# Quality dimensions Quality is several distinct dimensions rather than one, each needing its own verification. A program can be correct but slow, fast but insecure, secure but impossible to change six months on. Every software quality model rests on that premise, from Garvin's original framing (Garvin 1987)[^garvin1987] onward. The five dimensions developed here are five of **ISO/IEC 25010**'s eight product-quality characteristics (ISO/IEC 2011)[^isoiec25010_2011], the ones that carry a distinct verification method — close to the source-measurable set of **CISQ** (Consortium for Information and Software Quality (CISQ) 2021)[^cisq2021], plus Functionality. (The full mapping against Garvin, McCall, Boehm, FURPS, ISO, and CISQ is on the [framework comparison](https://quality.stereobooster.com/comparison.md).) ## Choosing methods for a system Picking and ordering the methods for a given part is its own procedure, set out under [**Choosing methods**](https://quality.stereobooster.com/choosing.md): rank the part's dimensions, match a method to each failure mode through the [axes](https://quality.stereobooster.com/axes.md), then sequence them by contextual cost. The ordered list and success picture on each dimension page are that procedure run once, for a typical part that already has continuous integration and a test suite; they illustrate the procedure rather than replace it. Each dimension here names *what it means* and *the methods that verify it*; the tools live on the method pages. The dimension's own page carries its failure modes, erosion signals, and methods in order of adoption. ### [Functionality](https://quality.stereobooster.com/functionality.md) - **What.** Does the software do what it claims? - **Methods.** [Example tests](https://quality.stereobooster.com/example-tests.md), [property-based testing](https://quality.stereobooster.com/property-based-testing.md), [differential](https://quality.stereobooster.com/differential-testing.md) and [metamorphic testing](https://quality.stereobooster.com/metamorphic-testing.md), [fuzzing](https://quality.stereobooster.com/fuzzing.md); [types](https://quality.stereobooster.com/types.md); [contracts](https://quality.stereobooster.com/contracts-and-runtime-assertions.md); [static analysis](https://quality.stereobooster.com/static-analysis.md); [code review](https://quality.stereobooster.com/code-review.md); [formal methods](https://quality.stereobooster.com/formal.md); [statistical and sampling testing](https://quality.stereobooster.com/statistical-testing.md). ### [Security](https://quality.stereobooster.com/security.md) - **What.** Does it hold up against someone trying to break it? - **Methods.** [Supply-chain hygiene](https://quality.stereobooster.com/supply-chain-hygiene.md), [static analysis / SAST](https://quality.stereobooster.com/deep-static-analysis.md), [threat modeling](https://quality.stereobooster.com/threat-modeling.md), [fuzzing](https://quality.stereobooster.com/fuzzing.md), [contracts](https://quality.stereobooster.com/contracts-and-runtime-assertions.md); plus DAST and penetration testing. ### [Reliability](https://quality.stereobooster.com/reliability.md) - **What.** Does it keep working when parts of it fail? - **Methods.** [Contracts and runtime invariants](https://quality.stereobooster.com/contracts-and-runtime-assertions.md), [monitoring and observability](https://quality.stereobooster.com/monitoring-and-observability.md), [chaos engineering](https://quality.stereobooster.com/chaos-engineering.md), [deterministic simulation testing](https://quality.stereobooster.com/deterministic-simulation-testing.md), [formal methods](https://quality.stereobooster.com/formal.md), [statistical model checking](https://quality.stereobooster.com/probabilistic-model-checking.md). ### [Performance](https://quality.stereobooster.com/performance.md) - **What.** Is it fast enough, and does it stay fast under load? - **Methods.** [Monitoring and observability](https://quality.stereobooster.com/monitoring-and-observability.md), [microbenchmarking](https://quality.stereobooster.com/microbenchmarking.md), [load and stress testing](https://quality.stereobooster.com/load-and-stress-testing.md), [profiling](https://quality.stereobooster.com/profiling.md); [superlinear cost at scale](https://quality.stereobooster.com/performance.md#superlinear-cost-at-scale). ### [Maintainability](https://quality.stereobooster.com/maintainability.md) - **What.** Can the next team change it safely? - **Methods.** [Types](https://quality.stereobooster.com/types.md), [static analysis](https://quality.stereobooster.com/static-analysis.md), [code review](https://quality.stereobooster.com/code-review.md), [git-history hotspots](https://quality.stereobooster.com/git-hotspots.md), [mutation testing](https://quality.stereobooster.com/mutation-testing.md), [change-point detection](https://quality.stereobooster.com/change-point-detection.md), [ADRs](https://quality.stereobooster.com/adrs.md), [refactoring practice](https://quality.stereobooster.com/refactoring-practice.md). ### Usability **Mentioned, not developed.** Ease of use for the intended user. A separate field with mature literature and tooling — WCAG audits, axe-core, user-research platforms, A/B experimentation (Statsig, GrowthBook). ### Aesthetics **Mentioned, not developed.** Fit, finish, perceived quality, trustworthiness signals. No method in this catalog verifies it: the oracle is a human judgment about the product's finish, not a check on its behavior. ### Data quality **A parallel vocabulary, not a sixth dimension.** When the subject under test is the *data* itself — data pipelines, analytics, ML feature stores — rather than the program, the governing model is **ISO/IEC 25012** (ISO/IEC 2008)[^isoiec25012], the data-quality sibling of the ISO/IEC 25010 software model these dimensions rest on. Its concerns are accuracy, completeness, consistency, timeliness, and schema or distribution drift over time. Those concerns land inside Functionality, Reliability and Performance rather than beside them: a field carrying a wrong value is a functionality failure, a feed that silently stops is a reliability one, and data arriving too late to act on is a performance one. ## Referenced by - [Maintainability](https://quality.stereobooster.com/maintainability.md) · Quality dimensions - [Methods](https://quality.stereobooster.com/methods.md) · Methods - [Recipes](https://quality.stereobooster.com/recipes.md) · Recipes - [Conventional](https://quality.stereobooster.com/conventional.md) · Conventional - [Choosing methods](https://quality.stereobooster.com/choosing.md) · Overview - [Software Quality](https://quality.stereobooster.com/index.md) · Overview ## References [^garvin1987]: Garvin, David A. 1987. "[Competing on the Eight Dimensions of Quality](https://hbr.org/1987/11/competing-on-the-eight-dimensions-of-quality)." *Harvard Business Review* 65 (6): 101–9. . [^isoiec25010_2011]: ISO/IEC. 2011. *[ISO/IEC 25010:2011: Systems and software engineering — SQuaRE — System and software quality models](https://www.iso.org/standard/35733.html)*. International Organization for Standardization. . [^cisq2021]: Consortium for Information and Software Quality (CISQ). 2021. *[Automated Source Code Quality Measures: Reliability, Security, Performance Efficiency, Maintainability (ISO/IEC 5055:2021)](https://www.it-cisq.org/standards/code-quality-standards/)*. . [^isoiec25012]: ISO/IEC. 2008. *[ISO/IEC 25012:2008: Software engineering — SQuaRE — Data quality model](https://www.iso.org/standard/35736.html)*. International Organization for Standardization. . ## Acronyms - ADR — architecture decision record - CISQ — Consortium for Information & Software Quality - DAST — dynamic application security testing - FURPS — Functionality, Usability, Reliability, Performance, Supportability - SAST — static application security testing