AS & A Level Computer Science 9618: Designing Normal, Boundary and Erroneous Test Data

A website requires users to create a new password between 8 and 20 characters long, inclusive. During validation, any password whose length is outside this range must be rejected, and the user asked to try again; any password whose length is within this range must be accepted.

(a) State one item of boundary (extreme) test data for the lower edge of the accepted length range, and one item of boundary (extreme) test data for the upper edge. For each, state whether the validation check should accept or reject it. [2]

(b) State one item of normal test data for the password length, and one item of erroneous (abnormal) test data for the password length, each different from your answers to part (a). For each, state whether the validation check should accept or reject it, and briefly explain why. [3]

(c) Explain why testing this validation check using only normal test data would not be sufficient to show that it works correctly. [2]

Part (a): Boundary (extreme) test data

The accepted length range is 8 to 20 characters, inclusive, so both endpoints are themselves valid lengths that the validation check must accept.

Lower edge: a password exactly 8 characters long, should be accepted, since 8 is the smallest length the validation check must allow.
Upper edge: a password exactly 20 characters long, should be accepted, since 20 is the largest length the validation check must allow.

[2 marks]: [1] for the correct lower-edge value (8, accepted), [1] for the correct upper-edge value (20, accepted).

Part (b): Normal and erroneous (abnormal) test data

Normal data: a length well inside the range and unremarkable in position, for example 14 characters, should be accepted, since 14 is comfortably between 8 and 20.
Erroneous (abnormal) data: a length that falls outside the accepted range altogether, for example 7 characters (one character short of the lower edge), should be rejected, since 7 is less than the minimum length of 8 allowed by the validation check. (A length of 21 characters, one character over the upper edge, would be an equally valid example of erroneous data.)

[3 marks]: [1] for a valid normal-data value (accepted, with a reason referring to it lying well inside the range), [1] for a valid erroneous-data value (rejected), [1] for a correct reason that the erroneous value lies outside the accepted range 8 to 20.

Part (c): Why normal data alone is not enough

Normal data only checks that the validation check behaves correctly for lengths that are clearly valid, well away from the limits of the accepted range. It does not check two other important kinds of behaviour:

Whether the validation check correctly accepts lengths sitting exactly on the edges of the range (boundary data, 8 and 20). A check that, for example, mistakenly excluded one endpoint would still pass every normal-data test.
Whether the validation check correctly rejects lengths that fall just outside the range (erroneous data, such as 7 or 21). A check that mistakenly accepted everything, with no upper or lower limit at all, would also still pass every normal-data test.

Because normal data alone cannot reveal either of these faults, boundary and erroneous data are both needed to properly test that the limits of the accepted range have been implemented correctly. [2 marks]: [1] for explaining that normal data does not test the edges of the range, [1] for explaining that normal data does not test that invalid lengths are correctly rejected.

Final answers

(a) Lower boundary: 8 characters, accepted. Upper boundary: 20 characters, accepted.
(b) Normal: 14 characters, accepted. Erroneous: 7 characters (or 21), rejected.
(c) Normal data alone cannot show that the boundaries of the range are correctly included, or that lengths outside the range are correctly rejected. Boundary and erroneous data are both needed for that.