Test Strategy for a Safety-Critical Automotive System
An automotive supplier is developing a brake control system that must comply with ISO 26262 ASIL D. The system includes software that monitors wheel speed sensors and activates anti-lock braking. The team has limited time for testing before a critical design review. They have unit tests for individual functions but no integration tests or hardware-in-the-loop (HIL) tests yet. The requirements specify a maximum response time of 10 ms from sensor input to brake activation. A static analysis tool has flagged a potential null pointer dereference in a rarely used error-handling routine. The project manager suggests skipping HIL tests to save time and relying on unit tests and code review.
1. Critique the project manager's suggestion and propose a risk-based test strategy.
Read the worked answer
Skipping HIL tests is unacceptable for ASIL D; unit tests and code review cannot validate timing and integration. The null pointer issue must be fixed and tested. Risk-based strategy: Prioritize tests for safety requirements. Conduct static analysis and fix all critical warnings. Perform integration tests focusing on sensor-to-actuator path. Use HIL to validate timing (10 ms) under various conditions. Include fault injection tests for sensor failures. Allocate time for regression testing. If time is tight, reduce scope of non-safety features or negotiate deadline. Document test coverage and traceability to requirements for ISO 26262 compliance.
2. How would you handle the null pointer dereference finding?
Read the worked answer
Treat it as a safety-critical defect. Analyze the code path: if the routine can be triggered in operation, it could cause a crash. Even if rarely used, ASIL D requires high coverage. Fix by adding null checks or refactoring to avoid nulls. Add unit tests to cover the error-handling path. Re-run static analysis to confirm. Document the fix and update traceability. If the routine is truly unreachable, prove it via analysis and remove dead code.