This paper presents a theory of test coverage and generation from specifications written in extended finite state machines (EFSMs). We investigate a family of coverage criteria based on the information of control flow and data flow in EFSMs and characterize them using the temporal logic CTL. We discuss the complexity of minimal cost test generation and describe a simple heuristic which uses the capability of model checkers to construct counterexamples. Our approach extends the range of applications of model checking from automatic verification of finite state systems to automatic test generation from finite state systems.