Skip to content

Joint-Condition Fault Injection

Fault-injection method — instantiates Conjunctive Path Assurance

Deliberately forces several fault conditions true at once in a sandbox and watches whether a complete failure path actually lights up.

Analysis and sampling reason about the conjunction; Joint-Condition Fault Injection stages it. Rather than waiting for a rare coincidence or arguing about a model, it actively forces a chosen set of conditions or faults true simultaneously — in a sandbox or twin, never on the live asset — and observes whether a complete failure path actually conducts end to end. Its defining trait is that it is empirical and active: it manufactures the coincidence on purpose to see the real integrated system's response, catching the wiring, timing, and interaction effects that a model quietly assumes away. It is the destructive experiment of the set — the one that pulls the real levers to find out whether the AND-chain truly completes.

Example

An industrial robot cell is tested on a hardware-in-the-loop rig. Each single-fault test has passed: light-curtain fault alone is safe, door-interlock fault alone is safe. Joint-Condition Fault Injection forces two at once — light-curtain muting stuck active and cell-door sensor jammed closed — while a maintenance-mode command is issued. On the rig the injected conjunction reveals that the arm can move at full speed with a human-present condition entirely unguarded: a live route that every single-fault test cleared. The finding exists only because the faults were forced together, against real control hardware, in a place where the resulting unsafe motion harmed nothing but a simulated workpiece.

How it works

Pick a target conjunction — often a cut set from the analysis, or the output of a guided search for the worst reachable combination — and stage it in a sandbox or digital twin isolated enough that a triggered fault cannot escape. Force the conditions simultaneously (or in a specified sequence, if the route needs an order) and observe, end to end, whether the path conducts. An adversarial search can widen from a single seed toward the combination most likely to break through. What distinguishes it from its siblings is that it measures reality, not a model: it triggers the coincidence and records what the real system actually does.

Tuning parameters

  • Injection point set — which faults you can force, and where. Too few and you can't stage the real conjunction; too invasive and the sandbox stops resembling production.
  • Search strategy — scripted named conjunctions versus a guided, adversarial search toward the worst combination; scripted covers the known, guided surfaces the surprise.
  • Sandbox fidelity — how faithfully the twin mirrors the real system; a low-fidelity rig injects cleanly but its "safe" verdict may not transfer.
  • Blast-radius containment — how strongly the sandbox is isolated so an injected fault cannot leak into production.
  • Simultaneity versus sequence — forcing conditions truly at once versus in a timed order; some routes need overlap, others a precise sequence.

When it helps, and when it misleads

Its strength is empirical ground truth: it forces the conjunction and shows what the real, integrated system does, surfacing the emergent wiring and timing effects that models and paper analyses assume away — the difference between believing a route is broken and watching it stay broken under load.[1]

Its limit is coverage: you can only inject the conjunctions you thought to stage, so it confirms hazards but can never prove none remain, and a low-fidelity twin's clean bill of health may not hold in production. The classic misuse is injecting only the combinations you are confident will pass — theatre dressed as a probe. The discipline is to drive injection from the enumerated cut sets and a genuinely adversarial search, keep the twin honest against the real system, and treat a passing injection as evidence about the cases you tried, not the ones you didn't.

How it implements the components

  • adversarial_path_search_boundary — the campaign's scope: the bounded space of fault-conjunctions the injector will actively force, ideally steered by an adversarial search toward the worst reachable combination.
  • digital_twin_or_safety_sandbox — the isolated twin or sandbox in which the conjunction is forced, so the real asset is never endangered by the experiment.

It does not enumerate which conjunctions exist — that ranked list is Minimal Cut-Set Enumeration — nor watch the live production system for them; that operational job is Runtime Gate Co-Activation Monitor.

Notes

This method sits close to Digital-Twin Hazard Rehearsal but points the other way: rehearsal replays realistic scenarios to see how the system copes, while fault injection forces adversarial fault conjunctions to see whether a path completes. The two share the sandbox and are often run in the same twin — rehearsal for plausibility, injection for the deliberately hostile combination.

References

[1] Deliberately introducing faults to test a system's response is a recognized verification-and-validation technique; its software-world incarnation is chaos engineering, which injects failures into running systems to expose weaknesses before they occur naturally. The joint-condition variant simply forces the faults together rather than one at a time. ↩