Modified condition/decision coverage
Modified condition/decision coverage (MC/DC), is used in the standard DO-178B to ensure that Level A software is tested adequately.
To satisfy the MC/DC coverage criterion, during testing all of the below must be true at least once[1]:
- Each decision tries every possible outcome
- Each condition in a decision takes on every possible outcome
- Each entry and exit point is invoked
- Each condition in a decision is shown to independently affect the outcome of the decision.
Independence of a condition is shown by proving that only one condition changes at a time.
The most critical (Level A) software, which is defined as that which could prevent continued safe flight and landing of an aircraft, must satisfy a level of coverage called modified condition/decision coverage (MC/DC).
Definitions
- Condition
- A condition is a leaf-level Boolean expression (it cannot be broken down into a simpler Boolean expression).
- Decision
- A Boolean expression composed of conditions and zero or more Boolean operators. A decision without a Boolean operator is a condition.
- Condition coverage
- Every condition in a decision in the program has taken all possible outcomes at least once.
- Decision coverage
- Every point of entry and exit in the program has been invoked at least once, and every decision in the program has taken all possible outcomes at least once.
- Condition/decision coverage
- Every point of entry and exit in the program has been invoked at least once, every condition in a decision in the program has taken all possible outcomes at least once, and every decision in the program has taken all possible outcomes at least once.
- Modified condition/decision coverage
- Every point of entry and exit in the program has been invoked at least once, every condition in a decision in the program has taken on all possible outcomes at least once, and each condition has been shown to affect that decision outcome independently. A condition is shown to affect a decision’s outcome independently by varying just that condition while holding fixed all other possible conditions. The condition/decision criterion does not guarantee the coverage of all conditions in the module because in many test cases, some conditions of a decision are masked by the other conditions. Using the modified condition/decision criterion, each condition must be shown to be able to act on the decision outcome by itself, everything else being held fixed. The MC/DC criterion is thus much stronger than the condition/decision coverage.
External links
References
- ^ Hayhurst, Kelly; Veerhusen, Dan; Chilenski, John; Rierson, Leanna (May 2001). "A Practical Tutorial on Modified Condition/ Decision Coverage". NASA. http://shemesh.larc.nasa.gov/fm/papers/Hayhurst-2001-tm210876-MCDC.pdf.