Fail-Safe Oxygen Control in Aquaculture Tanks
Bluefin Aquaculture has eight 40,000-litre tanks. A PLC polls dissolved-oxygen sensors every 30 seconds and switches aerators on below 5.0 mg/L, off above 5.8 mg/L. Last month a sensor stuck at 6.2 mg/L while oxygen in tank 4 actually fell to 2.1 mg/L; 600 fish died. The aerator relay was also found welded closed in tank 7, so the PLC’s “on” signal had no effect. Staff can override the PLC manually, but overrides are not logged. Each tank has one sensor and one relay; the PLC has a watchdog timer but it is disabled. The farm wants a fail-safe design, early detection of sensor faults, and evidence for an environmental audit.
1. Describe a closed-loop control system for tank oxygen that includes hysteresis, and explain how it would have responded differently in tank 4 if the sensor had been working.
Read the worked answer
The controlled variable is dissolved oxygen. The sensor measures it every 30 seconds and sends an analogue value to the PLC. The PLC compares the reading with the setpoint band: if oxygen falls below 5.0 mg/L, it energises the aerator relay; if oxygen rises above 5.8 mg/L, it de-energises the relay. The 0.8 mg/L gap is hysteresis, which stops the aerator rapidly switching on and off around a single threshold. The actuator affects the process - aeration increases oxygen - and the sensor feeds the result back, closing the loop. If tank 4’s sensor had been working, the reading would have fallen through 5.0 mg/L and the PLC would have switched the aerator on well before 2.1 mg/L. The failure was not the control logic but the feedback signal: a stuck sensor made the PLC believe oxygen was above the off threshold, so the actuator was never commanded.
2. Recommend three design changes that would detect or tolerate a stuck sensor, and explain the reasoning behind each.
Read the worked answer
First, use two independent oxygen sensors per tank and compare them. If they disagree by more than a plausible margin, such as 1.0 mg/L for more than two polling intervals, raise a fault and force the aerator on. This tolerates one failed sensor and detects the disagreement. Second, add plausibility and rate-of-change checks. A real sensor reading changes gradually; a value that stays exactly 6.200 for many hours, or jumps impossibly, is suspect. The PLC can also cross-check against temperature, feeding schedule, and time of day, because oxygen demand rises after feeding. Third, add relay feedback or current sensing so the PLC knows whether the aerator is actually drawing current. A welded relay contact would then be detected as “commanded off but current flowing” or “commanded on but no current,” depending on the failure. The watchdog timer should be enabled so a crashed PLC forces a fail-safe state - aerators on - rather than leaving outputs frozen.
3. Evaluate the 30-second polling interval. Recommend whether to change it, and discuss one trade-off with evidence from the incident.
Read the worked answer
Thirty seconds is probably too slow for a fail-safe oxygen system, but the incident was not caused by polling alone: the sensor was stuck, so faster polling would still have read 6.2 mg/L. Still, oxygen can fall quickly in a densely stocked tank, especially after feeding or at night when photosynthesis stops. A 30-second interval means up to 30 seconds before the PLC even sees a change, plus actuator response time. I would reduce the interval to 10 seconds for oxygen and keep a separate faster fault-check cycle for sensor disagreement. The trade-off is more PLC scan load, more network traffic, and potentially more sensor wear, but eight tanks and a few analogue inputs are well within a typical PLC’s capacity. The audit evidence should log every reading, every actuator command, every override with user ID and timestamp, and every fault. That log would show whether the stuck value persisted for hours and whether staff overrode the system.