# Software Testing — Levels, Black-Box, White-Box and Cyclomatic Complexity

Source: https://skills101.in/learn/software-engineering/software-testing-levels-black-white-box — Skills101 free tutorial (Software Engineering). Updated 2026-11-09.

Testing finds defects **before** users do. A bug found during design costs a little; the same bug found after release can cost 100 times more.

## 1. Basic terms

- **Error (mistake)** — a human mistake by a developer.
- **Defect (bug / fault)** — the wrong code that results.
- **Failure** — the system behaving wrongly when the defect runs.
- **Verification** — "Are we building the product **right**?" (reviews, inspections, walkthroughs — checking against the spec, often without running code).
- **Validation** — "Are we building the **right** product?" (running the software to check it meets user needs).

Testing shows the presence of bugs, never their absence — you can't test everything.

## 2. Levels of testing

![Testing pyramid: many unit tests at the base, then integration, system and acceptance testing at the top](https://skills101.in/learn-img/software-engineering/testing-levels.svg)

| Level | Tests | Who |
|---|---|---|
| Unit | one function/class in isolation | developers |
| Integration | modules working together | developers/testers |
| System | the complete system against the SRS (functional + performance, security…) | test team |
| Acceptance | does it meet the customer's needs? | customer/users |

**Integration approaches:** big-bang (all at once — hard to find bugs), **top-down** (uses **stubs** for lower modules not ready yet), **bottom-up** (uses **drivers** to call lower modules), sandwich (both).

**Alpha testing** — by real users at the developer's site. **Beta testing** — by real users at their own location, before the final release.

## 3. Black-box vs white-box

![Black-box testing checks inputs and outputs against the specification with the code hidden; white-box testing checks paths through visible code](https://skills101.in/learn-img/software-engineering/box-testing.svg)

### Black-box techniques

**Equivalence partitioning** — split inputs into classes that behave the same and test one value from each.
Age must be 18–60 → classes: below 18 (invalid), 18–60 (valid), above 60 (invalid). Tests: 10, 35, 70.

**Boundary value analysis (BVA)** — bugs hide at edges, so test min−1, min, min+1, max−1, max, max+1.
For 18–60: **17, 18, 19, 59, 60, 61**.

Also: decision tables (combinations of conditions) and state transition testing.

### White-box techniques

- **Statement coverage** — every line runs at least once.
- **Branch (decision) coverage** — every if/else outcome is taken (true and false). Branch coverage is stronger than statement coverage.
- **Path coverage** — every independent path is tested.

## 4. Cyclomatic complexity (McCabe)

The number of **independent paths** through code = the minimum number of test cases for full branch coverage.

![Flow graph with 6 nodes and 7 edges for an if/else-if grade program; cyclomatic complexity is 7 minus 6 plus 2 equals 3](https://skills101.in/learn-img/software-engineering/flow-graph.svg)

Three equivalent formulas:

- **V(G) = E − N + 2** (edges − nodes + 2)
- **V(G) = P + 1** (P = number of decision/predicate nodes)
- **V(G) = number of regions** in the flow graph (including the outside region)

For the grade program: 7 − 6 + 2 = **3**, and 2 decisions + 1 = **3**. So 3 test cases: marks 95 (A), 75 (B), 40 (C).

A rule of thumb: keep V(G) ≤ 10 per function; higher means harder to test and maintain.

## 5. More test types

- **Regression testing** — re-run old tests after a change to make sure nothing else broke (perfect for automation).
- **Smoke testing** — quick check that the build's main functions work at all.
- **Sanity testing** — narrow check that a specific fix works.
- **Performance, load, stress testing** — speed, expected load, beyond-limit load.
- **Usability, security, compatibility testing.**

## Common mistakes

- Swapping verification and validation.
- Using only valid values in BVA — include the invalid neighbours (17 and 61).
- Thinking 100% statement coverage means 100% branch coverage.

## Quick recap

- Error → defect → failure. Verification: built right; validation: right product.
- Unit → integration (stubs/drivers) → system → acceptance (alpha, beta).
- Black box: equivalence classes, boundary values. White box: statement, branch, path coverage.
- V(G) = E − N + 2 = decisions + 1.


Practice quiz and free certificate: https://skills101.in/learn/software-engineering/software-testing-levels-black-white-box