Skip to content
STIMSMITH

Condition Coverage

Concept

Condition coverage is a code-coverage metric that quantifies how thoroughly a testing process exercises conditional expressions in a design under test (DUT). In hardware fuzzing it is one of several coverage signals (alongside line, FSM, statement, branch, expression, and toggle coverage) used to steer input generation and to compare fuzzers such as TheHuzz, ChatFuzz, DifuzzRTL, Cascade, LiFU, GoldenFuzz, and GenHuzz. In configurable-systems testing it generalizes to 'presence conditions' extracted from code, giving rise to t-wise presence condition coverage.

First seen 6/14/2026
Last seen 9/1/2026
Evidence 15 chunks
Wiki v4

WIKI

Condition Coverage

Definition

Condition coverage is a coverage metric that measures the fraction of conditional expressions exercised by a test-generation process. In hardware fuzzing, condition coverage specifically requires that every input combination in a condition block produce the correct output value; it is reported alongside related metrics such as statement, branch, expression, toggle, FSM, and line coverage [evidence: 7d1ca475-9c0c-4b68-bc24-db339ffa3987, fedd43f9-88d9-4388-a2c7-805a2eea51f4]. In configurable-systems testing, condition coverage generalizes to "presence conditions" — boolean expressions extracted from the code that determine whether an implementation artifact is included in a given configuration.

READ FULL ARTICLE →

NEIGHBORHOOD

No graph connections found for this entity yet. It may appear in future ingestion runs.

explore full graph →

RELATIONSHIPS

7 connections
coverage metrics part of → 100% 2e
Condition coverage is one of the coverage metrics used.
coverage-based fuzzing ← uses 90% 2e
Coverage-based fuzzing uses condition coverage as a hardware coverage metric.
TheHuzz ← uses 100% 2e
TheHuzz uses condition coverage to test condition blocks for all possible input values.
GoldenFuzz ← evaluates 100% 2e
GoldenFuzz measures condition coverage as part of its evaluation.
GoldenFuzz ← uses 100% 2e
GoldenFuzz measures and reports condition coverage improvements over prior tools.
LiFU ← uses 100% 2e
LiFU measures and improves condition coverage on CPU designs.
Coverage-guided Fuzzing ← uses 95% 1e
Coverage-guided fuzzing uses condition coverage as one of its metrics.

CITATIONS

5 sources
5 citations — click to expand
[1] Condition coverage assesses the evaluation of all possible logical conditions, alongside FSM coverage (states/transitions of finite state machines) and line coverage (RTL lines executed during simulation); together these provide a comprehensive view of test-case effectiveness in hardware validation. [PDF] GenHuzz: An Efficient Generative Hardware Fuzzer - USENIX
[2] GenHuzz is evaluated against Cascade, DifuzzRTL, TheHuzz, and ChatFuzz with a comprehensive coverage analysis using condition, line, and FSM metrics across RocketChip, Boom, and CVA6; for the other fuzzers benchmarking focuses on RocketChip with condition-coverage metrics. [PDF] GenHuzz: An Efficient Generative Hardware Fuzzer - USENIX
[3] GenHuzz consistently outperforms Cascade across all cores and evaluation metrics, except for the FSM metric on RocketChip where GenHuzz and Cascade perform identically. [PDF] GenHuzz: An Efficient Generative Hardware Fuzzer - USENIX
[4] GenHuzz's condition-coverage continues to grow with the number of test cases while Cascade's coverage plateaus after a relatively small number of test cases, illustrating the role of the HGRL scheme that integrates reinforcement learning with a language model. [PDF] GenHuzz: An Efficient Generative Hardware Fuzzer - USENIX
[5] GenHuzz uses Synopsys VCS for RTL simulation and the Spike simulator as the RISC-V ISA reference model to detect mismatches between the DUT and the reference. [PDF] GenHuzz: An Efficient Generative Hardware Fuzzer - USENIX