{"id":7777,"date":"2024-06-27T12:00:11","date_gmt":"2024-06-27T10:00:11","guid":{"rendered":"https:\/\/lorit-consultancy.com\/en\/?p=7777"},"modified":"2025-04-29T13:54:43","modified_gmt":"2025-04-29T11:54:43","slug":"iso-26262-verification-methods-boundary-values-and-error-guessing","status":"publish","type":"post","link":"https:\/\/lorit-consultancy.com\/en\/2024\/06\/iso-26262-verification-methods-boundary-values-and-error-guessing\/","title":{"rendered":"ISO 26262 Verification Methods: boundary values and error guessing"},"content":{"rendered":"\r\n<h2 class=\"wp-block-heading\">Equivalence classes &amp; Boundary values<\/h2>\r\n\r\n\r\n\r\n<p>In the <strong><a href=\"https:\/\/lorit-consultancy.com\/2024\/06\/unlocking-the-secrets-of-iso-26262-verification-methods\/\">first part<\/a> <\/strong>of this blog series, we talked about verification in <strong><a href=\"https:\/\/lorit-consultancy.com\/en\/standards\/automotive\/iso26262\/\" target=\"_blank\" rel=\"noreferrer noopener\">ISO 26262<\/a><\/strong> through the determination of equivalence classes. At this point, we would like to continue with the second instalment and explain further examples of the methods for defining tests. In addition to the already mentioned equivalence classes, we will discuss boundary values as well as error guessing methods.<\/p>\r\n\r\n\r\n\r\n<p>Many customers have issues with understanding the various testing methods in the ISO 26262 standard. To say it in a diplomatic manner, ISO 26262 parts 4, 5, and 6 mention e.g. equivalence classes and boundary values as methods for deriving test cases but they do not explain much about these methods in detail. The ISO 26262 standard was derived from IEC 61508, the mother of all safety standards, and in fact the methodologies of these two standards still overlap at some of the topics. More helpful inputs about the equivalence classes, boundary values or error guessing methods can be found in the IEC 61508.<\/p>\r\n\r\n\r\n\r\n<p>According to IEC 61508-7, boundary values analysis is used e.g. to detect software errors at parameter limits or boundaries. The derived test cases are covering boundaries and extreme classes. Those input classes are previously divided using the generation of equivalence classes method.<\/p>\r\n\r\n\r\n\r\n<p>The test is checking the boundaries in the input domain. The use of the value zero, in a direct as well as in an indirect translation, is often error-prone and shall receive special attention to the following:<\/p>\r\n\r\n\r\n\r\n<ul class=\"wp-block-list\">\r\n<li>zero divisor;<\/li>\r\n\r\n\r\n\r\n<li>blank ASCII characters;<\/li>\r\n\r\n\r\n\r\n<li>empty stack or list element.<\/li>\r\n<\/ul>\r\n\r\n\r\n\r\n<p>Ultimately, a test should be defined that causes the outputs to exceed the specification boundary values. In other words, the test cases shall force the output to its limited values, through the boundaries at the input with direct impact on the output range, or through evaluation which boundary values at input are needed to cause boundaries at the output.<\/p>\r\n\r\n\r\n\r\n<h3 class=\"wp-block-heading\">Boundary values examples at hardware design<\/h3>\r\n\r\n\r\n\r\n<p>As part of functional testing, Boundary Value Analysis is based on testing the boundary values of valid and invalid partitions.<\/p>\r\n\r\n\r\n\r\n<p>E.g. Temperature sensor with valid range of -20\u00b0C to 125\u00b0C shall be tested:<br \/>Calculation of boundary values for:<\/p>\r\n\r\n\r\n\r\n<ul class=\"wp-block-list\">\r\n<li>Minimal value = -20\u00b0C<\/li>\r\n\r\n\r\n\r\n<li>Just above the minimum = -19\u00b0C<\/li>\r\n\r\n\r\n\r\n<li>Nominal value = 65\u00b0C<\/li>\r\n\r\n\r\n\r\n<li>Just below Max value = 124\u00b0C<\/li>\r\n\r\n\r\n\r\n<li>Max value = 125\u00b0<\/li>\r\n<\/ul>\r\n\r\n\r\n\r\n<div class=\"wp-block-spacer\" style=\"height: 100px;\" aria-hidden=\"true\">\u00a0<\/div>\r\n\r\n\r\n\r\n<p class=\"has-text-align-center\">E.g. for the n variable to be checked, maximum of 4n + 1 test case will be required. Therefore, for n = 1, the maximum test cases are:<br \/>4 \u00d7 1 + 1 = 5<br \/>Invalid boundary values to be tested at min-1 (-21\u00b0C) &amp; max-1(126\u00b0C)<\/p>\r\n\r\n\r\n\r\n<p>At an MCU, test blocks related to safety mechanisms e.g. temperature sensors &amp; ADC can be tested using fault injection methods. Test cases can be derived using methods like analysis boundary values.<\/p>\r\n\r\n\r\n<div class=\"wp-block-image\">\r\n<figure class=\"aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1151\" height=\"653\" class=\"wp-image-7780\" src=\"https:\/\/lorit-consultancy.com\/wp-content\/uploads\/2024\/06\/Img.1-MCU.png\" alt=\"\" srcset=\"https:\/\/lorit-consultancy.com\/wp-content\/uploads\/2024\/06\/Img.1-MCU.png 1151w, https:\/\/lorit-consultancy.com\/wp-content\/uploads\/2024\/06\/Img.1-MCU-1024x581.png 1024w, https:\/\/lorit-consultancy.com\/wp-content\/uploads\/2024\/06\/Img.1-MCU-768x436.png 768w\" sizes=\"auto, (max-width: 1151px) 100vw, 1151px\" \/><\/figure>\r\n<\/div>\r\n\r\n\r\n<p>The test cases on hardware detailed design level shall show the compliance with requirements and cover where applicable the test results for the integration level.<\/p>\r\n\r\n\r\n\r\n<h2 class=\"wp-block-heading\">Error Guessing<\/h2>\r\n\r\n\r\n\r\n<p>Error guessing is a testing technique where experienced testers use their intuition and knowledge about the system or similar designs to evaluate some uncategorized test cases and use them for the verification. The aim is to predict areas where defects are likely to occur. This technique relies on tester\u2019s knowledge of common or typical failures that might arise in similar systems which leads to structured test cases.<\/p>\r\n\r\n\r\n\r\n<p>\u201cError guessing tests\u201d can be based on data collected through a lessons-learned process or expert judgment or both. It can be supported e.g. by a FMEA.<\/p>\r\n\r\n\r\n<div class=\"wp-block-image\">\r\n<figure class=\"aligncenter size-medium\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"574\" class=\"wp-image-7782\" src=\"https:\/\/lorit-consultancy.com\/wp-content\/uploads\/2024\/06\/Error_guessing_expert-1024x574.jpg\" alt=\"\" srcset=\"https:\/\/lorit-consultancy.com\/wp-content\/uploads\/2024\/06\/Error_guessing_expert-1024x574.jpg 1024w, https:\/\/lorit-consultancy.com\/wp-content\/uploads\/2024\/06\/Error_guessing_expert-1920x1076.jpg 1920w, https:\/\/lorit-consultancy.com\/wp-content\/uploads\/2024\/06\/Error_guessing_expert-768x430.jpg 768w, https:\/\/lorit-consultancy.com\/wp-content\/uploads\/2024\/06\/Error_guessing_expert-1536x861.jpg 1536w, https:\/\/lorit-consultancy.com\/wp-content\/uploads\/2024\/06\/Error_guessing_expert-2048x1148.jpg 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\r\n<\/div>\r\n\r\n\r\n<h3 class=\"wp-block-heading\">Application of Error Guessing<\/h3>\r\n\r\n\r\n\r\n<p>Tester tries identifying common failures that have occurred in the past, such as boundary values issues, and then defines specific test cases to target these potential issues. Analyzing defects found in similar projects can help predicting similar issues in the current system aka lessons learned. Based on the experience and knowledge, the testers can explore the design of the system using error guessing methods to test various inputs and interactions that might lead to errors.<\/p>\r\n\r\n\r\n\r\n<p>The error guessing can lead to further methods of defining and application of test cases:<\/p>\r\n\r\n\r\n\r\n<ul class=\"wp-block-list\">\r\n<li>Boundary values: entering values just inside and just outside the valid range<\/li>\r\n\r\n\r\n\r\n<li>Fault injection: injection of invalid inputs with specific values<\/li>\r\n\r\n\r\n\r\n<li>Resource usage evaluation and testing the system\u2019s behavior when resources are exhausted<\/li>\r\n<\/ul>\r\n\r\n\r\n\r\n<p>Error guessing method can help to identify potential errors at specific items of the system very quickly, using the tester\u2019s knowledge and experience. It is a very flexible method that allows to adapt and respond to findings in short time. It is a valuable technique for identifying defects that might not be covered by other testing methods, leveraging the unique insights and experience of skilled testers to enhance the overall testing process.<\/p>\r\n\r\n\r\n<\/div><\/div><\/div><div class=\"content_section blue_bg blog_trenner_section\"><div class=\"row align-center medium-align-spaced\"><div class=\"columns border_solid_square post_thumbnail small-10 medium-5 large-3\"><div  data-ratio=\"1.2783505154639\" class=\"\"><picture><source media=\"(min-width:1024px)\" srcset=\"https:\/\/lorit-consultancy.com\/wp-content\/uploads\/2021\/01\/dijaz-maric.webp\" width=\"873\" height=\"1116\" type=\"image\/webp\" ><source media=\"(min-width:640px)\" srcset=\"https:\/\/lorit-consultancy.com\/wp-content\/uploads\/2021\/01\/dijaz-maric-801x1024.webp\" width=\"801\" height=\"1024\" type=\"image\/webp\" ><img decoding=\"async\" src=\"https:\/\/lorit-consultancy.com\/wp-content\/uploads\/2021\/01\/dijaz-maric-640x640.webp\" alt=\"\" loading=\"lazy\" width=\"640\" height=\"640\" type=\"image\/webp\" ><\/picture><svg version=\"1.1\" id=\"svg_border_solid_square\" class=\"svg_border_solid_square\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" xmlns:xlink=\"http:\/\/www.w3.org\/1999\/xlink\" x=\"0px\" y=\"0px\"\n\t viewBox=\"0 0 337 411.2\" style=\"enable-background:new 0 0 337 411.2;\" xml:space=\"preserve\">\n<polygon id=\"bg\" class=\"bg\" points=\"65,332.6 337,332.6 336.9,411.2 3.6,411.2 \"\/>\n<path id=\"border\" class=\"border\" d=\"M334,329.6V5.9c0-1.6-1.3-2.9-2.9-2.9l0,0L5.9,3.1C4.3,3.1,3,4.3,3,6v400.8c0,1.6,0.8,1.9,1.8,0.6\n\tl59.6-74.7l266.6-0.1C332.7,332.5,333.9,331.2,334,329.6z\"\/>\n<\/svg><\/div><div class=\"image_bottom_content\"><p>Dijaz Maric, QM &amp; Reliability Engineering Consultant<\/p>\n<\/div><\/div><div class=\"columns post_content small-12 medium-6 large-7\"><p>Do you want to learn more about the implementation of<strong> <a href=\"https:\/\/lorit-consultancy.com\/en\/standards\/automotive\/iso26262\/\" target=\"_blank\" rel=\"noopener\">ISO 26262<\/a>, <a href=\"https:\/\/lorit-consultancy.com\/en\/standards\/automotive\/iatf16949\/\" target=\"_blank\" rel=\"noopener\">IATF 16949<\/a>, or other standard in the <a href=\"https:\/\/lorit-consultancy.com\/en\/automotive\/\" target=\"_blank\" rel=\"noopener\">Automotive sector<\/a><\/strong>? We provide remote support and training to enhance your functional safety related projects. Please contact us at <strong><a href=\"mailto:info@lorit-consultancy.com\" target=\"_blank\" rel=\"noopener\">info@lorit-consultancy.com<\/a><\/strong>\u00a0for bespoke consultancy or join one of our\u00a0<strong><a href=\"https:\/\/lorit-consultancy.com\/en\/training\/\" target=\"_blank\" rel=\"noopener\">upcoming online courses<\/a><\/strong>.<\/p>\n<a class=\"add_logo_border\" target=\"_blank\" href=\"https:\/\/lorit-consultancy.com\/en\/standards\/automotive\/iso26262\/\"><span>Learn more<\/span><\/a><\/div><\/div><\/div><\/div><div class=\"single_content_section single_post_section content_section\"><div class=\"row\"><div class=\"post_content columns\">\n\r\n\r\n\r\n<h3 class=\"wp-block-heading\">Error guessing on hardware<\/h3>\r\n\r\n\r\n\r\n<p>This method can also be applied on hardware design level.<\/p>\r\n\r\n\r\n\r\n<p>Power supply errors:<\/p>\r\n\r\n\r\n\r\n<ul class=\"wp-block-list\">\r\n<li>Testing an item\u2019s response to power fluctuations<\/li>\r\n\r\n\r\n\r\n<li>Error guessing: Simulation of power surges, voltage drops, and transients to evaluate how the item controls those situations. Check of correct reaction, restart, safe state transition, if data is lost, or permanent damages occurs.<\/li>\r\n<\/ul>\r\n\r\n\r\n\r\n<p>Stress impact:<\/p>\r\n\r\n\r\n\r\n<ul class=\"wp-block-list\">\r\n<li>Assessing an item\u2019s performance under different temperature conditions<\/li>\r\n\r\n\r\n\r\n<li>Error Guessing: Expose the device to extreme temperatures, both high and low, and rapid temperature changes to see if it continues to function properly and if its components can withstand thermal stress.<\/li>\r\n<\/ul>\r\n\r\n\r\n\r\n<p>Startup and shutdown sequences:<\/p>\r\n\r\n\r\n\r\n<ul class=\"wp-block-list\">\r\n<li>Systems with specific startup and shutdown procedures<\/li>\r\n\r\n\r\n\r\n<li>Error guessing: Interrupting the startup or shutdown process, rapidly turning the system on and off, and checking if it recovers correctly or if there are any issues with data loss or corruption.<\/li>\r\n<\/ul>\r\n\r\n\r\n\r\n<p>Hardware-Software interaction:<\/p>\r\n\r\n\r\n\r\n<ul class=\"wp-block-list\">\r\n<li>Embedded systems with firmware<\/li>\r\n\r\n\r\n\r\n<li>Error Guessing: Loading different versions of firmware, intentionally using corrupted firmware, and updating firmware under various conditions (e.g., during operation or idle mode) to see how the system handles these scenarios.<\/li>\r\n<\/ul>\r\n\r\n\r\n\r\n<p>Above examples show how error guessing can be a useful technique in hardware testing allowing testers to leverage their experience and intuition to uncover potential errors and ensure robust and reliable hardware systems.<\/p>\r\n\r\n\r\n\r\n<p>Error guessing relies on lessons-learned and experience of the team. Semi-conductor producers often prepare failure\/ error catalogues for different blocks (digital\/ analogue) or different components and functions.<\/p>\r\n\r\n\r\n\r\n<h2 class=\"wp-block-heading\">Safety Mechanism Verification<\/h2>\r\n\r\n\r\n\r\n<p>At the end of this blog series, I would like to revisit the concept of equivalence classes and show how we could reduce the testing effort for the safety mechanism (SM) verification.<\/p>\r\n\r\n\r\n\r\n<p>In the image below we see a multi-channel battery monitor IC, which, among other things, is responsible for monitoring cell voltages. To reduce the testing effort for individual safety mechanisms we try to generate so-called equivalence classes and use one test to verify multiple SMs. Let&#8217;s assume the following SMs are present:<\/p>\r\n\r\n\r\n\r\n<ul class=\"wp-block-list\">\r\n<li>SM1: Measurement of the same cell voltage (C7) by ADC1 and ADC2 to check the cell voltage overlap, as a redundant measurement. SM1 shall check valid ranges of cell voltages.<\/li>\r\n\r\n\r\n\r\n<li>SM2: Redundant digital filter at ADC.<\/li>\r\n<\/ul>\r\n\r\n\r\n\r\n<p>We can define a set of tests that verify all three mentioned safety mechanisms. For example, when we test SM1, we can also verify SM2.<\/p>\r\n\r\n\r\n<div class=\"wp-block-image\">\r\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;69e5a5b4f2f3e&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"69e5a5b4f2f3e\" class=\"aligncenter size-full wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"1280\" height=\"678\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" class=\"wp-image-7784\" src=\"https:\/\/lorit-consultancy.com\/wp-content\/uploads\/2024\/06\/Img.2-Battery-monitor.png\" alt=\"\" srcset=\"https:\/\/lorit-consultancy.com\/wp-content\/uploads\/2024\/06\/Img.2-Battery-monitor.png 1280w, https:\/\/lorit-consultancy.com\/wp-content\/uploads\/2024\/06\/Img.2-Battery-monitor-1024x542.png 1024w, https:\/\/lorit-consultancy.com\/wp-content\/uploads\/2024\/06\/Img.2-Battery-monitor-768x407.png 768w\" sizes=\"auto, (max-width: 1280px) 100vw, 1280px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\taria-label=\"Enlarge\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.imageButtonRight\"\n\t\t\tdata-wp-style--top=\"state.imageButtonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewBox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\r\n<\/div>\r\n\r\n\r\n<h2 class=\"wp-block-heading\">In Conclusion<\/h2>\r\n\r\n\r\n\r\n<p>Equivalence classes, boundary values, error guessing, all those methods support you when defining your test cases for the verification process in ISO 26262. Which of them are useful, depends primarily on the risk analysis and the evaluated ASIL (automotive safety integrity level) of the item\/ system in question.<\/p>\r\n\r\n\r\n\r\n<p>I hope this blog helps you to better understand the methods discussed. If you want to learn more about the topic, feel free to contact us or book one of our courses on functional safety.<\/p>\r\n\r\n\r\n\r\n<p>By <a href=\"https:\/\/lorit-consultancy.com\/en\/about-us\/#dijaz-maric\">Dijaz Maric<\/a>, Quality Management &amp; Reliability Engineering Consultant<\/p>\r\n","protected":false},"excerpt":{"rendered":"<p>Equivalence classes &amp; Boundary values In the first part of this blog series, we talked about verification in ISO 26262 through the determination of equivalence classes. At this point, we would like to continue with the second instalment and explain further examples of the methods for defining tests. In addition to the already mentioned equivalence [&hellip;]<\/p>\n","protected":false},"author":11,"featured_media":7791,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[87,90,91,93],"tags":[],"class_list":["post-7777","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-functional-safety","category-reliability","category-safety","category-automotive"],"acf":[],"_links":{"self":[{"href":"https:\/\/lorit-consultancy.com\/en\/wp-json\/wp\/v2\/posts\/7777","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lorit-consultancy.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lorit-consultancy.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lorit-consultancy.com\/en\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/lorit-consultancy.com\/en\/wp-json\/wp\/v2\/comments?post=7777"}],"version-history":[{"count":11,"href":"https:\/\/lorit-consultancy.com\/en\/wp-json\/wp\/v2\/posts\/7777\/revisions"}],"predecessor-version":[{"id":8478,"href":"https:\/\/lorit-consultancy.com\/en\/wp-json\/wp\/v2\/posts\/7777\/revisions\/8478"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/lorit-consultancy.com\/en\/wp-json\/wp\/v2\/media\/7791"}],"wp:attachment":[{"href":"https:\/\/lorit-consultancy.com\/en\/wp-json\/wp\/v2\/media?parent=7777"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lorit-consultancy.com\/en\/wp-json\/wp\/v2\/categories?post=7777"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lorit-consultancy.com\/en\/wp-json\/wp\/v2\/tags?post=7777"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}