1. 1 Tips for Testing Financial Authorization Systems Melvyn Feuerman Citibank - CGTI Testing Automation 02/08/05 Mel.Feuerman@citicorp.com

2. 2 Tips for testing Financial Authorization Systems. 1.Use Version Control for all phases of testing 2.Build Software Robots to prototype missing links in the transaction chain.. 3.Focus on Critical Exception Testing Case Study: ATM/POS Authorization System TPNS

3. 3 Case Study: Financial Authorization System $ ATM Client $ POS Client Server Host Authorizer : ‘Approve’ / ‘Decline’ the $ transaction $ Customer Database External Shared Networks The Client, Server and Host C are links in a transaction chain..

4. 4 Common problems Testing with the wrong version of the SoftwareTesting with the wrong version of the Software Software Defects on one platform delays all developmentSoftware Defects on one platform delays all development Connections down between platforms/external networksConnections down between platforms/external networks Exception conditions/delays between not tested.Exception conditions/delays between not tested. Customer Customer Database Client A Server B Authorizer Host C External Shared Networks Delays often lead to “finger pointing” instead of project teamwork!!

5. 5 Tip # 1 Use Software Version Control in all phases of testing Tracks module changes /authorize fixes Provides ‘damage control” for fallback Recreate a problem before testing the fix Propagate fixes to all releases of software Version Control provides “fences” between development and production

6. 6 Use Version Control to setup three “fences” between Development and Production Development Libraries Client A Server B Host C IST Libraries Client A Server B Host C UAT Libraries Client A Server B Host C Production Libraries Client A Server B Host C Trouble Tracking System

7. 7 Using Version Control for Host C Fence 1 Software Version Control Host C IST Library Fence 2 Software Version Control Host C Developmen t Library Host C Production Library Fence 3 Software Version Control Host C Release 1 AUTH1.0 Host C Release 3 AUTH3.0 Host C Release 4 AUTH4.0 Host C Release 2 AUTH2.0 Host C UAT Library Host C Release AUTH1. 1

8. 8 Always Test fixes under Version Control! Always Test fixes under Version Control! Server B Host C Authorizer Client A Reproduce the problem with Auth 1.0 Execute test script with new Auth 1.1 Compare “actual to expected” Write trouble report for the “delta” Trouble Tracking Software Developers Submit a fix Version Control Auth 1.0 Auth 1.1

9. 9 Tip # 2 Build software Robots to Prototype missing links in the Transaction Chain

10. 10 Determine the “missing links” in the transaction chain …then build a Robot (1) Client A needs a response from Server B (2) Host C needs a request from Server B (3) Server B needs both Client A and Host C Customer Customer Act, Amount Database Account Amt Client A Return-Code Customer Enters: Account Amount Account, Amt Server B Return-Code Account, Amt Host C Return-Code

11. 11 IBM Teleprocessing Network Simulator (TPNS) 1.Simulate clients, servers and hosts 2. Supported protocols include SNA and TCP/IP 3. VBASIC like syntax TPNS Responder to test a Client TPNS Requestor to test a Host

12. 12 Test of Client A with a TPNS responder for Server B Test of Client A________________ Get Cash Request (Act, Amt,Pin) Pars Request (Act, Amt,Pin) Send to Server B (Act,Amt,Pin) Accept Response ( Return-Code) Reply to Customer ( Return Code) Customer Interface ROBOTSRVB : MSGTXT onin then recvdata=data do forever wait until onin rc = ‘approve’ type rc transmit end Endtxt

13. 13 Test of Host C Function : HOSTC (Account, Amount) Pars Request from Server B Host C Database (Account, Amount) Return to Server B ( Return_Code) Host C Database Card Act # Balance xyz 2375 1000.00 atmtxs: msgutbl /*Card TXCODE AMT PIN */ (‘XYZ, Getcash, 100.00, ABCD) ‘(XYZ, Getcash, 200.00, ABCD) endutbl robotsrvb: msgtxt do i = 0 to utblmax(atmtxs) request = utbl(atmtxs,i) type request transmit end endtxt Test of Host C with a TPNS requestor for Server B

14. 14 Tip # 3 Focus on Critical Exception Testing 1. Execute high risk tests first.. 2. Use “Robots” for timeout/reversal testing”

15. 15 Test of Get Cash Card PIN Account XYZ 1234 2375 Account Starting Balance 2375 300.00 ATM Client A Server B Card # XYX Pin 1223 Get Cash $100.00 Host C Authorizer Account TXN Amount 2375 Got Cash 100.00 2375 Got Cash 50.00 External Shared Networks What is missing from this test

16. 16 (3) Host C (1) ATM Request $30.00 Wait 60 seconds For a response Customer Withdrawal Act 2375 Amt 30.00 Send $30.00 Reversal after 60 seconds (2) Server B Send Request Wait 45 seconds Send Reversal on late response from Host C Act Amount 2375 With 30.00 2375 Rev 30.00 Match Reversal against original Timeouts between platforms are difficult to reproduce with real devices Use Robots to test ATM, Server B and Host C timeout/reversal functionality

17. 17 Test of Client ATM Timeout/Reversal Processing Test of a Client ATM reversal Send Withdrawal for $50.00 Set Timer to 60 second If no response within 60 seconds send a $50.0 reversal ROBOTSRVB: MSGTXT wait until ONIN do forever Suspend 61 RC = ‘APPROVE’ type RC transmit end Endtxt Send Reversal of $50.00

18. 18 Review: Tips for testing an Authorization System 1.Manage Change with Library Version Control 2.Reproduce a “defect” before testing the “fix” 3.Use Software Robots to prototype missing links 4.Execute high risk tests first