H2-1. What This Controller Must Prove (Performance Targets + Evidence Fields)

A pH/ORP controller is not “an ADC with many bits”. The real acceptance risk is whether the design stays trustworthy when input bias/leakage, offset drift, mains pickup, and ground/isolated partitions interact in a humid, long-cable installation. This chapter turns the problem into an evidence checklist: every later design choice must map back to a field that can be measured.

1) Define targets in the native electrical domain

pH is an electrical measurement first (mV), then mapped to pH. ORP is directly a mV quantity. Targets should be specified in the domain that is measured and calibrated:

• pH chain: equivalent input error (mV) → mapped to pH error under temperature compensation.
• ORP chain: absolute mV error, noise, drift, and recovery after switching events.
• Environment: humidity/condensation exposure and cable length ranges are part of the acceptance envelope.

2) Evidence fields (each later chapter must “close” at least one field)

3) Error budget framing (what dominates and why)

H2-2. Electrode Fundamentals for Engineers (pH vs ORP as a Source)

This chapter includes only the physics needed to design the electronics. A pH probe behaves like a very high source-impedance voltage source whose slope changes with temperature. An ORP probe behaves like a potential measurement that is typically more sensitive to grounding, switching events, and environmental pickup. Long cables and wet surfaces create three dominant interference paths that must be explicitly designed out.

1) Reduce each probe to a circuit model (the minimum required model)

2) The “6 assumptions” checklist (prevents design-by-guessing)

Before selecting any amplifier, filter, or ADC, lock down these six assumptions. Each one changes what “correct” looks like later.

3) The three dominant interference paths (and what each looks like in data)

• Capacitive pickup: mains/SMPS fields couple into long cable capacitance → visible as periodic ripple or burst noise (E2).
• Leakage film: humidity/contamination forms a resistive path across high-Z surfaces → appears as slow bias shift and drift (E3, E6).
• Ground loop / common-mode: reference/solution ground moves with machinery and wiring → appears as baseline steps and unstable calibration (E1, E7).

H2-3. High-Z Front-End Topology (Guarding, Bias Return, Driven Shield)

A high-impedance electrode front end succeeds only when the input current path is explicitly defined and remains stable in humidity. The dominant failure mode is not gain error, but unintended current flow through surface leakage, protection device leakage, and common-mode return paths. This chapter builds a topology that makes every picoamp path intentional, measurable, and defendable.

1) Close the bias return loop (make the return path intentional)

A pH/ORP electrode is a source only when there is a defined reference and a defined return. If the return path is not specified, the input node will seek a return through contamination films, cable shields, or protection devices—creating drift and instability.

2) Guard ring (PCB) + driven shield (cable) reduce two different leakages

Guarding addresses surface leakage by removing voltage difference across high-Z surfaces. A driven shield addresses capacitive pickup by making the cable shield follow the high-Z node, reducing the effective coupling into the amplifier input. The two must be treated as separate tools with separate verification points.

3) Protection without leakage disaster (layered placement strategy)

Protection components can be the largest leakage contributor under heat and humidity. The safest architecture separates “energy handling” away from the high-Z node and keeps high-leakage parts out of the guarded region.

• Outer layer: handle surge energy away from the high-Z node so aging/leakage is not directly injected into measurement.
• Middle layer: limit current and clamp intermediate nodes (still outside the guarded input island).
• Inner layer: minimal, low-leakage elements nearest the buffer input, designed to preserve pA budget.

H2-4. Chopper / Auto-Zero Strategy (Offset, 1/f Noise, Ripple Injection)

Chopper and auto-zero techniques reduce offset drift and 1/f noise, but they introduce a new error source: ripple injection that can be converted by cable capacitance and non-ideal protection paths into slow baseline motion. The correct strategy treats the amplifier, sampling plan, and filtering as one system so the injected components become predictable residuals.

1) Chopper vs auto-zero (choose based on what must be proven)

The selection should be tied to the evidence fields, not to marketing terms. The key question is whether the system is more limited by low-frequency drift or by injected ripple artifacts under long-cable, humid conditions.

2) Ripple injection becomes slow drift (how the field failure happens)

Injected ripple is not always visible as a clean sine wave. In a high-Z system, cable capacitance and leakage nonlinearities can translate injected components into slow baseline motion. This is why an amplifier that looks perfect on a short bench setup can drift in the field.

• Injection points: amplifier modulation, guard driver, reference/ADC front end, and protection nodes.
• Conversion mechanisms: cable capacitance, rectification through protection paths, humidity leakage films.
• Observed signatures: baseline wander (E3), periodic artifacts (E2), longer stabilization after switching (E4).

3) The coordination stack: analog LPF + sync sampling + digital filtering

Ripple management should be designed as a coordinated stack rather than one oversized filter. The stack keeps injected components bounded, avoids beat frequencies, and preserves acceptable recovery time.

• Analog low-pass: limits ripple magnitude entering the ADC without over-slowing electrode response.
• Sync sampling: aligns or avoids sampling relative to the chopping/AZ frequency to prevent beat artifacts.
• Digital filtering: applies targeted rejection (mains notch and residual ripple shaping) while controlling effective noise bandwidth.

H2-5. Input Protection for Wet Probes (ESD/Surge/Miswire Without Leakage)

Wet installations and long cables make transient events and wiring mistakes normal. Protection must achieve three simultaneous outcomes: (1) withstand engineering-class ESD/EFT/surge and miswire, (2) keep input leakage within the picoamp budget so accuracy remains valid, and (3) avoid temperature-dependent leakage that turns a “passes at room temperature” design into field drift.

1) Treat protection as an energy path, not a component list

The most reliable systems route surge energy away from the guarded high-Z island and keep “leaky under stress” parts out of the measurement node. The architecture should make it obvious where event current flows and which nodes remain protected by the bias-return and guarding strategy.

2) Layered protection: outer / middle / inner (leakage isolation by placement)

Use three layers so that energy handling and leakage risk are separated. The outer layer absorbs energy in the “dirty” zone near the connector. The middle layer limits current so inner elements stay small. The inner layer protects the buffer and shapes bandwidth without violating picoamp leakage.

3) Verify leakage like a field product (temperature × humidity × contamination)

Input leakage must be verified under the same environmental variables that create field drift. A “dry room temperature” pass is not sufficient. The goal is to detect both immediate leakage increase and slow degradation from repeated events.

• Temperature sweep: check leakage trend vs temperature to catch temperature-dependent leakage mechanisms.
• Humidity exposure: evaluate drift/leakage change under high humidity and condensation risk conditions.
• Contamination sensitivity: compare cleaned vs contaminated/flux-residue scenarios to quantify surface film impact.
• Post-event recheck: repeat E1/E2/E3 after event stress to detect aging-induced leakage rise.

H2-6. ADC Architecture for pH/ORP (ΔΣ vs SAR, Ratiometric, Reference)

ADC selection for pH/ORP should be driven by three constraints: slow signals, high source impedance, and strong interference. The winning architecture is the one that controls input sampling current, sets a defendable effective noise bandwidth (ENBW), and proves 50/60 Hz rejection while keeping reference drift from turning into pH error.

1) Start from the system constraints (what the ADC must not do)

2) ΔΣ vs SAR: decide using ENBW and input current behavior

A ΔΣ converter naturally fits low-bandwidth measurements because its digital filter defines ENBW and can place deep notches at mains frequencies. A SAR converter can work, but it typically demands a stronger front buffer and stricter anti-aliasing because the sampling capacitor draws transient current.

3) Range and reference: keep Vref drift from becoming pH error

pH conversion maps millivolts into pH using a temperature-dependent slope. Any reference drift or noise that appears as an input-equivalent millivolt error will map into pH error. Therefore, the reference plan should be documented as an error flow: Vref drift → code shift → mV error → pH error. The same flow is used to justify ratiometric choices.

• ENBW: state which filter/ODR defines ENBW so noise claims are auditable.
• 50/60 Hz rejection: specify whether rejection is from a notch, sync sampling, or both; confirm with a fixed-input test.
• Reference mapping: quantify how much Vref drift translates to mV and then to pH under the chosen slope model.

H2-7. Isolation Partitioning (Isolated ADC vs Isolated Front-End vs Isolated Outputs)

Isolation is a system partition decision: it determines where the probe shares a reference with the rest of the product and which coupling paths are allowed to pass ground-loop potentials and common-mode transients. Three practical partitions are common: (1) isolate after the analog front end, (2) isolate after the ADC (analog + ADC on the probe domain), or (3) isolate outputs only. The correct choice is the one that makes ground-loop and CMTI effects measurable and bounded.

1) Make ground loop and CMTI testable (what to probe and what to expect)

2) Three partitions and their tradeoffs (choose by what must be blocked)

3) Isolated power back-injection (how to detect and bound it)

Isolated DC-DC supplies can inject ripple and switching edges into the probe domain through return impedance and parasitic capacitance. The verification goal is to show that input noise/drift does not track ISO PSU ripple and that the guarded high-Z node remains stable during CMTI stress.

• Correlation test: sweep ISO PSU ripple (load change) and check if input noise/drift changes.
• CMTI stress: capture barrier CM waveform and verify the input node and reference node do not demodulate it into slow drift.
• Recovery behavior: verify that any spike has bounded amplitude and bounded recovery time (settling criterion).

H2-8. Temperature Sensing & Compensation (Nernst Slope, Probe Temperature, Board Temp)

Temperature compensation is not “add a temperature sensor.” It is a measurement model choice: which temperature represents the electrochemical system, how the slope vs temperature mapping is applied, and how delay and filtering avoid over-compensation during temperature transients. The most common field error is compensating with board temperature when the solution temperature is changing.

1) Minimal engineering model: slope(T) plus calibration offsets

pH conversion maps electrode millivolts into pH using a temperature-dependent slope. Compensation therefore applies Slope(T) (and optionally a calibrated offset) to the mV measurement. A valid implementation documents the error flow: temperature estimate → slope selection → mV-to-pH mapping → residual error.

2) Where temperature is sensed defines what is being compensated

3) Model + delay + filtering must work together (avoid dynamic mis-compensation)

A compensation algorithm must consider thermal delay: a temperature step at the solution does not appear instantly at the sensor. Excessive filtering hides noise but increases lag, which can create transient pH error during temperature changes. Align the compensation time constant with the measurement bandwidth and use step-response validation to bound overshoot and recovery.

• Model: linear, lookup, or multi-point fit chosen by accuracy and probe variation.
• Delay: quantify lag between solution and sensor; treat it as a dominant dynamic error source.
• Filter: apply only what is needed; validate with a temperature step response and a defined settling criterion.

H2-9. Calibration Workflow (2-Point/3-Point pH, ORP Single-Point, Storage & Integrity)

Calibration must be executable and traceable: the controller needs explicit acceptance criteria for stability and noise, a repeatable sequence for collecting reference points, and a protected method to store calibration records with rollback safety. The workflow should prevent “calibrating in a bad state” (unstable probe, wrong temperature source, mains pickup) and should preserve enough metadata to explain later why a calibration is trusted.

1) Calibration parameters and record model (what gets solved and what gets stored)

2) Acceptance criteria before taking a calibration point (prevent bad commits)

The workflow must define measurable “ready” conditions. A calibration point is only valid if the input is stable, noise is bounded, and temperature context is consistent. The same fields should later power self-diagnostics and calibration quality logs.

3) pH 2-point and 3-point workflows (offset + slope + validation)

A 2-point pH calibration solves offset and slope. A 3-point sequence is used when a consistency check is required across a wider range or when a third point is used as a validation gate. In both cases, each point is collected only after stability and noise gates pass, then averaged over a defined sample window.

• 2-point: collect Buffer A and Buffer B → compute offset and slope → verify both points after commit.
• 3-point: collect A/B/C → compute offset/slope from A/B → use C as validation (or segment/fit if enabled) → commit only if C error is bounded.
• Fail-safe: if any point fails gates, abort and log metrics rather than writing partial parameters.

4) ORP 1-point calibration with rejection logic (calibrate only when contact is healthy)

ORP calibration is commonly a single-point offset correction, but the critical engineering requirement is rejection: if the probe exhibits polarization, intermittent contact, or excessive drift/noise, the offset must not be committed. The workflow should direct the user to diagnosis or maintenance rather than “calibrating the failure into the system”.

• Commit only if drift and noise are within the same acceptance gates used for pH points.
• Record the full quality metrics even on failure to support later troubleshooting.
• If process requirements demand, allow a secondary validation point as a consistency check (without turning this into a full pH-like multi-point model).

5) Storage and integrity: versioning, power-fail safety, and traceable fields

Calibration records must survive power interruptions and should be verifiable later. Use an A/B record strategy with CRC and a two-phase commit: write the new record, verify CRC, then switch the active pointer. The record should include versioning, timestamps, temperature at calibration, computed parameters, and the quality metrics that justified acceptance.

H2-10. Self-Diagnostics (Probe Impedance, Leakage, Drift, Noise Signatures)

Self-diagnostics should answer a practical question: is the fault on the probe side, the board side, or the environment? The diagnostic layer relies on measurable metrics derived from the same evidence fields used during calibration (stability and noise metrics) plus targeted signatures for impedance, leakage/guard effectiveness, and noise-spectrum fingerprints (mains, switching ripple, RF coupling).

1) Diagnostic metrics: define what is measured and what it means

2) Probe impedance and slow response (aging and contamination signatures)

Aging and contamination often appear as slower settling and changed effective impedance or time-constant behavior. Trend-based diagnostics are more robust than relying on a single absolute number: if Z_est indicates increasing impedance or the response becomes slower across sessions, the probe is likely degrading. This directly explains why stability gates in calibration (mV/min) become difficult to pass.

• Trend: compare Z_est or settling time against the probe’s own historical baseline.
• Consistency: if Z_est worsens with stable leakage metrics, suspect probe-side aging/contamination.

3) Leakage and guard effectiveness (board-side wet-film contamination detection)

Wet-film leakage and contamination on the board typically raise input leakage and reduce the effectiveness of guarding. A practical diagnostic is a leakage surrogate metric that increases with humidity exposure and improves after drying/cleaning, while probe impedance may remain normal. This creates a strong separation between probe-side aging and board-side leakage faults.

• Guard check: compare input noise/drift behavior with and without guard-related conditions defined by the design.
• Humidity signature: leak_metric increases under humidity; recovers after drying (environment-driven evidence).
• Maintenance action: if leak_metric is high, prioritize cleaning/inspection of the high-Z island and contamination sources.

4) Noise fingerprints: mains pickup, switching ripple, and RF coupling

Noise is most actionable when it is classified into fingerprints with different root causes and fixes. Use spectral bins and correlation tests with known events (load changes, switching states, RF activity) to determine the dominant coupling path.

5) ORP polarization and contact issues (reject calibration, guide maintenance)

ORP probes can show polarization or intermittent contact that manifests as poor stability (stability_metric fails), abnormal drift, and sensitivity to small disturbances. The controller should treat this as a diagnostic condition: block offset commit, log metrics, and guide maintenance actions (cleaning, re-seating, replacement) rather than allowing a calibration that masks the fault.

H2-11. Outputs & Control (Isolated 4–20mA, DAC/PWM, Relays/SSR, Safety States)

Outputs must connect to real industrial wiring while protecting the high-impedance measurement chain. This chapter builds a practical output partition: measurement domain (probe/AFE), logic domain (MCU), and field/output domain (current loop, 0–10V/PWM, relay/SSR), then proves two things with measurable evidence: (1) output accuracy and fault detection, and (2) output switching does not shift the input baseline.

1) Output partitioning: ground reference and isolation choices

Field outputs are most robust when referenced to the field side and isolated from the measurement/logic side. Three practical arrangements are common:

• Isolated output domain: 4–20mA / 0–10V / relay supply and returns stay on the isolated side; reduces ground-loop injection into the high-Z input.
• Mixed: current loop isolated, low-power PWM non-isolated; acceptable only if switching edges and return currents are tightly controlled.
• Non-isolated outputs: simplest wiring but highest risk of coupling into AFE; requires strict return-path and timing rules.

2) Isolated 4–20mA: accuracy chain, compliance, and open-loop detection

A current loop is the most common industrial interface because it tolerates long cables and EMI, but it fails if the loop has insufficient compliance voltage, if the reference drifts, or if ground/return currents leak into the measurement island. A practical implementation is a DAC (or PWM-DAC) feeding a V-to-I stage, with an independent loop monitor to detect open/short and to confirm the commanded current.

2.1 Recommended MPN building blocks (examples)

MPN note: The list above is a practical starting set (commonly available industrial parts). Final selection depends on loop supply (e.g., 12/24V), compliance voltage budget, required diagnostics, and isolation rating. Keep the measurement high-Z island physically and electrically separated from loop return currents.

2.2 Evidence fields and test method: output linearity + open-loop detect

• Linearity table: measure at 4/8/12/16/20mA (and optional 3.6/21mA if used for alarms), across temperature points; record max error and gain/offset drift.
• Compliance margin: sweep load resistance to the worst case; verify the loop can still reach 20mA without saturating.
• Open-loop detection: intentionally open the loop and verify detection threshold/time; log the event and force fail-safe state.
• Coupling test: step the loop current (e.g., 4↔20mA) while observing TP_IN baseline shift (mV) and recovery time.

3) 0–10V / DAC / PWM outputs: reference rules and ripple control

0–10V and PWM are common for actuators and dimming interfaces, but they can inject switching edges into the analog front-end if the return path is shared. The design must explicitly define whether these outputs are isolated and where their reference sits. If PWM is used, the low-pass filter must be chosen to trade off response time vs ripple, and the switching edges must be contained in the output domain.

3.1 Recommended MPN examples (0–10V / PWM / DAC path)

3.2 Evidence fields and interference checks

• 0–10V linearity error: multi-point sweep and temperature sweep; record offset/gain drift.
• PWM ripple: measure ripple RMS/pp after the filter; confirm ripple does not appear as a baseline shift at TP_IN.
• Update transient: step output value and log overshoot/settling; ensure the output transient does not coincide with measurement sampling windows.

4) Relay / SSR drive: fail-safe behavior and switching-noise containment

Relays and SSRs control pumps, valves, and safety interlocks. The controller must define fail-safe states (power loss, MCU fault, probe fault, calibration data corruption) and contain switching noise so it does not corrupt pH/ORP readings. The safest approach is to keep relay/SSR supply and return on the field side, apply proper snubbing/clamping, and schedule switching away from measurement sampling windows.

4.1 Recommended MPN examples (drivers and protection)

4.2 Fail-safe truth table (example)

Define explicit default actions under faults. The exact actions are application dependent, but the table below shows the structure that makes behavior auditable:

5) Output-to-measurement interference: coupling paths and mitigation

Output switching can shift the pH/ORP baseline through three main coupling paths: (1) ground return coupling from loop/coil currents, (2) supply coupling via isolated PSU load steps and reference movement, and (3) capacitive/EMI coupling from PWM edges and relay transients. The mitigation must be structural (partitioning + returns) and temporal (switching away from sampling).

• Partition and returns: keep loop/relay returns in the field domain; do not share the high-Z island return path.
• Quiet window: schedule ADC sampling in a quiet window; enforce a settling delay after relay/SSR switching.
• Load-step control: limit output-domain load steps (soft-start/controlled edge) so TP_ISO stays stable.
• Transient containment: coil flyback/clamp + snubbing where needed; keep dv/dt nodes compact and far from the guarded input island.

6) Evidence plan: what to measure, where, and how to judge pass/fail

H2-12. FAQs (Accordion; Each Answer Points Back to Evidence Fields)

Each answer uses a fixed structure: Short answer (1 sentence) + What to measure (2 points) + First fix (1 point), and links back to the same evidence fields used in validation (noise, drift, leakage, impedance trend, isolation coupling, and output-interference test points).