I'm trying to understand the difference between non-functional requirements and quality attributes. Are they the same thing?

You can find a set of quality attributes in the ISO 9126, now ISO/IEC 2500xx SQuaRE family of standards.

I know that each system is defined by a set of functional requirements and every of this requirements has associated one or more quality attributes. For example, suppose that you have the requirement that describes the login functionality of a system. You can associate to that requirement the attributes of security and performance.

If I say that the system can not take more than 1 second to respond, I'm talking about a constraint.

So, where the concept of non-functional requirements kicks in? Are they defined by the users? How can I identify them?

  • 4
    To answer your question: yes, non-functional requirements and quality attributes are the same thing. Commented May 2, 2011 at 8:06

3 Answers 3


I think that you are thinking about this a little too hard. Functional and non-functional requirement are not really as separable as you are suggesting, Take the login case for example.

The user SHALL be able to log in through a web interface. Technically, this is a functional requirement.

The system MUST respond to log in requests within 1 second. Technically, this is a non-functional requirement.

Either way they are both just as important regardless of specific classification.

Requirements can come from any number of places. You might want to have better performance than a competitor. A customer might have specific needs. There might be a request from marketing or sales. There isn't one place were they come from. Though, you could probably abstract away all the different sources and refer to them as customers. Ultimately that is what they are.

You can identify the difference using the following metric. Functional requirements describe what a system will do. A non-functional requirement specifies how it does it.


The rule is simple and clear.

Functional requirements are things the system does.

Non-functional requirements are quality attributes or aspects of how the system is designed, built or implemented.

  • Performance (1 second)
  • Maintainability
  • Adaptability
  • Cost
  • security
  • usability (which is a property of the system as a whole)
  • testability
  • scalability

Read this. It's very clear. http://en.wikipedia.org/wiki/Non-functional_requirement

Non-functional requirements show up the same way functional requirements show up. Users. The context in which the system will be implemented. Lots of places. Management. Other organizations. Network admins, sys admins, database admins. Everyone who is a stakeholder or merely a bystander will contribute non-functional requirements.

When looking at "requirements documents" over the last 30 years, I can say this. Many requirements documents written by large, in-house IT organizations are political statements with perhaps 80% non-functional requirements and less than 20% functional requirements.

I read one that had a single sentence that was a functional requirement. The rest of the 30 page document talked about platform, and support, and backups and restores, and operating systems and database, and standards, and operations, and lots and lots of stuff that the system did not do.

  • LOL, I have had the opposite experience of lots of functional requirements and no non-functional ones until the systemm is done and it isn't fast enough (or secure enough, etc.), BUt then our requirements are written by people on the business side.
    – HLGEM
    Commented Jan 10, 2013 at 21:46

Non-Functional requirements and Quality Attributes are one and the same

The idea behind the name change in recent times is that, these so called non-functional requirements are in fact system functionality (or a set of system functionality) that has a cross-cut impact in the system. Meaning, the transversal impact that this kind of "special functionality" has in a system makes it a Quality Attribute of that system. As an example:

A system with 5 components must process a request in 10ms. If one component has a defect taking 5ms to make its part in the processing it will affect the performance of the system as a whole.

Just as security is not only about a login and when it is affected it affects the whole system.

Summarizing, quality attributes (i.e. non-functional requirements) are all about functionality, how you implement something and how this implementation affects your systems. Typically, the difference to the "normal requirements" is in its impact, range and visibility.

Here is an interesting link on how to identify them in a structured way:

And a book on how to document them and define them correctly:

Not the answer you're looking for? Browse other questions tagged or ask your own question.