HTST flow diversion is an interlock that protects the public. The divert logic, the recorder and the redundancy around the legal time-temperature point all need to be designed to a higher standard than ordinary process control.
Yoghurt, cultured cream and flavoured products suit an ISA-88 structure, where recipes are parameterised data and the procedural logic is reused across units rather than rewritten per product.
3-A Sanitary Standards keep uncleanable geometry out of the equipment, and FSANZ traceability obligations require the control system to capture lot and process data that can be retrieved during an audit or recall.
Dairy processing automation in Australia is shaped by requirements that do not apply to most other manufacturing sectors. Pasteurisation is a public health control point with a legally significant time-temperature relationship. Cleaning has to be validated and recorded. Cultured products are made by recipe and need batch structure. Traceability under the Food Standards Code has to be demonstrable, not assumed. Each of these places specific demands on the control system that a general-purpose PLC or SCADA configuration has to be designed to meet. Metromotion Controls is a control systems integrator based in Mount Waverley that delivers automation across Melbourne, Victoria and Australia for dairy, beverage and food plants.
This article covers the parts of a dairy plant where the control design matters most: HTST pasteurisation and its divert interlock, separation and standardisation, CIP, ISA-88 batch control for cultured and value-added products, hygienic design to 3-A, thermal control and traceability. The figures used in the worked example are illustrative engineering values, not measurements from any installation.
This article supports our dairy industry and industrial automation work: the design and integration of control systems for processing plants where the control system is part of the food safety record as well as a production tool.
High-temperature short-time (HTST) pasteurisation is the heart of a fluid milk plant. Raw milk is heated, held at temperature for a defined time, then cooled, with the heating and cooling recovered against each other in a plate heat exchanger to save energy. As a widely cited public health reference, the HTST condition for milk is around 72 degrees Celsius held for at least 15 seconds, achieved in the holding tube whose length and flow rate together set the residence time.
The control problem is not holding a temperature. A modern PID loop driving a steam or hot-water valve does that comfortably, and loop tuning for dairy thermal processes is its own discipline covered in PID loop tuning for food and dairy. The problem is proving, continuously and defensibly, that every millilitre of milk that flowed forward actually received the legal treatment, and stopping any that did not. That is what the flow diversion device and its interlock logic exist to do.
The thermal process treats milk as a continuous stream, so there is no batch to inspect after the fact. The proof has to be generated in real time and recorded as it happens. This is why the pasteuriser carries a dedicated temperature recorder at the legal point, why the divert function is treated as a protective interlock rather than ordinary process control, and why the design has to consider what happens on sensor failure, power loss and signal loss as well as during normal running.
The flow diversion device (FDD), commonly a divert valve, sits at the discharge of the holding tube. Its job is binary: send milk forward to the cooling section and packaging, or divert it back to the balance tank for reprocessing. The decision is driven by the temperature measured at the end of the holding tube, the point at which milk has completed its residence time at temperature.
The principle of the interlock is straightforward to state and exacting to implement:
Because the divert function protects the public, it is reasonable to treat it under functional safety thinking. The temperature sensor, the logic solver and the final element (the divert valve) form a safety loop whose integrity can be assessed using the functional safety framework of IEC 61508 and, for machinery, IEC 62061. A formal SIL assessment determines whether a single temperature element is adequate or whether redundant sensing and diagnostic coverage are warranted for the divert loop. The point is that the divert interlock should be designed and documented as a protective function, with defined response time, fail-safe behaviour and proof testing, rather than buried in general process code.
The following sequence and figures are illustrative engineering values chosen to show the logic, not measurements from any installation. Consider an HTST pasteuriser with a legal cut-in setpoint of 72.0 degrees Celsius at the holding-tube outlet and a required divert response time of two seconds.
Inputs:
TT_HOLD holding-tube outlet temperature (dual element, voted)
FDD_FWD_FB forward-position limit switch feedback
FDD_DIV_FB divert-position limit switch feedback
AIR_OK instrument air pressure healthy
PWR_OK control power healthy
Parameters:
T_CUTIN = 72.0 degC (legal forward-flow temperature)
T_HYST = 0.3 degC (deadband to prevent chattering)
T_DIVERT_MAX = 2.0 s (maximum time to reach divert)
Logic:
FORWARD_PERMIT :=
(TT_HOLD >= T_CUTIN)
AND AIR_OK
AND PWR_OK
AND not FAULT
if FORWARD_PERMIT then
command FDD to FORWARD
else
command FDD to DIVERT # default / fail-safe state
# re-arm only above setpoint plus hysteresis
if (TT_HOLD < T_CUTIN) then
FORWARD_PERMIT := false
if (TT_HOLD >= T_CUTIN + T_HYST) and conditions healthy then
allow FORWARD again
# position proof and fault latching
if command = DIVERT and (FDD_DIV_FB = false) within T_DIVERT_MAX then
FAULT := true # device failed to divert in time
raise alarm, record event
if command = FORWARD and FDD_FWD_FB = false then
FAULT := true # device not confirmed forward
force DIVERT, raise alarm
# any forward flow below setpoint is a recordable deviation
if FDD_FWD_FB = true and TT_HOLD < T_CUTIN then
record DEVIATION with timestamp and temperatureSeveral design points are worth drawing out. The temperature is voted from dual elements so a single sensor failure does not silently permit forward flow. The deadband stops the valve chattering around the setpoint, which would otherwise wear the actuator and fragment the record. The default state of the device is divert, so the absence of an explicit forward permit is itself safe. The position feedback turns a command into a proof, and the failure to confirm divert within the response time latches a fault rather than continuing. Every forward-flow event below setpoint is recorded as a deviation with a timestamp and temperature, so the record shows precisely when the plant fell out of specification and for how long.
Before or after pasteurisation, depending on plant layout, a centrifugal separator splits warm milk into skim and cream. Standardisation then sets the fat content of the finished product by blending a controlled proportion of cream back into skim, or by removing cream, to a target.
In an automated plant this is done in-line rather than by batch blending. A fat-content or density measurement on the blended stream feeds a ratio control loop that trims the cream and skim flow setpoints to hold the target fat content, typically to a tight tolerance such as plus or minus 0.05 percent fat as an illustrative figure. The control system records the achieved fat against the production run, which matters for two reasons: the product has to meet its specification, and the declared fat on the label has to be accurate under labelling requirements. In-line standardisation also reduces giveaway, the cost of overshooting the fat target and giving away product value, which on a high-volume line is a real and continuous saving. This kind of in-line ratio and quality control is part of the broader PLC, SCADA and HMI work that ties instrumentation to product specification.
Cleaning-in-place is non-negotiable in dairy because the soils are aggressive: fats, proteins and the mineral scale (milkstone) that bakes onto heat-transfer surfaces in the pasteuriser. A dairy CIP system has to clean multiple circuits, the raw side, the pasteurised side, the separator, the tanks and the filling lines, each with its own soil and chemistry, and prove every cycle.
The mechanics of dairy CIP, endpoint-driven phases, the caustic and acid chemistry, the intermediate rinse and coverage verification, are covered in depth in CIP automation for hygienic processing. The points specific to dairy are worth noting here. Milkstone removal is what makes the acid wash essential on the pasteuriser circuit, because caustic alone does not lift mineral scale. The heat-exchanger plates are a demanding circuit because their narrow channels need adequate flow velocity to scour, and a return pump sized for an easier circuit will starve them. And the same control system that runs CIP is the one that has to keep the raw and pasteurised sides rigorously separated, because a CIP cross-connection or a mis-set transfer valve is a direct route to recontaminating pasteurised product.
Fluid milk is a continuous process. Cultured and value-added products are batch processes, and they suit the ISA-88 model (published internationally as IEC 61512). Yoghurt is made by heating and holding the milk base, cooling to inoculation temperature, adding culture, then incubating at a controlled temperature until the target acidity is reached. Cultured cream, flavoured milks and dairy desserts follow comparable recipe-driven sequences.
ISA-88 separates the recipe from the equipment control. The recipe is the product-specific data: the incubation temperature, the hold time, the target pH, the order of additions. The equipment control is the reusable phase logic that operates a valve, holds a temperature or runs an agitator regardless of which product is being made. Structuring the plant this way gives several things at once, the same parameterised-procedure approach detailed in ISA-88 batch control for food manufacturing:
For cultured products, the incubation phase is where control discipline earns its keep. Holding the incubation temperature steady across a long fermentation, and ending the phase on a measured pH or titratable acidity endpoint rather than a fixed timer, produces a more consistent product than running every batch to the clock. The endpoint that ends the phase is also the record that proves the batch reached specification.
A control system can only verify a clean that the equipment is capable of receiving. If a circuit contains a dead leg, a capped tee or an idle branch where flow cannot scour the surface, no endpoint logic on the main flow path will clean it. This is why hygienic design and control design have to be considered together.
The 3-A Sanitary Standards are the widely used reference for hygienic equipment design in dairy and food processing. They address the geometry and materials that keep equipment cleanable: smooth contact surfaces, self-draining layouts, the elimination of dead legs and crevices, and fittings that can be cleaned in place rather than only by dismantling. For the control engineer, the relevance is direct. When asked to make an existing circuit verifiable, the right response to a dead leg or a starved branch is to flag it as a design issue, because instrumentation can detect a leg that did not clean but cannot make an uncleanable leg clean. Specifying 3-A compliant equipment and self-draining pipe routing at the design stage prevents the geometry that later defeats coverage verification.
Dairy is a thermal process from end to end. Milk is received cold, warmed for separation, pasteurised, cooled, and held cold until despatch. Each of those transitions is a control loop and a record.
On the heating side, the pasteuriser regeneration section recovers heat from the hot pasteurised stream into the incoming raw stream, which cuts energy use but also couples the two loops, so the control has to manage the interaction rather than treat heating and cooling as independent. On the cold side, raw milk silos, pasteurised storage and chilled despatch all need continuous temperature monitoring with alarming and historian capture, so that a refrigeration excursion is detectable and can be tied to the specific product lots that were exposed. A cold chain failure that is not recorded against a lot forces a wider product withdrawal than one that is, which is a direct link between instrumentation coverage and recall cost. Continuous temperature trending of this kind is part of the industrial data and IIoT layer that captures and retains the time-series evidence.
Traceability is a legal obligation, not a nice-to-have. The Australia New Zealand Food Standards Code, administered by Food Standards Australia New Zealand, requires a food business to trace product one step back and one step forward through the supply chain. State dairy authorities license and audit processors against the dairy-specific primary production and processing requirements.
For the control system, demonstrable traceability means capturing and linking, as data rather than paper:
| Link | What the control system records |
|---|---|
| Raw milk receipt | Tanker and silo lot, receipt temperature, volume, supplier |
| Standardisation | Achieved fat content against the production run |
| Pasteurisation | Holding-tube temperature trend, any divert or deviation events, recorder data |
| Batch (cultured) | Recipe and version, ingredient lots, incubation profile, endpoint reached |
| CIP | Per-cycle conductivity, temperature and flow records for each circuit cleaned |
| Packaging and despatch | Finished lot codes, fill data, despatch temperature and destination |
Held this way, a recall can be narrowed to the specific lots affected rather than withdrawing a whole production window, and an auditor can retrieve the time-temperature and cleaning evidence for any batch quickly. This is the difference between traceability as an intention and traceability as a capability.
Dairy plants rarely justify a full rip-and-replace. The skids, tanks and stainless steel are usually sound, and the constraint is the control layer. A useful way to prioritise an upgrade is by what carries the most regulatory and safety weight:
Staged this way, the early stages buy down the most serious risk and the later stages return cost savings, and each stage stands on its own rather than depending on a single large project completing. Upgrade staging of this kind is covered further in automation upgrade planning.
A few mistakes recur on dairy automation projects, and they are worth naming because they are avoidable.
Dairy automation in Australia is a specific discipline because the control system is part of the food safety record. The pasteuriser divert interlock protects the public and should be engineered as a protective function. Cultured products suit an ISA-88 batch structure. Cleaning has to be validated and recorded. Hygienic design to 3-A keeps uncleanable geometry out of the plant, and FSANZ traceability requires the control system to capture lot and process data that can be retrieved during an audit or recall. For a site planning an upgrade, prioritising the safety and compliance functions first, then the productivity gains, scopes the work in the order that buys down risk fastest.
The pasteurisation conditions, standards numbers and design principles in this article are general industry and regulatory references, not Metromotion Controls measurements. Sources used:
If your site is planning a controls upgrade on a pasteuriser, a CIP system or a cultured-products line, Metromotion Controls can scope the work in the order that addresses food safety and compliance first. Our dairy industry and systems integration pages set out how that engagement typically runs.
Tommy Kim writes for Metromotion Controls, a Melbourne control systems integrator delivering PLC, SCADA, controls integration and commissioning for food, beverage, dairy and FMCG manufacturers across Australia.
The flow diversion device, often called the FDD or divert valve, sits at the outlet of the holding tube. When milk in the holding tube has reached and held the legal time-temperature combination it is allowed to flow forward to packaging. If the temperature at the end of the holding tube falls below the legal cut-in point, the device must move to divert within a defined period, sending the under-processed milk back to the balance tank rather than forward. The divert action is an interlock driven directly by the holding-tube temperature, and on a well-designed system it fails to the divert position on loss of signal or power so that under-processed product can never reach the forward line.
Food safety sits under the Australia New Zealand Food Standards Code administered by Food Standards Australia New Zealand (FSANZ), with primary production and processing standards for dairy products, plus state dairy authorities that license and audit processors. Equipment hygiene is commonly designed to the 3-A Sanitary Standards used across dairy and food processing. The control structure for cultured and value-added products follows ISA-88 (IEC 61512) batch control, and machinery and process safety follows the functional safety standards IEC 61508 and IEC 62061 along with AS 4024 for machine safeguarding. Pasteurisation performance requirements draw on long-established public health practice such as the time-temperature relationships codified internationally.
A centrifugal separator splits warm milk into skim and cream. Standardisation then blends a controlled proportion of cream back into skim, or removes it, to hit a target fat content for the finished product. In an automated plant this is done in-line with a flow ratio control loop: a fat-content analyser or density measurement trims the cream and skim flow setpoints so the blended stream holds the target fat, typically within a tight tolerance. The control system records the achieved fat content against the production run, which supports both product specification and labelling compliance.
Cultured and value-added dairy products are made by recipe: a fermentation profile for yoghurt, an inoculation and incubation step for cultured cream, a blend and pasteurise sequence for flavoured milk. ISA-88 separates the recipe (the product-specific parameters and the order of steps) from the equipment control (the reusable phase logic that operates a valve, holds a temperature or runs an agitator). That separation means a new product or a revised fermentation temperature is a recipe change rather than a software change, and the same verified phase logic serves every tank. It also places the record at the phase boundaries, so the batch record and the control structure are the same structure.
HTST (high-temperature short-time) pasteurisation holds milk at around 72 degrees Celsius for at least 15 seconds as a general reference, producing chilled product with a short shelf life. UHT (ultra-high temperature) treatment runs much hotter, around 135 to 150 degrees Celsius for a few seconds, producing commercially sterile product for ambient storage. Both rely on a holding tube and a forward-flow interlock, but UHT adds aseptic downstream handling, sterile barriers and steriliser cycle control, so the control system has to manage sterilisation of the plant itself and maintain aseptic integrity, not only the thermal treatment of the product.
Traceability under the Food Standards Code requires a processor to trace product one step back and one step forward. For the control system that means linking incoming raw milk silo and tanker lots to the processing batches that consumed them, linking those batches to the pasteurisation and standardisation records, and linking the finished batch to packaging and despatch data. Held as historian and batch-record data rather than paper, this lets a quality team narrow a recall to the specific lots affected instead of withdrawing a whole production window, and lets an auditor retrieve the time-temperature and CIP evidence for any given batch quickly.
PLC logic, SCADA architecture, HMI standards, alarming and historian integration for manufacturing sites.
Controls engineering for new production lines, brownfield upgrades and integrated plant systems.
Controls for dairy processing, milk receival, pasteurisation, CIP and production reporting.
Where CIP automation investment pays back: cycle optimisation, digital audit records, queueing and coverage verification.
Why most flow, pressure and level loops run PI, why slow thermal loops justify full PID with anti-windup, and a structured lambda method over trial and error.
A practical guide to ISA-88 batch control covering the procedural model, equipment mapping and traceability.
A practical ISA-88 batch control guide for Australian food and beverage manufacturers, covering when you need it, the physical, procedural and recipe models, phase states, FSANZ traceability, platform choice and brownfield migration.
Key point
ISA-88 gives batch control a consistent structure
Published 9 May 2026
CIP is one of the largest controllable cost centres in a food or beverage plant. This article covers the four areas where CIP automation investment pays back: cycle optimisation for trade waste and chemical cost, digital audit records, queueing for equipment availability, and coverage verification to prevent silent failures.
Key point
CIP is one of the largest controllable cost centres in a food plant
Published 9 May 2026
How MES and SCADA work together in Australian food plants: the ISA-95 functional levels, the MESA model, B2MML data exchange, the SCADA-to-MES boundary, OEE and genealogy, ERP integration, and an illustrative Level 2 to Level 3 data mapping.
Key point
SCADA controls and monitors the plant; MES manages production
Published 9 May 2026
Map out scope, delivery approach and what to have ready before the first conversation. Answer a few questions and Metromotion Controls returns a tailored scoping brief on screen.