Risk Management & DFMEA

How ConstructiVision traces every bug and every feature back to a pre-committed risk register — with measurable prediction accuracy that almost no SDLC achieves.

The Control Most SDLC Projects Don't Have

Every software project has a bug tracker. Most have a risk log of some kind. Almost none have them structurally connected — where every bug is required to reference a specific risk register entry, the risk register is measurably validated by the bugs that emerge from testing, and the failure mode predictions can be scored for accuracy after the fact.

What Makes This Traceability Unusual

The DFMEA (failure mode analysis) is written before any development session begins. Every bug discovered in testing must match a DFMEA entry — or trigger a new one, permanently expanding the model's coverage. The result: a risk register that is empirically validated by real test data, with a measurable accuracy rate of 86% across 21 bugs logged over 3 build iterations.

Most SDLC tools operate with three disconnected worlds: a feature backlog (what we're building), a bug tracker (what went wrong), and a risk register (theoretical hazards, reviewed at kickoff and archived). In ConstructiVision, these three form a single connected graph — navigable in any direction, version-controlled, and subject to a coverage metric you almost never see in software engineering practice.


What DFMEA Is — And What It Isn't

DFMEA (Design Failure Mode & Effects Analysis) is a structured pre-development analysis borrowed from manufacturing engineering. For each function the product performs, you systematically ask: what could fail here? How severe would that be? How often might it occur? How hard would it be to detect before it reaches the customer?

S × O × D
RPN formula: Severity (1–10) × Occurrence (1–10) × Detection (1–10) = Risk Priority Number (1–1000)
≥ 200
RPN threshold requiring a documented Recommended Action before a build can be declared releasable
S = 10
Maximum Severity — reserved for failure modes with potential to cause physical harm or structural failure
Tool Typical Usage (Industry) ConstructiVision Usage
Bug Tracker Issues logged reactively after discovery; closed on fix; no structural linkage to risk model Every bug must cite a DFMEA ID and confirmed RPN. Bug cannot close without the DFMEA cross-reference being updated in doc 32.
Risk Register Generated at project kickoff; rarely updated; treated as a compliance artifact and archived Living document — each new bug that doesn't match an existing entry creates a new DFMEA row with S/O/D ratings. Detection (D) improves when a fix adds observable controls.
Feature Backlog Separate from risk; feature "done" when code ships and tests pass Features are the subjects of DFMEA rows. A feature shipped without DFMEA coverage for its failure modes is definitionally incomplete — tracked as tech debt.
GitHub Issue Title, description, labels, assignee — no required fields beyond title Enforced template includes a ## DFMEA Reference section with DFMEA ID, RPN, and match classification (Yes / NEW). Missing this section = issue not properly filed.

The Traceability Chain — Navigable in Any Direction

Every significant failure mode in ConstructiVision travels a documented chain from design intent to closed defect. The chain can be followed forward (feature → risk → bug → fix) or backward (bug → risk → feature). Both directions are always populated because filing a bug without a DFMEA link is not a valid final state.

① Feature
Weld Connection Dialog
User selects hardware type for concrete panel embedments and connections
② DFMEA Row (pre-committed)
FM-07 — Wrong hardware selected
S=10: incorrect weld hardware in fabrication drawings → structural failure during panel tilt · RPN 360
③ Bug Discovered
Bug #12
Incompatible hardware combination not flagged · found by AutoIT+OCR validation run · DFMEA match: FM-07 ✓
④ Fix Applied
wc_dlg.lsp
Incompatible combinations disabled at UI level; validation added to selection callback
⑤ DFMEA Updated
D: 6 → 3
Detection improved by UI control; new RPN = 10 × 6 × 3 = 180 · now below 200 threshold

Starting from Bug #12 leads immediately to FM-07 and the weld connection feature. Starting from the feature leads to all associated DFMEA rows. The risk register is always a live, navigable map of the codebase's known failure modes — not a snapshot frozen at project start.


Pre-Commitment: Written Before AI Touches the Code

The DFMEA is not written after bugs are found. It is written at the start of a design phase, before code editing begins. This is a deliberate engineering constraint — not process overhead.

Why Pre-Commitment Closes an AI-Specific Vulnerability

An AI agent optimizing toward task completion will minimize perceived severity of obstacles. If allowed to retroactively define what constitutes a significant defect, an AI could:

  1. Receive a failing test, observe it relates to the weld connection dialog
  2. Reason that "the failure mode seems edge-case, severity is probably low"
  3. Assign S=3 instead of S=10, producing RPN 54 — below the action threshold
  4. Close the issue as "low priority, no action required"
  5. Commit, push, and move on — with a structural safety issue unresolved

Pre-committed DFMEA entries — with S=10 locked in version control before the first line of code was written — prevent this rationalization completely. The severity was defined by a human engineer analyzing the physical consequences. It is not a field the AI session can redefine.

// copilot-instructions.md — mandatory DFMEA linkage rule

Every bug must link to the DFMEA. When logging a bug:
- Identify the matching DFMEA failure mode from doc 31, Section 9
- Add the DFMEA # to the bug entry AND the cross-ref table in doc 32
- If bug MATCHES predicted failure mode → validate symptom aligns with predicted effect
- If bug is NEW → flag NEW, add row to DFMEA with S/O/D ratings, calculate RPN
- If RPN ≥ 200 → document Recommended Action before build can be released

Every GitHub Issue MUST include a ## DFMEA Reference section.
// This rule is in the AI agent's mandatory instructions — not a style guide.

The Actual Risk Scores — ConstructiVision DFMEA Table

These are real entries from the project DFMEA, not illustrative examples. ConstructiVision runs inside AutoCAD 2000 to generate structural specifications and panel books for concrete tilt-up construction. The top failure modes reflect that physical context directly.

RPN S Failure Mode Worst-Case Effect Current Controls
500 Windows Help subsystem removed from Win10/Win11 All users on modern Windows lose in-application help — critical for field engineers who cannot pause construction activity for web searches Identified at project start; requires alternative help delivery in modernization. No mitigation currently deployed. Action required before release.
360 10 Weld connection dialog — wrong hardware type specified Incorrect weld hardware specification reaches fabrication drawings → physical structural failure during concrete panel tilt on job site AutoIT+OCR validation verifies dialog content on every build. UI-level hardware combination validation under active development in wc_dlg.lsp.
315 9 Dimensional data entry — uncaught input error propagation Dimension typo propagates silently through panel book to fabrication → defective physical panel shipped to job site mp_dlg validation callbacks via chrchk.lsp; range checks at dialog level. No downstream cross-check at drawing-generation level — Detection (D) currently elevated.
≥200
(pre-fix)
7 Startup timing race — plugin loads before AutoCAD subsystem ready AutoCAD crash (0xC0000005) at LocalizeReservedPlotStyleStrings+533 on application start — product completely unusable on affected VM configuration Fixed — Bug 20. VLX load timing adjusted. RPN now below 200 threshold. Confirmed by full four-VM validation matrix run.
Closed Missing Menus\Group1\Pop13 registry keys setvars crashes on load; all CSV menu items fail; product non-functional from first launch Fixed — Bug 19. Registry keys added to Configure-ConstructiVision.ps1. Detection improved — deployment script now validates key existence. Confirmed VM 102, 104, 108, 109.
Closed Missing Project Settings\CV\RefSearchPath registry key Site drawing file not found on project load — partial product failure; Edit Existing Drawing workflow broken Fixed — Bug 21. Key added to deployment script; verified on VM 104 with SSH reg query comparison against VM 102 golden baseline.

What RPN ≥ 200 Means in Practice

Any failure mode with RPN ≥ 200 requires a documented Recommended Action in the DFMEA table. That action must be completed and the Detection (D) rating updated before the build can be declared releasable. This is the mechanism that prevents a "known issue, low priority" backlog from holding safety-adjacent items indefinitely — the threshold is defined in the risk model, not negotiated at release time.


Enforced Issue Template — Every Bug Carries Its DFMEA Link

The requirement isn't documented in a style guide that can be ignored. It is embedded in the AI agent's mandatory operating instructions — the file that governs every AI-assisted development session. A GitHub Issue that lacks a ## DFMEA Reference section has not satisfied the definition of "properly filed."

● Open [Bug #19] setvars Function cancelled — missing HKCU Menus\Group1\Pop13 registry keys
## Description
On VM 104 (XP SP3, TB11-01x32): AutoCAD reports setvars Function cancelled immediately after CSV menu launch. All menu functions fail. Product non-functional on this configuration.
## Root Cause
Missing registry keys at:
HKCU\SOFTWARE\Autodesk\AutoCAD\R15.0\ACAD-1:409\Profiles\<<Unnamed Profile>>\Menus\Group1
HKCU\...\Menus\Pop13
Keys present on VM 102 (working) — absent on VM 104 (broken). Identified by SSH reg query diff.
## DFMEA Reference
DFMEA ID: FM-03 — Registry configuration incomplete on fresh install
RPN (pre-fix): 280 (S=7, O=8, D=5)
Predicted Failure Mode: Missing deployment artifact causes product non-functional on clean environment
Match: Yes — symptom (setvars cancelled, menu non-functional) aligns exactly with predicted effect
RPN (post-fix): 112 (S=7, O=8, D=2) — Detection improved by Configure-ConstructiVision.ps1 validation check
## Fix
Missing keys added to Configure-ConstructiVision.ps1. Script now creates keys during VM setup. Verified passing on VM 102, 104, 108, 109 via full OCR comparison against VM 103 golden baseline.

bug severity: high dfmea: fm-03 status: fixed

Prediction Coverage — How Good Is the Risk Model?

Because every bug must link to a DFMEA entry, it is possible to ask a question that most projects never can: what fraction of the bugs that actually appeared were predicted before testing began?

The answer, across 21 bugs logged over 3 build iterations: 86% prediction coverage.

86% — 18 of 21 bugs matched a pre-predicted failure category
18
Bugs matched an existing DFMEA entry — the risk model correctly predicted the failure category before testing began
3
Bugs were NEW failure modes — not predicted, triggered new DFMEA rows, permanently expanding coverage
21
Total bugs logged across 3 build versions with full DFMEA traceability and bidirectional linking

What 86% Coverage Tells You

The DFMEA was written before any code was edited. Fourteen percent of the bugs that showed up were genuinely not anticipated — failure modes the analysis had not predicted. Each of those 3 bugs created a new DFMEA row, permanently improving the model's coverage for future development cycles. A risk register that updates when it's wrong is fundamentally different from one that gets archived after project kickoff. The 86% figure is not a target — it is a measurement of how well the initial risk analysis characterized the actual failure space of the product.


When a Bug Escapes the DFMEA — The Model Expands

When testing discovers a bug with no matching DFMEA entry, the protocol is explicit and mandatory:

If bug is NEW (no existing DFMEA entry matches):
1. Flag as NEW in the bug tracker entry (doc 32)
2. Add a new row to the DFMEA table (doc 31, Section 9)
3. Assign S, O, D ratings — calculate RPN
4. Add cross-reference in doc 32 DFMEA table with Match = NEW
5. If RPN ≥ 200 → document Recommended Action before release

// This is not penalizing the prediction. It's improving it.
// After this cycle, the DFMEA covers one more real failure mode than before.
// The model's prediction accuracy improves with each build iteration.

This means the risk model grows more accurate over time. A product that has run 3 validation campaigns across 4 VM configurations, discovered 21 bugs, and maintained 86% prediction coverage is producing a DFMEA that is empirically validated — not a theoretical exercise from a pre-release planning meeting.


Framework Alignment — DFSS CDOV

The DFMEA methodology is a core tool of Design for Six Sigma (DFSS) — specifically the CDOV process (Concept → Design → Optimize → Verify) from Creveling, Slutsky & Antis (2003). DFSS treats quality as a measurable engineering property: Y = f(X), where Y is "the product generates structurally correct specifications" and X is the set of parameters under control. The DFMEA is the mechanism that identifies which X values carry S=10 consequences when they fail — so those parameters receive engineering-grade controls, not just hope. The Quality & Validation page covers the complementary detection infrastructure.

← Quality & Validation Deployment Pipeline →


SimpleStruct — Powered by ConstructiVision | Quality-First AI-Assisted Engineering