Beyond MC/DC Coverage Testing

In the last 5 years, the Back-to-Back testing approach became very popular in the automotive domain and could be applied successfully. One reason is the trend to subsume all development and test activities to a higher abstraction layer, the model level. Another reason is the introduction of the ISO 26262 standard, which recommends the back-to-back testing approach to assure equal behavior between model and code for functional safety reasons. Several coverage criteria like Decision Coverage (DC) and Modified Condition/Decision Coverage (MC/DC) are state-of-the art for back-to-back testing. But due to the fact that not all internal signals are available for comparison due to missing visibility, pure code coverage criteria are not enough to uncover all potential system errors. A vector set fulfilling even strong metrics like MC/DC may be inadequate to uncover all possible differences between model and code. One reason is that MC/DC is inadequate to complete describe the behavior of specific blocks. Another reason is the so called masking effect leading to situations, that integral errors could not be observed at the SUTs interface right in the moment of the testing time frame. In this paper, we provide a solution to address both problems by introducing model based test properties and by extending the MC/DC coverage criterion with necessary system data conditions. This will guarantee the observation of internal errors at the observable interface and thus achieves a huge quality improvement. The resulting new test case definitions could become very complicated for human beings thus it can take long time to achieve high coverage manually. To automate this task, we have extended our existing test vector generation approach targeting 100% MC/DC coverage to generate vectors covering all additional test goals. The presented approach has been introduced in an existing test and verification environment within DENSO.