SDLC and STLC
How software gets built from idea to release, the main development models (waterfall, V-model, agile, DevOps), and the testing life cycle that runs inside them.
Nobody builds a house by grabbing bricks and hoping for the best. First you decide what you need (three bedrooms, a big kitchen), then an architect draws plans, then builders build, an inspector checks the work, the family moves in, and for years afterwards someone fixes leaks and repaints the walls.
Software is built the same way. The steps have a name, and so do the steps that testers follow inside them. Knowing both tells you what is happening on your team right now and what you should be doing about it.
The SDLC in six phases
The software development life cycle (SDLC)Software development life cycleThe stages software goes through, from idea and requirements to release and maintenance.Open in glossary → is the sequence of stages software goes through, from “we have an idea” to “people use it every day”. Different companies use slightly different names, but almost all of them include these six:
| Phase | Building a house | Food delivery app example |
|---|---|---|
| 1. Requirements | “Three bedrooms, a garden, a budget of X.” | “Customers can apply one coupon code per order.” |
| 2. Design | The architect draws the plans. | Screens for the coupon field, rules, and which service checks the code. |
| 3. Development | Builders lay bricks, run pipes and wires. | Developers write the app code and the coupon service. |
| 4. Testing | The inspector checks walls, wiring and plumbing. | Testers check valid, expired and invalid coupons on phones and browsers. |
| 5. Deployment | The family gets the keys and moves in. | The new version goes live on the App Store, Google Play and the website. |
| 6. Maintenance | Fixing a leaky tap, adding a porch. | Fixing bugs users report, adding “free delivery” coupons later. |
The quick version
Four ways to run the SDLC
Teams arrange these six phases in different models:
- Waterfall. One phase after another, each finished before the next starts. Testing comes near the end. Simple to plan, but problems are found late.
- V-model. Like waterfall, but every design phase has a matching test level. While requirements are written, acceptance tests are designed; while the architecture is drawn, integration tests are planned. Tests are designed early, run late.
- AgileAgileA way of building software in small, frequent increments with constant feedback.Open in glossary →. Work is cut into short sprintsSprintA short, fixed period (often two weeks) in which a team builds and tests a set of work.Open in glossary → (often two weeks). Each sprint plans, builds, tests and shows a small working slice. Testing happens all the time, next to development. ScrumScrumA popular agile framework where a team works in short sprints with fixed roles and meetings.Open in glossary → is the most popular way of doing agile.
- DevOps / continuous delivery. Small changes flow through an automated pipeline that builds and tests every change, so the team can release very often. Manual testers focus on new features and risky areas.
Find it early, fix it cheap
A missing rule caught while reading a user storyUser storyA short description of a feature from the user's point of view.Open in glossary → costs a five-minute chat. The same problem found after release can mean a hotfix, an app store review, support tickets and refunds. Moving testing activities earlier is called shift-left (left = earlier on a timeline).
What testers do in each phase
Ask questions about requirements, review designs, write test cases during development, run tests when the buildBuildA specific compiled version of the app or website that is ready to be installed or tested.Open in glossary → is ready, smoke-check productionProductionThe live environment that real users use.Open in glossary → after release, and test fixes during maintenance.
The STLC: testing’s own life cycle
The software testing life cycle (STLC)Software testing life cycleThe phases of testing work, from analyzing requirements to closing the test cycle.Open in glossary → is the sequence of testing activities. Each phase has entry criteria (what must be true before you start) and exit criteria (what must be true before you call it done).
| STLC phase | Main deliverable |
|---|---|
| Requirement analysis | Questions, list of testable requirements |
| Test planning | Test planTest planA document describing what will be tested, how, by whom, when, and what 'done' means.Open in glossary → |
| Test case design | Test casesTest caseA written set of steps, data and an expected result used to check one specific behavior.Open in glossary →, test dataTest dataThe input values, accounts and records you use while testing.Open in glossary → |
| Environment setup | A working test environmentEnvironmentA setup of servers, data and configuration where the software runs, such as dev, staging or production.Open in glossary →, passed smoke testSmoke testingA quick check of the most important features to decide if a build is stable enough to test further.Open in glossary → |
| Test execution | Test results, bug reportsBug reportA clear written description of a bug so developers can reproduce and fix it.Open in glossary → |
| Test closure | Test summary report, lessons learned |
In an agile team the whole cycle repeats inside every sprint, often several times at once (one mini cycle per story).
Development models
A development model is the “recipe” a team uses to move through the SDLC phases: in which order, how often and how strictly. The model decides when you, as a tester, get to see working software. That is why it matters so much to your day.
Waterfall
In the waterfall model, each phase is finished and signed off before the next begins, like water falling down a staircase. Requirements are written in full, then the whole design, then all the code, and only then does testing start.
- Good for: stable, well-understood requirements, strict documentation needs, fixed contracts.
- Weak at: change. If testers discover in month ten that a requirement was misunderstood in month one, a lot of work has to be redone, and there is usually little time left.
V-model
The V-model is waterfall bent into a “V”. The left side goes down through definition and design; coding sits at the bottom; the right side goes back up through test levels. Every phase on the left is paired with a test level on the right:
The big idea: design the tests at the same time as the thing they will test. While the business writes “customers can apply one coupon per order”, testers already write the acceptance test for it. Writing a test is a great way to discover that a requirement is vague (“Is a free-delivery code a coupon too?”). The V-model is also a handy picture of two big questions: verificationVerificationChecking that we built the product right, according to its specification.Open in glossary → (“did we build it right?”, checked against the design) and validationValidationChecking that we built the right product, one that really meets users' needs.Open in glossary → (“did we build the right thing?”, checked against real needs). See Verification vs Validation. The four test levels get their own lesson: Levels of Testing.
Iterative and agile
Iterative models build the product in repeated cycles, adding and improving a bit each time. Agile is the most popular family of iterative approaches. Instead of one big release after a year, an agile team delivers a small, working, tested piece every few weeks and adjusts based on feedback.
Most agile teams use Scrum, which works in fixed time boxes called sprints, usually two weeks long:
- Backlog refinement. The team discusses upcoming user stories and sharpens their acceptance criteriaAcceptance criteriaConditions a user story must meet to be considered done and accepted.Open in glossary →.
- Sprint planning. The team picks the stories it can finish in this sprint.
- Build and test. Developers build the stories one by one; testers test each story as soon as it is ready. A short daily stand-up keeps everyone in sync.
- Sprint review. The team demos what is done to stakeholders.
- Retrospective. The team talks about what to improve next sprint. Then the next sprint starts.
In agile, testing is not a phase at the end. It is an activity that happens every day. The flip side: the app changes every sprint, so regression testingRegression testingRe-running tests to check that new changes didn't break things that used to work.Open in glossary → keeps growing, and teams need a smart regression set (and usually some automation).
DevOps and continuous delivery
DevOps joins development (“Dev”) and operations (“Ops”, the people who run the servers) into one team with shared responsibility. A key practice is a pipeline: every time a developer pushes a change to the shared code, a server automatically builds the app and runs the automated tests (this is called continuous integration, or CI). If the change passes, it can be released quickly and safely (continuous delivery, or CD). Some web teams release many times a day; mobile teams are slower because app store releases need review, but they often ship weekly or every two weeks.
For a beginner, three things matter:
- Automated checks run on every change. A red (failed) pipeline means “not ready”.
- Manual testing doesn’t disappear. It moves to where humans add the most value: new features, exploratory testingExploratory testingLearning, designing and running tests at the same time, guided by curiosity and a goal.Open in glossary →, usability and risky areas.
- Production is watched closely. Crash reports, error logs and user feedback become a source of bugs, and new features are often switched on for a small group of users first.
The models side by side
| Model | When you test | Best when |
|---|---|---|
| Waterfall | One big phase near the end | Requirements are fixed and well known |
| V-model | Design tests early, run them late | Strict quality or safety rules |
| Agile (Scrum) | Every day, inside each sprint | Requirements change and feedback matters |
| DevOps / CD | Continuously, mostly automated, plus manual for new work | Frequent, small releases |
Real teams often mix: a “mostly agile” team with a waterfall-style release phase for a big launch is very common.
Why finding bugs late costs more
Imagine nobody wrote down the rule “one coupon per order”. Here is what fixing it costs at each stage:
The later a bug is found, the more it costs
Example: the coupon rule "one coupon per order" was never written down.
- RequirementsEdit one sentence after a 5-minute chat.
- DesignChange a mock-up or a diagram.
- DevelopmentRewrite some code and its unit tests.
- TestingBug report, fix, new build, retest, regression.
- ProductionHotfix, app store review, support tickets, refunds, lost trust.
You may have seen charts claiming a bug costs “exactly 100 times more” in production. Be careful with precise numbers like that; they come from old studies of very different projects. The trend is what is real and widely agreed: the later a problem is found, the more work, people and risk its fix involves.
This is why modern teams shift left: they move testing activities earlier on the timeline. Shift-left doesn’t mean “test less at the end”. It means “also test at the beginning”: review requirements, discuss examples before coding, and test small pieces as soon as they exist.
Where testers get involved in each phase
| SDLC phase | What a tester does |
|---|---|
| Requirements | Reads stories, asks “what if…?”, points out missing or untestable criteria |
| Design | Reviews mock-ups and flows, spots missing states (loading, error, empty) |
| Development | Plans testing, writes test cases, prepares data and devices, tests early builds |
| Testing | Runs tests, explores, reports bugs, retests fixes, runs regression |
| Deployment | Smoke tests the release candidate and then production |
| Maintenance | Tests hotfixes, checks user-reported bugs, updates the regression suite |
The STLC: the testing life cycle
The software testing life cycle (STLC) describes the testing work itself, from “what are we testing?” to “here is what we found”. It runs inside the SDLC. (The ISTQB syllabus describes the same work as a “test process” with slightly different names, such as test analysis, test design, test implementation, test execution and test completion. The ideas match.)
Each phase has two kinds of rules:
- Entry criteria: what must be true before the phase can start. Like a recipe’s “you will need”: you can’t start baking without flour and an oven.
- Exit criteria: what must be true before the phase is “done”. Like “bake until golden and a toothpick comes out clean”. Without exit criteria, testing either never ends or ends whenever the deadline arrives.
- Requirement analysis. Read the requirements and user stories, find what is testable, ask questions, list risks. Entry: requirements are available. Exit: questions answered, testable requirements identified. Deliverables: question list, list of testable requirements, a first traceability matrixTraceability matrixA table linking each requirement to the test cases that cover it.Open in glossary → linking requirements to future tests.
- Test planning. Decide scope (what will and won’t be tested), approach, people, devices, schedule and risks. Entry: requirements understood. Exit: plan agreed. Deliverables: the test planTest planA document describing what will be tested, how, by whom, when, and what 'done' means.Open in glossary →, effort estimate. (A test strategyTest strategyThe high-level, long-term approach to testing used across a company or product.Open in glossary → is the higher-level, longer-lived document that many plans follow.)
- Test case design. Write test scenariosTest scenarioA high-level idea of what to test, such as 'User resets a forgotten password'.Open in glossary → and detailed test cases, and decide what data you need. Entry: plan approved. Exit: test cases written and reviewed, every requirement covered. Deliverables: test cases, test data, updated traceability matrix. See How to Write Test Cases.
- Test environment setup. Prepare the place where tests run: a test server or stagingStagingA pre-release environment that mirrors production as closely as possible.Open in glossary →, the right build, devices, accounts, test cards. Often runs in parallel with test case design. Entry: you know what the tests need. Exit: the build is installed and a smoke test passes. Deliverables: a ready environment, smoke test result.
- Test execution. Run the tests, compare expectedExpected resultWhat should happen when you perform a test step, according to the requirements.Open in glossary → and actual resultsActual resultWhat really happened when you performed the test.Open in glossary →, report bugs, retest fixes, run regression. Entry: test cases ready, environment passed the smoke test. Exit: planned tests run, no open critical bugs, agreed coverage reached. Deliverables: test results, bug reportsBug reportA clear written description of a bug so developers can reproduce and fix it.Open in glossary → (see How to Write Bug Reports), daily status.
- Test closure. Sum up and look back. Entry: execution exit criteria met, or the team decides to stop. Exit: report shared, lessons recorded. Deliverables: test summary report (what was tested, results, open bugs, risks, recommendation), lessons learned.
SDLC vs STLC
| SDLC | STLC | |
|---|---|---|
| Covers | Building the whole product | The testing work only |
| Who | Whole team | Mainly testers |
| Goal | Deliver working software | Find problems and give confidence |
| Relation | The big cycle | Runs inside it |
How the STLC fits inside a 2-week sprint
Here is what the STLC looks like for a tester on a food delivery team, sprint goal: “Customers can apply coupons at checkout.”
The STLC inside one 2-week sprint
Phases overlap. Each story goes through its own mini cycle while the sprint moves on.
Requirement analysis
Read the sprint stories, ask questions in planning and refinement.
Test planning
A light plan: which stories are risky, which devices, what regression to run.
Test case design
Write cases for each story while developers build it.
Environment setup
Install each new build on the test environment, smoke test it.
Test execution
Test stories as soon as each one is ready; retest fixes; regression at the end.
Test closure
Share results in the sprint review, raise process issues in the retro.
- Day 1 (planning): you read the three coupon stories, ask about expired codes and minimum order values, and note that you’ll need test accounts with order history. That is requirement analysis and test planning, done in an hour or two.
- Days 2-6: while developers build, you write test cases for each story and prepare coupon codes in the test environment. When the first story lands on day 4, you install the build, smoke test it and start testing.
- Days 4-9: you test each story as it arrives, log bugs, retest fixes the same day, and talk to developers constantly.
- Days 8-9: you run the regression set on the release candidate: login, cart, payment, order tracking.
- Day 10: you share a short summary in the sprint review (“all three stories pass; one low-severity layout bug left open”) and mention in the retro that stories arrived late.
The phases overlap, and each story runs through its own mini cycle. But all six are still there.
Try it: when does testing happen?
Switch between the models and watch the timeline. Then click the phases to see what testers do in each one.
When does testing happen?
Switch the development model, then click any phase to see what testers do there.
Each phase is finished and signed off before the next one starts, like water flowing down steps. Going back up is slow and expensive.
Testing is one big block near the end. Bugs found there have to travel all the way back up.
Phases
Requirements
Business analysts write down everything the app must do, often in a long requirements document.
Tester's role: Review the document and ask questions: "What happens if the coupon has expired?" Ambiguities found here cost a conversation, not a rewrite.
Works well
Clear plans and documents. Works when requirements are stable and well understood (for example, a regulated banking back-office system).
Watch out
Testers see working software late. A misunderstood requirement can survive for months before anyone runs the app.
Practice the STLC
First put the six phases in order, then match common deliverables to the phase that produces them.
STLC trainer
Two quick exercises. No dragging needed, just click.
Click the phases in the order a test team works through them.
- 1Empty slot
- 2Empty slot
- 3Empty slot
- 4Empty slot
- 5Empty slot
- 6Empty slot
Practice: plan the testing for one story
Here is a real-looking story from a travel booking app:
Story: As a traveler, I want to add travel insurance to my flight booking so that I am covered if I have to cancel.
Acceptance criteria:
- An “Add insurance” option appears on the payment screen for flights over 7 days away.
- The insurance costs 5% of the ticket price, minimum €10.
- The insurance appears as a separate line in the booking confirmation email.
On paper or in a note, try these three tasks:
- Requirement analysis: write at least three questions you would ask before testing.
- Entry criteria: what must be true before you can start test execution for this story?
- Exit criteria: when would you say testing of this story is done?
Show a sample answer
Questions: What about flights exactly 7 days away? Is the 5% calculated before or after taxes and discounts? What currency is the €10 minimum in for non-euro bookings? Can insurance be removed after booking? Does it apply to every passenger or the whole booking?
Entry criteria: the story’s questions are answered; the feature is deployed to the test environment; a smoke test of booking and payment passes; test cards and flight data (one flight 6, 7 and 8 days away, one cheap ticket below €200) are ready.
Exit criteria: all test cases for the three criteria have been run on iOS, Android and web; no open critical or high bugs; the confirmation email was checked; booking-and-payment regression passed.
SDLC and STLC checklist
0 of 8 checked
Check your understanding
Quick quiz
0/6 answered · 0 correct
1.In which model is testing mostly one big phase near the end of the project?
2.What is the main idea of the V-model?
3.A tester reads a new user story and asks: 'What happens if the coupon expires while it's in the cart?' Which STLC phase is this?
4.Which is a good exit criterion for test execution?
5.Which deliverable belongs to test closure?
6.Why is 'shift-left' valuable?
Key takeaways
- The SDLC is the life cycle of building software: requirements, design, development, testing, deployment, maintenance.
- Waterfall tests near the end; the V-model pairs each design phase with a test level; agile tests inside every sprint; DevOps tests every change, mostly automatically.
- The later a bug is found, the more it tends to cost to fix (a trend, not a fixed multiplier). Shift left: question requirements and test early.
- Testers add value in every SDLC phase, not only in “testing”.
- The STLC has six phases: requirement analysis, test planning, test case design, environment setup, test execution, test closure.
- Entry criteria say when a phase can start; exit criteria say when it is done. In agile, the whole STLC repeats (and overlaps) inside each sprint.
Finished this page?Nice work, this page is complete!
Mark it as done to track your progress. It's saved in this browser, no account needed.
Its review cards are now in Bites ⚡