ADS7038-Q1: Interference among multi-channel sampling signals

Hazel,

I will check with the team about the functional safety.  Can you provide more detail on your concern that the "two sample signals may interfere with each other."  It is common place that we have multichannel ADC.  So some more detail on what the specific concern is here would be helpful.

Art 

Hi Hazel,

let me see if I understand the problem correctly.
They want to use two ADS7038-Q1 devices and control them both through a single SPI bus by having one CSn signal per ADC. Is that a correct understanding?

The biggest challenge with that is probably to find out if you are talking to the right ADC device, #1 or #2. If the host has a fault where the CSn signals are issued incorrectly there is the plausibility that you are talking to #1 but you actually wanted to talk to #2.
One solution to detect this fault would be to configure both devices with different register settings. You would then periodically read those registers which are configured differently in the two devices to check if you are still talking to the correct device.

Just in general using two of the same ADCs for redundancy is often times not considered enough diversity because both devices could potentially have the same design flaws or manufacturing faults, etc.

We did not do any specific functional safety checks with ADS7038-Q1. However we classified the device as FS-Capable according to TI's functional safety categories. You will find an overview of those categories on TI's functional safety landing page.
https://www.ti.com/technologies/functional-safety.html

As such we provide some basic functional safety documentation which you can find on the product folder under "Technical documentation".
ADS7038-Q1 Functional Safety FIT Rate, FMD and Pin FMA

Regards,
Joachim Wuerker

Hi 

Thank you for your quick reply. Actually, I want to use one ADS7038-Q1 device with different ADC channels ,

and control it through one SPI bus. According to your reply, use one device with different ADC channel for redundancy

is also not considered enough diversity?

Hi Hazel,

thanks a lot for the clarification.
What does your customer want to achieve? That is, what are his safety goals and ASIL targets?
Does he want to measure the same signal with two channels of ADS7038-Q1?

In the end you will have to analyze the failure modes of the ADC and check which ones lead to a safety goal violation.
One of the major faults of an ADC are "gain and offset error out of specification". By measuring the same signal with two ADC channels you will not be able to detect such faults. Typically you use one available channel to measure a known test signal, such as the voltage from an external voltage reference. That way you can detect a gain error in the ADC for example.

Regards,
Joachim Wuerker

Hi Joachim,

    Our SG: Prevent the Production AC and DC voltage side  Overvoltage==>ASILB;

For sensor sampling and calculation, we need ensure two voltage signals independent with each other; Or we need ensure no common cause failure ; And we design the plausibility check to check the voltage deviation, usually we use two different sampling circuit, but now we only use one ADC; 

Now one ADC have two channels to get the voltage signals; Some potential failures and points shall be considered as below:

1. Two voltage signals use one ADC, is there common cause failure in ADC lead to two voltage signals deviation : Two voltage OV or UV?

2.Will the power supplier of ADC lead  to two voltage output deviations and the values are the same from ADC FEMDA?

3. SPI failures, how we cover the failures?
4. Is there any proposal to avoid the common cause failures when the ADC are getting two redundant voltages?

Hi Hazel,

thanks for the additional information.

If you use two channels of ADS7038-Q1 to measure the same voltage redundantly you will certainly have some common-cause failures.
If the ADC has a gain or offset error outside of specification, that would affect both measurements in the same way. Means you would not be able to detect this failure just by comparing (plausibility checking) the two measurements.
However you would be able to detect those failures by measuring a 3rd known signal. This could for example be a voltage coming from an external VREF.

Faults in the Mux need to be detected as well. Measuring the 3rd signal could be one way to check if the Mux is at least still working and is not stuck at a channel.
I would also suggest to use different resistor divider ratios for the two redundant measurements. That way you should be able to tell if the Mux selected the correct signal for measurement.

The SPI offers a CRC check which would cover most of the SPI failures.
In addition the host can check for "loss of communication", e.g. when it receives only 1s or 0s on SDO. This could happen when the device lost power, is held in reset or some of the SPI pins have a fault.

It is hard to predict what happens to the two measurements when the supplies are out of range. But in general this would affect both measurements in the same way. If the supplies drop below the POR (power-on threshold) then the device would be held in reset and the host could detect a loss of communication. In general it would be a good idea to monitor the supplies of the ADC though.

Please also note that ADS7038-Q1 was not developed according to ISO 26262. The customer may have to perform an "evaluation of the hardware element" according to ISO 26262-8 section 13.

Regards,
Joachim Wuerker