Model-in-the-Loop Engineering · Capstone brief
ENG-06 · Fault injection lab
When you inject named sensor faults into an approved loop, does the controller fail gracefully (detected, safe state) or silently (wrong output, no alarm)?
The question
When you inject named sensor faults into an approved loop, does the controller fail gracefully (detected, safe state) or silently (wrong output, no alarm)?
System / materials
Teacher-approved controller + sensor set. Fault list fixed by teacher (stuck-at, drift, dropout, scale error).
Expected failure modes
Only injecting faults the controller already ignores. No safe-state definition.
Done looks like
Fault matrix: fault type × detection time × safe state reached, with one silent-failure case honestly reported.
Five C's
CT: silent vs. loud failure. CR: choosing faults that matter. CO: peer injects one fault blind. CM: matrix a maintainer can scan. CZ: hazard if silent.
Mentor role
Controls engineer reviews fault list at Checkpoint 1 and matrix at Checkpoint 2. School-supervised.
Rubric calibration
R1: approved fault set. R2: injection procedure logged. R3: nominal baseline run. R4: silent failure addressed. R5: matrix complete. R6: no production system.
Two ways this goes wrong
(a) Only faults that trip obvious alarms. (b) Safe state undefined — “it stopped” is not a case.
Credit lane fit
Lane A immediately. No verified credit claim.