Why on earth would you want just branch coverage?
As a programming language C has short circuiting logic operators. Implicitly when you use them in the condition of a conditional expression, you are going to get branching in addition to the branching associated with the conditional statement. Best to think of things as nested conditional statements achieved by the language syntax. As a consequence you may get statement level branch coverage, but you may just never execute the entire code. The FAA has a CAST paper (CAST 10) titled "What is a "Decision" in Application of Modified Condition/Decision Coverage (MC/DC) and Decision Coverage (DC)?" It is intended to address the interaction between the concept of branch coverage and the actual branching which occurs complements of the compilier. Dave Lightstone From: [email protected] [mailto:klee-dev-bounces at keeda.stanford.edu] On Behalf Of Giuseppe Di Guglielmo Sent: Monday, November 01, 2010 6:11 AM To: klee-dev at keeda.stanford.edu Subject: [klee-dev] Maximizing Branch Coverage (not path coverage) Hi, is there a way to run the KLEE for maximizing the branch coverage rather than exhaustively enumerating all the possible paths? For example, consider the code: if (cond1) { // A } else { // B } if (cond2) { // C } else { // D } there are 4 paths 1. A; C; 2. A; D; 3. B; C; 4. B; D; but satisfying the two conditions 1. ( conv1) && ( conv2 ) 2. ( !conv1 ) && ( !conv2 ) is enough to guarantee 100%-branch coverage. Does KLEE support such an approach? Thanks, G. -------------- next part -------------- An HTML attachment was scrubbed... URL: http://keeda.Stanford.EDU/pipermail/klee-dev/attachments/20101101/1670f9f8/attachment.html
