The 7 Principles of Software Testing

All 7 Principles Explained

• 1. Testing shows presence of defects — Testing can prove bugs exist but CANNOT prove software is bug-free. Even 100% test coverage doesn't mean zero bugs.
• 2. Exhaustive testing is impossible — You can't test every combination of inputs, paths, and conditions. Prioritize using risk and business impact.
• 3. Early testing saves time and money — A bug found in requirements costs $1 to fix. In production: $100–$1000. Shift testing left.
• 4. Defects cluster together — 80% of bugs live in 20% of the code (Pareto principle). Focus testing effort on complex, high-change modules.
• 5. Beware of the pesticide paradox — Running the same tests finds the same bugs. Regularly review and add new test cases to find new bugs.
• 6. Testing is context dependent — Testing a banking app is different from testing a game. Techniques, rigor, and tools vary by domain.
• 7. Absence of errors is a fallacy — A bug-free app that doesn't meet user needs is still a failure. Verification AND validation both matter.

Principles Applied in Code

// ── Principle 4: Defect Clustering ────────────────────────────
// High-complexity functions cluster bugs. Target these first.
// Cyclomatic complexity > 10 = high defect probability zone

// LOW complexity — fewer tests needed
function isEven(n) {
    return n % 2 === 0;  // 1 path, 1 test covers it
}

// HIGH complexity — this function is a bug magnet
function processPayment(amount, currency, user, promoCode, isSubscriber) {
    // 15+ conditional branches = 15+ things that can go wrong
    if (!user) { /* ... */ }
    if (amount <= 0) { /* ... */ }
    if (currency !== "USD" && currency !== "EUR") { /* ... */ }
    if (promoCode) {
        if (isSubscriber) { /* 20% off */ }
        else { /* 10% off */ }
    }
    // ...more conditions
}
// This function needs 20+ test cases; the isEven function needs 2.

// ── Principle 5: Pesticide Paradox ────────────────────────────
// Version 1 tests (always run, always pass — pesticide effect):
test("login with valid email and password succeeds");
test("login with wrong password fails");

// After code changes in v2, add NEW tests addressing new scenarios:
test("login fails after 5 consecutive failures (lockout)");
test("login with SQL injection attempt is blocked");
test("login with Unicode characters in email succeeds");
test("session token expires after 30 minutes of inactivity");

Common Mistakes

• Violating Principle 1 — Claiming the software 'has no bugs' after testing. Testing proves presence, not absence.
• Violating Principle 2 — Trying to achieve 100% exhaustive testing and burning budget on diminishing returns.
• Violating Principle 3 — Creating tests only after development is complete. Requirements reviews are testing too.
• Violating Principle 7 — Focusing only on functional correctness while ignoring usability, performance, and user value.

Quick Quiz — 7 Principles of Testing

Tip

Practice Task

Common Mistake