Software Testing

MC/DC Testing

Prof. M.S. Prasad

This lecture is based on Safety critical software development and testing techniques available
on open literature. It is suitable for M.Tech ( Avionics) students.
 MC/DC Testing DO 178 B
MC/DC is defined in DO-178B/ED-12B, -“Software Considerations in Airborne Systems and
Equipment Certification”, dated December 1, 1992.

Definition of MC/DC:
(1) Every point of entry and exit in the program has been invoked at least once
(2) Every condition in a decision in the program has taken all possible outcomes at least once
(3) Every decision in the program has taken all possible outcomes at least once
(4) Each condition in a decision has been shown to independently affect that decision's
outcome. A condition is shown to independently affect a decision's outcome by varying just
that condition while holding fixed all other possible conditions.

Decision Coverage

Decision coverage requires two test cases: one for a true outcome and another for a false
outcome.
For simple decisions (i.e., decisions with a single condition), decision coverage ensures
complete testing of control constructs. But, not all decisions are simple. For the decision (A or
B), test cases (TF) and (FF) will toggle the decision outcome between true and false. However,
the effect of B is not tested; that is, those test cases cannot distinguish between the decision (A
or B) and the decision A.

Condition Coverage

Condition coverage requires that each condition in a decision take on all possible outcomes at
least once (to overcome the problem in the previous example), but does not require that the
decision take on all possible outcomes at least once. In this case, for the decision(A or B) test
cases (TF) and (FT) meet the coverage criterion, but do not cause the decision to take on all
possible outcomes. As with decision coverage, a minimum of two tests cases is required for
each decision.

Condition Decision Coverage

Condition/decision coverage combines the requirements for decision coverage with those for
condition coverage. That is, there must be sufficient test cases to toggle the decision outcome
between true and false and to toggle each condition value between true and false. Hence, a
minimum of two test cases are necessary for each decision. Using the example (A or B), test
cases (TT) and (FF) would meet the coverage requirement. However, these two tests do not
distinguish the correct expression (A or B) from the expression A or from the expression B or
from the expression (A and B).

Avionics Software Testing # m s prasad Page 1

Modified Condition Decision Coverage
The MC/DC criterion enhances the condition/decision coverage criterion by requiring that each
condition be shown to independently affect the outcome of the decision. The independence
requirement ensures that the effect of each condition is tested relative to the other conditions.
However, achieving MC/DC requires more thoughtful selection of the test cases, in general, a
minimum of n+ 1 test cases for a decision with n inputs. For the example (A or B), test cases
(TF), (FT), and (FF) provide MC/DC. For decisions with a large number of inputs, MC/DC
requires considerably more test cases than any of the coverage measures discussed above.

Multiple Condition Coverage

Finally, multiple condition coverage requires test cases that ensure each possible combination
of inputs to a decision is executed at least once; that is, multiple condition coverage requires
exhaustive testing of the input combinations to a decision. In theory, multiple condition
coverage is the most desirable structural coverage measure; but, it is impractical for many
cases. For a decision with n inputs, multiple condition coverage requires 2n tests.
 MC / DC criteria is stronger than Condition /Decision.
 100% MC/DC will gurantee that each simple condition will not be masked by the other
condition. For Example a situation as X < 0 Or Y < 0 then if X= -1 then X<0 is true , and
condition Y<0 is masked since it is always true irrespective of Y condition.

Testing Criterias

Coverage Statement Decision Condition Condition/Decision MC/DC Multiple

Criteria Coverage coverage Coverage Coverage Condition
Coverage
Every point of -------     
Entry & exit
has been
invoked
Every stmt has  --
been
executed once
Every decision    
has taken all
possible
outcome once
All condition    
has taken all
posible
outcomes
Every  
condition has
been shown
independently
affecting the
decision

Avionics Software Testing # m s prasad Page 2

MC/DC Examples
Simple example code .

if ( ( A ||B) && C)

{ /* stmt 1

} else

{ /* stmt 2

Here A, B and C represent atomic boolean expressions (i.e. not divisible in other
boolean sub-expressions).

In order to ensure Condition coverage criteria for this example, A, B and C should be
evaluated at least one time "true" and one time "false" during tests, which would be the
case with the 2 following tests:
A = true / B = true / C = true
A = false / B = false / C = false

In order to ensure Decision coverage criteria, the condition ( (A or B) and C ) should

also be evaluated at least one time to "true" and one time to "false". Indeed, in our
previous test cases:
A = true / B = true / C = true ---> decision evaluates "true"
A = false / B = false / C = false ---> decision evaluates "false"

However, these two tests do not ensure a Modified condition/decision

coverage which implies that each boolean variable should be evaluated one time to
"true" and one time to "false", and this with affecting the decision's outcome. It means
that from a test case to another, changing the value of only one atomic condition will
also change the decision's outcome; although with only the two previous tests, it is
impossible to know which condition influences the decision's evaluation...
In practice, for a decision with n atomic boolean conditions, we have to find at
least n+1 tests in order to be able to ensure Modified condition/decision coverage. As
there are 3 atomic boolean conditions (A, B et C) in our example, we can (for instance)
choose the following set of tests:
A = false / B = false / C = true ---> decision is evaluated to "false"
A = false / B = true / C = true ---> decision is evaluated to "true"
A = false / B = true / C = false ---> decision is evaluated to "false"

Avionics Software Testing # m s prasad Page 3

 A = true / B = false / C = true ---> decision is evaluated to "true"
Indeed, in this case:
 Between the 1 st and 4 th test scenarios, only A changed of value, which also made the
decision's outcome change its value ("false" in the 1 st case, "true" in the 2 nd);
 Between 1 st and 2 nd, only B changed of value, which also made the decision's outcome
change its value (passing from "false" to "true");
 Between 2 nd and 3 rd, only C changed of value and decision's outcome's value also
changed (passing from "true" to "false").

Besides, Decision and Condition coverage criteria are still respected (each boolean
variable and the decision's outcome itself take at least one time the "true" and "false"
values). The Modified condition/decision coverage is then ensured.

Example 2
Assume we replace the condition: ((A||B)&&C)
by: (((u == 0) || (x>5)) && ((y<6) || (z == 0)))
A full Test Coverage would consist into building the following truth table and testing
each combination:

Test case n A: (u B: C: D: (z ( (A || B) &&

== 0) (x>5) (y<6) == 0) (C || D) )
1 F F F F F
2 F F F T F
3 F F T _ F
4 F T F F F
5 F T F T T
6 F T T _ T
7 T _ F F F
8 T _ F T T
9 T _ T _ T
Example 3
Considering the following code:
Int isReadyToTakeOff (int a, int b, int c, int d)
{ if(((a == 1) ||(b == 1)) && ((c == 1) || (d == 1)))
return 1; else return 0;
}

Avionics Software Testing # m s prasad Page 4

----------------------------------------------------------------------------------------------------------------

Avionics Software Testing # m s prasad Page 5