Fault Injection Testing
Learn to turn diagnostic coverage claims into evidence: choose fault models, inject at the right V-model level, plan campaigns from the FMEDA and report coverage with honest statistics.
- Chapters
- 10
- Chapters
- Injection environments
- 3
- Injection environments
- Worked campaign
- 1
- Worked campaign
Quick answers
- What is fault injection testing in ISO 26262?
- Fault injection testing deliberately introduces faults into a system to demonstrate that its safety mechanisms detect and react to them as claimed. In ISO 26262 it appears as a test method at multiple levels (software unit and integration testing in Part 6, hardware integration in Part 5, and system and vehicle integration in Part 4) with Part 11 adding semiconductor-specific guidance. Its central role is converting an analytical Diagnostic Coverage claim from the FMEDA into demonstrated evidence for the safety case, including proof that detection and reaction complete within the Fault-Tolerant Time Interval. It complements FMEA and FTA; it does not replace them.
- How do you measure diagnostic coverage with fault injection?
- Each injected fault is classified into exactly one outcome: detected, silent (undetected), late, masked, false alarm, or inconclusive. Achieved DC is then computed as detected divided by detected plus undetected, with masked faults excluded from the denominator. For sampled campaigns the point estimate is not enough: you report a Wilson or Clopper-Pearson confidence bound, and it is the lower bound that must meet the required DC. Dropping inconclusive results or excluding awkward outcomes is one of the classic ways a campaign silently invalidates itself.
Why it pays for itself
Turn DC claims into evidence
Every Diagnostic Coverage value in the FMEDA is a claim until a fault injection test demonstrates it. Learn to trace each claimed percentage to an experiment an assessor can inspect.
Verify reaction inside the FTTI
Measure detection latency and fault reaction time against the fault tolerant time interval, so a campaign shows that the mechanism reacts in time and not only that it exists.
Plan statistically defensible campaigns
Derive fault lists from FMEDA rows, choose exhaustive or sampled strategies, classify every outcome, and report a Wilson or Clopper-Pearson lower bound instead of a bare point estimate.
What you’ll be able to do
Pick representative fault models
Choose fault models that reflect the physical failure mechanisms your FMEDA assumes.
Select the injection technique
Match hardware, software or simulation injection to the access you have and the evidence you need.
Plan a defensible campaign
Build the fault list, choose exhaustive or sampled strategy and define pass criteria before the first run.
Report coverage honestly
Classify outcomes and state achieved coverage with the statistical confidence a reviewer expects.
Feed the safety case
Turn campaign results into safety case entries, including timing findings against the FTTI.
Chapter by chapter
- 01
Why Fault Injection
See why a coverage figure stays a claim until injected faults demonstrate it, how reaction time ties to the FTTI, and what injection cannot replace.
- Claim versus evidence
- FTTI and reaction time
- What it does not replace
- 02
Fault Models
Choose the fault models that drive a campaign, from logic-level faults and single-event upsets to communication and software faults and their persistence.
- Logic-level models
- Single-event upsets
- Permanent, transient, intermittent
- 03
Where in the Lifecycle
Place fault injection on the V-model from software units to vehicle level and connect each level's results to FMEDA claims and the safety case.
- Software unit and integration
- Hardware integration
- System and vehicle level
- 04
Hardware Fault Injection
Compare hardware techniques, from pin forcing and glitching to EMFI, laser and JTAG injection, by access, precision and the evidence each produces.
- Pin-level forcing
- Power and clock glitching
- JTAG and boundary scan
- 05
Software Fault Injection
Apply code mutation, debugger corruption, interface faults and exception forcing, and decide where interception hooks belong and how to automate them.
- Code mutation
- Debugger-driven corruption
- Interception wrappers
- 06
Simulation & Model-Based FI
Use RTL and gate-level fault simulation, virtual ECUs, HiL rigs and saboteur blocks to inject faults before or alongside real hardware.
- RTL fault simulation
- Virtual ECU injection
- Saboteurs and mutants
- 07
Campaign Planning
Derive a fault list from the FMEDA and architecture, choose exhaustive or sampled campaigns, compare golden and faulty runs, and set acceptance criteria.
- Fault list derivation
- Exhaustive versus sampled
- Golden run comparison
- 08
Measuring Coverage
Classify every injection outcome, compute achieved coverage, attach statistical confidence to sampled results, and keep failure-mode coverage apart from DC.
- Outcome classification
- Achieved coverage
- Statistical confidence
- 09
Tools & Standards
Map tool categories to their roles, decide when an injection tool needs qualification, and read the semiconductor guidance in ISO 26262-11.
- Tool categories
- Tool qualification
- Semiconductor guidance
- 10
Worked Example & Pitfalls
Run a stuck-at injection campaign against an EPS torque watchdog from test plan to safety case entry, then review what invalidates campaigns.
- EPS torque watchdog
- Test plan and execution
- Campaign pitfalls
Read all 10 chapters with Expert.
Start with a free account: the complete Functional Safety Concept guide and 5 practice exams a month, then upgrade when you need this guide.
Expert plan pricingNot just text: the visual toolkit
FTTI race
Detection plus reaction time racing the hazard, and what happens when the race is lost.
Fault model taxonomy explorer
Browse fault model families and the physical mechanisms each one stands for.
Mutation testing lab
Apply a mutation operator to a small function and see whether the tests kill it.
Campaign sample-size simulator
Shows how sample size and true detection rate shape the confidence you can claim.
Outcome classification tree
Routes every injected fault into exactly one outcome class.
EPS Torque Watchdog Campaign
The last chapter runs a stuck-at injection campaign against the torque watchdog of an electric power steering ECU and carries the result into the safety case.
- The scenario, the safety mechanism and the fault model under test
- The test plan and how the campaign is executed
- How the results are classified and entered into the safety case
- The pitfalls that quietly invalidate a campaign
Unlock in course
Who this guide is for
- Hardware safety engineers who assigned DC values in an FMEDA and now must back them
- Test engineers planning HIL, JTAG, or simulation-based injection campaigns
- Software leads verifying range checks, flow monitors, and watchdog handlers
- Anyone facing an assessor question about where a coverage number came from
Frequently Asked Questions
Common questions about Fault Injection Testing
Start the course today
A free account unlocks one full concept guide, 3 work product templates, 1 guided process, the Markov and RBD simulators, and 5 practice exams per month. The Pro and Expert plans unlock more of the 93-guide library. No credit card required.
Continue with
Where this topic leads next.
- Verification and assessmentFunctional Safety Assessment & AuditLearn how to prepare for and execute independent functional safety assessments per ISO 26262-2. Covers evidence package assembly, assessor qualifications, common non-conformities, and corrective action tracking.
- Verification and assessmentSafety Case DevelopmentLearn how to structure claims, evidence, and arguments using GSN or CAE notation into a living safety case. Covers modular structure, argument patterns, incremental development aligned with sprints, and assessment readiness.
- Vehicle domainsActuator SafetyMotors, valves and relays are where safety goals become physical: learn how actuation channels fail stuck or runaway, how feedback and diagnostics catch it, and how safe states from de-energize to active hold are engineered and quantified.