Modified Condition/Decision Coverage (MC/DC)

MC/DC Metric Definition

The modified condition/decision coverage (MC/DC) coverage is like condition coverage, but every condition in a decision must be tested independently to reach full coverage. This means that each condition must be executed twice, with the results true and false, but with no difference in the truth values of all other conditions in the decision. In addition, it needs to be shown that each condition independently affects the decision.

With this metric, some combinations of condition results turn out to be redundant and are not counted in the coverage result. The coverage of a program is then then number of executed statement blocks and non-redundant combinations of condition results divided by the number of statement blocks and required condition result combinations.

Example

A sample C/C++ function with a decision composed of OR and AND expressions illustrates the difference between Modified Condition/Decision Coverage and a coverage of all possible combinations as required by MCC:

bool isSilent(int *line1, int *line2)
{
    if ((!line1 || *line1 <= 0) && (!line2 || *line2 <= 0))
        return true;
    else
        return false;
}

For 100% Multiple Condition Coverage a total of seven tests would be required. The “modified” requirements of MC/DC, on the other hand, reduces the number of required tests to the five listed below:

For completeness here are the two tests that MCC would require in addition:

Relevance in Safety Standards

ISO 26262 recommends MC/DC for ASIL A, B, C and highly recommends this method for ASIL D.

EN 50128 recommends MC/DC (or Multiple Condition Coverage) for SIL 1 and 2. For SIL 3 and 4 this level is even highly recommended.

DO 178C mandates that MC/DC should be satisfied with independence for Software Level A.

IEC 61508 recommends MC/DC for SIL 1, 2 and 3 and highly recommends this level for SIL 4.