Branch Coverage

Concept

Branch coverage is a code-coverage metric that measures the fraction of decision-point edges (branches) in a program that are exercised by a test suite. It is one of the main code-coverage types alongside statement and path coverage, is widely used as a basic test criterion in pre-silicon unit-level validation, is collected together with other code-based metrics by processor/hardware fuzzers (such as TheHuzz, FuSS, and GoldenFuzz) during RTL simulation, and is one of the optimization objectives targeted by coverage-directed test-generation tools such as uGP and FireDrill.

First seen 5/28/2026

Last seen 8/2/2026

Evidence 23 chunks

Wiki v7

WIKI

Overview

Branch coverage is a code-coverage metric that measures the fraction of decision-point edges (branches) in a program that are exercised by a test suite. Specifically, branch coverage indicates whether all possible branches of a conditional statement — including if-else-if, case, and for-loop constructs — have been executed; execution of only the "True branch" of a conditional yields 50% branch coverage.[1] Branch coverage of source code is a very widely used test criterion and is similar in nature to line coverage, MC/DC, and other test objectives such as assertion-violation coverage, since all of these reduce to the question of whether many test objectives are reachable by some test input.[2]

Formally, for a set of test inputs (\mathcal{S}), a set of branches (\mathcal{B}), and a branch (b) that can be evaluated to a Boolean value (v), branch coverage can be expressed as[6]

READ FULL ARTICLE →

NEIGHBORHOOD

No graph connections found for this entity yet. It may appear in future ingestion runs.

explore full graph →

RELATIONSHIPS

11 connections

Verifying Instruction Set Simulators using Coverage-guided Fuzzing ← uses 100% 4e

The paper uses branch coverage as part of its coverage metrics.

Code Coverage part of → 95% 4e

Branch coverage is a type of code coverage metric

Frequency Heuristic ← uses 90% 2e

The frequency heuristic prioritizes seeds that access branches with lower access counts.

TheHuzz ← uses 100% 2e

TheHuzz uses branch coverage to test branching constructs.

coverage metrics part of → 100% 2e

Branch coverage is one of the coverage metrics used.

Coverage-Guided Fuzzing ← uses 100% 2e

Coverage-guided fuzzing uses branch coverage as a metric to guide exploration.

FuSS Framework ← evaluates 100% 2e

FuSS evaluates its effectiveness using branch coverage as a metric.

MicroGP ← uses 90% 2e

MicroGP's fitness function includes branch coverage

Fine-Grained Code Analysis for Processor Fuzzing ← uses 98% 2e

The paper uses branch coverage as the primary evaluation metric.

GoldenFuzz ← uses 90% 1e

GoldenFuzz measures and optimizes branch coverage as part of its coverage-guided fuzzing approach.

Dependency-Aware Heuristic ← uses 90% 1e

The dependency-aware heuristic targets unvisited branches to improve branch coverage.

LINKED ENTITIES

2 links

Code Coverage PART_OF Extracted graph relationship

MicroGP USES Extracted graph relationship

CITATIONS

12 sources

12 citations — click to expand

[1] Branch coverage measures whether all possible branches of conditional constructs (if-else-if, case, for-loop) have been exercised by a test suite; executing only the True branch yields 50% branch coverage. Unified Coverage Methodology for SoC Post-Silicon Validation

[2] Branch coverage is one of the main code-coverage types alongside statement and path coverage and is part of the broader notion of code coverage. Unified Coverage Methodology for SoC Post-Silicon Validation

[3] In pre-silicon validation, branch coverage is a basic unit-level coverage metric alongside statement coverage; interconnection testing uses path coverage; full-chip validation shifts to functionality-based metrics. Unified Coverage Methodology for SoC Post-Silicon Validation

[4] Post-silicon branch coverage is limited to proof-of-concept demonstrations because silicon contains logic equivalent to RTL rather than RTL source, requiring additional on-chip instrumentation. Unified Coverage Methodology for SoC Post-Silicon Validation

[5] Concolic test generation targets exhaustive branch coverage but covers paths more efficiently than branches, limiting its ability to provide unreachability proofs for uncovered branches. Towards exhaustive branch coverage with PathCrawler

[6] TheHuzz uses Synopsys VCS to simulate target hardware and processes VCS logs to extract a union of coverage metrics including statement, branch, toggle, expression, and condition coverage; it tests each branching construct's both conditions and uses coverage-point hits to optimize IM-pair selection. TheHuzz: Instruction Fuzzing of Processors Using Golden Reference Models

[7] Branch coverage alone is insufficient for bugs related to floating wires, MUX-select signal transitions, MUX DFFs, and protocol-level bugs, motivating TheHuzz to combine branch with statement, toggle, expression, condition, and FSM coverage. TheHuzz: Instruction Fuzzing of Processors Using Golden Reference Models

[8] FuSS uses branch coverage as a primary evaluation metric and reaches close to 100% branch coverage in under 10 hours on RISC-V SoCs, versus ~80% for traditional fuzzing and ~88% for fuzzing plus property checking. FuSS: Coverage-Directed Hardware Fuzzing with Selective Symbolic Execution

[9] Mutation coverage is a stronger metric than branch coverage in continuous integration, revealing additional test-suite weaknesses at acceptable overhead, but adoption is limited by build-integration difficulty, perception that branch coverage is good enough, and build-time overhead. Comparing Mutation Coverage Against Branch Coverage in an Industrial Setting

[10] GoldenFuzz defines branch coverage formally as Cov_branch(S) = |{(b,v): ∃X, b evaluated to v in X}| / (2|B|), counting both true and false evaluations of every branch, and uses it as one of several code-coverage metrics tracked alongside condition, expression, FSM, and toggle coverage. GoldenFuzz Fuzzing Framework

[11] In an industrial evaluation of uGP and FireDrill CDG tools, branch coverage is one of the fitness terms (alongside Expression and Toggle coverage) used to drive genetic-algorithm evolution; cumulative branch coverage reaches 98–99% across ASC/DSC/BIRTH configurations. Feedback-based Coverage Directed Test Generation: An industrial evaluation

[12] Branch coverage results correlate with test size, and the BIRTH configuration of uGP achieved the best branch coverage results on average; counter-intuitively Expression coverage exceeded Branch coverage during progression because remaining uncovered branches depend on simple antecedent variables. Feedback-based Coverage Directed Test Generation: An industrial evaluation