument and its calibration date.
Powering up in stages
- With the motors, outputs and drives disabled or disconnected, switch on the main isolator and check the supply voltages at the incoming terminals, then each branch.
- Check the 24 V supply and its current with nothing connected, then with the controllers, then with the I/O (see Power Distribution and the Control Supply).
- Bring up the controller and network: firmware versions, IP addresses, the module list, the clock; check that every device is found and has no faults (see Industrial Communication).
- Check the safety devices first before enabling any motion (see below).
- Record the versions of all firmware and software, so that the validated configuration is known.
I/O check: point to point
The point-to-point check proves the whole chain for every signal: the field device, the cable, the terminal, the I/O card, the address and the tag in the program and on the HMI. Operate each input at the field device and confirm the right tag changes; force each output and confirm the right device responds. Tick it off against the I/O list.
Worked example: how long does it take?
At about 1.5 minutes per input and 2.0 minutes per output (with a second person watching the device), the 132 points of the I/O list (88 inputs, 44 outputs) take 3.7 hours with two people, if nothing is wrong. Allow double for finding the wires that are on the wrong terminal. A simulator or a break-out box at the FAT does most of the inputs without the field devices, and saves hours on site (see Requirements, Specification and Project Stages).
- Test with the real device, not a jumper, wherever possible: a sensor wired to the wrong terminal and tested with a jumper passes the test and fails in service.
- Check polarity and logic: normally open or closed, active high or low, and fail-safe wiring of a broken wire.
- Record every discrepancy and correct the drawings and the I/O list at once.
Loop checks
For each analog signal, inject or simulate known values and confirm the engineering-unit reading. A loop calibrator sourcing 4, 8, 12, 16 and 20 mA at the field end checks the cable, the input card, the scaling and the HMI display in one go (see Analog Scaling Tool and the 4–20 mA section of Wiring, Cables and Voltage Drop).
Worked example: a 0 to 10 bar loop
| Injected current | Fraction of span | Expected reading | Tolerance (±0.25 % of span) |
|---|---|---|---|
| 4 mA | 0 % | 0.00 bar | ±0.03 bar |
| 8 mA | 25 % | 2.50 bar | ±0.03 bar |
| 12 mA | 50 % | 5.00 bar | ±0.03 bar |
| 16 mA | 75 % | 7.50 bar | ±0.03 bar |
| 20 mA | 100 % | 10.00 bar | ±0.03 bar |
The readings taken at the HMI were:
| Current | Expected | Read | Error (bar) | Result |
|---|---|---|---|---|
| 4 mA | 0.00 bar | 0.02 bar | +0.02 | pass |
| 8 mA | 2.50 bar | 2.46 bar | −0.04 | fail |
| 12 mA | 5.00 bar | 5.03 bar | +0.03 | fail |
| 16 mA | 7.50 bar | 7.71 bar | +0.21 | fail |
| 20 mA | 10.00 bar | 10.01 bar | +0.01 | pass |
- The largest error is 0.21 bar against a tolerance of ±0.03: the loop fails at 8, 12, 16 mA. The end points pass but the points between fail, with +0.21 bar at 16 mA. A straight-line scaling error cannot do that, so look for something non-linear: a square-root characteristic enabled in the transmitter or the card, a damaged input, or a faulty injector. Check the calibrator against a reference first, then the settings.
- Check the fault conditions: 0 mA (a broken wire) must raise a fault, not read as zero pressure (see the NAMUR levels in Sensors, Signal Conditioning and ADCs).
- RTD loops: inject a resistance from a decade box, using the standard table; a Pt100 is 100.00 Ω at 0 °C and about 138.5 Ω at 100 °C. The values below follow the Callendar–Van Dusen equation.
| Temperature | Pt100 resistance |
|---|---|
| 0 °C | 100.00 Ω |
| 50 °C | 119.40 Ω |
| 100 °C | 138.51 Ω |
| 150 °C | 157.33 Ω |
| 200 °C | 175.86 Ω |
Drives and motors
- Enter the motor nameplate data into the drive, set the limits (speed, current, torque, ramps), and run the autotune with the motor disconnected from the load if the maker says so (see Motion Control and Actuators).
- Check the direction of rotation unloaded and the encoder direction; run slowly first.
- Test the brake, the holding torque, the emergency stop and safe torque off with the drive’s feedback.
- Tune the speed and position loops for the real load, then log a step response and save the result.
Worked example: judging a tuning step response
A 100 rpm speed step gives an overshoot of 8 % and settles to within 2 % in 0.6 s (the loop has a proportional gain of 4.0 and an integral time of 0.2 s). If the requirement is “no more than 5 % overshoot and settling within 1 s”, the settling passes and the overshoot fails: reduce the gain or lengthen the integral time a little and repeat. Write the acceptance numbers into the test sheet, run the step three times and keep the plot.
Safety functions
- Test every emergency stop, every guard and every interlock in every mode, with the machine in several states, and record it (see Machine Safety Systems).
- Measure the stopping time at the worst case and compare with the value used for the safety distance.
- Fault-injection tests on the safety circuits: break one channel, short the two channels, hold a feedback contact: the machine must stop and not restart.
- Verify the safety program version and its checksum against the validated one.
- Signed record: who tested, when, with which result.
Sequences and fault injection
Run each mode (manual, automatic, setting, maintenance) slowly or with reduced speed and force first, then at full production rate. Then try to break it: a machine that works only when everything is right is not finished.
| Fault to inject | What must happen |
|---|---|
| Pull a sensor cable | It reaches a safe state, shows a clear message and recovers correctly, without damage and without a restart that surprises someone |
| Drop a network cable | It reaches a safe state, shows a clear message and recovers correctly, without damage and without a restart that surprises someone |
| Trip a motor overload | It reaches a safe state, shows a clear message and recovers correctly, without damage and without a restart that surprises someone |
| Cut the air | It reaches a safe state, shows a clear message and recovers correctly, without damage and without a restart that surprises someone |
| Switch off power in mid-cycle | It reaches a safe state, shows a clear message and recovers correctly, without damage and without a restart that surprises someone |
| Open a guard in each mode | It reaches a safe state, shows a clear message and recovers correctly, without damage and without a restart that surprises someone |
| Press each emergency stop | It reaches a safe state, shows a clear message and recovers correctly, without damage and without a restart that surprises someone |
| Fill or empty a buffer | It reaches a safe state, shows a clear message and recovers correctly, without damage and without a restart that surprises someone |
| Jam a conveyor | It reaches a safe state, shows a clear message and recovers correctly, without damage and without a restart that surprises someone |
| Lose the plant network | It reaches a safe state, shows a clear message and recovers correctly, without damage and without a restart that surprises someone |
- Power loss mid-cycle: restore the power; the machine must start in a defined condition (see Power Distribution and the Control Supply).
- Operator mistakes: press the wrong button, select the wrong recipe, skip a step: the HMI and the interlocks should prevent harm.
- Record every change made to the program during commissioning, and update the drawings (see Documentation, Handover and Lifecycle).
FAT and SAT
| Test | Where | What is shown |
|---|---|---|
| FAT (factory acceptance test) | The supplier’s workshop | Everything that can be shown without the site: the panel, the program with simulated or real I/O, the HMI, the safety logic, documents |
| SAT (site acceptance test) | The customer’s site | The wiring to the real field devices, the services, the product, the operators and the performance |
- Agree the FAT and SAT procedures before the build, with the pass criteria and who witnesses each test.
- Do a dry run of the FAT before the customer arrives; the real FAT should be a demonstration, not a discovery.
- Fix and retest: a failure is a record, a correction and a retest, with the date.
- After the SAT take a fresh backup of every device, with the versions (see Documentation, Handover and Lifecycle).
Acceptance, run-in and the punch list
Worked example: a 72-hour run
- At a 2.4 s cycle the machine makes 1 500 cycles an hour and 108 000 cycles in 72 hours. During the run it stops 3 times for 15 minutes each: an MTBF of about 24 hours and an availability of (72 − 3 × 0.25) ÷ 72 = 99.0 %.
- Against a target of 98 %, the run passes. Agree in advance what counts as a stop (a machine fault, but not a lack of material or a break), how it is measured, and what happens if the run fails (restart the clock, or fix and continue).
- A zero-failure demonstration: to show with 95 % confidence that the fault rate is below 0.2 % of cycles, the machine must run 1 496 cycles with no failures. If the contract asks for this, check that the run is long enough.
- Cycle time: ten measured cycles average 2.40 s with a standard deviation of 0.018 s; the requirement is 2.50 s. The margin is (2.50 − 2.40) ÷ 0.018 = 6 standard deviations: comfortably met.
| Class of open item | Number | Rule |
|---|---|---|
| A: Safety or unable to run: must be closed before acceptance | 3 | Must be closed before acceptance |
| B: Affects performance: closed before the end of the warranty period or by agreed date | 8 | Closed by an agreed date, with payment held back |
| C: Cosmetic or minor: closed when convenient | 14 | Closed when convenient |
| Total | 25 |
- Hold back payment for open items in proportion (see Requirements, Specification and Project Stages).
- Sign the acceptance certificate only when the tests are complete and the records are in the file.
- Keep the test records for the life of the machine: they are evidence in a dispute or an investigation.
Related
- System Integration: the overview of this guide.
- Requirements, Specification and Project Stages: the acceptance criteria written into the specification.
- Machine Safety Systems: validating the safety functions.
- Documentation, Handover and Lifecycle: the records and backups that close the project.
- Analog Scaling Tool for loop checks.
FAQ
What is the difference between FAT and SAT?
The FAT is done at the supplier’s premises before shipping and shows that the equipment meets the specification; the SAT repeats the important checks on site with the real wiring, utilities, product and operators.
How do I check a 4–20 mA loop?
Inject 4, 8, 12, 16 and 20 mA at the field end with a loop calibrator and compare the displayed value with the expected one at each point, within the stated tolerance. Check also that 0 mA raises a fault.
Why test insulation resistance, and at what voltage?
To find damaged insulation or moisture before power is applied. IEC 60204-1 requires at least 1 MΩ at 500 V DC for power circuits, with electronics and surge protectors disconnected first.
How long should an acceptance run be?
Long enough to show the rate, quality and reliability that the contract requires: typically one to several days of production, or a number of cycles that gives the confidence stated. Agree what counts as a failure in advance.
References
- IEC 60204-1, clause 18 (verification: protective bonding, insulation resistance, voltage tests, functional tests); IEC 61439-1 (routine verification of assemblies).
- ISA-5.1 (instrument loop diagrams) and IEC 60751 (Pt100 resistance table); ISO 13849-2 and IEC 62061 (validation of safety functions).
- ISPE GAMP 5 (qualification of automated systems), where the validation of regulated systems is required.
Last reviewed: October 2026. Values, times and tolerances are illustrative: use the standards, the specification and the instrument makers’ data.