I appreciated the suggestions in my thread about buying a tank controller, but I wanted to make this it's own thread. In light of recent events, I've been reviewing my ATO setup and making significant changes. First, I've switched from a 50G reservoir to a 15G one, so the risk is much lower. I'll have to figure something out for next summer while I am in Alaska again, but until then it makes no sense to run the risk of such a disaster. In addition, I've bought a Reef Angel controller, and it is currently running a simple ATO with the help of a slightly modified ATO script Roberto was kind enough to write for me. However, I've been running over the options in my head and I want to build it to be as dependable as I can. The goals are as follows: 1. Perform ATO function with the lowest possibility for the system to overdose Kalk. 2. Shut down ATO if PH rises too high. 3. Shut down the ATO, heater & skimmer if the sump gets low. 4. Shut down the ATO pump if the RA relay sticks on. 5. Notify me if the system is out of spec. So here's the plan I've come up with: 3 Float switches: #1 float switch controlling the ATO, with a timeout set. If the timeout is exceeded, ATO is deactivated and notification is sent to me. #2 float switch providing the low sump sensor, which when activated shuts down heater, skimmer, ATO, and sends a notification. (Currently this isn't how I have it, but I need to learn this scripting language to change it hah!) #3 float switch, a basic single switch relay from Autotopoff.com plugged in between the RA and the pump, which provides a safety on the system running away for any reason, stuck relay, me getting stupid with the scripting, me leaving the RA stuck in a menu while I dreamily stare at fish with the ATO active, etc... In addition, if the PH rises above let's say, 8.6ish(?), then the ATO would deactivate. I haven't figured out for sure if I can do this with the RA, but I don't see why not. I am undecided if this should be a "fault" disable which disables the ATO until serviced, and sends a notification. It depends on how often this type of event occurs, and since I've never really chased my PH numbers I'm not sure how much the fluctuate normally. Open to suggestions on this. If it's not a fault notification, I run the risk of it falling into a loop and still being able to overdose, although much more slowly. However, having the ATO shut down while I'm away is a serious problem too. The system needs to be robust enough that I can still go to work... I'm leaning towards making this a temporary state, and if the PH is above a certain point it will simply refuse to run the ATO, but not throw a fault and disable it, my hope is that the timeout would catch any more serious conditions that occur. Any input while I'm in the planning stages is appreciated. If I'm headed the wrong way I'd rather know now than after I get it half put together.