diff --git a/tools/analysis/data-aggregator/CMakeLists.txt b/tools/analysis/data-aggregator/CMakeLists.txt
index 06dec286..30b50d98 100644
--- a/tools/analysis/data-aggregator/CMakeLists.txt
+++ b/tools/analysis/data-aggregator/CMakeLists.txt
@@ -1,10 +1,16 @@
 install(PROGRAMS
 fail-analysis-common.inc.sh
+function-occurrences-onwrite.sh
 function-occurrences.sh
 resulttype-occurrences_coverage.sh
+resulttype-occurrences-onwrite_coverage.sh
+resulttype-occurrences-onwrite.sh
 resulttype-occurrences.sh
 symbol-occurrences_coverage.sh
+symbol-occurrences-onwrite_coverage.sh
+symbol-occurrences-onwrite.sh
 symbol-occurrences.sh
+translation-unit-occurrences-onwrite.sh
 translation-unit-occurrences.sh
 variant-durations.sh
 DESTINATION bin)
diff --git a/tools/analysis/data-aggregator/function-occurrences-onwrite.sh b/tools/analysis/data-aggregator/function-occurrences-onwrite.sh
new file mode 100755
index 00000000..4240bdd6
--- /dev/null
+++ b/tools/analysis/data-aggregator/function-occurrences-onwrite.sh
@@ -0,0 +1,48 @@
+#!/bin/bash
+
+show_description() {
+cat >&2 <<EOT
+This script calculates the per-function absolute result count (EAFC) for the
+"inject-on-write" fault model, which assumes that writes to memory can get
+corrupted, and completely disregards storage duration (e.g. time between write
+and subsequent read).  The metric is calculated from the results of a normal
+"inject-on-read" campaign, only using the FI results from memory accesses that
+directly follow a "write" access.
+EOT
+}
+MUST_FILTER=1
+source $(dirname $0)/fail-analysis-common.inc.sh
+
+# This implementation makes sure the write -- not the subsequent memory access
+# that determines the result type -- happens in the context of the
+# corresponding function.
+#
+# Currently does not take into account right-margin writes, i.e. those
+# that are not followed by *any* memory access.  This is mostly OK as
+# import-trace creates synthetic 'write' events at the right margin for
+# all but those memory accesses that are exactly on the right margin
+# already.
+$MYSQL << EOT
+SELECT v.benchmark, v.variant, s.name, s.address, r.resulttype, SUM(t.width) AS occurrences
+FROM variant v
+JOIN symbol s
+	ON s.variant_id = v.id
+JOIN trace tw
+	ON tw.variant_id = s.variant_id
+	AND tw.instr2_absolute BETWEEN s.address AND s.address + s.size - 1
+	AND tw.accesstype = 'W'
+JOIN trace t
+	ON t.variant_id = s.variant_id
+	AND t.data_address = tw.data_address
+	AND tw.instr2 + 1 = t.instr1
+JOIN fspgroup g
+	ON g.variant_id = t.variant_id
+	AND g.data_address = t.data_address
+	AND g.instr2 = t.instr2
+JOIN result_GenericExperimentMessage r
+	ON r.pilot_id = g.pilot_id
+WHERE $FILTER
+GROUP BY s.variant_id, s.address, r.resulttype
+ORDER BY s.address, r.resulttype
+;
+EOT
diff --git a/tools/analysis/data-aggregator/resulttype-occurrences-onwrite.sh b/tools/analysis/data-aggregator/resulttype-occurrences-onwrite.sh
new file mode 100755
index 00000000..e6e27868
--- /dev/null
+++ b/tools/analysis/data-aggregator/resulttype-occurrences-onwrite.sh
@@ -0,0 +1,40 @@
+#!/bin/bash
+
+show_description() {
+cat >&2 <<EOT
+This script calculates the global absolute result count (EAFC) for the
+"inject-on-write" fault model, which assumes that writes to memory can get
+corrupted, and completely disregards storage duration (e.g. time between write
+and subsequent read).  The metric is calculated from the results of a normal
+"inject-on-read" campaign, only using the FI results from memory accesses that
+directly follow a "write" access.
+EOT
+}
+source $(dirname $0)/fail-analysis-common.inc.sh
+
+# Currently does not take into account right-margin writes, i.e. those
+# that are not followed by *any* memory access.  This is mostly OK as
+# import-trace creates synthetic 'write' events at the right margin for
+# all but those memory accesses that are exactly on the right margin
+# already.
+$MYSQL << EOT
+SET sql_mode = 'NO_UNSIGNED_SUBTRACTION';
+SELECT v.benchmark, v.variant, r.resulttype, SUM(t.width) AS occurrences
+FROM result_GenericExperimentMessage r
+INNER JOIN fspgroup g
+	ON g.pilot_id = r.pilot_id
+INNER JOIN trace t
+	ON g.instr2 = t.instr2
+	AND g.data_address = t.data_address
+	AND g.variant_id = t.variant_id
+INNER JOIN trace tw
+	ON t.instr1 = tw.instr2 + 1
+	AND t.data_address = tw.data_address
+	AND t.variant_id = tw.variant_id
+	AND tw.accesstype = 'W'
+INNER JOIN variant v
+	ON t.variant_id = v.id
+WHERE $FILTER
+GROUP BY v.id, r.resulttype
+ORDER BY v.benchmark, v.variant, r.resulttype;
+EOT
diff --git a/tools/analysis/data-aggregator/resulttype-occurrences-onwrite_coverage.sh b/tools/analysis/data-aggregator/resulttype-occurrences-onwrite_coverage.sh
new file mode 100755
index 00000000..4ebdeddb
--- /dev/null
+++ b/tools/analysis/data-aggregator/resulttype-occurrences-onwrite_coverage.sh
@@ -0,0 +1,58 @@
+#!/bin/bash
+
+show_description() {
+cat >&2 <<EOT
+This script calculates the fault-coverage factor for the "inject-on-write"
+fault model, which assumes that writes to memory can get corrupted, and
+completely disregards storage duration (e.g. time between write and subsequent
+read).  The metric is calculated from the results of a normal "inject-on-read"
+campaign, only using the FI results from memory accesses that directly follow a
+"write" access.
+EOT
+}
+source $(dirname $0)/fail-analysis-common.inc.sh
+
+# Currently does not take into account right-margin writes, i.e. those
+# that are not followed by *any* memory access.  This is mostly OK as
+# import-trace creates synthetic 'write' events at the right margin for
+# all but those memory accesses that are exactly on the right margin
+# already.
+$MYSQL << EOT
+SET sql_mode = 'NO_UNSIGNED_SUBTRACTION';
+SELECT v.benchmark, v.variant, r.resulttype,
+	SUM(t.width)
+		/
+	(SELECT SUM(t.width)
+	FROM result_GenericExperimentMessage r
+	INNER JOIN fspgroup g
+		ON g.pilot_id = r.pilot_id
+	INNER JOIN trace t
+		ON g.instr2 = t.instr2
+		AND g.data_address = t.data_address
+		AND g.variant_id = t.variant_id
+	INNER JOIN trace tw
+		ON t.instr1 = tw.instr2 + 1
+		AND t.data_address = tw.data_address
+		AND t.variant_id = tw.variant_id
+		AND tw.accesstype = 'W'
+	WHERE t.variant_id = v.id -- refers to parent query
+	) AS coverage
+FROM result_GenericExperimentMessage r
+INNER JOIN fspgroup g
+	ON g.pilot_id = r.pilot_id
+INNER JOIN trace t
+	ON g.instr2 = t.instr2
+	AND g.data_address = t.data_address
+	AND g.variant_id = t.variant_id
+INNER JOIN trace tw
+	ON t.instr1 = tw.instr2 + 1
+	AND t.data_address = tw.data_address
+	AND t.variant_id = tw.variant_id
+	AND tw.accesstype = 'W'
+INNER JOIN variant v
+	ON t.variant_id = v.id
+WHERE $FILTER
+GROUP BY v.id, r.resulttype
+ORDER BY v.benchmark, v.variant, r.resulttype
+;
+EOT
diff --git a/tools/analysis/data-aggregator/symbol-occurrences-onwrite.sh b/tools/analysis/data-aggregator/symbol-occurrences-onwrite.sh
new file mode 100755
index 00000000..60d5b60e
--- /dev/null
+++ b/tools/analysis/data-aggregator/symbol-occurrences-onwrite.sh
@@ -0,0 +1,38 @@
+#!/bin/bash
+
+show_description() {
+cat >&2 <<EOT
+This script calculates the per-symbol absolute result count (EAFC) for the
+"inject-on-write" fault model, which assumes that writes to memory can get
+corrupted, and completely disregards storage duration (e.g. time between write
+and subsequent read).  The metric is calculated from the results of a normal
+"inject-on-read" campaign, only using the FI results from memory accesses that
+directly follow a "write" access.
+EOT
+}
+source $(dirname $0)/fail-analysis-common.inc.sh
+
+$MYSQL << EOT
+SELECT v.benchmark, v.variant, s.name, s.size, r.resulttype, SUM(t.width) AS occurrences
+FROM variant v
+JOIN symbol s
+	ON v.id = s.variant_id
+JOIN trace tw
+	ON tw.variant_id = v.id
+	AND tw.data_address BETWEEN s.address AND s.address + s.size - 1
+	AND tw.accesstype = 'W'
+JOIN trace t
+	ON t.variant_id = v.id
+	AND t.instr1 = tw.instr2 + 1
+	AND t.data_address = tw.data_address
+JOIN fspgroup g
+	ON t.variant_id = g.variant_id
+	AND t.data_address = g.data_address
+	AND t.instr2 = g.instr2
+JOIN result_GenericExperimentMessage r
+	ON r.pilot_id = g.pilot_id
+WHERE $FILTER
+GROUP BY v.id, s.name, r.resulttype
+ORDER BY v.benchmark, v.variant, s.name, r.resulttype
+;
+EOT
diff --git a/tools/analysis/data-aggregator/symbol-occurrences-onwrite_coverage.sh b/tools/analysis/data-aggregator/symbol-occurrences-onwrite_coverage.sh
new file mode 100755
index 00000000..40de8756
--- /dev/null
+++ b/tools/analysis/data-aggregator/symbol-occurrences-onwrite_coverage.sh
@@ -0,0 +1,47 @@
+#!/bin/bash
+
+source $(dirname $0)/fail-analysis-common.inc.sh
+
+$MYSQL << EOT
+SELECT v.benchmark, v.variant, s.name, s.size, r.resulttype,
+	SUM(t.width)
+		/
+	(SELECT SUM(t.width)
+	FROM symbol s
+	JOIN trace tw
+		ON tw.variant_id = s.variant_id
+		AND tw.data_address BETWEEN s.address AND s.address + s.size - 1
+		AND tw.accesstype = 'W'
+	JOIN trace t
+		ON t.variant_id = tw.variant_id
+		AND t.data_address = tw.data_address
+		AND t.instr1 = tw.instr2 + 1
+	JOIN fspgroup g
+		ON t.variant_id = g.variant_id
+		AND t.data_address = g.data_address
+		AND t.instr2 = g.instr2
+	JOIN result_GenericExperimentMessage r
+		ON r.pilot_id = g.pilot_id
+	WHERE t.variant_id = v.id -- refers to parent query
+	) AS coverage
+FROM variant v
+JOIN symbol s
+	ON v.id = s.variant_id
+JOIN trace tw
+	ON tw.variant_id = v.id
+	AND tw.data_address BETWEEN s.address AND s.address + s.size - 1
+	AND tw.accesstype = 'W'
+JOIN trace t
+	ON t.variant_id = v.id
+	AND t.data_address = tw.data_address
+	AND t.instr1 = tw.instr2 + 1
+JOIN fspgroup g
+	ON t.variant_id = g.variant_id
+	AND t.data_address = g.data_address
+	AND t.instr2 = g.instr2
+JOIN result_GenericExperimentMessage r
+	ON r.pilot_id = g.pilot_id
+WHERE $FILTER
+GROUP BY v.id, s.name, r.resulttype
+ORDER BY v.benchmark, v.variant, s.name, r.resulttype;
+EOT
diff --git a/tools/analysis/data-aggregator/translation-unit-occurrences-onwrite.sh b/tools/analysis/data-aggregator/translation-unit-occurrences-onwrite.sh
new file mode 100755
index 00000000..86817d2f
--- /dev/null
+++ b/tools/analysis/data-aggregator/translation-unit-occurrences-onwrite.sh
@@ -0,0 +1,40 @@
+#!/bin/bash
+
+source $(dirname $0)/fail-analysis-common.inc.sh
+
+# This implementation makes sure the write -- not the subsequent memory access
+# that determines the result type -- happens in the context of the
+# corresponding translation unit.
+#
+# Currently does not take into account right-margin writes, i.e. those
+# that are not followed by *any* memory access.  This is mostly OK as
+# import-trace creates synthetic 'write' events at the right margin for
+# all but those memory accesses that are exactly on the right margin
+# already.
+$MYSQL << EOT
+SELECT v.benchmark, v.variant, f.path, r.resulttype, SUM(t.width) AS occurrences
+FROM variant v
+JOIN dbg_filename f
+	ON f.variant_id = v.id
+JOIN dbg_mapping m
+	ON f.variant_id = m.variant_id
+	AND f.file_id = m.file_id
+JOIN trace tw
+	ON tw.variant_id = m.variant_id
+	AND tw.instr2_absolute BETWEEN m.instr_absolute AND m.instr_absolute + m.line_range_size - 1
+	AND tw.accesstype = 'W'
+JOIN trace t
+	ON t.variant_id = tw.variant_id
+	AND t.instr1 = tw.instr2 + 1
+	AND t.data_address = tw.data_address
+JOIN fspgroup g
+	ON g.variant_id = t.variant_id
+	AND g.data_address = t.data_address
+	AND g.instr2 = t.instr2
+JOIN result_GenericExperimentMessage r
+	ON r.pilot_id = g.pilot_id
+WHERE $FILTER
+GROUP BY v.id, f.file_id, r.resulttype
+ORDER BY v.benchmark, v.variant, f.path, r.resulttype
+;
+EOT