Factory and Site Acceptance Testing
When a plant buys a control system, the vendor writes the test procedure, the vendor runs the test, and the vendor decides what counts as a pass. The buyer signs. That arrangement works until something in the specification was never actually tested, and by then the system is installed.
We act for the buyer. We have written test procedures, witnessed factory acceptance tests at Emerson and at ABB, and run site testing on DCS, ESD and burner management systems on plants in operation.
Factory acceptance testing
Test procedures written against the specification. Not against the vendor's standard checklist. Every requirement in the functional specification becomes a test with a defined pass criterion, including the ones the vendor would rather demonstrate than test.
Simulation of the field. I/O forced and simulated across the full signal range, not only at the values that behave. Failure modes exercised: open circuit, out of range, communication loss, power loss to a segment.
Redundancy proved by failure. Controller changeover, network changeover and power supply changeover tested by removing the primary, under load, with the process simulation running — not by reading a status indication.
Safety system logic against the cause-and-effect matrix. Every input combination that the matrix defines, and the ones it does not, to establish what happens outside the specified envelope. See also Safety Systems and Burner Management Systems.
Punch list with severity. What blocks shipment, what can be closed on site, and what is a specification defect rather than a build defect. Recorded so that the same item cannot quietly change category later.
Site acceptance testing
Loop checking. Field device to control system to operator display, end to end, per loop, against the loop drawing.
Functional testing. Interlocks, sequences and permissives exercised against the control narrative, with the process in a defined state.
Loop tuning. Controllers tuned on the running process rather than left at the values that survived the factory test.
Safety system proof testing. Trip functions demonstrated from the sensor through the logic solver to the final element, with response times measured.
Documentation reconciled to reality. As-built drawings and signal database updated to what was actually installed, which is never exactly what was designed.
Independent verification
We also verify I&C design documentation against local and international standards on behalf of a buyer, whether or not we take part in the testing — before construction, when a finding still costs a drawing revision rather than a shutdown.
We have carried out this role at scale: on a combined cycle power plant, verification of design for execution documentation, review of control algorithms and signal databases, inspection of instrumentation and control equipment at the manufacturers under their quality control programmes, entrance control at site, quality control of erection and commissioning, and review of test and commissioning programmes — all as the investor's representative.
Risk-based test programmes
A commissioning test programme written from the specification tests what the system is supposed to do. A test programme written from the risks tests what happens when it does not.
We write and run the second kind. The structure is the same each time:
Name the failures worth testing
Not every component, but the ones whose failure changes the outcome: the governor block, the actuator, the oil pressure supply, the auxiliary power feed, the controller and its I/O subsystem, the communication channels.
Apply them one at a time, deliberately, on the running plant
With the protections verified and in service beforehand, with a permit to work, with personnel briefed on how to stop the test, and with people stationed at the manual means of shutting the machine down if the automatic ones are the thing being tested.
State in advance what a pass looks like for each, and record what actually happened rather than whether it felt acceptable.
Say when a test cannot be run
On one unit the islanding test could not be performed at all, because the governor had been deliberately slowed to protect the penstock and no valid result was obtainable. Recording that, with the reason, is a result — and it prevented a test that would have damaged the plant to produce a number nobody could use. See Hydro Turbine Control for the governor and protection context on that unit.
Reviewing someone else's protocol
We are also asked to review completed test protocols as an outside expert. On a turbogenerator protocol covering load rejection at 5 and 15 MW, transfer from load control to speed control on leaving the grid, automatic change of control law from proportional to proportional-integral on entering the island, overspeed protection, automatic synchronisation and 6.3 kV automatic transfer switching, the questions we were asked to answer were which of the stated conclusions the recorded measurements actually supported, and what had not been demonstrated at all.
A test report is evidence only if the tests behind it prove what the report claims. Reading one properly is a separate skill from running one.
Platforms we have tested on
Emerson Ovation · ABB Industrial IT 800xA · ABB Symphony · Siemens PCS7 · Yokogawa Centum VP · HIMA HIQuad · Foxboro Triconex · ABB AC800