Fault Injection Techniques (Pin, Bus, Model)

#!/usr/bin/env python3
# Pin-level fault injection: switch sensor line to fault state
# Uses Pickering 40-297 relay matrix card (HIL fault injection)

class PinFaultInjector:
    """Controls relay matrix for pin-level fault injection"""

    FAULT_NORMAL   = 0   # normal connection: sensor to HIL DAC
    FAULT_SHORT_GND= 1   # short to ground (0V)
    FAULT_SHORT_BAT= 2   # short to battery (12V)
    FAULT_OPEN     = 3   # open circuit (disconnect)

    def __init__(self, relay_card_addr):
        self.addr  = relay_card_addr
        self.state = {}  # channel -> fault state

    def inject(self, channel, fault_type, duration_ms=None):
        """Inject fault on given channel (e.g., throttle sensor)"""
        print(f"  FI: channel={channel} fault={fault_type}")
        # In real impl: send command to relay card via GPIB/USB
        # self.relay_card.set_crosspoint(channel, fault_type)
        self.state[channel] = fault_type
        if duration_ms is not None:
            import threading
            t = threading.Timer(duration_ms / 1000.0,
                               self.clear, args=[channel])
            t.start()

    def clear(self, channel):
        self.state[channel] = self.FAULT_NORMAL
        # self.relay_card.set_crosspoint(channel, self.FAULT_NORMAL)

# Test: inject throttle sensor short-to-ground; verify ECU DTC
def test_throttle_short_to_gnd(fi, ecu_monitor):
    import time
    fi.inject("TPS_CHANNEL_1", PinFaultInjector.FAULT_SHORT_GND)
    time.sleep(0.1)  # wait for FHTI (100 ms)
    dtcs = ecu_monitor.read_dtcs()
    assert "P0122" in dtcs, f"Expected DTC P0122 (TPS low), got {dtcs}"
    fi.clear("TPS_CHANNEL_1")
    print("  PASS: DTC P0122 set within FHTI")

// CANoe CAPL script: inject CAN bus faults during HIL test
// Run from CANoe environment; modifies bus traffic

variables {
  message VehicleSpeed vspd;    // message to corrupt
  int fi_enabled = 0;
  int fi_drop_count = 0;
}

// Message drop fault: suppress VehicleSpeed for 200ms
on message VehicleSpeed {
  if (fi_enabled) {
    // Do not call output() -- message is dropped
    fi_drop_count++;
  } else {
    output(this);  // pass through normally
  }
}

// Bit-error injection: corrupt specific signal value
on message BrakeStatus {
  if (fi_enabled == 2) {
    this.BrakePresssure_kPa = 0xFFFF;  // inject max value (out-of-range)
  }
  output(this);
}

// Test control: called from ECU-TEST or Python
on sysvar FaultInjection::VSpeedDropEnable {
  fi_enabled = @this;
  write("Fault injection: VehicleSpeed drop = %d", fi_enabled);
}