Signed Bytes and Fail-Safe Logic in a Greenhouse Controller
A school greenhouse project uses a 10-bit analogue-to-digital converter (ADC) with a reference voltage of 3.3 V. The temperature sensor is linear and maps -20 °C to 0 V and +60 °C to 3.3 V. The firmware stores each temperature reading in one byte using 8-bit two's complement, then sends it as two hexadecimal digits over a serial link to a display. During a cold night the display shows 246 °C and the pump control program begins behaving erratically. The control rule is: pump on when the soil sensor reports dry AND either the temperature is above 35 °C or the light level is below 200. A technician discovers that unplugging the soil sensor makes the pump run continuously. The team has one week before a science fair and must decide whether to patch the firmware or redesign the sensor wiring.
1. The transmitted byte is 0xF6. Decode the temperature correctly, explain why the display shows 246 °C, and calculate the resolution of the measurement system.
Read the worked answer
0xF6 is 1111 0110 in binary. In 8-bit two's complement the leading 1 means the value is negative. Invert the bits to get 0000 1001, then add 1 to get 0000 1010, which is 10. Therefore the value is -10 °C, not 246 °C. The display has interpreted the byte as unsigned; 246 is simply the unsigned value of 0xF6. A range check would have caught this because the sensor's valid range is -20 °C to +60 °C, and 246 °C is impossible.
The resolution is the range divided by the number of ADC codes: 80 °C divided by 2^10, or 1024, gives 0.078125 °C per code. The byte width is adequate because -20 °C to +60 °C fits within the signed 8-bit range of -128 to +127. The firmware should decode the stored byte as signed and reject readings outside the sensor's valid range before using them in control logic.
2. Explain why unplugging the soil sensor turns the pump on continuously, and propose a fix that is appropriate for a one-week deadline.
Read the worked answer
An unconnected input is floating. The pull-down or internal bias pulls it to 0 V, and the program interprets 0 as 'dry'. The rule then sees dry equals true, and at night the light level is likely below 200, so the pump runs. This is a fail-dangerous design: loss of a sensor looks like a valid dry reading.
A one-week patch should do two things. In hardware, fit a pull-up resistor so a disconnected signal reads high, and use a connector with a sense pin if possible. In firmware, validate the soil reading against plausible bounds and rate of change. If the reading is invalid or the sensor is disconnected, set a fault flag, force the pump off, and raise an alarm. Change the rule to: pump on when dry AND (hot OR dark) AND NOT fault. Add a maximum continuous run timer and a manual override. Test by unplugging each sensor. Wiring alone is not enough because a failed sensor can still output a plausible value; the fault check provides defence in depth.