DD3-LoRa-Bridge-MultiSender/docs/engineering/hil-test-matrix.md

DD3 HIL test matrix

Area	Stimulus	Required evidence	Expected result
Boot	Flash/start both boards	boot, role, periodic health from each	Exactly one sender and receiver; no reset loop; bounded heap/stack
Time	Sender receive window and receiver startup time-sync burst	sender request/completion, receiver startup transmit	Valid UTC completion during the 180 s baseline; misses remain visible
Meter baseline	Real optical meter	meter_frame, meter_sample	Frame classification and seconds index when present; no secrets/values logged
Batch	Normal 30 s batching	create, encode, every TX/RX chunk, complete, decode, ACK TX/RX	One batch ID correlates end to end
Meter timeout	Partial start then >1.5 s pause	classification=timeout, health	No reset; next valid fixture recovers
Meter malformed	Each parser fixture then valid	failure/partial classification, then valid	No reset; failure is not treated as valid evidence
Meter time	rollback/jump seconds fixtures	meter_time rollback/jump	Diagnostic classification; subsequent valid frame recovers
Oversize/slow	>512-byte or slow fixture	oversized or valid event, health	Bounded buffers and continued operation
Drop chunk	drop_chunk once	incomplete transfer, retry, later complete/ACK	Incomplete batch is not decoded; retry recovers
Duplicate chunk	duplicate_chunk once	duplicate/incomplete diagnostic, retry, later ACK	No double publication; transfer recovers
Corrupt chunk	post-CRC byte flip once	lora_reject=crc_fail, retry, later ACK	CRC rejects frame; incomplete batch not decoded
Suppress ACK	suppress one ACK response	receiver suppression, sender timeout/retry, later ACK	Retry count increments and recovers
Delay ACK	delay one ACK response	delay event and ACK/retry timing	No crash/deadlock; transfer recovers
Wrong ACK ID	altered batch ID once	sender rejected ack_rx, retry, correct ACK	Incorrect ACK cannot complete inflight batch

For every fault case, compare health events before and after injection, require a later successful ACK, and inspect raw logs for resets. MQTT duplicate-publication evidence may require a separately approved broker observer; without it, report that assertion as blocked rather than inferring success solely from radio logs.