Non-Functional Testing

"Functional" vs "Non-functional"

• Functional — what app DOES (login, checkout).
• Non-functional — HOW WELL it does (speed, scale, secure).

Categories (FURPS+)

• Functionality (covered separately).
• Usability.
• Reliability.
• Performance.
• Security.
• Plus: localization, accessibility, compatibility, scalability.

Performance subtypes

• Load — normal expected load.
• Stress — beyond limit, find breaking point.
• Spike — sudden surge (Black Friday).
• Endurance / Soak — long duration (24h).
• Scalability — scale linearly?
• Volume — large data sets.

Reliability metrics

• MTBF (Mean Time Between Failures).
• MTTR (Mean Time To Recovery).
• Availability — 99.9% = 8.76h downtime/year.
• Error rate — % requests fail.

Tools

• Performance: k6, JMeter, Gatling, Locust.
• Security: OWASP ZAP, Burp Suite, Nessus.
• Accessibility: axe-core, WAVE, Pa11y.
• Compatibility: BrowserStack, Sauce Labs.

VN context

SBV regulation cho banking: 99.95% uptime, MTTR < 1h, performance test mỗi major release. E-com Tết spike: load test 10× normal traffic mandatory.

Pyramid for non-functional

Don't test all every release. Schedule:

• Performance: nightly nhỏ, weekly đầy đủ.
• Security: each release scan, pentest quarterly.
• Accessibility: each major UI change.