From Pressman, “Software Engineering

– a practitionerʼs approach”, Chapter 14

and Pezze + Young, “Software Testing
and Analysis”, Chapters 10-11

Today, weʼll talk about testing – how to

test software. The question is: How do
Functional Testing we design tests? And weʼll start with
functional testing.

Software Engineering
Andreas Zeller • Saarland University

Functional testing is also called “black-

box” testing, because we see the
program as a black box – that is, we
ignore how it is being written

in contrast to structural or “white-box”

testing, where the program is the base.

3
 If the program is not the base, then what
is? Simple: itʼs the specification.

If the program is not the base, then what

is? Simple: itʼs the specification.
Testing Tactics
Functional Structural
“black box” “white box”

• Tests based on spec • Tests based on code

• Test covers as much • Test covers as much

specified behavior implemented behavior
as possible as possible
5

Why Functional?
Functional Structural
“black box” “white box”

• Program code not necessary

• Early functional test design has benefits
reveals spec problems • assesses testability • gives additional
explanation of spec • may even serve as spec, as in XP
6
 Structural testing can not detect that
some required feature is missing in the
Why Functional? code
Functional testing applies at all
granularity levels (in contrast to
structural testing, which only applies to
Functional Structural unit and integration testing)
“black box” “white box”

• Best for missing logic defects

Common problem: Some program logic was simply forgotten
Structural testing would not focus on code that is not there

• Applies at all granularity levels

unit tests • integration tests • system tests • regression tests
7

2,510,588,971 years, 32 days, and 20

hours to be precise.
A Challenge
class Roots {
// Solve ax2 + bx + c = 0
public roots(double a, double b, double c)
{ … }

// Result: values for x

double root_one, root_two;
}

• Which values for a, b, c should we test?

assuming a, b, c, were 32-bit integers, we’d have (232)3 ≈ 1028 legal inputs
with 1.000.000.000.000 tests/s, we would still require 2.5 billion years
8

Note that in 900 million years, due to

increase of the luminosity of the sun,
Life Cycle of the Sun CO2 levels will be toxic for plants; in 1.9
billion years, surface water will have
evaporated (source: Wikipedia on
“Earth”)

9
 Note that in 900 million years, due to
increase of the luminosity of the sun,
Life Cycle of the Sun CO2 levels will be toxic for plants; in 1.9
billion years, surface water will have
evaporated (source: Wikipedia on
“Earth”)

10

None of this is crucial for the

computation, though.

11

12
 A Challenge
class Roots {
// Solve ax2 + bx + c = 0
public roots(double a, double b, double c)
{ … }

// Result: values for x

double root_one, root_two;
}

• Which values for a, b, c should we test?

assuming a, b, c, were 32-bit integers, we’d have (232)3 ≈ 1028 legal inputs
with 1.000.000.000.000 tests/s, we would still require 2.5 billion years
13

One might think that picking random

samples might be a good idea.
Random Testing

• Pick possible inputs uniformly

• Avoids designer bias
A real problem: The test designer can make the same logical
mistakes and bad assumptions as the program designer
(especially if they are the same person)

• But treats all inputs as equally valuable

14

However, it is not. For one, we donʼt

care for bias – we specifically want to
Why not Random? search where it matters most. Second,
random testing is unlikely to uncover
specific defects. Therefore, we go for
functional testing.
• Defects are not distributed uniformly
• Assume Roots applies quadratic equation
and fails if b2 – 4ac = 0 and a = 0
• Random sampling is unlikely to choose
a = 0 and b = 0

15
 The main steps of a systematic
approach to functional program testing
Systematic Functional Testing (from Pezze + Young, “Software Testing
and Analysis”, Chapter 10)
identify
Functional Independently
specification testable feature

identify derive

Representative
Model
values

derive
generate
Test case
Test case
specifications

16

Testable Features
identify
Functional Independently
specification testable feature

• Decompose systemRepresentative
into
identify derive

independently testable features (ITF) Model

values
• An ITF need not correspond to units or
subsystems of the software derive
generate

• ForTestsystem Test case

case testing, ITFs are exposed
specifications
through user interfaces or APIs
17

Just one – roots is a unit and thus

provides exactly one single testable
Testable Fatures feature.

class Roots {
// Solve ax2 + bx + c = 0
public roots(double a, double b, double c)
{ … }

// Result: values for x Ask

double root_one, root_two; audience
}

• What are the independently testable features?

18
 Every single function becomes an
independently testable feature. Some
Testable Fatures functions (like memory access, for
instance) are dependent on each other,
though: to retrieve a value, you must
first store it.
(Note how the calculator shows the
#years required for the Roots
• Consider a multi-function calculation.)
calculator
• What are the independently
testable features?
Ask
audience
19

The main steps of a systematic

approach to functional program testing
Testable Features (from Pezze + Young, “Software Testing
and Analysis”, Chapter 10)
identify
Functional Independently
specification testable feature

identify derive

Representative
Model
values

derive
generate
Test case
Test case
specifications

20

The main steps of a systematic

approach to functional program testing
Representative Values (from Pezze + Young, “Software Testing
and Analysis”, Chapter 10)
identify
Functional Independently
• Try to select
specification inputs testable feature
that are especially
identify derive
valuable
Representative
• Usually by values
Model
choosing
representatives of equivalence derive
classes that
generate
are apt to fail often or not Test
at allcase
Test case
specifications

21
 Needles in a Haystack
• To find needles,
look systematically
• We need to find out
what makes needles special

22

We can think of all the possible input values to a program as

little boxes ... white boxes that the program processes

Systematic Partition Testing

correctly, and colored boxes on which the program fails. Our
problem is that there are a lot of boxes ... a huge number,
and the colored boxes are just an infinitesimal fraction of the
Failures are sparse in whole set. If we reach in and pull out boxes at random, we
Failure (valuable test case) ... but dense in some
the space of possible are unlikely to find the colored ones.
No failure parts of the space
inputs ... Systematic testing says: Letʼs not pull them out at random.
Letʼs first subdivide the big bag of boxes into smaller groups
The space of possible input values

(the pink lines), and do it in a way that tends to concentrate

the colored boxes in a few of the groups. The number of
groups needs to be much smaller than the number of boxes,
(the haystack)

so that we can systematically reach into each group to pick

one or a few boxes.
Functional testing is one variety of partition testing, a way of
drawing the orange lines so that, when one of the boxes
within a orange group is a failure, many of the other boxes in
that group may also be failures. Functional testing means
using the program specification to draw pink lines.
(from Pezze + Young, “Software Testing and Analysis”,
If we systematically test some Functional testing is one way of Chapter 10)
cases from each part, we will drawing orange lines to isolate
include the dense parts regions with likely failures
23

How do we choose equivalence

classes? The key is to examine input
Equivalence Partitioning conditions from the spec. Each input
condition induces an equivalence class
– valid and invalid inputs.

Input condition Equivalence classes

range one valid, two invalid
(larger and smaller)

specific value one valid, two invalid

(larger and smaller)

member of a set one valid, one invalid

boolean one valid, one invalid

24
 How do we choose representatives rom
equivalence classes? A greater number
Boundary Analysis of errors occurs at the boundaries of an
equivalence class rather than at the
“center”. Therefore, we specifically look
Possible test case for values that are at the boundaries – 
both of the input domain as well as at
the output.

• Test at lower range (valid and invalid),

at higher range(valid and invalid), and at center
25

(from Pezze + Young, “Software Testing

and Analysis”, Chapter 10)
Example: ZIP Code
• Input:
5-digit ZIP code
• Output: Ask
list of cities audience
• What are
representative
values to test?

26

(from Pezze + Young, “Software Testing

and Analysis”, Chapter 10)
Valid ZIP Codes
1. with 0 cities
as output
(0 is boundary value)

2. with 1 city
as output
3. with many cities
as output

27
 (from Pezze + Young, “Software Testing
and Analysis”, Chapter 10)
Invalid ZIP Codes
4. empty input
5. 1–4 characters
(4 is boundary value)

6. 6 characters
(6 is boundary value)

7. very long input

8. no digits
9. non-character data
28

“Special” ZIP Codes

• How about a ZIP code that reads

12345‘; DROP TABLE orders; SELECT
* FROM zipcodes WHERE ‘zip’ = ‘

• Or a ZIP code with 65536 characters…

• This is security testing

29

Generally, random inputs are easier to

generate, but less likely to cover parts of
Gutjahr’s Hypothesis the specification or the code.
See Gutjahr (1999) in IEEE
Transactions on Software Engineering
25, 5 (1999), 661-667

Partition testing
is more effective
than random testing.

30
 The main steps of a systematic
approach to functional program testing
Representative Values (from Pezze + Young, “Software Testing
and Analysis”, Chapter 10)
identify
Functional Independently
specification testable feature

identify derive

Representative
Model
values

derive
generate
Test case
Test case
specifications

31

The main steps of a systematic

approach to functional program testing
Model-Based Testing (from Pezze + Young, “Software Testing
and Analysis”, Chapter 10)
identify
Functional Independently
specification testable feature
• Have a formal model
that specifies softwareidentify
behavior derive

• Models typically come

Representative
as
values
Model

• finite state machines and derive

• decision structures generate
Test case
Test case
specifications

32

0
As an example, consider these steps
modeling a product maintenance
process…
(from Pezze + Young, “Software Testing
1 2 and Analysis”, Chapter 14)
3

4 5 6

Finite
State 7 8

Machine
9

33
 …based on these (informal)
requirements
(from Pezze + Young, “Software Testing
and Analysis”, Chapter 14)

34

Coverage Criteria

• Path coverage: Tests cover every path

Not feasible in practice due to infinite number of paths

• State coverage: Every node is executed

A minimum testing criterion

• Transition coverage: Every edge is executed

Typically, a good coverage criterion to aim for

35

0
With five test cases (one color each), we
can achieve transition coverage
(from Pezze + Young, “Software Testing
and Analysis”, Chapter 14)
1 2
3

4 5 6

Transition
Coverage 7 8

36
 Finite state machines can be used to
model for a large variety of behaviors –
State-based Testing and thus serve as a base for testing.

• Protocols (e.g., network communication)

• GUIs (sequences of interactions)
• Objects (methods and states)

37

Hereʼs an example of a finite state

machine representing an Account class
empty set up going through a number of states.
open acct setup Accnt acct Transition coverage means testing each
Account method once.
deposit (From Pressman, “Software Engineering
(initial)

Account states
– a practitionerʼs approach”, Chapter 14)
deposit

working
acct
balance
credit withdraw
accntInfo

withdrawal
(final)

dead nonworking
acct close acct

38
Figure 14.3 State diagram for Account class (adapted from [KIR94])

A decision table describes under which

Decision Tables conditions a specific outcome comes to

be. This decision table, for instance,
determines the discount for a purchase,
Education Individual depending on specific thresholds for the
amount purchased.
Education account T T F F F F F F (from Pezze + Young, “Software Testing
Current purchase > and Analysis”, Chapter 14)
Threshold 1 – – F F T T – –
Current purchase >
Threshold 2 – – – – F F T T
Special price <
scheduled price F T F T – – – –
Special price <
Tier 1 – – – – F T – –
Special price <
Tier 2 – – – – – – F T
Edu Special No Special Tier 1 Special Tier 2 Special
Out discount price discount price discount price discount Price

39
 Condition Coverage
• Basic criterion: Test every column
“Don’t care” entries (–) can take arbitrary values

• Compound criterion: Test every combination

Requires 2n tests for n conditions and is unrealistic

• Modified condition decision criterion (MCDC):

like basic criterion, but additionally, modify
each T/F value at least once Nicolas and I were going
Again, a good coverage criterion to aim for through the slides and found
that in the Functional testing
lecture, on slide 39, the Basic
criterion is swapped with the
Compound criterion
description, at least from what
we know from the Structural
testing chapter from the
Pezze&Young book. Are we
40

We modify the individual values in

MCDC Criterion column 1 and 2 to generate four

additional test cases – but these are
already tested anyway. For instance,
Education Individual the modified values in column 1 are
already tested in column 3.
Education account F
T T F F F F F F (from Pezze + Young, “Software Testing
Current purchase > and Analysis”, Chapter 14)
Threshold 1 – – F F T T – –
Current purchase >
Threshold 2 – – – – F F T T
Special price <
scheduled price F T F T – – – –
Special price <
Tier 1 – – – – F T – –
Special price <
Tier 2 – – – – – – F T
Edu Special No Special Tier 1 Special Tier 2 Special
Out discount price discount price discount price discount Price

41

This also applies to changing the other

MCDC Criterion values, so adding additional test cases

is not necessary in this case.
(from Pezze + Young, “Software Testing
Education Individual and Analysis”, Chapter 14)

Education account T T F F F F F F
Current purchase >
Threshold 1 – – F F T T – –
Current purchase >
Threshold 2 – – – – F F T T
Special price <
scheduled price TF T F T – – – –
Special price <
Tier 1 – – – – F T – –
Special price <
Tier 2 – – – – – – F T
Edu Special No Special Tier 1 Special Tier 2 Special
Out discount price discount price discount price discount Price

42
 MCDC Criterion
Education Individual
Education account T F
T F F F F F F
Current purchase >
Threshold 1 – – F F T T – –
Current purchase >
Threshold 2 – – – – F F T T
Special price <
scheduled price F T F T – – – –
Special price <
Tier 1 – – – – F T – –
Special price <
Tier 2 – – – – – – F T
Edu Special No Special Tier 1 Special Tier 2 Special
Out discount price discount price discount price discount Price

43

However, if we had not (yet) tested the

MCDC Criterion individual accounts, the MC/DC criterion

would have uncovered them.
(from Pezze + Young, “Software Testing
Education Individual and Analysis”, Chapter 14)

Education account T T F F F F F F
Current purchase >
Threshold 1 – – F F T T – –
Current purchase >
Threshold 2 – – – – F F T T
Special price <
scheduled price F F
T F T – – – –
Special price <
Tier 1 – – – – F T – –
Special price <
Tier 2 – – – – – – F T
Edu Special No Special Tier 1 Special Tier 2 Special
Out discount price discount price discount price discount Price

44

Established by a number of studies

done by E. Weyuker at AT&T. “Any
Weyuker’s Hypothesis explicit relationship between coverage
and error detection would mean that we
have a fixed distribution of errors over
all statements and paths, which is
clearly not the case”.

The adequacy of a coverage criterion

can only be intuitively defined.

45
 To decide where to put most effort in
testing, one can also examine the past –
Learning from the past i.e., where did most defects occur in the
past. The above picture shows the
distribution of security vulnerabilities in
Firefox – the redder a rectangle, the
more vulnerabilities, and therefore a
likely candidate for intensive testing.
The group of Andreas Zeller at Saarland
University researches how to mine such
information automatically and how to
predict future defects.

46

Evidence: several studies, including

Zellerʼs own evidence :-)
Pareto’s Law

Approximately 80% of defects

come from 20% of modules

47

The main steps of a systematic

approach to functional program testing
Model-Based Testing (from Pezze + Young, “Software Testing
and Analysis”, Chapter 10)
identify
Functional Independently
specification testable feature

identify derive

Representative
Model
values

derive
generate
Test case
Test case
specifications

48
 The main steps of a systematic
approach to functional program testing
Deriving Test Case Specs (from Pezze + Young, “Software Testing
and Analysis”, Chapter 10)
identify
• specification
Input values enumerated in previous
Functional step
Independently
testable feature
• Now: need to take care of combinations
identify derive
• Typically, one Representative
uses models and values
Model
representative
values to generate derive
test cases generate
Test case
Test case
specifications

49

Many domains come as a combination

of individual inputs. We therefore need
Combinatorial Testing to cope with a combinatorial explosion.

IIS Windows
Server OS

Apache Linux

MySQL Oracle

Database 50

Combinatorial Testing

• Eliminate invalid combinations

IIS only runs on Windows, for example

• Cover all pairs of combinations

such as MySQL on Windows and Linux

• Combinations typically generated

automatically
and – hopefully – tested automatically, too

51
 Pairwise testing means to cover every
single pair of configurations
Pairwise Testing
IIS Windows IIS Windows

Apache Linux Apache Linux

MySQL Oracle MySQL Oracle

IIS Windows IIS Windows

Apache Linux Apache Linux

MySQL Oracle MySQL Oracle

52

In practice, such testing needs hundreds

and hundreds of PCs in every possible
Testing environment configuration – Microsoft, for instance,
has entire buildings filled with every
hardware imaginable
Source: http://www.ci.newton.ma.us/
MIS/Network.htm

• Millions of configurations
• Testing on dozens of different machines
• All needed to find & reproduce problems

53

The main steps of a systematic

approach to functional program testing
Deriving Test Case Specs (from Pezze + Young, “Software Testing
and Analysis”, Chapter 10)
identify
Functional Independently
specification testable feature

identify derive

Representative
Model
values

derive
generate
Test case
Test case
specifications

54
 The main steps of a systematic
approach to functional program testing
Deriving Test Cases (from Pezze + Young, “Software Testing
and Analysis”, Chapter 10)
identify
Functional Independently
specification testable feature
• Implement test cases in code identify derive
• Requires building scaffolding –
Representative
i.e., drivers and stubs values Model

derive
generate
Test case
Test case
specifications

55

Hereʼs an example for automated unit

tests – the well-known JUnit
Unit Tests
• Directly access units (= classes, modules,
components…) at their programming
interfaces
• Encapsulate a set of tests as a single
syntactical unit
• Available for all programming languages
(JUNIT for Java, CPPUNIT for C++, etc.)

56

The main steps of a systematic

approach to functional program testing
Deriving Test Cases (from Pezze + Young, “Software Testing
and Analysis”, Chapter 10)
identify
Functional Independently
specification testable feature

identify derive

Representative
Model
values

derive
generate
Test case
Test case
specifications

57
 The main steps of a systematic
approach to functional program testing
Systematic Functional Testing (from Pezze + Young, “Software Testing
and Analysis”, Chapter 10)
identify
Functional Independently
specification testable feature

identify derive

Representative
Model
values

derive
generate
Test case
Test case
specifications

58

Summary

59