Coverage Generating Function

• Coverage generating functions are mathematical constructs that convert branch reachability and set coverage into real-valued representations for systematic analysis.
• They enable the reduction of branch coverage in floating-point programs to an unconstrained minimization problem with near-linear scaling and high empirical efficiency.
• In combinatorics, the associated generating polynomials exhibit complete log-concavity, ensuring ultra–log–concave level sets and broad applicability across coverage-like functions.

A coverage generating function is a central mathematical construct in multiple domains, notably in software testing for floating-point code and in the combinatorial study of set functions. In both contexts, the construction encodes structural information as a real-valued function whose value or level sets capture key coverage properties: namely, code branch reachability in testing, or the combinatorial expansion of set-systems in theoretical settings. This article presents a rigorous exposition of coverage generating functions as they appear in automated test input generation for floating-point programs via unconstrained optimization (Fu et al., 2017), and as multivariate generating polynomials for set functions with coverage-like properties, including their deep structural consequences as shown via complete log-concavity (Abdolazimi et al., 2023).

1. Mathematical Definition in Software Testing

Let $P$ denote a floating-point program with input vector $x \in \mathbb{R}^m$ and $N$ conditional statements $\ell_0, \ldots, \ell_{N-1}$, each with “true” and “false” branches, $i_T$ and $i_F$, respectively. Define the set $S \subseteq \{i_T,i_F \mid 0 \leq i < N\}$ as saturated (already covered) branches. The coverage generating function, denoted $F:\mathbb{R}^m \to \mathbb{R}_{\ge 0}$ and termed the representing function, is defined via program instrumentation as follows:

• For every branch condition $a_i(x)\; \text{op}_i\; b_i(x)$, introduce the branch-distance function $d(\text{op},a,b)$, with explicit non-negativity and $x \in \mathbb{R}^m$0 if and only if $x \in \mathbb{R}^m$1 is satisfied.
• For each conditional $x \in \mathbb{R}^m$2, the penalty function is:

$x \in \mathbb{R}^m$3

where $x \in \mathbb{R}^m$4 is a global variable tracked during execution, initially $x \in \mathbb{R}^m$5.

• The representing function $x \in \mathbb{R}^m$6 is then the final value of $x \in \mathbb{R}^m$7 after an execution of the instrumented program $x \in \mathbb{R}^m$8, following a sequence of penalties as dictated by the execution path and state $x \in \mathbb{R}^m$9 (Fu et al., 2017).

2. Derivation and Theoretical Guarantees

The construction of $N$0 relies on systematic instrumentation of the control flow: each conditional in the program is prefaced by an update to $N$1 via the penalty function, which dynamically reflects the saturation status of each branch.

A fundamental property: any global minimizer $N$2 of $N$3, satisfying $N$4 for a given state $N$5, witnesses the coverage of at least one branch not yet in $N$6. Conversely, a zero value in $N$7 corresponds precisely to an execution that saturates a new branch.

This equivalence enables the reduction of the branch-coverage problem to a global unconstrained minimization problem, a fact formalized in (Fu et al., 2017):

• $N$8 if and only if the execution corresponding to $N$9 exercises at least one new branch not in $\ell_0, \ldots, \ell_{N-1}$0.
• The function is always non-negative: $\ell_0, \ldots, \ell_{N-1}$1 for all $\ell_0, \ldots, \ell_{N-1}$2.
• Upon saturating all branches, $\ell_0, \ldots, \ell_{N-1}$3 becomes strictly positive everywhere.

3. Unconstrained Optimization Algorithm

Coverage search proceeds by treating $\ell_0, \ldots, \ell_{N-1}$4 as a black-box function and iteratively applying standard global optimization strategies, such as basin-hopping (MCMC plus local search), to identify inputs minimizing $\ell_0, \ldots, \ell_{N-1}$5. After each new zero is found and the corresponding branch coverage is updated, the process repeats until all branches are saturated or a stopping criterion is met.

A typical algorithm iterates over multiple random starting points and local searches, updating $\ell_0, \ldots, \ell_{N-1}$6 and re-invoking minimization as new branches are discovered. This method achieves near-linear scaling in the number of branches, with observed empirical efficiency—e.g., achieving on average 90.8% branch coverage in 6.9 seconds for the Sun C math library, significantly outperforming random testing, AFL, and other symbolic/concolic tools (Fu et al., 2017).

4. Generating Polynomial of Coverage-Like Set Functions

In combinatorics, a coverage function on ground set $\ell_0, \ldots, \ell_{N-1}$7 is any set function

$\ell_0, \ldots, \ell_{N-1}$8

with $\ell_0, \ldots, \ell_{N-1}$9 for given subsets $i_T$0 of a universe $i_T$1 and weight function $i_T$2. More generally, strongly 2-coverage functions extend this framework by requiring, for all $i_T$3 with $i_T$4, that the restriction of $i_T$5 to $i_T$6 matches a coverage function up to a constant on sets of size 1 and 2.

The multivariate generating polynomial associated to such a function is

$i_T$7

which is multi-affine and has nonnegative coefficients (Abdolazimi et al., 2023).

For degree $i_T$8, the homogenized generating polynomial is

$i_T$9

which is homogeneous of degree $i_F$0 in $i_F$1 variables.

5. Complete Log-Concavity and Ultra–Log–Concavity

A key structural property of generating polynomials for strongly 2-coverage functions is complete log-concavity (CLC). A homogeneous polynomial $i_F$2 is completely log-concave if all directional derivatives of any order (in any nonnegative direction) are nonnegative and log-concave on $i_F$3. This is characterized by conditions on indecomposability of lower-degree derivatives and by the Hessian criterion for homogeneous quadratics.

A central result is that the homogenized generating polynomial $i_F$4 of any strongly 2-coverage function is completely log-concave (Abdolazimi et al., 2023). One consequence is that for the specialization

$i_F$5

the sequence $i_F$6 is ultra–log–concave, i.e.,

$i_F$7

for $i_F$8. This encompasses classical coverage functions, matroid rank functions, and their sums (Abdolazimi et al., 2023).

6. Illustrative Examples and Applications

Software Testing Example

For the simple floating-point program “if $i_F$9 then branch T else branch F,” the representing function setup alternately drives the minimization to discover both branches. Starting with neither branch saturated, the penalty function is always zero, so $S \subseteq \{i_T,i_F \mid 0 \leq i < N\}$0 for all $S \subseteq \{i_T,i_F \mid 0 \leq i < N\}$1; after T is saturated, $S \subseteq \{i_T,i_F \mid 0 \leq i < N\}$2 only if $S \subseteq \{i_T,i_F \mid 0 \leq i < N\}$3 (covering T) and strictly positive otherwise, so future minimizations will eventually uncover F by traversing $S \subseteq \{i_T,i_F \mid 0 \leq i < N\}$4.

This alternating penalty definition and repeated minimization rapidly discovers all feasible branches, as seen in empirical scaling results (Fu et al., 2017).

Combinatorial Example

For the coverage function $S \subseteq \{i_T,i_F \mid 0 \leq i < N\}$5 or a matroid rank function $S \subseteq \{i_T,i_F \mid 0 \leq i < N\}$6, the associated homogenized generating polynomial is completely log-concave, thereby ensuring ultra–log–concavity of level sets. This structural property persists for any positive linear combination (matroid-rank-sum functions), which includes, for example, the joint-entropy function of discrete random variables and sums of coverage functions.

7. Limitations and Scope

Coverage generating functions in the software testing context exhibit limitations in the presence of infeasible branches (which the minimization cannot reach), subnormal or corner-case floating-point values (requiring special seeding), and non-floating-point conditions or pointer checks (which are ignored). In combinatorial settings, the framework characterizes only those set functions that are strongly 2-coverage; standard non-coverage or arbitrary valuations fall outside its scope.

Empirical scaling on standard floating-point libraries demonstrates robust performance; however, the method relies on the structure of the penalty and representing function, and the ability of unconstrained optimization heuristics to escape local minima and cover the relevant search space efficiently (Fu et al., 2017, Abdolazimi et al., 2023).