The 40-Litre Overdose
A school's 6 m × 12 m hydroponic greenhouse has 240 lettuce plants in four nutrient-film channels and a 1,000 L reservoir. A Year 13 technology team built a controller: a low-cost PLC reads one pH probe and one electrical-conductivity (EC) probe, then runs two peristaltic pumps for pH-down and nutrient concentrate. The target EC is 1.8 mS/cm ± 0.2. Last week the EC probe drifted, reading 1.2 when the actual value was 2.6; the controller ran the concentrate pump for 11 minutes instead of 40 seconds. About 40 L of concentrate entered the reservoir and most plants showed leaf burn within two days. The team has NZ$1,800 left and must keep the system running with student technicians, no internet, and a 10-week term.
1. Propose a control strategy that would prevent a repeat of the 40 L overdose, and explain the trade-offs.
Read the worked answer
The overdose happened because one sensor was trusted without any independent check. The controller measured a false low EC and ran the concentrate pump for 11 minutes. A safe design must make that failure mode impossible, not just less likely.
A layered strategy:
- Hard dose limit: fit a mechanical or timer-based limit so the concentrate pump cannot run for more than, say, 60 seconds per dose or 2 litres per hour. This is independent of the PLC and would have capped the 40 L event at a much smaller volume.
- Sensor validation: add a second EC probe or a plausibility check. If the two probes differ by more than 0.3 mS/cm, or if the EC does not rise after dosing, stop the pump and alarm.
- Flow/level interlock: if there is no flow in the channel or the reservoir level is low, stop dosing.
- Manual reset and log: after any alarm, a student must inspect and reset; the controller records the event.
With $1,800, the team can afford a second probe, a dosing timer, and a simple data logger. The trade-off is complexity: more components mean more to maintain, so the system should use standard fittings and a clear calibration schedule. The hard limit should be installed first because it addresses the worst outcome directly; the second probe improves diagnosis and catches drift earlier. Neither replaces weekly calibration.
2. Explain the difference between open-loop and closed-loop control in this system and why the current design is not truly closed-loop despite having sensors.
Read the worked answer
An open-loop system doses a set amount without checking the result. A closed-loop system measures the output, compares it with the setpoint, and adjusts. On paper the greenhouse controller is closed-loop because it has pH and EC probes and computes a dose.
In practice it behaves like an open-loop system with a single unreliable sensor. The EC probe sits in the reservoir, not in the channel, so there is a mixing delay between dosing and measurement. The controller has no way to tell whether the probe is drifting, whether the pump actually delivered, or whether the concentrate has mixed. When the probe read 1.2 instead of 2.6, the controller treated the false error as real and kept dosing. A true closed-loop system needs a valid feedback signal, a known actuator response, and a way to detect a fault.
The fix is to add plausibility checks and a second measurement: compare the EC before and after a dose, limit the maximum dose, and alarm if the expected change does not occur. The team should also move the probe downstream or add a mixing period. This is a control-system judgement: having a sensor is not the same as having feedback.
3. Evaluate whether the team should spend the remaining budget on a second EC probe or on a mechanical dosing limiter.
Read the worked answer
The remaining $1,800 is enough for both, but if the team can only choose one, the mechanical dosing limiter should come first.
A second EC probe costs perhaps $200–$300 and catches drift by comparison, but it shares the same failure environment: both probes can foul, and a student may not calibrate either. It improves reliability but does not guarantee a hard stop. A dosing limiter - a timer, a fixed-volume dosing chamber, or a pump run-time cap - costs less and directly prevents the catastrophic outcome, regardless of what the sensor says. It is a safety layer, not a control layer.
The best answer is a combined package: a $100–$150 timer as the hard limit, a second EC probe for validation, and a calibration log. That is still within budget and addresses both the worst case and the early warning. The team should also write a failure-mode table: sensor drift, pump stuck on, blocked line, power cut. For each, state what stops the dose. If the only answer is 'the PLC', the design is not safe enough. The final decision should be recorded with the cost, the failure mode addressed, and the maintenance burden on students.