Statement Coverage

10.2.1 Statement Coverage

The statement coverage criterion provides for generating sufficient test data to execute each statement of the candidate program at least once. This is a very weak criterion, since the only faults it is likely to expose are those that are so egregious that any exe- cution of the faulty statement will cause an error, and that the error is so extensive that it will propagate and cause a failure; by statement, this criterion usually refers to ele- mentary statements, typically assignment statements and atomic system calls. This criterion can also be applied at a higher level of abstraction than the elementary state- ment, and calls for exercising all the components of a composite system, with the same qualification: it can only expose faulty components that are so egregiously faulty that any execution of these components will sensitize their fault and subsequently prop- agate the resulting error to cause failure. Because this criterion is so weak, a single path may, conceivably, satisfy it, in some simple cases.

As an illustration, we consider the following simple program g:

{int x; int y; read(x); read(y); // assuming x>0, y>0 while (x!=y) {if (x>y) {x=x-y;} else {y=y-x;}}; write(x);}

10.2 CONTROL FLOW COVERAGE 203

Execution of the following path through the program will exercise all the elementary statements:

p: int x; int y; // F0 read(x); read(y);

// F1 ((x!=y)? true); ((x>y)? true); {x=x-y;} // F2 ((x!=y)? true); ((x>y)? false); {y=y-x;} // F3 ((x!=y)? false);

// F4 {write(x);

// F5

The effect of F0 is to let the space of the program be defined by variables is and os of type file stream and variables x and y of type integer; all subsequent functions will

be defined on this space. We find: F 1 = s,s length is ≥ 2 x = head is y = head tail is

is = tail 2 is os = os

The product of F 2 by F 3 yields:

F 2 • F 3 = s,s x > y x −y < y x = x−y y = 2y−x is = is os = os

Whence, the product of F 2 • F 3 by F 4 yields:

F 2 • F 3 • F 4 = s,s x > y x −y < y x = x−y y = 2y−x is = is os = os x = y which we simplify to become:

F 2 • F 3 • F 4 = s,s 2x = 3y x = x−y y = x is = is os = os

Multiplying on the left by F 1 , we find

F 1 • F 2 • F 3 • F 4 = s,s length is ≥ 2 2 × head is = 3 × head tail is

x = head is −head tail is y=x is = tail 2 is os = os

Multiplying on the right by F 5 , we find PF 1 • F 2 • F 3 • F 4 • F 5 = s,s length is ≥ 2 2 × head is = 3 × head tail is

x = head is −head tail is

y=x is = tail 2 is os = os x

204 STRUCTURAL CRITERIA

The domain of this function is: dom P = s,s length is ≥ 2 2 × head is = 3 × head tail is Any element of this domain is a possible test data that satisfies the criterion of

statement coverage; we choose the initial state s defined by:

is = 21,14 os = x= y=

Even though a single path (and a single element in the domain of the path) enabled us to satisfy the criterion of statement coverage, it may be beneficial, in practice, to cover different statements with different paths (whenever possible) to minimize the likelihood of error masking (the longer the path, the more likely it is for an error to be masked). To this effect, we may satisfy the statement coverage with the following two paths:

p1: int x; int y; // F0 read(x); read(y);

// F1 ((x!=y)? true); ((x>y)? true); {x=x-y;}

// F2 ((x!=y)? false);

// F3 {write(x);

// F4 p2: int x; int y;

// F0 read(x); read(y);

// F1 ((x!=y)? true); ((x>y)? false); {y=y-x;} // F2 ((x!=y)? false);

// F3 {write(x);

// F4

We leave it as an exercise to the reader to generate test data from these two paths.