Skip to content
Bugwise
Menu
Testing Fundamentals

SDLC and STLC

How software gets built from idea to release, the main development models (waterfall, V-model, agile, DevOps), and the testing life cycle that runs inside them.

beginner Mobile & web
Short on time? Switch to the quick version.

Nobody builds a house by grabbing bricks and hoping for the best. First you decide what you need (three bedrooms, a big kitchen), then an architect draws plans, then builders build, an inspector checks the work, the family moves in, and for years afterwards someone fixes leaks and repaints the walls.

Software is built the same way. The steps have a name, and so do the steps that testers follow inside them. Knowing both tells you what is happening on your team right now and what you should be doing about it.

The SDLC in six phases

The software development life cycle (SDLC)Software development life cycleThe stages software goes through, from idea and requirements to release and maintenance.Open in glossary → is the sequence of stages software goes through, from “we have an idea” to “people use it every day”. Different companies use slightly different names, but almost all of them include these six:

PhaseBuilding a houseFood delivery app example
1. Requirements“Three bedrooms, a garden, a budget of X.”“Customers can apply one coupon code per order.”
2. DesignThe architect draws the plans.Screens for the coupon field, rules, and which service checks the code.
3. DevelopmentBuilders lay bricks, run pipes and wires.Developers write the app code and the coupon service.
4. TestingThe inspector checks walls, wiring and plumbing.Testers check valid, expired and invalid coupons on phones and browsers.
5. DeploymentThe family gets the keys and moves in.The new version goes live on the App Store, Google Play and the website.
6. MaintenanceFixing a leaky tap, adding a porch.Fixing bugs users report, adding “free delivery” coupons later.

The quick version

Four ways to run the SDLC

Teams arrange these six phases in different models:

Find it early, fix it cheap

A missing rule caught while reading a user storyUser storyA short description of a feature from the user's point of view.Open in glossary → costs a five-minute chat. The same problem found after release can mean a hotfix, an app store review, support tickets and refunds. Moving testing activities earlier is called shift-left (left = earlier on a timeline).

What testers do in each phase

Ask questions about requirements, review designs, write test cases during development, run tests when the buildBuildA specific compiled version of the app or website that is ready to be installed or tested.Open in glossary → is ready, smoke-check productionProductionThe live environment that real users use.Open in glossary → after release, and test fixes during maintenance.

The STLC: testing’s own life cycle

The software testing life cycle (STLC)Software testing life cycleThe phases of testing work, from analyzing requirements to closing the test cycle.Open in glossary → is the sequence of testing activities. Each phase has entry criteria (what must be true before you start) and exit criteria (what must be true before you call it done).

STLC phaseMain deliverable
Requirement analysisQuestions, list of testable requirements
Test planningTest planTest planA document describing what will be tested, how, by whom, when, and what 'done' means.Open in glossary →
Test case designTest casesTest caseA written set of steps, data and an expected result used to check one specific behavior.Open in glossary →, test dataTest dataThe input values, accounts and records you use while testing.Open in glossary →
Environment setupA working test environmentEnvironmentA setup of servers, data and configuration where the software runs, such as dev, staging or production.Open in glossary →, passed smoke testSmoke testingA quick check of the most important features to decide if a build is stable enough to test further.Open in glossary →
Test executionTest results, bug reportsBug reportA clear written description of a bug so developers can reproduce and fix it.Open in glossary →
Test closureTest summary report, lessons learned

In an agile team the whole cycle repeats inside every sprint, often several times at once (one mini cycle per story).

Development models

A development model is the “recipe” a team uses to move through the SDLC phases: in which order, how often and how strictly. The model decides when you, as a tester, get to see working software. That is why it matters so much to your day.

Waterfall

In the waterfall model, each phase is finished and signed off before the next begins, like water falling down a staircase. Requirements are written in full, then the whole design, then all the code, and only then does testing start.

  • Good for: stable, well-understood requirements, strict documentation needs, fixed contracts.
  • Weak at: change. If testers discover in month ten that a requirement was misunderstood in month one, a lot of work has to be redone, and there is usually little time left.

V-model

The V-model is waterfall bent into a “V”. The left side goes down through definition and design; coding sits at the bottom; the right side goes back up through test levels. Every phase on the left is paired with a test level on the right:

Left side (define)Right side (test)
RequirementsAcceptance testingAcceptance testingTesting whether the product is ready to be accepted by the customer, users or business.Open in glossary →
System designSystem testingSystem testingTesting the complete, integrated product as a whole against its requirements.Open in glossary →
ArchitectureIntegration testingIntegration testingTesting that different parts of the system work correctly together.Open in glossary →
Module designUnit testingUnit testingTesting the smallest pieces of code, like a single function, usually by developers.Open in glossary →

The big idea: design the tests at the same time as the thing they will test. While the business writes “customers can apply one coupon per order”, testers already write the acceptance test for it. Writing a test is a great way to discover that a requirement is vague (“Is a free-delivery code a coupon too?”). The V-model is also a handy picture of two big questions: verificationVerificationChecking that we built the product right, according to its specification.Open in glossary → (“did we build it right?”, checked against the design) and validationValidationChecking that we built the right product, one that really meets users' needs.Open in glossary → (“did we build the right thing?”, checked against real needs). See Verification vs Validation. The four test levels get their own lesson: Levels of Testing.

Iterative and agile

Iterative models build the product in repeated cycles, adding and improving a bit each time. Agile is the most popular family of iterative approaches. Instead of one big release after a year, an agile team delivers a small, working, tested piece every few weeks and adjusts based on feedback.

Most agile teams use Scrum, which works in fixed time boxes called sprints, usually two weeks long:

  1. Backlog refinement. The team discusses upcoming user stories and sharpens their acceptance criteriaAcceptance criteriaConditions a user story must meet to be considered done and accepted.Open in glossary →.
  2. Sprint planning. The team picks the stories it can finish in this sprint.
  3. Build and test. Developers build the stories one by one; testers test each story as soon as it is ready. A short daily stand-up keeps everyone in sync.
  4. Sprint review. The team demos what is done to stakeholders.
  5. Retrospective. The team talks about what to improve next sprint. Then the next sprint starts.

In agile, testing is not a phase at the end. It is an activity that happens every day. The flip side: the app changes every sprint, so regression testingRegression testingRe-running tests to check that new changes didn't break things that used to work.Open in glossary → keeps growing, and teams need a smart regression set (and usually some automation).

DevOps and continuous delivery

DevOps joins development (“Dev”) and operations (“Ops”, the people who run the servers) into one team with shared responsibility. A key practice is a pipeline: every time a developer pushes a change to the shared code, a server automatically builds the app and runs the automated tests (this is called continuous integration, or CI). If the change passes, it can be released quickly and safely (continuous delivery, or CD). Some web teams release many times a day; mobile teams are slower because app store releases need review, but they often ship weekly or every two weeks.

For a beginner, three things matter:

The models side by side

ModelWhen you testBest when
WaterfallOne big phase near the endRequirements are fixed and well known
V-modelDesign tests early, run them lateStrict quality or safety rules
Agile (Scrum)Every day, inside each sprintRequirements change and feedback matters
DevOps / CDContinuously, mostly automated, plus manual for new workFrequent, small releases

Real teams often mix: a “mostly agile” team with a waterfall-style release phase for a big launch is very common.

Why finding bugs late costs more

Imagine nobody wrote down the rule “one coupon per order”. Here is what fixing it costs at each stage:

The later a bug is found, the more it costs

Example: the coupon rule "one coupon per order" was never written down.

  1. RequirementsEdit one sentence after a 5-minute chat.
  2. DesignChange a mock-up or a diagram.
  3. DevelopmentRewrite some code and its unit tests.
  4. TestingBug report, fix, new build, retest, regression.
  5. ProductionHotfix, app store review, support tickets, refunds, lost trust.
Bar heights show the trend, not exact numbers. The real cost depends on the team and the bug, but the direction is almost always the same.

You may have seen charts claiming a bug costs “exactly 100 times more” in production. Be careful with precise numbers like that; they come from old studies of very different projects. The trend is what is real and widely agreed: the later a problem is found, the more work, people and risk its fix involves.

This is why modern teams shift left: they move testing activities earlier on the timeline. Shift-left doesn’t mean “test less at the end”. It means “also test at the beginning”: review requirements, discuss examples before coding, and test small pieces as soon as they exist.

Where testers get involved in each phase

SDLC phaseWhat a tester does
RequirementsReads stories, asks “what if…?”, points out missing or untestable criteria
DesignReviews mock-ups and flows, spots missing states (loading, error, empty)
DevelopmentPlans testing, writes test cases, prepares data and devices, tests early builds
TestingRuns tests, explores, reports bugs, retests fixes, runs regression
DeploymentSmoke tests the release candidate and then production
MaintenanceTests hotfixes, checks user-reported bugs, updates the regression suite

The STLC: the testing life cycle

The software testing life cycle (STLC) describes the testing work itself, from “what are we testing?” to “here is what we found”. It runs inside the SDLC. (The ISTQB syllabus describes the same work as a “test process” with slightly different names, such as test analysis, test design, test implementation, test execution and test completion. The ideas match.)

Each phase has two kinds of rules:

  • Entry criteria: what must be true before the phase can start. Like a recipe’s “you will need”: you can’t start baking without flour and an oven.
  • Exit criteria: what must be true before the phase is “done”. Like “bake until golden and a toothpick comes out clean”. Without exit criteria, testing either never ends or ends whenever the deadline arrives.
  1. Requirement analysis. Read the requirements and user stories, find what is testable, ask questions, list risks. Entry: requirements are available. Exit: questions answered, testable requirements identified. Deliverables: question list, list of testable requirements, a first traceability matrixTraceability matrixA table linking each requirement to the test cases that cover it.Open in glossary → linking requirements to future tests.
  2. Test planning. Decide scope (what will and won’t be tested), approach, people, devices, schedule and risks. Entry: requirements understood. Exit: plan agreed. Deliverables: the test planTest planA document describing what will be tested, how, by whom, when, and what 'done' means.Open in glossary →, effort estimate. (A test strategyTest strategyThe high-level, long-term approach to testing used across a company or product.Open in glossary → is the higher-level, longer-lived document that many plans follow.)
  3. Test case design. Write test scenariosTest scenarioA high-level idea of what to test, such as 'User resets a forgotten password'.Open in glossary → and detailed test cases, and decide what data you need. Entry: plan approved. Exit: test cases written and reviewed, every requirement covered. Deliverables: test cases, test data, updated traceability matrix. See How to Write Test Cases.
  4. Test environment setup. Prepare the place where tests run: a test server or stagingStagingA pre-release environment that mirrors production as closely as possible.Open in glossary →, the right build, devices, accounts, test cards. Often runs in parallel with test case design. Entry: you know what the tests need. Exit: the build is installed and a smoke test passes. Deliverables: a ready environment, smoke test result.
  5. Test execution. Run the tests, compare expectedExpected resultWhat should happen when you perform a test step, according to the requirements.Open in glossary → and actual resultsActual resultWhat really happened when you performed the test.Open in glossary →, report bugs, retest fixes, run regression. Entry: test cases ready, environment passed the smoke test. Exit: planned tests run, no open critical bugs, agreed coverage reached. Deliverables: test results, bug reportsBug reportA clear written description of a bug so developers can reproduce and fix it.Open in glossary → (see How to Write Bug Reports), daily status.
  6. Test closure. Sum up and look back. Entry: execution exit criteria met, or the team decides to stop. Exit: report shared, lessons recorded. Deliverables: test summary report (what was tested, results, open bugs, risks, recommendation), lessons learned.

SDLC vs STLC

SDLCSTLC
CoversBuilding the whole productThe testing work only
WhoWhole teamMainly testers
GoalDeliver working softwareFind problems and give confidence
RelationThe big cycleRuns inside it

How the STLC fits inside a 2-week sprint

Here is what the STLC looks like for a tester on a food delivery team, sprint goal: “Customers can apply coupons at checkout.”

The STLC inside one 2-week sprint

Phases overlap. Each story goes through its own mini cycle while the sprint moves on.

Requirement analysis

Read the sprint stories, ask questions in planning and refinement.

Test planning

A light plan: which stories are risky, which devices, what regression to run.

Test case design

Write cases for each story while developers build it.

Environment setup

Install each new build on the test environment, smoke test it.

Test execution

Test stories as soon as each one is ready; retest fixes; regression at the end.

Test closure

Share results in the sprint review, raise process issues in the retro.

A typical shape, not a rule. Some teams run regression on a separate release branch, and many keep a "test-ready by day 8" agreement so stories don't all land on the last day.
  • Day 1 (planning): you read the three coupon stories, ask about expired codes and minimum order values, and note that you’ll need test accounts with order history. That is requirement analysis and test planning, done in an hour or two.
  • Days 2-6: while developers build, you write test cases for each story and prepare coupon codes in the test environment. When the first story lands on day 4, you install the build, smoke test it and start testing.
  • Days 4-9: you test each story as it arrives, log bugs, retest fixes the same day, and talk to developers constantly.
  • Days 8-9: you run the regression set on the release candidate: login, cart, payment, order tracking.
  • Day 10: you share a short summary in the sprint review (“all three stories pass; one low-severity layout bug left open”) and mention in the retro that stories arrived late.

The phases overlap, and each story runs through its own mini cycle. But all six are still there.

Try it: when does testing happen?

Switch between the models and watch the timeline. Then click the phases to see what testers do in each one.

When does testing happen?

Switch the development model, then click any phase to see what testers do there.

Each phase is finished and signed off before the next one starts, like water flowing down steps. Going back up is slow and expensive.

Project timeline testing
Project startRelease

Testing is one big block near the end. Bugs found there have to travel all the way back up.

Phases

Requirements

Business analysts write down everything the app must do, often in a long requirements document.

Tester's role: Review the document and ask questions: "What happens if the coupon has expired?" Ambiguities found here cost a conversation, not a rewrite.

Works well

Clear plans and documents. Works when requirements are stable and well understood (for example, a regulated banking back-office system).

Watch out

Testers see working software late. A misunderstood requirement can survive for months before anyone runs the app.

Practice the STLC

First put the six phases in order, then match common deliverables to the phase that produces them.

STLC trainer

Two quick exercises. No dragging needed, just click.

Click the phases in the order a test team works through them.

  1. 1Empty slot
  2. 2Empty slot
  3. 3Empty slot
  4. 4Empty slot
  5. 5Empty slot
  6. 6Empty slot

Practice: plan the testing for one story

Here is a real-looking story from a travel booking app:

Story: As a traveler, I want to add travel insurance to my flight booking so that I am covered if I have to cancel.

Acceptance criteria:

  1. An “Add insurance” option appears on the payment screen for flights over 7 days away.
  2. The insurance costs 5% of the ticket price, minimum €10.
  3. The insurance appears as a separate line in the booking confirmation email.

On paper or in a note, try these three tasks:

  1. Requirement analysis: write at least three questions you would ask before testing.
  2. Entry criteria: what must be true before you can start test execution for this story?
  3. Exit criteria: when would you say testing of this story is done?
Show a sample answer

Questions: What about flights exactly 7 days away? Is the 5% calculated before or after taxes and discounts? What currency is the €10 minimum in for non-euro bookings? Can insurance be removed after booking? Does it apply to every passenger or the whole booking?

Entry criteria: the story’s questions are answered; the feature is deployed to the test environment; a smoke test of booking and payment passes; test cards and flight data (one flight 6, 7 and 8 days away, one cheap ticket below €200) are ready.

Exit criteria: all test cases for the three criteria have been run on iOS, Android and web; no open critical or high bugs; the confirmation email was checked; booking-and-payment regression passed.

SDLC and STLC checklist

0 of 8 checked

Check your understanding

Quick quiz

0/6 answered · 0 correct

  1. 1.In which model is testing mostly one big phase near the end of the project?

  2. 2.What is the main idea of the V-model?

  3. 3.A tester reads a new user story and asks: 'What happens if the coupon expires while it's in the cart?' Which STLC phase is this?

  4. 4.Which is a good exit criterion for test execution?

  5. 5.Which deliverable belongs to test closure?

  6. 6.Why is 'shift-left' valuable?

Key takeaways

  • The SDLC is the life cycle of building software: requirements, design, development, testing, deployment, maintenance.
  • Waterfall tests near the end; the V-model pairs each design phase with a test level; agile tests inside every sprint; DevOps tests every change, mostly automatically.
  • The later a bug is found, the more it tends to cost to fix (a trend, not a fixed multiplier). Shift left: question requirements and test early.
  • Testers add value in every SDLC phase, not only in “testing”.
  • The STLC has six phases: requirement analysis, test planning, test case design, environment setup, test execution, test closure.
  • Entry criteria say when a phase can start; exit criteria say when it is done. In agile, the whole STLC repeats (and overlaps) inside each sprint.

Finished this page?Nice work, this page is complete!

Mark it as done to track your progress. It's saved in this browser, no account needed.

Its review cards are now in Bites ⚡
Esc

Type to search the whole site.