Code coverage

This article needs additional citations for verification. Please help improve this article by adding reliable references. Unsourced material may be challenged and removed. (May 2009)

Code coverage is a measure used in software testing. It describes the degree to which the source code of a program has been tested. It is a form of testing that inspects the code directly and is therefore a form of white box testing^[1]. Currently, the use of code coverage is extended to the field of digital hardware, the contemporary design methodology of which relies on Hardware description languages (HDLs).

Code coverage techniques were amongst the first techniques invented for systematic software testing. The first published reference was by Miller and Maloney in Communications of the ACM in 1963.

Code coverage is one consideration in the safety certification of avionics equipment. The standard by which avionics gear is certified by the Federal Aviation Administration (FAA) is documented in DO-178B.^[2]

Coverage criteria

To measure how well the program is exercised by a test suite, one or more coverage criteria are used.

Basic coverage criteria

There are a number of coverage criteria, the main ones being:^[3]

• Function coverage - Has each function (or subroutine) in the program been called?
• Statement coverage - Has each line of the source code been executed?
• Decision coverage (also known as branch coverage) - Has each control structure (such as an IF statement) evaluated both to true and false?
• Condition coverage (or predicate coverage) - Has each boolean sub-expression evaluated both to true and false? This does not necessarily imply decision coverage.
• Condition/decision coverage - Both decision and condition coverage should be satisfied.

For example, consider the following C++ function:

int foo(int a, int b)
{
    int c = b;
    if ((a>5) && (b>0)) {
        c = a;
    }
    return a*c;
}

Assume this function is a part of some bigger program and this program was run with some test suite. If during this execution function 'foo' was called at least one, then function coverage for this function is satisfied. Statement coverage for this function will be satisifed if it was called e.g. as 'foo(7,1)'. The tests with 'foo(7,1)' and 'foo(7,0)' calls will satisfy decision coverage. Condition coverage can be satisfied with tests, which do 'foo(7,1)', 'foo(7,0)' and 'foo(4,0)'.

In languages, like Pascal, where standard boolean operations are not short circuit, condition coverage is not necessary implies decision coverage. For example, consider the following fragment of code:

if a and b then

Condition coverage can be satified by two tests:

• a=true, b=false
• a=false, b=true

However, this set of tests doesn't satify decision coverage.

Modified condition/decision coverage

For safety-critical applications (e.g. for avionics software) it is often required that modified condition/decision coverage (MC/DC) is satisifed. This criteria extends condition/decision criteria with requirements that each condition should affect the decision outcome independently. For example, consider the following code:

if (a or b) and c then

The condition/decision criteria will be satisfied by the following set of tests:

• a=true, b=true, c=true
• a=false, b=false, c=false

However, the above tests set will not satisfy modified condition/decision coverage, since in the first test, the value of 'b' and in the second test the value of 'c' wouldn't influence the output. So, the following test set is needed to satisfy MC/DC:

• a=true, b=false, c=true
• a=false, b=true, c=true
• a=true, b=true, c=false

Multiple condition coverage

This criteria requires that all combinations of conditions inside each decision are tested. For example, the code fragment from previous section will require eight tests:

• a=false, b=false, c=false
• a=false, b=false, c=true
• a=false, b=true, c=false
• a=false, b=true, c=true
• a=true, b=false, c=false
• a=true, b=false, c=true
• a=true, b=true, c=false
• a=true, b=true, c=true

Other coverage criteria

There are further coverage criteria, which are used less often:

• Linear Code Sequence and Jump (LCSAJ) Coverage - has every LCSAJ been executed?
• JJ-Path coverage - have all jump to jump paths ^[4] (AKA LCSAJs) been executed?
• Path coverage - Has every possible route through a given part of the code been executed?
• Entry/exit coverage - Has every possible call and return of the function been executed?

Safety-critical applications are often required to demonstrate that testing achieves 100% of some form of code coverage.

Some of the coverage criteria above are connected. For instance, path coverage implies decision, statement and entry/exit coverage. Decision coverage implies statement coverage, because every statement is part of a branch.

Full path coverage, of the type described above, is usually impractical or impossible. Any module with a succession of n decisions in it can have up to 2ⁿ paths within it; loop constructs can result in an infinite number of paths. Many paths may also be infeasible, in that there is no input to the program under test that can cause that particular path to be executed. However, a general-purpose algorithm for identifying infeasible paths has been proven to be impossible (such an algorithm could be used to solve the halting problem)^[5]. Techniques for practical path coverage testing instead attempt to identify classes of code paths that differ only in the number of loop executions, and to achieve "basis path" coverage the tester must cover all the path classes.

Code coverage in practice

The target software is built with special options or libraries and/or run under a special environment such that every function that is exercised (executed) in the program(s) is mapped back to the function points in the source code. This process allows developers and quality assurance personnel to look for parts of a system that are rarely or never accessed under normal conditions (error handling and the like) and helps reassure test engineers that the most important conditions (function points) have been tested. The resulting output is then analysed to see what areas of code have not been exercised and the tests are updated to include these areas as necessary. Combined with other code coverage methods, the aim is to develop a rigorous, yet manageable, set of regression tests.

In implementing code coverage policies within a software development environment one must consider the following:

• What are coverage requirements for the end product certification and if so what level of code coverage is required. The typical level of rigor progression is as follows: Statement, Branch/Decision, Modified Condition/Decision Coverage(MC/DC), LCSAJ (Linear Code Sequence and Jump)
• Will code coverage be measured against tests that verify requirements levied on the system under test (DO-178B)
• Is the object code generated directly traceable to source code statements. Certain certifications,(ie. DO-178B Level A) require coverage at the assembly level if this is not the case, "Then, additional verification should be performed on the object code to establish the correctness of such generated code sequences" DO-178B) para-6.4.4.2 ^[6].

Test engineers can look at code coverage test results to help them devise test cases and input or configuration sets that will increase the code coverage over vital functions. Two common forms of code coverage used by testers are statement (or line) coverage and path (or edge) coverage. Line coverage reports on the execution footprint of testing in terms of which lines of code were executed to complete the test. Edge coverage reports which branches or code decision points were executed to complete the test. They both report a coverage metric, measured as a percentage. The meaning of this depends on what form(s) of code coverage have been used, as 67% path coverage is more comprehensive than 67% statement coverage.

Generally, code coverage tools and libraries exact a performance and/or memory or other resource cost which is unacceptable to normal operations of the software. Thus, they are only used in the lab. As one might expect, there are classes of software that cannot be feasibly subjected to these coverage tests, though a degree of coverage mapping can be approximated through analysis rather than direct testing.

There are also some sorts of defects which are affected by such tools. In particular, some race conditions or similar real time sensitive operations can be masked when run under code coverage environments; and conversely, some of these defects may become easier to find as a result of the additional overhead of the testing code.

Software code coverage tools

• Atlassian Clover - a Java code coverage and test visualization tool which also displays coverage per-test. Free for open source projects
• BullseyeCoverage - C and C++ code coverage tool
• Cobertura - a free Java tool that calculates the percentage of code accessed by tests
• CodeCover - Java / Cobol code coverage tool for use by shell in win / linux, Apache ant script, or as Eclipse-Plugin (including boolean analyzer and correlation matrix), XML Reports
• Devel::Cover - Code coverage metrics for Perl
• EMMA - a free Java code coverage tool
• gcov - Code coverage test for GCC compiler
• gcov-kernel - gcov support for the Linux kernel
• ggcov - GTK+ GUI for gcov
• IBM OLIVER (CICS interactive test/debug), application program test/debugging and code coverage tool for IBM CICS
• Insure++ - a coverage of source code of application tested with functional tests.
• iSYSTEM winIDEA - measures coverage on a wide variety of embedded processors. It works by recoding execution directly on hardware, without instrumenting code or modifying the program and in real-time.
• LDRA Testbed measures statement coverage, branch/decision coverage, LCSAJ Coverage, procedure/function call coverage, branch condition coverage, branch condition combination coverage and modified condition decision coverage (MC/DC) for DO-178B Level A.
• Jtest, C++test, .Test - calculate percentage of code covered by tests.
• lcov - Web UI for gcov
• NCover - .Net code coverage tool with cyclomatic complexity
• PartCover - .NET 2.0 code coverage tool
• python-coverage - Code coverage for Python
• rcov - Code coverage for Ruby
• Semantic Designs Test Coverage tools for C, C++, C#, Java, COBOL and PHP
• shcov - Code coverage collection and visulization for shell scripts
• SIMON (Batch Interactive test/debug), batch application program test/debugging and code coverage tool
• Sonar - Sonar collects, analyzes and reports metrics on source code. Includes consolidated reporting on and across projects throughout time.
• Tessy - code coverage for embedded software in C/C++. Branch/decision coverage, MC/DC, multiple condition coverage. Coverage is measured during unit testing.
• Testwell CTC++ measures all coverage levels up to modified condition coverage including modified condition decision coverage (MC/DC) for C, C++, Java and C# (all compilers and all embedded targets).
• Trucov - Code coverage analysis tool for the GCC compiler that displays control flow graphs.
• VB Watch - Visual Basic code coverage and performance analysis tool
• XDebug - PHP debugging tool, including code coverage
• Xpediter - A Mainframe testing tool, including code coverage

Hardware code coverage tools

• Aldec
• Cadence Design Systems
• JEDA Technologies
• Mentor Graphics
• Nusym Technology
• Synopsys

See also

Software Testing portal

• Mutation testing
• Software metric
• Regression testing
• Static code analysis
• White box testing
• Modified Condition/Decision Coverage
• Linear Code Sequence and Jump
• Intelligent verification
• Cyclomatic complexity

Notes

External links

• Code Coverage Analysis by Steve Cornett
• Introduction to Code Coverage
• Don't be fooled by the coverage report
• Systematic mistake analysis of digital computer programs