Skip to content

Coverage / Reachability

Prime #
759
Origin domain
Computer Science & Software Engineering
Subdomain
formal methods and verification → Computer Science & Software Engineering

Core Idea

Coverage / reachability is the structural pattern of asserting that every required target in some target set is reachable from — or producible by — the system's inputs, pathways, or mechanisms. The claim is one of completeness in the surjective direction: the system covers the target set, and nothing required is left unreachable. The failure mode is a gap — a target that the system was supposed to be able to reach but cannot. The diagnostic is enumeration of the required targets and a check that at least one pathway exists to each. The pattern is the completeness claim about a relation — a mapping, a routing, an accessibility, a productive capacity — and it is deliberately silent about the uniqueness or efficiency of the pathway and about whether multiple pathways exist.

Formally, the pattern is the surjectivity of a relation R from a source set S to a required-target set T: for every t in T, there exists some s in S with s R t. The negation — coverage failure — is the existence of a t reached by no s. Two structural properties follow. Coverage is monotone: adding inputs or pathways can only increase it; removing them can only decrease it. And coverage is relative to T: it can be trivially achieved by shrinking the target set and trivially broken by expanding it, which makes the target set itself a load-bearing design artefact rather than a fixed background. The standing structural risk is that a system's coverage claim rests on an implicit target set that drifts in either direction without the claim being revalidated — new branches, new beneficiary classes, or new failure modes silently enlarge T while the old coverage proof is still being cited. The pattern is the surjective sibling of injectivity (no collisions, distinct inputs to distinct outputs); together they generate the standard bijection properties, but each carries an independent intervention catalogue and can hold or fail without the other.

How would you explain it like I'm…

A Crayon for Every Colour

Imagine you have a box of crayons and a picture you want to finish. Coverage means: for every colour the picture needs, you have at least one crayon that can make it. If even one needed colour is missing from your box, that is a gap. You do not care how many crayons of that colour you have, just that none of the needed ones are missing.

Reach Everything, No Gaps

Coverage, or reachability, is the claim that every target you are supposed to reach can be reached from your system's inputs or pathways. It is a completeness claim: nothing required is left unreachable. The failure mode is a gap, a target that was supposed to be reachable but is not. You check it by listing all the required targets and making sure at least one path leads to each one. It deliberately says nothing about whether the path is the best one, or whether there are several paths, only that at least one exists for every target. A sneaky risk is that the list of required targets quietly grows, new cases get added, while everyone keeps trusting the old proof that coverage held.

Every Target Reachable

Coverage / reachability is the structural pattern of asserting that every required target in some target set is reachable from, or producible by, the system's inputs, pathways, or mechanisms. It is a completeness claim in the surjective direction: the system covers the target set and nothing required is left unreachable. The failure mode is a gap, a target the system was supposed to reach but cannot, and the diagnostic is to enumerate the required targets and check at least one pathway exists to each. It is deliberately silent about uniqueness, efficiency, or how many pathways exist. Formally it is the surjectivity of a relation from a source set onto a required-target set. Two properties follow: coverage is monotone, since adding inputs or pathways can only increase it, and it is relative to the target set, so it can be trivially gained by shrinking the targets or broken by expanding them, which makes the target set itself a load-bearing design choice rather than fixed background. It is the surjective sibling of injectivity, which forbids collisions; together they give the bijection properties, but each can hold or fail without the other.

 

Coverage / reachability is the structural pattern of asserting that every required target in some target set is reachable from, or producible by, the system's inputs, pathways, or mechanisms. The claim is one of completeness in the surjective direction: the system covers the target set, and nothing required is left unreachable. The failure mode is a gap, a target that the system was supposed to reach but cannot, and the diagnostic is enumeration of the required targets plus a check that at least one pathway exists to each. The pattern is the completeness claim about a relation (a mapping, routing, accessibility, or productive capacity) and is deliberately silent about the uniqueness or efficiency of the pathway and about whether multiple pathways exist. Formally it is the surjectivity of a relation R from a source set S to a required-target set T: for every t in T there exists some s in S with s R t, the negation being a t reached by no s. Two structural properties follow. Coverage is monotone: adding inputs or pathways can only increase it, removing them can only decrease it. And coverage is relative to T: it is trivially achieved by shrinking T and trivially broken by expanding it, which makes the target set itself a load-bearing design artefact rather than a fixed background. The standing risk is that a coverage claim rests on an implicit target set that drifts, new branches, beneficiary classes, or failure modes silently enlarging T while the old coverage proof is still cited. It is the surjective sibling of injectivity (no collisions, distinct inputs to distinct outputs); together they generate the standard bijection properties, but each carries an independent intervention catalogue and can hold or fail without the other.

Structural Signature

the source-and-pathway set — the required-target set — the reaching relation between them — the surjective completeness obligation (every target reached by at least one source) — the gap as an unreached target — the monotonicity in pathways and relativity to the target set

A configuration exhibits coverage / reachability when each of the following holds:

  • A required-target set. A stipulated collection of elements that the system is obligated to be able to reach or produce: branches, destinations, beneficiary classes, competencies, failure modes. This set is a load-bearing design artefact, not a fixed background.
  • A source-and-pathway set. A collection of inputs, channels, or mechanisms from which targets can be reached: tests, routes, access channels, courses, controls.
  • A reaching relation. A relation that holds between a source and a target when the source reaches, routes to, exercises, teaches, or mitigates that target.
  • The surjective obligation. Completeness in the surjective direction: for every target there exists at least one source standing in the relation to it. The claim is silent about uniqueness, efficiency, or multiplicity of pathways.
  • The gap. The negation of coverage: a target reached by no source. Detecting gaps is the diagnostic, and enumeration of targets plus a per-target existence check is the procedure.
  • Monotonicity and relativity. Coverage can only increase as pathways are added and decrease as they are removed (monotone in the source set), and it is defined only relative to the target set (trivially achieved by shrinking T, trivially broken by enlarging it).

The components compose so that the dominant silent failure is target-set drift: pathway loss is visible, but a quietly growing T leaves an old, still-cited coverage proof that no longer covers, which is why an honest claim must re-anchor on its T.

What It Is Not

  • Not traceability. Traceability links each artefact back to its source or requirement — a per-element provenance relation. Coverage asserts the surjective completeness of a relation: every target reached by some source. One traces individual lineages; the other proves no target is orphaned.
  • Not redundancy. Coverage demands at least one pathway to each target and is silent about a second. redundancy demands more than one. A coverage-complete system can be one outage from a gap.
  • Not completeness. General completeness is a catch-all "nothing missing"; coverage is the specific surjective form — completeness of a relation in the reaching direction, relative to a stipulated target set, monotone in pathways.
  • Not injectivity or representation. Coverage says every target is hit; it says nothing about collisions (distinct sources to distinct targets). A fully covering relation can be many-to-one, so coverage never implies a bijection or a faithful one-to-one representation.
  • Not reachability as efficiency. The relation only requires that a pathway exists, not that it is short, cheap, or fast. Existence of a route is orthogonal to its adequacy.
  • Common misclassification. Reading a coverage percentage as a robustness or quality guarantee. "100% covered" means every required target has one pathway — not that the pathways are adequate, redundant, or distinct. Catch it by asking for the target set and whether any target rests on a single, possibly inadequate, path.

Broad Use

  • Software testing: branch, path, and statement coverage — every code branch is exercised by at least one test; gaps are branches no test reaches.
  • Network reachability: every required destination is reachable from every required origin in the routing fabric; unreachability is the design failure to detect and fix.
  • Service design and public policy: every entitled beneficiary class has at least one accessible pathway to the benefit; coverage gaps are eligible-but-unreachable populations, a chronic failure of welfare programmes.
  • Workflow design: every input case has at least one terminating branch; an input that reaches no terminal state is a coverage failure.
  • Access control: every required action is permitted by at least one granted role; a required action no role permits is a coverage gap that breaks the workflow.
  • Curriculum design: every required competency is taught by at least one course; an uncovered competency is a graduation gap.
  • Formal verification: every reachable state is enumerated, and unreachability of a bad state is the dual proof obligation.
  • Failure-mode and effects analysis: every documented failure mode has at least one mitigating control; an uncovered mode is a gap in the safety case.

Clarity

The label distinguishes completeness in the surjective direction from neighbouring completeness claims that ordinary language blurs together. Coverage is "every required target is reached by at least one input." It is not "every input is used" (that is utilisation), and it is not "every output is reached by exactly one input" (that is injectivity-plus-coverage, a bijection on the relevant subset). Naming it sharply turns the diagnostic — enumerate the target set, check at least one pathway to each — into a routine that ports across substrates rather than being re-invented in each. The clarifying force also foregrounds the target set as a design object: coverage is meaningful only relative to a stipulated set of required targets, so redefining that set changes what coverage means, and an honest coverage claim must state its T explicitly. This exposes a common rhetorical move — claiming coverage while quietly contracting the target set so the remaining gaps fall outside it — as a redefinition rather than an achievement. Once the surjective skeleton is named, an unfamiliar coverage claim can be audited in minutes: ask for the target set, the source set, the relation, and the gaps.

Manages Complexity

The pattern reduces a heterogeneous set of substrate problems — test gaps, routing holes, eligible-but-unreached beneficiaries, unhandled workflow inputs, unteachable competencies, unproven safety cases — to one structural question and one diagnostic procedure with a small, substrate-independent intervention catalogue. Enumerate the target set, making the required-outputs claim explicit and reviewable. Map inputs and pathways to targets, constructing the relation that determines coverage. Identify gaps as targets with no incoming pathway. Close gaps by adding inputs, adding pathways, or contracting the target set — the last being honest if scope is genuinely reduced and dishonest if gaps are quietly redefined away. Detect over-time erosion, revalidating the claim whenever targets are added. The compression is that a test engineer, a network architect, a benefits administrator, and a safety analyst run the same five-step procedure under different names, so expertise in one transfers as procedure in the others. Complexity moves from an unbounded, per-substrate worry ("are we missing anything important?") to a bounded set-relation audit whose monotonicity guarantees that the only ways coverage can change are adding or removing pathways, or moving the target-set boundary.

Abstract Reasoning

The prime trains a reasoner to render any completeness worry as a surjective relation and then ask the three questions the formalism exposes: what is the required-target set, what is the source-and-pathway set, and is there at least one s reaching each t? Because coverage is monotone, the reasoner knows that the claim can only be strengthened by adding pathways and weakened by removing them — there are no surprising interactions to track within a fixed T. Because coverage is relative to T, the reasoner knows that the real subtlety lives at the target-set boundary: a coverage claim is only as trustworthy as the stability and honesty of its T, so the diagnostic must include "has the target set drifted since this claim was last validated?" The non-obvious move the prime licenses is to treat target-set drift, not pathway failure, as the dominant silent failure: pathways tend to be visible and pathway loss tends to be noticed, whereas a target set that quietly grows leaves an old, still-cited coverage proof that no longer covers. The prime also keeps coverage cleanly separated from its relatives — it is weaker than redundancy (which demands more than one pathway) and orthogonal to injectivity (which forbids collisions) — so the reasoner does not over-claim distinctness or uniqueness from a mere coverage result.

Knowledge Transfer

The diagnostic ports across substrates without modification. A software-test engineer measuring branch coverage is making the same structural move as a public-services designer auditing beneficiary access pathways, a network architect verifying destination reachability, and a curriculum designer auditing competency-to-course mapping; the role mappings transfer directly — required-target set ↔ branches / destinations / beneficiary classes / competencies / failure modes; source-and-pathway set ↔ tests / routes / access channels / courses / controls; relation ↔ exercises / routes-to / reaches / teaches / mitigates; gap ↔ untested branch / unreachable host / unreached beneficiary / untaught competency / unmitigated mode. The intervention vocabulary — enumerate targets, map pathways, identify gaps, close gaps, watch for target-set drift — is invariant, and the only substrate-specific work is deciding what counts as a required target and what counts as a pathway. The transferred and non-obvious lesson is that the most dangerous coverage failures are usually not broken pathways but unexamined growth of the target set: a claim that was true when T was fixed silently becomes false as new branches, new eligible populations, or new failure modes are added, and because coverage is monotone in pathways but relative in targets, the audit must re-anchor on T every time. A reader who has internalised the prime can therefore walk into an unfamiliar domain and audit a coverage claim in minutes — ask for the target set, the input set, and the relation, then look for the elements of T with no incoming pathway — and can immediately recognise the difference between honestly closing a gap (adding a pathway) and cosmetically closing it (shrinking T so the gap is no longer required).

Examples

Formal/abstract

Branch coverage in a unit-test suite is the prime in its purest form. The required-target set T is the set of conditional branches in the program's control-flow graph — every if/else arm, every loop entry and exit. The source-and-pathway set S is the test cases. The reaching relation holds when executing a test traverses a given branch. The surjective obligation is "every branch is exercised by at least one test"; a gap is a branch no test reaches. The structure makes the two key properties operational. Monotonicity: adding a test can only cover more branches, never fewer, so coverage is a strictly accumulating quantity as the suite grows. Relativity to T: when a developer adds a new if to the code, T silently enlarges, and a coverage report that still cites "92%" from before the change is measuring against a stale target set. The diagnostic — enumerate the branches, check at least one traversing test per branch — is exactly the surjective existence check. The intervention catalogue applies directly: a gap is closed honestly by writing a test that traverses the branch, and cosmetically (the redefinition move the prime warns against) by deleting the branch's coverage requirement or excluding the file from the report. Mapped back: branches are the required targets, tests are the sources, execution is the reaching relation, and the dominant silent failure — target-set drift as new branches are added faster than tests — is precisely the prime's prediction that coverage is monotone in pathways but relative in T.

Applied/industry

Two applied instances show the same skeleton in non-software substrates. First, public benefits administration: a state rolls out a childcare subsidy. The required-target set is the enumerated classes of eligible families (by income band, employment status, immigration status, county). The source-and-pathway set is the access channels — the online portal, the phone line, in-person offices, partner non-profits. The reaching relation holds when a beneficiary class has at least one channel through which it can actually enrol. A coverage gap is an eligible-but-unreachable class — say, non-English-speaking rural families for whom the online-only portal and the county office two hours away constitute no real pathway. The audit is the prime's: enumerate eligible classes, map channels to classes, find classes with no incoming pathway, and close them by adding a channel (mobile enrolment, translated phone intake) rather than by quietly narrowing eligibility. Second, failure-mode-and-effects analysis in aerospace: T is the catalogued failure modes of a subsystem, S is the mitigating controls (redundancy, monitors, procedures), and a gap is a documented failure mode with no mitigating control — an unaddressed hole in the safety case. As new failure modes are discovered in testing, T grows, and an old "all modes mitigated" sign-off silently becomes false. Mapped back: beneficiary classes and failure modes are required targets; access channels and mitigating controls are sources; enrolment-feasibility and mitigation are the reaching relations; and in both the chronic danger is not a broken pathway but unexamined growth of T, so the safety case and the benefits rollout must each re-anchor on their target set every time it expands.

Structural Tensions

T1 — Existence versus Adequacy of the Pathway (scopal). The surjective obligation is satisfied by at least one pathway to each target — but a pathway can exist while being too narrow, too slow, or too costly to count as real coverage. The tension is between formal reachability and effective reachability. The failure mode is checkbox coverage: a beneficiary class is "covered" by an online-only portal it cannot navigate, or a branch is "covered" by a test that touches it without meaningfully exercising it. The diagnostic: for each existence-of-pathway, ask whether the pathway carries adequate capacity and quality, not merely whether the relation holds — coverage's silence about pathway quality is exactly where the gap hides in plain sight.

T2 — Target-Set Stability versus Drift (temporal). Coverage is monotone in pathways but only relative to a fixed target set T, so the claim's truth is dated. The productive tension is between a coverage proof that was valid when constructed and a T that grows after. The failure mode the prime names: citing a stale "92%" after new branches, new eligible classes, or new failure modes silently enlarged T. The diagnostic is a re-anchoring audit — every coverage claim must carry the snapshot of T it was validated against, and any expansion of T invalidates the old proof until re-run. Pathway loss is visible; target growth is the dangerous, quiet failure.

T3 — Coverage versus Redundancy (multiplicity). Coverage demands one pathway; it is deliberately silent about whether a second exists. The tension is between the cheap surjective guarantee and the resilience that only redundancy provides. The failure mode is single-path fragility mistaken for coverage: every target reachable, but each by exactly one pathway, so a single failure opens a gap. The diagnostic: distinguish "every target reached" from "every target reached by at least two independent pathways" — a coverage-complete system can be one outage away from a coverage hole, and reading coverage as robustness over-claims what the surjective property guarantees.

T4 — Honest Closure versus Cosmetic Contraction (sign/direction). A gap can be closed by adding a pathway (raising coverage) or by shrinking T so the gap falls outside scope (redefining coverage). Both report "covered," but they move in opposite directions on the thing that matters. The tension is between genuine extension of reach and rhetorical narrowing of obligation. The failure mode is coverage laundering: excluding a file from the report, narrowing eligibility, or de-scoping a failure mode, then claiming achievement. The diagnostic: compare the current T against the prior T — if coverage rose because the denominator shrank, the gap was hidden, not closed.

T5 — Surjective Coverage versus Injective Distinctness (coupling). Coverage (every target reached by some source) is orthogonal to injectivity (distinct sources to distinct targets, no collisions). The tension is that a system can be fully covering while many sources collide onto the same target, leaving other apparent distinctions illusory. The failure mode is inferring uniqueness or efficiency from coverage: assuming that because every requirement is met, each is met by its own dedicated mechanism. The diagnostic: separately verify the injective property — coverage proves nothing about collisions, so reading a coverage result as a bijection conflates two independent set properties that hold or fail without each other.

T6 — Local Per-Target Check versus Global Composition (scalar). The diagnostic is a per-target existence check, run target by target. The tension is between verifying each target locally and the system-level claim that all targets are simultaneously coverable under shared, finite resources. The failure mode is resource-blind coverage: each target is individually reachable, but the pathways contend for the same channel, tester time, or budget, so they cannot all be exercised at once. The diagnostic: after the per-target checks pass, ask whether the pathways are jointly realisable — a coverage proof assembled from independent existence checks can be globally infeasible even when every local check succeeds.

Structural–Framed Character

Coverage / reachability sits at the structural end of the structural–framed spectrum, with an aggregate of 0.0: it is the surjective completeness of a relation — every required target reached by at least one source — a set-theoretic property that holds wherever there is a source set, a target set, and a reaching relation between them. Nothing about it depends on a field's vocabulary or on any normative stance.

Every diagnostic reads structural. The pattern carries no home vocabulary that must travel: it is told as branch coverage in a test suite, destination reachability in a routing fabric, beneficiary access in a welfare programme, competency mapping in a curriculum, and mitigation coverage in an FMEA, each substrate supplying its own targets and pathways while the surjective skeleton stays invariant. It carries no inherent approval or disapproval — full coverage is not good in itself and a gap is not bad in itself until you specify what the targets are; the property is value-neutral surjectivity. Its origin is formal — definable purely as "for every t in T there exists an s in S with s R t," with two derived facts (monotonicity in pathways, relativity to T) that are mathematical, not institutional — and it runs indifferently in code-coverage instrumentation, a packet-routing graph, and a chemical-pathway analysis, none requiring a human practice to instantiate. And invoking it RECOGNISES a completeness pattern already present in the relation rather than IMPORTING a frame: to audit coverage is to enumerate T and check pathways, not to overlay an interpretive lens. On every diagnostic the prime reads structural, consistent with the 0.0 aggregate.

Substrate Independence

Coverage / reachability is a maximally substrate-independent prime — composite 5 / 5 on the substrate-independence scale. Its domain breadth is total: the surjective-completeness claim recurs with identical force in software branch coverage, network destination reachability, welfare-programme beneficiary access, workflow input handling, access-control permissions, curriculum competency mapping, formal-verification state enumeration, FMEA failure-mode mitigation, and chemical-pathway analysis — spanning code, institutions, pedagogy, and chemistry. Its structural abstraction is maximal because the property is statable in bare set-theoretic terms — "for every t in T there exists an s in S with s R t," with two derived facts (monotonicity in pathways, relativity to T) that are mathematical rather than domain-laden — so it carries no normative or institutional load. The transfer evidence sits a notch lower at 4: the role mappings and the five-step audit (enumerate targets, map pathways, find gaps, close gaps, watch for target-set drift) port across substrates with documented instances, but the cross-domain carrying is mostly a shared diagnostic procedure rather than a single formal model literally re-run, and what counts as a "required target" or a "pathway" must be re-decided in each substrate. The pattern is recognised wherever a source set, target set, and reaching relation exist, holding the composite at 5.

  • Composite substrate independence — 5 / 5
  • Domain breadth — 5 / 5
  • Structural abstraction — 5 / 5
  • Transfer evidence — 4 / 5

Relationships to Other Primes

One-hop neighborhood: parents above, mutual partners to the right, children below.Coverage /Reachabilitysubsumption: SurjectivitySurjectivity

Parents (1) — more general patterns this builds on

  • Coverage / Reachability is a kind of Surjectivity

    The file states outright "Formally, the pattern is the surjectivity of a relation R from a source set S to a required-target set T", calls itself "the surjective sibling of injectivity" and "the specific surjective form" of completeness, and its own cross-ref link is surjectivity. The worklist confirms surjectivity is a canonical/candidate prime (injectivity its co-equal dual). Direction: coverage_reachability is-a surjectivity, specialized to an explicit required-target set with the gap/monotonicity/ target-drift apparatus added — genuine specialization, not a duplicate. surjectivity is a valid (CAND-NEW-011) slug. Medium conviction because the added target-set-relativity makes it arguably a co-equal applied sibling rather than a strict child; child_of surjectivity is the better-fitting direction.

Path to root: Coverage / Reachability → Surjectivity

Neighborhood in Abstraction Space

Coverage / Reachability sits in a moderately populated region (52nd percentile for distinctiveness): it has near-neighbors but no dense thicket of synonyms.

Family — Finite Capacity & Contention (18 primes)

Nearest neighbors

Computed from structural-signature embeddings · 2026-06-14

Not to Be Confused With

The nearest neighbour, and the easiest confusion, is traceability. Both relate two sets — sources and targets, artefacts and requirements — and both are diagnosed by walking a relation. But they assert opposite obligations on opposite directions. Traceability is a per-element provenance claim: each artefact can be linked back to the requirement or origin it serves, so the relation is read source-by-source and its guarantee is that nothing is unaccounted for in its lineage. Coverage is a surjective completeness claim: every required target has at least one source reaching it, so the relation is read target-by-target and its guarantee is that no target is orphaned. A codebase can be fully traceable (every line maps to a requirement) yet have terrible coverage (many requirements exercised by no test), and vice versa. The invariants differ: traceability's invariant is the existence of a backward link from each artefact; coverage's is the existence of a forward link to each target. Conflating them lets a team cite a tidy requirements-traceability matrix as if it proved their test suite reached every requirement — two different relations on the same sets.

A second genuine confusion is with redundancy. Coverage is deliberately silent about pathway multiplicity: it is satisfied by exactly one source per target. Redundancy is precisely the claim coverage refuses to make — that more than one independent pathway exists, so that the loss of one does not open a gap. The two are stacked, not synonymous: redundancy presupposes coverage (you cannot have two pathways to a target that has none) but adds a resilience guarantee coverage never offers. The practical hazard is reading a green coverage report as robustness. A system where every target is reached by exactly one pathway is coverage-complete and single-fault-fragile at once; the prime's monotonicity tells you adding pathways only helps, but only the redundancy lens tells you how many you need for the failure model you face.

A third worth separating is completeness in its general sense. General completeness is the unqualified "nothing is missing," a property whose meaning depends entirely on what "missing" ranges over. Coverage is a sharpened, structural species of it: completeness of a reaching relation, in the surjective direction, relative to an explicit target set, and monotone in the source set. The sharpening is what makes coverage auditable in minutes where general completeness invites endless argument — but it also means a coverage claim is only as honest as its declared target set. The dishonest move the prime names (shrinking T so gaps fall outside scope) is invisible if one reasons in the loose vocabulary of "is it complete?" and obvious once one insists on coverage's relativity to a named T.

For a practitioner the distinctions are operational. Ask traceability questions to audit provenance and impact ("if this requirement changes, what must change?"); ask coverage questions to audit reach ("is every requirement exercised by something?"); invoke redundancy when a single pathway is an unacceptable single point of failure; and never let a coverage percentage stand in for either provenance or resilience. The three relations can each hold or fail independently, and a system's safety case usually needs all three argued separately.

Solution Archetypes

No catalogued solution archetypes reference this prime yet.