Automation for Australian Dairy Processing Plants

Dairy processing automation in Australia is shaped by requirements that do not apply to most other manufacturing sectors. Pasteurisation is a public health control point with a legally significant time-temperature relationship. Cleaning has to be validated and recorded. Cultured products are made by recipe and need batch structure. Traceability under the Food Standards Code has to be demonstrable, not assumed. Each places specific demands on the control system that a general-purpose PLC or SCADA configuration has to be designed to meet.

Metromotion Controls is a control systems integrator based in Mount Waverley that delivers automation across Melbourne, Victoria and Australia for dairy, beverage and food plants. This article covers the parts of a dairy plant where control design matters most, and supports our dairy automation Australia, PLC programming Melbourne and industrial automation Melbourne pages. The figures in the worked example are illustrative engineering values, not measurements from any installation.

HTST pasteurisation: the control point that defines the plant

High-temperature short-time (HTST) pasteurisation is the heart of a fluid milk plant. Raw milk is heated, held at temperature for a defined time, then cooled, with heating and cooling recovered against each other in a plate heat exchanger to save energy. Under the Australian dairy standard, FSANZ Standard 4.2.4, milk must be pasteurised at no less than 72 degrees Celsius for no less than 15 seconds, or an equivalent time-temperature combination of at least the same lethal effect, with the residence time set by the holding tube's length and the flow rate through it.

The control problem is not holding a temperature. A PID loop driving a steam or hot-water valve does that comfortably, and loop tuning for dairy duties is its own discipline covered in PID loop tuning for food and dairy. The problem is proving, continuously and defensibly, that every millilitre of milk that flowed forward received the legal treatment, and stopping any that did not. Because the process treats milk as a continuous stream, there is no batch to inspect afterwards, so the proof has to be generated in real time. That is why the pasteuriser carries a dedicated temperature recorder at the legal point, why the divert function is treated as a protective interlock rather than ordinary process control, and why the design has to consider sensor failure, power loss and signal loss as well as normal running.

Flow diversion and the divert logic

The flow diversion device (FDD), commonly a divert valve, sits at the discharge of the holding tube. Its job is binary: send milk forward to cooling and packaging, or divert it back to the balance tank for reprocessing. The decision is driven by the temperature at the end of the holding tube, where milk has completed its residence time at temperature. The interlock principle is straightforward to state and exacting to implement:

• Milk flows forward only when the holding-tube outlet temperature is at or above the legal cut-in setpoint.
• If that temperature falls below the cut-in point, the device must move to divert within a defined short period.
• The device must fail to the divert position on loss of power, air or temperature signal, so an instrument or utility failure can never present as a pass.
• Limit-switch feedback monitors the device position, so the control system confirms the valve actually reached divert rather than only commanding it.

Because the divert function protects the public, it is reasonable to treat it under functional safety thinking. The temperature sensor, the logic solver and the divert valve form a safety loop whose integrity can be assessed using IEC 61508 and, for machinery, IEC 62061. A formal SIL assessment determines whether a single temperature element is adequate or whether redundant sensing is warranted. The interlock should be designed and documented as a protective function, with defined response time, fail-safe behaviour and proof testing, rather than buried in general process code.

A worked HTST divert interlock sequence (illustrative)

The following sequence and figures are illustrative, chosen to show the logic, not measurements from any installation. Consider an HTST pasteuriser with a legal cut-in setpoint of 72.0 degrees Celsius at the holding-tube outlet and a required divert response time of two seconds.

Inputs:
  TT_HOLD      holding-tube outlet temperature (dual element, voted)
  FDD_FWD_FB   forward-position limit switch feedback
  FDD_DIV_FB   divert-position limit switch feedback
  AIR_OK       instrument air pressure healthy
  PWR_OK       control power healthy
 
Parameters:
  T_CUTIN      = 72.0 degC   (legal forward-flow temperature)
  T_HYST       = 0.3 degC    (deadband to prevent chattering)
  T_DIVERT_MAX = 2.0 s       (maximum time to reach divert)
 
Logic:
  FORWARD_PERMIT :=
        (TT_HOLD >= T_CUTIN)
    AND  AIR_OK
    AND  PWR_OK
    AND  not FAULT
 
  if FORWARD_PERMIT then
        command FDD to FORWARD
  else
        command FDD to DIVERT          # default / fail-safe state
 
  # re-arm only above setpoint plus hysteresis
  if (TT_HOLD < T_CUTIN) then
        FORWARD_PERMIT := false
  if (TT_HOLD >= T_CUTIN + T_HYST) and conditions healthy then
        allow FORWARD again
 
  # position proof and fault latching
  if command = DIVERT and (FDD_DIV_FB = false) within T_DIVERT_MAX then
        FAULT := true                  # device failed to divert in time
        raise alarm, record event
 
  if command = FORWARD and FDD_FWD_FB = false then
        FAULT := true                  # device not confirmed forward
        force DIVERT, raise alarm
 
  # any forward flow below setpoint is a recordable deviation
  if FDD_FWD_FB = true and TT_HOLD < T_CUTIN then
        record DEVIATION with timestamp and temperature

The design points: the temperature is voted from dual elements, so a single sensor failure does not silently permit forward flow; the deadband stops the valve chattering around setpoint; the default state is divert, so the absence of a forward permit is itself safe; position feedback turns a command into a proof, and a failure to confirm divert within the response time latches a fault; and every forward-flow event below setpoint is recorded as a deviation with a timestamp and temperature, so the record shows exactly when the plant fell out of specification and for how long.

Separation and standardisation

Depending on plant layout, a centrifugal separator splits warm milk into skim and cream, and standardisation then sets the finished product's fat content by blending cream back into skim, or removing it, to a target. In an automated plant this is done in-line: a fat or density measurement on the blended stream feeds a ratio control loop that trims the cream and skim setpoints to hold the target, typically to a tight tolerance such as plus or minus 0.05 percent fat as an illustrative figure. Recording the achieved fat against the run matters because the product has to meet its specification and the declared fat on the label has to be accurate, and in-line control also reduces giveaway, the value lost by overshooting the target. This kind of ratio and quality control is part of the broader PLC, SCADA and HMI work.

CIP in a dairy plant

Cleaning-in-place is non-negotiable in dairy because the soils are aggressive: fats, proteins and the mineral scale (milkstone) that bakes onto heat-transfer surfaces in the pasteuriser. A dairy CIP system has to clean multiple circuits, the raw side, the pasteurised side, the separator, the tanks and the filling lines, each with its own soil and chemistry, and prove every cycle. The general mechanics are covered in CIP automation for hygienic processing. The dairy-specific points: milkstone removal makes the acid wash essential on the pasteuriser circuit, because caustic alone does not lift mineral scale; the heat-exchanger plates need adequate flow velocity to scour their narrow channels, so a return pump sized for an easier circuit will starve them; and the control system that runs CIP must keep the raw and pasteurised sides rigorously separated, because a cross-connection or a mis-set transfer valve is a direct route to recontaminating pasteurised product.

Batch control for cultured and value-added products

Fluid milk is continuous, but cultured and value-added products are batch processes that suit the ISA-88 model (published internationally as IEC 61512). Yoghurt is made by heating and holding the milk base, cooling to inoculation temperature, adding culture, then incubating until the target acidity is reached. Cultured cream, flavoured milks and dairy desserts follow comparable recipe-driven sequences.

ISA-88 separates the recipe from the equipment control. The recipe is product-specific data, the incubation temperature, hold time, target pH and order of additions; the equipment control is reusable phase logic that operates a valve, holds a temperature or runs an agitator regardless of product. The same approach is detailed in ISA-88 batch control for food manufacturing, and it gives several things at once: a new product or a revised fermentation profile becomes a recipe change rather than code that has to be retested; the same verified phase logic serves every tank; and the record is captured at the phase boundaries, so the batch record and the control structure are one and the same, with each batch linked to the raw material lots it consumed and the equipment it ran on.

For cultured products, the incubation phase is where control discipline earns its keep, because ending it on a measured pH or titratable acidity endpoint rather than a fixed timer produces a more consistent product and is also the record that proves the batch reached specification.

Hygienic design to 3-A Sanitary Standards

A control system can only verify a clean that the equipment is capable of receiving. A dead leg, a capped tee or an idle branch where flow cannot scour the surface will not be cleaned by any endpoint logic on the main flow path, which is why hygienic design and control design have to be considered together. The 3-A Sanitary Standards are the widely used reference for hygienic equipment design in dairy and food processing, addressing the geometry and materials that keep equipment cleanable: smooth contact surfaces, self-draining layouts, the elimination of dead legs and crevices, and fittings that clean in place rather than only by dismantling. For the control engineer the implication is direct, because instrumentation can detect a leg that did not clean but cannot make an uncleanable leg clean. The right response to a dead leg is to flag it as a design issue, and specifying 3-A compliant equipment and self-draining routing at the design stage prevents the geometry that later defeats coverage verification.

Thermal control and cold chain

Dairy is a thermal process from end to end, and each transition from cold receipt through separation, pasteurisation and cooling to chilled despatch is a control loop and a record. The pasteuriser regeneration section recovers heat from the hot pasteurised stream into the incoming raw stream, which cuts energy use but couples the two loops, so the control has to manage the interaction rather than treat heating and cooling as independent. On the cold side, raw milk silos, pasteurised storage and chilled despatch need continuous temperature monitoring with alarming and historian capture, so a refrigeration excursion is detectable and can be tied to the specific lots exposed. A cold chain failure not recorded against a lot forces a wider product withdrawal than one that is, a direct link between instrumentation coverage and recall cost, captured in the industrial data and IIoT layer.

Traceability under the Food Standards Code

Traceability is a legal obligation, not a nice-to-have. The Australia New Zealand Food Standards Code, administered by Food Standards Australia New Zealand, requires a food business to trace product one step back and one step forward through the supply chain, and state dairy authorities license and audit processors against the dairy-specific primary production and processing requirements. For the control system, demonstrable traceability means capturing and linking, as data rather than paper:

Held this way, a recall can be narrowed to the specific lots affected rather than withdrawing a whole production window, and an auditor can retrieve the time-temperature and cleaning evidence for any batch quickly. That is the difference between traceability as an intention and traceability as a capability.

How to scope a dairy automation upgrade

Dairy plants rarely justify a full rip-and-replace. The skids, tanks and stainless steel are usually sound, and the constraint is the control layer. A useful way to prioritise an upgrade is by what carries the most regulatory and safety weight:

1. Safety and food safety functions first. The pasteuriser divert interlock, its recorder and the raw/pasteurised separation logic, which justify the highest design rigour, including a SIL assessment of the divert loop where warranted.
2. Validated cleaning. Endpoint-driven CIP with per-cycle records and coverage verification, so cleaning is both effective and provable.
3. Batch structure for cultured and value-added lines. An ISA-88 recipe structure where products are currently run from operator memory or one-off PLC code.
4. Traceability and reporting. The historian and batch-record layer that links lots end to end and makes audit and recall retrieval fast.
5. Optimisation. In-line standardisation to reduce giveaway, energy recovery tuning and CIP cycle optimisation, once the compliance layers are sound.

Staged this way, the early stages buy down the most serious risk and each stage stands on its own rather than depending on a single large project completing. Upgrade staging of this kind is covered further in automation upgrade planning.

Common pitfalls

• Treating the divert interlock as ordinary process control. Without defined fail-safe behaviour, position proof and response-time checking, it is a protective function with no integrity. It should be designed, documented and proof-tested as a safety loop.
• Ending thermal and CIP phases on timers instead of measurement. A fixed timer over-runs a clean circuit and under-cleans a fouled one. The measured endpoint is both the better control and the audit evidence.
• Letting recipes live as duplicated PLC code. Every change then has to be made and retested in several places, and the versions drift. An ISA-88 recipe structure removes this.
• Designing the control system before the hygienic design is settled. Dead legs and non-self-draining routing cannot be cleaned by any control logic, so hygienic design to 3-A has to come first.

References

The pasteurisation conditions, standards numbers and design principles in this article are general industry and regulatory references, not Metromotion Controls measurements. Sources used:

• Food Standards Australia New Zealand, Standard 4.2.4 Primary Production and Processing Standard for Dairy Products and the Food Standards Code: https://www.foodstandards.gov.au/
• 3-A Sanitary Standards, Inc. (3-A SSI), hygienic design standards for dairy and food processing equipment: https://www.3-a.org/
• ISA, the standards body publishing the ISA-88 batch control standard: https://www.isa.org/
• IEC, publisher of IEC 61512 and IEC 61508: https://www.iec.ch/
• Dairy Foods, industry coverage of dairy processing and sanitation: https://www.dairyfoods.com/

If your site is planning a controls upgrade on a pasteuriser, a CIP system or a cultured-products line, Metromotion Controls can scope the work in the order that addresses food safety and compliance first. Our dairy industry and systems integration pages set out how that engagement typically runs.