Anti-pinch function: 24 passing tests and a missing transition
You are testing an anti-pinch window-lift ECU (ASIL A). The requirement states that on obstacle detection during closing, the motor must reverse within 100 ms and the reversal force must not exceed 100 N. The supplier's test set has 24 cases built by equivalence partitioning over obstacle stiffness and boundary values at 99 N, 100 N and 101 N, and at 95 ms, 100 ms and 105 ms. All 24 pass and the supplier declares the requirement verified. Reviewing the state machine you find the transition 'closing → reversing' is only specified for obstacle detection in the top 4 mm of travel; below that no transition exists and the implementation remains in 'closing'. No test places the obstacle more than 4 mm below the top edge. Later field data shows the escape occurs only at 9.5 V supply combined with a cold motor at −20 °C.
1. Explain why 24 passing cases missed the defect, and name the dynamic technique plus the criterion that would have exposed it.
Read the worked answer
All 24 cases vary continuous parameters, force and time, but they enter the same behavioural region: obstacle detected near the top of travel. Equivalence partitioning and boundary value analysis were applied to the numeric inputs only, so the test set samples one state path very thoroughly and never samples the rest of the state space.
Technique: state transition testing, with transition coverage as the reporting criterion, together with an explicit list of specified transitions that have no test. The subtlety is that 1-switch or N-switch coverage would still not have found this, because the transition is absent from the specification, not merely untested. Coverage of the model as written would have been 100 %.
So the criterion alone is not enough. Pair it with a systematic comparison of the implementation's guard conditions against the specified transition conditions, and with a robustness test that injects obstacle detection at several positions of travel, not one. Report two numbers: transitions covered, and transitions in the implementation with no corresponding specified behaviour.
2. The escape needs 9.5 V supply plus a cold motor at −20 °C. Which technique derives these cases, and how do you justify the chosen values to the assessor?
Read the worked answer
The relevant factors are environmental and operational: supply voltage including the cranking dip, temperature, motor friction or age, obstacle stiffness, and window position. The technique is the classification tree method (combinatorial testing with a covering array works too, but the tree gives you the justification).
Build the tree from the operating conditions in the environmental and functional specifications, not from intuition: classes for voltage at the lower limit, nominal and upper limit, including the cold-crank dip; temperature at the specified minimum, nominal, maximum and storage extremes; motor state cold, warm, worn; window position across the full travel. Choose the classes from the specification boundaries, then generate combinations. Pairwise is a defensible minimum when the factors are largely independent; where a risk analysis says two factors interact, as here with low voltage and high friction, add those combinations explicitly.
Justify to the assessor by showing the tree, the source of each boundary, the covered combinations and the explicitly added risk-based combinations, so the reasoning is visible and not just the resulting 24 rows.
3. Is the boundary set 99 N / 100 N / 101 N adequate? What would you change?
Read the worked answer
No, for three reasons.
- The threshold in the test is the printed requirement, not the implemented threshold. The 100 N is a limit, and the realised threshold is shifted by sensor accuracy, quantisation and mechanical tolerance. If force measurement carries a few percent error, the effective band is several newtons wide and 99/101 N probes inside the noise.
- The limit is one-sided. Exceeding 100 N is the hazard, so the interesting boundary is the maximum permitted force under worst-case mechanics, not a symmetric neighbourhood around the nominal value. Test the worst case plus a margin just below and just above the realised threshold.
- The timing boundaries ignore task quantisation. If the supervising task runs on a 10 ms cycle, 95/100/105 ms do not align with execution, so the 100 ms case is not reproducible. Derive the timing values from the cycle and the measurement resolution.
Rebuild the set with the specification's tolerances, the sensor characteristics and the task timing as inputs, and record the derivation so the next reviewer can check the reasoning.