Decision Coverage / Branch Coverage

Decision Coverage Metric Definition

Here Coco verifies that all statements are executed and all decisions have all possible results. The coverage of a program is the number of executed statement blocks and decisions divided by the total number of statements and decisions – where each decision counts twice, once for the true case and one for the false case.

Comparison to Statement Coverage

Decision Coverage can reveal insights in cases where Statement Coverage does not detect a missing test:

if (p) {
    p->invoke();
}

A single test (with a non-null p) covers all statements. There’s an “invisible” branch, however. What if p is null? A second test is required albeit no concrete statement will be hit.

Weakness of Decision Coverage

Only the outcome of a decision needs to be tested. Boolean expressions leading to the decision are not considered:

if (a && b) {
    // do something
}

Condition Coverage metrics like MC/DC address this weakness.

Relevance for Safety Standards

ISO 26262 recommends Branch Coverage for ASIL A and highly recommends the method for ASIL B, C and D.

EN 50128 recommends Branch Coverage for SIL 1 and 2. For SIL 3 and 4 this level is even highly recommended.

DO 178C mandates that Decision Coverage should be satisfied with independence for Software Level A and B.

IEC 61508 recommends Branch Coverage for SIL 1 and 2 and highly recommends this level for SIL 3 and 4.