Joint-Condition Fault Injection¶
Fault-injection method — instantiates Conjunctive Path Assurance
Deliberately forces several fault conditions true at once in a sandbox and watches whether a complete failure path actually lights up.
Analysis and sampling reason about the conjunction; Joint-Condition Fault Injection stages it. Rather than waiting for a rare coincidence or arguing about a model, it actively forces a chosen set of conditions or faults true simultaneously — in a sandbox or twin, never on the live asset — and observes whether a complete failure path actually conducts end to end. Its defining trait is that it is empirical and active: it manufactures the coincidence on purpose to see the real integrated system's response, catching the wiring, timing, and interaction effects that a model quietly assumes away. It is the destructive experiment of the set — the one that pulls the real levers to find out whether the AND-chain truly completes.
Example¶
An industrial robot cell is tested on a hardware-in-the-loop rig. Each single-fault test has passed: light-curtain fault alone is safe, door-interlock fault alone is safe. Joint-Condition Fault Injection forces two at once — light-curtain muting stuck active and cell-door sensor jammed closed — while a maintenance-mode command is issued. On the rig the injected conjunction reveals that the arm can move at full speed with a human-present condition entirely unguarded: a live route that every single-fault test cleared. The finding exists only because the faults were forced together, against real control hardware, in a place where the resulting unsafe motion harmed nothing but a simulated workpiece.
How it works¶
Pick a target conjunction — often a cut set from the analysis, or the output of a guided search for the worst reachable combination — and stage it in a sandbox or digital twin isolated enough that a triggered fault cannot escape. Force the conditions simultaneously (or in a specified sequence, if the route needs an order) and observe, end to end, whether the path conducts. An adversarial search can widen from a single seed toward the combination most likely to break through. What distinguishes it from its siblings is that it measures reality, not a model: it triggers the coincidence and records what the real system actually does.
Tuning parameters¶
- Injection point set — which faults you can force, and where. Too few and you can't stage the real conjunction; too invasive and the sandbox stops resembling production.
- Search strategy — scripted named conjunctions versus a guided, adversarial search toward the worst combination; scripted covers the known, guided surfaces the surprise.
- Sandbox fidelity — how faithfully the twin mirrors the real system; a low-fidelity rig injects cleanly but its "safe" verdict may not transfer.
- Blast-radius containment — how strongly the sandbox is isolated so an injected fault cannot leak into production.
- Simultaneity versus sequence — forcing conditions truly at once versus in a timed order; some routes need overlap, others a precise sequence.
When it helps, and when it misleads¶
Its strength is empirical ground truth: it forces the conjunction and shows what the real, integrated system does, surfacing the emergent wiring and timing effects that models and paper analyses assume away — the difference between believing a route is broken and watching it stay broken under load.[1]
Its limit is coverage: you can only inject the conjunctions you thought to stage, so it confirms hazards but can never prove none remain, and a low-fidelity twin's clean bill of health may not hold in production. The classic misuse is injecting only the combinations you are confident will pass — theatre dressed as a probe. The discipline is to drive injection from the enumerated cut sets and a genuinely adversarial search, keep the twin honest against the real system, and treat a passing injection as evidence about the cases you tried, not the ones you didn't.
How it implements the components¶
adversarial_path_search_boundary— the campaign's scope: the bounded space of fault-conjunctions the injector will actively force, ideally steered by an adversarial search toward the worst reachable combination.digital_twin_or_safety_sandbox— the isolated twin or sandbox in which the conjunction is forced, so the real asset is never endangered by the experiment.
It does not enumerate which conjunctions exist — that ranked list is Minimal Cut-Set Enumeration — nor watch the live production system for them; that operational job is Runtime Gate Co-Activation Monitor.
Related¶
- Instantiates: Conjunctive Path Assurance — it forces the joint state and confirms empirically whether a route conducts.
- Consumes: Minimal Cut-Set Enumeration for the cut sets it targets for injection.
- Sibling mechanisms: Minimal Cut-Set Enumeration · Property-Based State-Sequence Testing · Digital-Twin Hazard Rehearsal · Runtime Gate Co-Activation Monitor · Full-Factorial Joint-State Test
Editorial Notes¶
Form Classification¶
Form family: Experiment, Test & Rehearsal
Rationale: Joint-Condition Fault Injection operates as a bounded trial, probe, simulation, or rehearsal that generates evidence from performance because it deliberately forces several fault conditions true at once in a sandbox and watches whether a complete failure path actually lights up
Independent corroboration: The frozen evidence defines Joint-Condition Fault Injection as 'Deliberately forces several fault conditions true at once in a sandbox and watches whether a complete failure path actually lights up', so its operative form is Experiment, Test & Rehearsal.
Review outcome: Independent reviewer agreement; high confidence.
Origin Attribution¶
Primary origin: Computer Science & Software Engineering
Origin pattern: Cross-disciplinary synthesis
Present-day reach: Multi-domain
Rationale: Software reliability and chaos-testing traditions developed deliberate injection of interacting faults into controlled systems.
Related originating lineages:
- Engineering & Design (beyond software) — Safety and reliability engineering supplied conjunctive fault-path reasoning and sandboxed destructive testing.
Review resolution: Both independent reviews place the primary lineage in computer_science. The queued differences (domain_reach_disagreement) concern secondary metadata rather than primary provenance. The final retains engineering_design only where a reviewer supplied a formative-lineage rationale; downstream application by itself is not treated as origin. origin_mode=cross_disciplinary_synthesis records the relationship among origin traditions, while domain_reach=multi_domain records application breadth separately. encyclopedia_synthesis=true reflects whether either reviewer identified a corpus-specific synthesis, and confidence=high preserves the more cautious evidence assessment.
Encyclopedia synthesis: The exact catalogued form synthesizes established practice rather than reproducing a single standard historical label.
Review outcome: Reconciled after independent review; high confidence.
Notes¶
This method sits close to Digital-Twin Hazard Rehearsal but points the other way: rehearsal replays realistic scenarios to see how the system copes, while fault injection forces adversarial fault conjunctions to see whether a path completes. The two share the sandbox and are often run in the same twin — rehearsal for plausibility, injection for the deliberately hostile combination.
References¶
[1] Arlat, J., et al. "Fault Injection for Dependability Validation: A Methodology and Some Applications". IEEE Transactions on Software Engineering 16(2), 166–182 (1990). Uses deliberate fault injection to obtain empirical observations of how an integrated fault-tolerant system actually behaves. registry ↩ Show verification details
Supported in partVerified against the publisher's abstract
Arlat et al. show fault injection on a prototype yields empirical dependability observations of integrated systems, not the wiring/timing or load effects claimed.
“The proposed approach is based on the use of fault injection at the physical level on a hardware/software prototype of the system considered.”