Title: Fault Injection Testing for ISO 26262 | ISO 26262 Academy URL: https://iso26262.academy/features/concepts/fault-injection-testing Description: Verify safety mechanisms with fault injection: show they detect and react within the FTTI, and support FMEDA diagnostic coverage claims with test evidence. --- Concept guide · ISO 26262-4/-5/-6 · 10 chapters # Fault Injection Testing Learn to turn diagnostic coverage claims into evidence: choose fault models, inject at the right V-model level, plan campaigns from the FMEDA and report coverage with honest statistics. 10 Chapters 3 Injection environments 1 Worked campaign Included in [Expert](https://iso26262.academy/pricing#plan-advanced) [Preview free](https://iso26262.academy/register?plan=free&from=%2Fconcepts%2Ffault-injection-testing&utm_source=website&utm_medium=cta&utm_campaign=features_concepts) See the chapters Inside the course 1. 01 **Why Fault Injection** 2. 02 **Fault Models** 3. 03 **Where in the Lifecycle** 4. 04 **Hardware Fault Injection** 5. 05 **Software Fault Injection** The short version ## Quick answers What is fault injection testing in ISO 26262? Fault injection testing deliberately introduces faults into a system to demonstrate that its safety mechanisms detect and react to them as claimed. In ISO 26262 it appears as a test method at multiple levels (software unit and integration testing in Part 6, hardware integration in Part 5, and system and vehicle integration in Part 4) with Part 11 adding semiconductor-specific guidance. Its central role is converting an analytical Diagnostic Coverage claim from the FMEDA into demonstrated evidence for the safety case, including proof that detection and reaction complete within the Fault-Tolerant Time Interval. It complements FMEA and FTA; it does not replace them. How do you measure diagnostic coverage with fault injection? Each injected fault is classified into exactly one outcome: detected, silent (undetected), late, masked, false alarm, or inconclusive. Achieved DC is then computed as detected divided by detected plus undetected, with masked faults excluded from the denominator. For sampled campaigns the point estimate is not enough: you report a Wilson or Clopper-Pearson confidence bound, and it is the lower bound that must meet the required DC. Dropping inconclusive results or excluding awkward outcomes is one of the classic ways a campaign silently invalidates itself. Keep going, free - [Article · 6 min read Fault Injection: Proving Diagnostic Coverage Instead of Claiming It](https://iso26262.academy/blog/fault-injection-proving-diagnostic-coverage) - [Demo exam · no account Test yourself with 7 exam-style questions](https://iso26262.academy/demo-exam) Why this course · ISO 26262, Part 4 ## Why it pays for itself ### Turn DC claims into evidence Every Diagnostic Coverage value in the FMEDA is a claim until a fault injection test demonstrates it. Learn to trace each claimed percentage to an experiment an assessor can inspect. ### Verify reaction inside the FTTI Measure detection latency and fault reaction time against the fault tolerant time interval, so a campaign shows that the mechanism reacts in time and not only that it exists. ### Plan statistically defensible campaigns Derive fault lists from FMEDA rows, choose exhaustive or sampled strategies, classify every outcome, and report a Wilson or Clopper-Pearson lower bound instead of a bare point estimate. After the course ## What you’ll be able to do ### Pick representative fault models Choose fault models that reflect the physical failure mechanisms your FMEDA assumes. ### Select the injection technique Match hardware, software or simulation injection to the access you have and the evidence you need. ### Plan a defensible campaign Build the fault list, choose exhaustive or sampled strategy and define pass criteria before the first run. ### Report coverage honestly Classify outcomes and state achieved coverage with the statistical confidence a reviewer expects. ### Feed the safety case Turn campaign results into safety case entries, including timing findings against the FTTI. The curriculum · 10 chapters ## Chapter by chapter 1. 01 **Why Fault Injection** See why a coverage figure stays a claim until injected faults demonstrate it, how reaction time ties to the FTTI, and what injection cannot replace. - Claim versus evidence - FTTI and reaction time - What it does not replace 2. 02 **Fault Models** Choose the fault models that drive a campaign, from logic-level faults and single-event upsets to communication and software faults and their persistence. - Logic-level models - Single-event upsets - Permanent, transient, intermittent 3. 03 **Where in the Lifecycle** Place fault injection on the V-model from software units to vehicle level and connect each level's results to FMEDA claims and the safety case. - Software unit and integration - Hardware integration - System and vehicle level 4. 04 **Hardware Fault Injection** Compare hardware techniques, from pin forcing and glitching to EMFI, laser and JTAG injection, by access, precision and the evidence each produces. - Pin-level forcing - Power and clock glitching - JTAG and boundary scan 5. 05 **Software Fault Injection** Apply code mutation, debugger corruption, interface faults and exception forcing, and decide where interception hooks belong and how to automate them. - Code mutation - Debugger-driven corruption - Interception wrappers 6. 06 **Simulation & Model-Based FI** Use RTL and gate-level fault simulation, virtual ECUs, HiL rigs and saboteur blocks to inject faults before or alongside real hardware. - RTL fault simulation - Virtual ECU injection - Saboteurs and mutants 7. 07 **Campaign Planning** Derive a fault list from the FMEDA and architecture, choose exhaustive or sampled campaigns, compare golden and faulty runs, and set acceptance criteria. - Fault list derivation - Exhaustive versus sampled - Golden run comparison 8. 08 **Measuring Coverage** Classify every injection outcome, compute achieved coverage, attach statistical confidence to sampled results, and keep failure-mode coverage apart from DC. - Outcome classification - Achieved coverage - Statistical confidence 9. 09 **Tools & Standards** Map tool categories to their roles, decide when an injection tool needs qualification, and read the semiconductor guidance in ISO 26262-11. - Tool categories - Tool qualification - Semiconductor guidance 10. 10 **Worked Example & Pitfalls** Run a stuck-at injection campaign against an EPS torque watchdog from test plan to safety case entry, then review what invalidates campaigns. - EPS torque watchdog - Test plan and execution - Campaign pitfalls Read all 10 chapters with Expert. Start with a free account: the complete Functional Safety Concept guide and 5 practice exams a month, then upgrade when you need this guide. [Expert](https://iso26262.academy/pricing#plan-advanced) [Preview free](https://iso26262.academy/register?plan=free&from=%2Fconcepts%2Ffault-injection-testing&utm_source=website&utm_medium=cta&utm_campaign=features_concepts) [Try the 7-question demo exam](https://iso26262.academy/demo-exam) Interactive figures ## Not just text: the visual toolkit ### FTTI race Detection plus reaction time racing the hazard, and what happens when the race is lost. ### Fault model taxonomy explorer Browse fault model families and the physical mechanisms each one stands for. ### Mutation testing lab Apply a mutation operator to a small function and see whether the tests kill it. ### Campaign sample-size simulator Shows how sample size and true detection rate shape the confidence you can claim. ### Outcome classification tree Routes every injected fault into exactly one outcome class. Worked Example ## EPS Torque Watchdog Campaign The last chapter runs a stuck-at injection campaign against the torque watchdog of an electric power steering ECU and carries the result into the safety case. - The scenario, the safety mechanism and the fault model under test - The test plan and how the campaign is executed - How the results are classified and entered into the safety case - The pitfalls that quietly invalidate a campaign EPS fault injection plan Target: torque watchdog of a fictional EPS ECU under stuck-at faults Unlock in course Built for ## Who this guide is for - Hardware safety engineers who assigned DC values in an FMEDA and now must back them - Test engineers planning HIL, JTAG, or simulation-based injection campaigns - Software leads verifying range checks, flow monitors, and watchdog handlers - Anyone facing an assessor question about where a coverage number came from ## Frequently Asked Questions Common questions about Fault Injection Testing A fault model bridges physical failure mechanisms to stimuli a test engineer can apply. The standard families are logic-level faults (stuck-at, bridging, open, transition and timing faults), single-event upsets (single-bit, multi-bit, and transients), and the communication fault classes of ISO 26262-6 Annex D: corruption, loss, delay, insertion, and babbling idiot. Choosing representative fault models matters as much as the injection itself: an unrepresentative model produces systematically optimistic coverage. Hardware techniques range from non-invasive JTAG register writes and pin-level forcing through power and clock glitching up to spatially precise but destructive EMFI and laser injection. Software techniques include code mutation, debugger-driven variable corruption, API stubbing, and exception forcing. Simulation covers RTL and gate-level fault simulation, virtual ECUs in CI/CD, and saboteur blocks across MiL, SiL, and HiL. The right choice depends on the fault model, the access you have, and the evidence the safety case needs. Ten chapters spanning fault models, the V-model levels where injection applies, hardware, software and simulation techniques, campaign planning from the FMEDA, coverage statistics and tool qualification. The worked example runs a stuck-at campaign against the torque watchdog of an EPS ECU from test plan to safety case entry, and the guide closes with the pitfalls that invalidate campaigns. A free account starts you off, and the Pro and Expert plans unlock more of the library. ## Running this analysis on a real project? Have an engineer check it, or help you build it. You get written findings on method, coverage and results. From **$1,490** with a written quote before any charge [See how we can help](https://iso26262.academy/features/consulting?service=analysis#sample) ## Start the course today A free account unlocks one full concept guide, 3 work product templates, 1 guided process, the Markov and RBD simulators, and 5 practice exams per month. The Pro and Expert plans unlock more of the 93-guide library. No credit card required. [Preview free](https://iso26262.academy/register?plan=free&from=%2Fconcepts%2Ffault-injection-testing&utm_source=website&utm_medium=cta&utm_campaign=features_concepts) [View Pricing Plans](https://iso26262.academy/pricing) Continue with ## Where this topic leads next. [Browse all 93 guides](https://iso26262.academy/features/concepts#library) - Verification and assessment [Functional Safety Assessment & Audit](https://iso26262.academy/features/concepts/functional-safety-assessment) Learn how to prepare for and execute independent functional safety assessments per ISO 26262-2. Covers evidence package assembly, assessor qualifications, common non-conformities, and corrective action tracking. [Expert](https://iso26262.academy/pricing#plan-advanced) 6 chapters - Verification and assessment [Safety Case Development](https://iso26262.academy/features/concepts/safety-case) Learn how to structure claims, evidence, and arguments using GSN or CAE notation into a living safety case. Covers modular structure, argument patterns, incremental development aligned with sprints, and assessment readiness. [Expert](https://iso26262.academy/pricing#plan-advanced) 12 chapters - Vehicle domains [Actuator Safety](https://iso26262.academy/features/concepts/actuator-safety) Motors, valves and relays are where safety goals become physical: learn how actuation channels fail stuck or runaway, how feedback and diagnostics catch it, and how safe states from de-energize to active hold are engineered and quantified. [Expert](https://iso26262.academy/pricing#plan-advanced) 14 chapters