Dairy Science & Technology · Dairy Engineering & Plant Operations · also Instrumentation and Process Control, Dairy Plant Automation
Measuring and controlling temperature, flow, pressure and level in a milk plant, from sensors to PLC and SCADA.
In the exams: ICAR AICE subject 38 Unit 7; ICAR AIEEA-PG group 17 Unit I (computerisation and automatic process control in milk processing)
A modern milk plant is run by its instruments. Every litre is measured at reception, every pasteuriser is held at temperature by a controller and proved safe by a recorder, every CIP circuit steps through its rinses on a timer and a conductivity signal, and every batch leaves a trail of electronic records. Instrumentation is the craft of measuring temperature, pressure, flow, level and composition reliably; process control is the craft of using those measurements to keep the process where it should be; automation ties the two together with programmable logic controllers (PLCs), supervisory control and data acquisition (SCADA) and distributed control systems (DCS).
This manual is written for the dairy technologist, not the instrument engineer. The general theory of sensors, bridges, signal conditioning and feedback control is covered in the agricultural engineering subject instrumentation-sensors-control; here each chapter gives a short reminder of that theory and then spends its words on what is particular to milk: hygienic sensor design, the legal role of the pasteuriser recorder and flow diversion valve, conductivity-based phase detection in CIP, metering at reception, and the integrity of the records that prove a product was made safely. Equipment construction (plate heat exchangers, holding tubes, valves as hardware) is in dairy-processing-equipment, pasteurisation as a critical control point is in dairy-food-safety-systems, and laboratory instruments such as spectrophotometers and chromatographs are in dairy-analysis-instrumental.
Examiners ask about this subject in three ways. Entrance and postgraduate papers (ICAR AIEEA-PG group 17, GATE Agricultural Engineering) test definitions and short calculations: accuracy against full scale, time constants, thermocouple and RTD readings, 4–20 mA scaling, controller modes. PhD and specialist papers (ICAR AICE-JRF/SRF subject 38 Unit 7) go further into controller tuning, valve characteristics, PLC logic and system architecture. Regulators and auditors, finally, ask whether the plant can prove what its instruments did, which is why the last chapter is on data integrity. Regulatory details such as recorder accuracy limits and test frequencies change and differ by country; this manual describes the principles and sends you to the current text, for example the Codex Code of Hygienic Practice for Milk and Milk Products, the EU food-hygiene regulations, the US Grade A Pasteurized Milk Ordinance (PMO) or your own national food-safety regulation.
Any instrument, from a dial thermometer on a cream tank to a Coriolis meter at reception, can be described by the same chain of functional elements. A primary sensing element responds to the quantity being measured (the measurand): a thermocouple junction to temperature, a diaphragm to pressure. A variable-conversion element changes the signal into a more convenient physical form, such as a diaphragm movement into a change of capacitance. A variable-manipulation element changes the magnitude of the signal without changing its nature, as an amplifier raises millivolts to volts. A data-transmission element carries the signal to where it is used, today usually as a 4–20 mA current loop or a digital fieldbus. Finally a data-presentation element shows or records the value: an indicator, a chart recorder, a SCADA screen or a historian database.
Thinking in these blocks helps with fault finding. If a pasteuriser outlet thermometer reads wrongly, the fault may lie in the sensor (a damaged RTD), the conversion (a wrong transmitter range), the transmission (a loose terminal adding resistance), or the presentation (a mis-scaled display). The general theory of these elements, and of loading, interference and noise, is set out in agri-engineering instrumentation-sensors-control; this chapter keeps to the characteristics a dairy technologist must specify and check.
Static characteristics describe an instrument when the measurand is steady. Range is the span of values it can measure, for example 0–150 °C; span is the difference between the upper and lower range values. Accuracy is how close the reading is to the true value, and is quoted in two different ways that students often confuse. Accuracy as a percentage of full scale (or of span) gives a fixed absolute error over the whole range: a 0–10 bar gauge of ±1% full scale can be wrong by ±0.1 bar anywhere, which is ±5% of a 2 bar reading. Accuracy as a percentage of reading shrinks with the reading. This is why a gauge or flowmeter should be chosen so that normal readings fall in the upper part of its range.
Precision, or repeatability, is the closeness of repeated readings of the same input; an instrument can be precise but inaccurate if it carries a constant bias, which calibration removes. Resolution is the smallest change the instrument can show. Sensitivity is the change of output per unit change of input, such as millivolts per degree. Linearity describes how closely the calibration curve follows a straight line; non-linearity is usually quoted as the largest deviation from that line as a percentage of full scale. Hysteresis is the difference between readings taken with the input rising and with it falling, common in mechanical gauges and some level switches. Dead band is the range of input change that produces no output change. Drift is a slow change of output with time at constant input, and zero drift and span drift are corrected at calibration.
When the measurand changes, the instrument lags behind. Most temperature sensors behave as first-order systems: after a step change the reading follows the exponential rise y = 1 − e^(−t/τ) of the step, where τ is the time constant. After one time constant the reading has covered 63.2% of the step, after three 95.0% and after five about 99.3%, which is why five time constants are taken as "settled". A sensor in a thermowell can have a time constant of many seconds, which matters in a holding tube where milk spends only seconds: a slow sensor will record a temperature fall late, and the controller and flow diversion valve will respond late. Pressure transmitters and some level instruments respond faster but can show second-order behaviour with overshoot and oscillation.
Errors are classed as gross errors (misreading, wrong range, wrong connection), systematic errors (a constant bias from calibration, installation or environment, such as stem conduction in a short thermometer pocket) and random errors (scatter that averaging reduces). A good installation reduces systematic error: the sensor tip immersed fully in the flowing stream, a well-fitted thermowell with heat-transfer compound where allowed, and cables screened and routed away from motor power cables to reduce electrical noise. Calibration against a reference traceable to national standards, recorded with its uncertainty, is the only way to know how large the remaining error is; measurement uncertainty itself is treated in dairy-quality-assurance-sqc.
A thermocouple is two dissimilar metal wires joined at a measuring (hot) junction. Because of the Seebeck effect, a voltage appears that depends on the difference between the hot-junction temperature and the temperature of the reference (cold) junction, where the wires meet copper at the instrument terminals. Thermocouples are self-generating: they need no excitation current. Type T (copper–constantan) suits low and moderate temperatures such as chilling and pasteurisation; type K (chromel–alumel) and type J (iron–constantan) are general-purpose types used at higher temperatures, for example in boilers and spray-dryer inlet air.
Two practical points dominate. First, cold-junction compensation: the instrument measures its own terminal temperature and adds the corresponding emf, so the displayed reading equals the hot-junction temperature. Without compensation, a reading is low by roughly the terminal temperature. Second, extension and compensating cables made of matching alloys must be used between the sensor and the instrument; ordinary copper cable creates new junctions and errors. For calculations, examiners often give a constant Seebeck coefficient in microvolts per degree; real thermocouple emf is slightly non-linear, and accurate work uses the reference tables or polynomials for each type. Thermocouple accuracy is typically a degree or more, which is why RTDs are preferred for the legal measurement in a pasteuriser.
A resistance temperature detector (RTD) uses the rise of a metal's resistance with temperature. The industrial standard is the Pt100, a platinum element with a resistance of 100 Ω at 0 °C. Over a moderate range its resistance follows R = R0(1 + αT) closely, with α = 0.00385 per °C for the common industrial grade, so a Pt100 reads about 138.5 Ω at 100 °C and about 128.1 Ω at 72 °C. The exact relation (the Callendar–Van Dusen equation) adds small higher-order terms. RTDs are more stable and accurate than thermocouples over the range met in a milk plant, which is why they are used for pasteuriser control and recording.
An RTD is passive: a small current is passed through it and the voltage measured, usually in a bridge or a transmitter. Lead-wire resistance adds to the reading, so three-wire connections (which place lead resistances in adjacent bridge arms where they largely cancel) or four-wire connections (which measure voltage on separate leads and remove lead effects almost entirely) are used. Self-heating by the measuring current is kept small. Thermistors are semiconductor elements whose resistance changes strongly, usually falling with temperature (NTC types); they are very sensitive but non-linear, and are used in data loggers and cold-chain monitors more than in process lines.
A high-temperature short-time (HTST) pasteuriser carries at least three temperature instruments at the end of the holding tube, each with a different job. An indicating thermometer, traditionally a mercury-in-glass or now an accepted digital reference, is the reference against which the others are checked. The recording thermometer, or safety thermal limit recorder (STLR) in US terminology, draws a continuous chart or electronic record of the holding-tube outlet temperature and the position of the flow diversion valve, and its sensor is linked to the controller that moves that valve. A separate controlling sensor at the heater outlet tells the temperature controller how much steam or hot water to admit.
The recorder is the plant's legal proof that every litre was pasteurised. Its chart or electronic file shows the date, the product, the temperature trace, the time and duration of any diversions, and the operator's signature or electronic sign-off; inspectors check it against the indicating thermometer. Regulations set the required accuracy of each instrument, the response-time test for the recording sensor, the cut-in and cut-out temperatures of the diversion valve, and how often each is tested. These figures differ between jurisdictions and are revised; in the US they are in the current Pasteurized Milk Ordinance and its appendices, and elsewhere in national dairy-hygiene rules. A technologist's task is to know where the plant's own rules are written and to keep the test records that prove compliance. Pasteurisation as a critical control point is treated in dairy-food-safety-systems.
Pressure is measured as gauge pressure (relative to the atmosphere), absolute pressure (relative to vacuum) or differential pressure (between two points). In a dairy the main instruments are Bourdon-tube gauges for local indication, and diaphragm-type electronic transmitters that use strain gauges, capacitance or piezoresistive elements to give a 4–20 mA or digital output. In product contact, sensors must be hygienic: a flush diaphragm mounted in a sanitary fitting, with no dead space where milk can lodge, or a remote diaphragm seal filled with a food-grade fluid. Bourdon gauges with an open tube are not acceptable on product lines because they cannot be cleaned.
Pressure matters in three places above all. Homogenisers run at high pressure and their gauges show whether the valves are set correctly. Evaporators run under vacuum, so absolute-pressure measurement controls the boiling temperature. And in a pasteuriser regenerator, the pasteurised milk must be kept at a higher pressure than the raw milk, so that a pinhole leak in a plate lets safe milk into raw milk rather than the reverse. That pressure difference is checked by differential pressure instruments interlocked with the booster pump and the flow diversion valve; the principle is universal, while the required margin and test method are set in the applicable regulation.
Several flow principles are used in milk plants. Differential-pressure meters (orifice plates, venturis) rely on Bernoulli's equation: the flow rate is proportional to the square root of the pressure drop, so halving the flow cuts the differential to a quarter, and the meter loses accuracy at low flows. Orifice plates are poorly suited to milk because they trap product and are hard to clean, but the square-root law is a standard examination topic.
Electromagnetic (magnetic) flowmeters apply Faraday's law: a conductive liquid flowing through a magnetic field generates a voltage proportional to its velocity. They have no moving parts or obstructions, are fully cleanable and measure milk, cream, whey and CIP solutions well because all are electrically conductive; they cannot measure non-conductive liquids such as oils, and entrained air causes errors. Coriolis mass flowmeters measure mass flow directly from the twisting of vibrating tubes and give density as a by-product, from which temperature-compensated volume, total solids of concentrate or the end of a product run can be inferred; they are accurate but expensive and sensitive to air. Positive-displacement meters count fixed volumes and are used for custody transfer in some plants. Turbine meters are less common on product because of cleaning. In the US, magnetic flowmeters form the heart of meter-based timing systems that replace the timing pump in an HTST pasteuriser, under conditions set in the PMO.
Level in silos, balance tanks and CIP tanks is measured either continuously or by point switches. Hydrostatic (pressure) level sensors measure the pressure at the bottom of the tank, which equals ρgh, so a known density converts pressure to height; foam does not affect them but a density change (say from milk to water) does. Radar and ultrasonic sensors measure the time for a signal to return from the surface; radar copes better with foam, vapour and temperature changes, while ultrasonic sensors can be confused by foam. Load cells weigh the whole tank and give mass directly, which is useful for blending and dosing. Capacitance and vibrating-fork switches give high and low alarms, dry-run protection for pumps and overfill protection.
In a balance tank on a pasteuriser, a float valve or level control keeps the supply steady so that the timing pump never runs dry and the raw-milk side stays at the right pressure. In a silo, level and temperature together tell the operator how much milk is held and whether it is being kept cold. Every level instrument in product contact must be hygienic and cleanable in place, and switches must fail safe: a broken high-level switch should signal "high" and stop filling rather than letting the tank overflow.
pH is measured with a glass electrode whose potential changes with hydrogen-ion activity, paired with a reference electrode. The ideal slope is given by the Nernst equation: about 59.16 mV per pH unit at 25 °C, rising in proportion to absolute temperature, which is why pH meters compensate for temperature. A pH 7 buffer gives roughly 0 mV on a typical combination electrode. Calibration uses two buffers bracketing the working range, and the measured slope is compared with the theoretical one; a slope well below theory shows an ageing or fouled electrode.
In a dairy, inline pH is used to follow fermentation in yoghurt and cheese vats, to decide when to break or cool, and to control acid dosing in whey and effluent treatment. Glass electrodes in product lines raise a hygiene and foreign-body concern, so many plants use sensors in retractable housings that withdraw the electrode for cleaning and calibration, or non-glass sensor types where accepted. Protein fouling slows the electrode and shifts its reading, so cleaning and recalibration schedules are part of the control plan.
Electrical conductivity measures the ability of a solution to carry current, which depends on its ionic content. Contacting cells use electrodes; inductive (toroidal) sensors use two coils and no exposed electrodes, so they resist fouling and suit strong detergents. Conductivity rises with temperature by roughly 2% per °C for many solutions, so readings are compensated to a reference temperature, usually 25 °C.
Conductivity is the workhorse of CIP control. Caustic and acid detergents have much higher conductivity than water, so a conductivity sensor on the return line can confirm that the detergent concentration in the tank is correct (the controller doses concentrate until the reading reaches its set point), and can detect the change from water to detergent and from detergent back to rinse water. This phase separation decides when to divert the return flow to drain and when to recover detergent to its tank, saving chemicals and preventing detergent from reaching product. Milk itself has a modest conductivity, and a rise in the conductivity of milk from a cow can signal mastitis, which is used in in-line sensors on milking systems.
Optical turbidity sensors measure light scattered or absorbed by particles and fat globules. They detect the interface between milk and water when a line is flushed, so product can be recovered rather than lost to drain, and they confirm that rinse water has become clear. Density, from Coriolis meters or dedicated density transmitters, indicates the total solids of concentrate leaving an evaporator or the change from one product to another.
Inline composition analysers measure fat, protein and solids continuously. Near-infrared (NIR) and mid-infrared instruments estimate composition from absorption at characteristic wavelengths, calibrated against reference chemical methods; they allow automatic standardisation, where the controller adjusts the proportion of cream returned to skim milk to hit a target fat percentage. Their accuracy is only as good as their calibration, so they are checked regularly against laboratory results. The laboratory reference methods and spectroscopic theory belong to dairy-analysis-instrumental; here the point is how inline sensors feed control loops and when they must be verified.
Feedback control compares a measured process variable with a set point and acts on the difference, the error. The controller's output drives a final control element such as a steam valve, which changes the process. Open-loop control, by contrast, acts on a timer or fixed schedule without checking the result. General block-diagram theory and stability analysis are in agri-engineering instrumentation-sensors-control.
On-off (two-position) control switches the output fully on or fully off. To prevent rapid switching, a differential or dead band is set: a cold store compressor might start at 5 °C and stop at 2 °C. On-off control is cheap and adequate where some oscillation is acceptable, as in cold rooms, water heaters and level control in some tanks. The process variable cycles continuously around the set point; a narrower differential reduces the swing but increases switching and wear.
Proportional (P) action makes the output change in proportion to the error: output = bias + Kc × error, where Kc is the controller gain. Many controllers express this as proportional band (PB), the percentage change of input that drives the output through its full range; PB (%) = 100 / Kc, so a gain of 2 is a proportional band of 50%. Proportional-only control leaves a steady offset whenever the load changes, because a non-zero error is needed to hold the output at a new value. A higher gain reduces the offset but makes the loop more oscillatory.
Integral (I) action, also called reset, adds output in proportion to the accumulated error over time, so it keeps changing the output until the error is zero; it removes offset. It is set as integral time Ti (minutes per repeat) or its inverse, repeats per minute. Too much integral action causes overshoot and slow oscillation, and when the output saturates (a valve fully open during start-up) the integral term can "wind up" and cause a large overshoot later, which anti-windup logic prevents. Derivative (D) action responds to the rate of change of the error, anticipating where the process is going; it damps overshoot in slow processes such as large heated tanks but amplifies measurement noise, so it is used sparingly and often omitted from flow loops. PI control is the default for most dairy loops: flow, pressure and most temperatures. PID is used for slow thermal processes. A pasteuriser heating-section temperature loop is typically PI or PID acting on a steam or hot-water valve.
Tuning means choosing gain, integral time and derivative time so the loop responds quickly without excessive overshoot. One classic method is the Ziegler–Nichols ultimate-gain (closed-loop) method: with integral and derivative action off, the gain is raised until the loop oscillates steadily; that gain is the ultimate gain Ku and the period of oscillation is the ultimate period Pu. The rules then give, for P-only control, Kc = 0.5 Ku; for PI, Kc = 0.45 Ku and Ti = Pu/1.2; for PID, Kc = 0.6 Ku, Ti = Pu/2 and Td = Pu/8. These settings give a fairly aggressive response with about a quarter-amplitude decay and are usually softened in practice. Other methods use an open-loop step test (process reaction curve) to estimate the process gain, dead time and time constant.
Beyond single loops, cascade control places one controller's output as another's set point: a pasteuriser product-temperature controller (master) sets the hot-water temperature controller (slave), so disturbances in the hot-water circuit are corrected before they reach the milk. Feedforward control measures a disturbance, such as a change in incoming milk temperature, and adjusts the output before the error appears. Ratio control keeps two flows in a fixed proportion, as in blending or detergent dosing. Dead time, the delay before a change is seen at the sensor, is the enemy of tight control; long sample lines and slow analysers add dead time and force slower tuning.
The final control element is what physically changes the process: a valve, a variable-speed pump, a heater. Control valves in dairies are usually hygienic seat valves or butterfly valves driven by pneumatic actuators, with a positioner that compares the controller signal with the actual stem position and corrects it.
A valve's inherent flow characteristic is the relation between stem travel and flow at constant pressure drop. With a linear characteristic, flow is proportional to travel. With an equal-percentage characteristic, each equal increment of travel changes the flow by an equal percentage of the flow already passing, giving fine control at low openings; it suits loops where the pressure drop across the valve falls as flow rises, such as most heat-exchanger and pressure loops. A quick-opening characteristic gives most of the flow in the first part of the travel and suits on-off service and relief. Valve capacity is expressed by the flow coefficient Cv (US gallons per minute of water at 1 psi drop) or Kv (cubic metres per hour of water at 1 bar drop); for liquids, flow is proportional to the coefficient times the square root of pressure drop divided by specific gravity. Kv is about 0.865 × Cv. An oversized valve operates nearly closed and controls poorly; an undersized one cannot pass maximum flow.
Every pneumatic valve must go to a defined position if air or power is lost. An air-to-open valve is spring-closed, so it fails closed; an air-to-close valve fails open. The safe position depends on the duty: a steam valve to a pasteuriser heater should fail closed so the product cannot overheat or the plant cannot continue heating unattended; a cooling-water valve should usually fail open; a flow diversion valve must fail to the divert position so that unpasteurised milk returns to the balance tank rather than going forward. Choosing fail-safe action is a hazard decision, written into the design and checked at commissioning.
Hygienic valve types matter as much as control action. Mix-proof (double-seat) valves allow two different liquids, such as product and CIP solution, to be in adjacent lines with a leakage chamber vented to drain between them, so a seal failure shows as a visible leak rather than contamination. Valve-position feedback switches tell the PLC whether a valve has actually moved; interlocks use this feedback, not just the command signal.
Instead of throttling a valve, flow can be controlled by changing pump speed with a variable-frequency drive (VFD), which changes the supply frequency to an AC motor. For centrifugal pumps, the affinity laws state that flow is proportional to speed, head to the square of speed and power to the cube of speed, so a modest speed reduction gives a large energy saving compared with throttling. VFDs are common on CIP supply pumps, milk transfer pumps and homogeniser feed.
In an HTST pasteuriser, the timing pump (or a magnetic flowmeter with a controlled valve or drive) fixes the maximum flow rate through the holding tube and therefore the minimum holding time. If a VFD were allowed to drive the timing pump faster than the sealed setting, holding time would fall below the legal minimum, so regulations require the speed or flow limit to be fixed, sealed or alarmed and tested. Positive-displacement timing pumps give flow nearly independent of pressure; centrifugal pumps do not and therefore need a flow-control system to serve as a timing device.
A programmable logic controller (PLC) is an industrial computer built to read inputs, run a control program and set outputs reliably in a plant environment. It has a power supply, a central processor, memory, input modules (digital inputs from switches and valve feedback, analogue inputs from 4–20 mA transmitters) and output modules (digital outputs to solenoids and motor starters, analogue outputs to control valves and drives). Remote input/output racks and fieldbuses reduce wiring.
A PLC works in a repeated scan cycle: it reads all inputs into an image table, executes the program from top to bottom using that image, writes the results to the outputs, and performs communications and self-checks, then repeats. Scan times are typically a few to tens of milliseconds. Because inputs are read once per scan, a pulse shorter than the scan time can be missed; fast pulses from flowmeters are therefore taken by high-speed counter modules that count independently of the scan. Analogue signals of 4–20 mA are converted to engineering units by linear scaling: value = lower range + (current − 4)/16 × span. A current below about 4 mA signals a broken wire or failed transmitter, which is why the live zero of 4 mA is used.
The international standard IEC 61131-3 defines PLC programming languages: ladder diagram, function block diagram, structured text, instruction list (now deprecated) and sequential function chart. Ladder logic, drawn like relay circuits, remains the most widely understood by maintenance staff. A rung reads left to right: contacts in series form an AND condition, contacts in parallel form an OR, and a normally closed contact passes power when its input is off. A seal-in (latching) circuit uses a contact of the output in parallel with the start button, so the output stays on after the button is released until a normally closed stop contact opens the rung. Timers (on-delay, off-delay) and counters complete the basic set.
Sequential function charts describe step-by-step processes such as CIP or a cheese-vat recipe: each step has actions and each transition a condition, such as "conductivity above set point for 30 s". Good PLC programs separate interlocks (conditions that must always be true for safety, written so they cannot be bypassed from the operator screen) from sequence logic and from operator convenience functions. Safety-critical functions such as emergency stops are usually hard-wired or run on a separate safety PLC built to the relevant functional-safety standard, rather than relying on the standard program.
Where a PLC handles a public-health function, such as the control of a flow diversion valve, regulators treat it with particular care. The general principles are that the public-health logic must be protected from alteration (password protection, sealing, or a separate dedicated controller), that any change must be documented, tested and approved, and that the system must be verified by testing the actual inputs and outputs, not just by reviewing the program. Some jurisdictions require the critical inputs, such as the recording thermometer's temperature limit, to act through hard-wired or independently verified circuits.
For the technologist, the practical lesson is that the PLC's program is part of the food-safety system. A copy of the approved program version, a change log, a record of every test of the diversion function and of each interlock, and controlled access to programming software are as important as the chart recorder. In the US the conditions for computerised public-health controls on HTST systems are set in the PMO; other countries set their own, and the current text must be checked.
Supervisory control and data acquisition (SCADA) software runs on computers above the PLCs. It shows the process on mimic screens, lets operators start sequences and change set points within permitted limits, raises alarms, and stores data in a historian for trends and reports. The PLCs keep controlling even if SCADA stops. A distributed control system (DCS) integrates controllers, input/output, operator stations and engineering tools from one platform, with control distributed across many controllers; DCSs are traditional in large continuous processes, while PLC-plus-SCADA systems dominate in dairies, although the distinction has blurred.
Automation is often described as a pyramid of levels. The ISA-95 (IEC 62264) standard describes level 0 as the physical process, level 1 as sensing and actuation, level 2 as monitoring and supervisory control (PLC, SCADA), level 3 as manufacturing operations management (MES: scheduling, batch records, quality, genealogy) and level 4 as business planning (ERP). ISA-88 (IEC 61512) is the standard for batch control: it separates the recipe (what to make) from the equipment (how the plant does it), and describes procedures, unit procedures, operations and phases. In a dairy, ISA-88 thinking lets one cheese-vat phase such as "fill with milk to set volume" be reused by many recipes.
Alarm management is a discipline in itself. Too many alarms, or alarms that sound for normal events, teach operators to ignore them. Good practice prioritises alarms, removes nuisance alarms, uses deadbands and delays to stop chattering, and records who acknowledged each alarm and when. A historian stores time-stamped process values efficiently, often by recording a value only when it changes by more than a set deadband; this compression must not be so coarse that a short temperature dip is lost.
Plant networks connect field devices (fieldbuses and industrial Ethernet), controllers, SCADA servers and business systems. Because control networks now connect to office networks and the internet, cybersecurity is a production risk: separating networks into zones with controlled conduits, limiting remote access, keeping backups of PLC programs and SCADA configurations, and controlling user accounts are standard measures described in the IEC 62443 series. A ransomware attack that stops SCADA can halt a plant, and an unauthorised change to a set point can be a food-safety event.
The operator screen is where people and automation meet. Screens should show the process in a way that makes abnormal conditions obvious: grey backgrounds with colour reserved for alarms and abnormal states, trends next to values so direction is visible, and clear indication of valve positions and sequence steps. Operators should be able to change only what their role allows; set-point limits stop a pasteuriser temperature being set below its legal minimum from the screen. Every change made through SCADA should be logged with user, time, old and new values.
For milk plants, the most important screens are reception (tankers, silos, samples), processing (pasteurisers, separators, standardisation), CIP (circuits, steps, conductivity, temperature) and filling. A technologist who can read these screens, trends and logs can investigate a complaint or a near-miss much faster than one who relies only on paper.
An HTST pasteuriser brings together almost every topic in this manual. Raw milk enters a balance tank, passes through the regeneration section where it is warmed by outgoing pasteurised milk, is driven by the timing pump (or a flow-controlled system) through the heating section, held in the holding tube, and reaches the flow diversion valve (FDV). If the recording controller's sensor at the end of the holding tube reads at or above the legal cut-in temperature, the FDV is in forward flow and milk goes on through regeneration and cooling to storage. If the temperature falls below the cut-out, the FDV moves to divert and returns the milk to the balance tank to be heated again. The FDV is designed to fail to divert on loss of air or power.
Around this core are interlocks. Pressure-differential controls keep pasteurised milk at a higher pressure than raw milk in the regenerator, and stop or prevent forward flow when that condition is not met; a booster pump on the raw side is allowed to run only when the FDV is in forward flow and the pressure differential is correct. Leak-detect positions of the FDV, the timing of the valve, and the sequence after a divert are all specified by regulation and tested at set intervals with records kept. The temperature controller itself (PI or PID on a hot-water or steam circuit, often in cascade) keeps the product near set point so that diversions are rare. Holding-tube construction and the hardware of the FDV belong to dairy-processing-equipment; the specific temperatures, test frequencies and interlock rules belong to the current regulation.
A CIP programme is a sequence: pre-rinse with water, caustic detergent circulation, intermediate rinse, acid circulation, final rinse, and sometimes sanitiser. Automation runs this sequence and proves it was done. Each step has set points for temperature, flow (or velocity) and time, and a detergent concentration controlled by conductivity. The return line carries conductivity and often turbidity sensors: at the start of a detergent step, the return is sent to drain until conductivity shows full-strength detergent has arrived, then switched to recover detergent to its tank; at the start of the rinse, recovery continues until conductivity falls, and then the rinse goes to drain. Temperature on the return proves the whole circuit reached cleaning temperature, not just the supply.
The CIP record for each circuit should show the circuit cleaned, start and end times, each step's duration, temperature and conductivity traces, and any faults. Interlocks prevent CIP solution reaching product: route verification by valve feedback, mix-proof valves between cleaning and product lines, and checks that the circuit is complete before chemical is sent. Chemistry, flow velocity and verification by swabbing are in cip-sanitation-hygienic-design.
At reception the plant measures what it is paying for and what it is accepting into the process. Milk from a tanker is pumped through an air eliminator (a vessel that removes entrained air so it is not counted as milk), then through a flowmeter, usually magnetic or Coriolis, and into a silo. Volume measured by a magnetic meter is converted to mass using density, or mass is measured directly by Coriolis. Automatic samplers take a representative proportional sample during unloading for composition and quality tests; a sample taken only from the top of a tank is not representative.
Reception automation records tanker identity, compartment, supplier route, quantity, temperature and sample identity, and links this to laboratory results such as fat, protein and antibiotic screening. That link is the start of traceability: a later problem can be traced back to the tanker and route. Reception also runs its own CIP of lines and tanker hoses, and interlocks prevent a tanker being unloaded into a silo that is being cleaned or is already full. Weighbridges, where used, give a cross-check on meter readings.
A dairy's records prove that each batch was made safely: pasteuriser charts, CIP records, reception tests, calibration certificates, batch records. When records are electronic, they must be as trustworthy as signed paper. Data integrity means the data are complete, consistent and accurate throughout their life, from creation to archive.
The widely used summary is ALCOA: data should be Attributable (who did it and when), Legible (readable for their whole retention period), Contemporaneous (recorded at the time of the activity), Original (the first record, or a certified true copy) and Accurate. ALCOA+ adds Complete, Consistent, Enduring and Available. A pasteuriser record that can be edited without trace, a CIP report printed after someone has overwritten a failed step, or a shared login that hides who changed a set point all break these principles.
Regulators have set rules for electronic records. In the US, 21 CFR Part 11 sets requirements for electronic records and electronic signatures in FDA-regulated activities where records are kept electronically to meet a predicate rule. In the EU, Annex 11 of the EU Good Manufacturing Practice guide covers computerised systems in medicinal-product manufacture, and its principles are widely borrowed in food. Whether a given rule applies to a particular dairy record depends on the jurisdiction and on what the record is used for, so the plant's regulatory specialist must decide; the principles, however, are shared.
Those principles are: validated systems that do what they are meant to do; secure, individual user accounts with role-based permissions; audit trails that record, automatically and unalterably, who created, changed or deleted data, when, and why, with old values retained; electronic signatures linked to their records and to a unique person; time synchronisation so time stamps are reliable; regular backup and tested restore; and controlled archiving for the retention period. Periodic review of audit trails, not just their existence, is expected.
Computerised systems that control or record critical processes are validated: user requirements are written, the system is tested against them (installation, operational and performance qualification), and the results are documented. After validation, any change to hardware, software, configuration or recipe goes through change control: the change is described, its risk assessed, it is tested, approved and documented, and affected staff are trained. Calibration records for the instruments feeding the system are part of the same evidence.
For a technologist, the habits that matter are simple. Never share passwords. Record at the time, not later. Do not delete or overwrite a failed result; annotate it. Keep the chart or electronic record of every pasteuriser diversion and every CIP fault with the explanation. Know where the current approved PLC program and recipe versions are kept. These habits turn instruments into evidence.
Learn to sketch an HTST pasteuriser with its balance tank, timing pump, holding tube, recorder-controller, flow diversion valve and regenerator pressures, and explain what each instrument proves. Practise the standard calculations until they are automatic: accuracy against full scale, the 63.2% time constant, Pt100 resistance with α = 0.00385 /°C, thermocouple emf with cold-junction compensation, 4–20 mA scaling, the square-root flow law, proportional band and Ziegler–Nichols settings. During in-plant training, read real recorder charts and CIP reports and ask how each value was measured.
A production or quality officer five years in checks pasteuriser charts every day, signs off CIP records, investigates diversions and alarms, and arranges instrument calibration. Typical decisions: whether a recorder reading that disagrees with the reference thermometer means a product hold; whether a CIP step that ended early needs a re-clean; whether a new flowmeter at reception is accurate enough for payment. Knowing controller modes and tuning lets you talk usefully with the automation engineer when a loop oscillates, and knowing data-integrity rules keeps your records defensible in an audit.
A plant head or engineering manager with 25 years' experience owns the automation strategy: which loops justify inline analysers, how SCADA, MES and ERP connect, how public-health controls are protected and tested, how cybersecurity and backups are managed, and how much to spend on instrument upgrades. They approve change-control requests, review audit-trail findings, defend the plant's systems to regulators and customers, and plan replacement of ageing PLCs before spare parts disappear. Their judgement balances reliability, compliance and cost across many plants.
A professor or research director uses this subject to teach control theory through dairy examples, supervise research on inline sensors (spectroscopy, ultrasound, soft sensors and model-based estimation of composition or fouling), and advise standards bodies and regulators on computerised public-health controls. They set examination papers at postgraduate level, review project designs for pilot plants, and judge whether new sensing methods are validated well enough to replace established ones in regulated processes.
This manual describes principles and does not quote the numeric limits set by regulators for pasteuriser recorders, flow diversion valves, holding times, pressure differentials or test frequencies, because they differ between countries and are revised; read your current national rule (for example the EU food-hygiene regulations or the US Pasteurized Milk Ordinance) alongside the Codex Code of Hygienic Practice for Milk and Milk Products. Thermocouple reference tables, full Callendar–Van Dusen coefficients, fieldbus protocols, functional-safety (SIL) assessment and model-predictive control are mentioned only briefly or not at all. Calculations use idealised relations (constant Seebeck coefficient, linear RTD, ideal Nernst slope) that are fine for examinations but not for calibration work.
Original practice questions written to the syllabus and pattern of the exams named in each question's examTags. They are not past papers and do not reproduce any board's questions. Numerical items use idealised relations and values stated in each question; regulatory limits for pasteuriser controls are not quoted and must be read from the current regulation.
These notes are free to read here, with no account.
What the Laisha app adds:
Free for ten days, then a subscription. We would rather write that here than have you find it later.