Approved. After 2 minutes

Approved. After 2 minutes.

You're at the checkout. You tap your card. The POS terminal shows a spinner, and it keeps spinning.

You look back. There are 10+ people in the queue. Everyone is getting nervous. Two of them leave for another cashier.

After about two minutes, the screen finally says "Approved".

The payment worked. The experience didn't.

That's the gap between functional and non-functional requirements.

Functional requirements say what the system must do:
When the customer taps the card within 4 cm of the terminal, start the transaction. Check the card, the balance and the limits. Run the fraud checks. Approve and hold the funds. Notify the customer and the merchant.

The payment above passed every one of them. And on the test environment, with a handful of payments at a time, it was fast. QA would sign off on it.

Non-functional requirements say how well it must do it. Speed, load, availability, what happens when something fails. Nobody wrote those down.

And even when someone does, it's easy to get wrong.

Say the team agrees on "the average payment takes under 3 seconds". On a normal day, it does. Then Black Friday comes, 100,000 people pay at once, and 1 in 100 payments hangs for two minutes. That's 1,000 people. The average is still about 2 seconds. The requirement is met. The people in that queue don't care.

It works the other way too. If 60 payments take 3.5 seconds and 40 take 2 seconds, the average is 2.9. The requirement is met again, while most customers wait longer than you promised.

An average hides the few who suffer and the many who wait. So a stronger version looks like this:
Speed: half of all payments are approved within 1.5 seconds, 95% within 2 seconds, 99% within 5 seconds.
Load: this holds at 3x our busiest hour on record.
Availability: 99.9% a month, excluding planned maintenance. That's about 43 minutes of downtime a month.
Failure: no answer in 10 seconds means a clear message on the screen and no money held.

Every line has a number, so every line can be tested.

Do you write down your non-functional requirements, or do you find them in production?