Schedule a Software Walkthrough
Common Defect Enumeration — Reliable Software SOW Appendix B Analyzed ~1,000,000 Failures Categories 10 DEVCOM Aviation & Missile Center · Public Release
CDE
Common Defect Enumeration · Root Cause Taxonomy

The Common Defect Enumeration

Ann Marie Neufelder analyzed almost one million real software failures for root cause. Despite the huge number of failures, they collapse down to only a few hundred generic, functional root causes — a closed taxonomy called the Common Defect Enumeration (CDE), organized into 10 failure mode categories. The 6D CDE Software FMEA is built directly on top of it.

1Origin

Almost a million failures, a few hundred root causes

Most defect taxonomies are built from intuition or a handful of case studies. The CDE is different — it comes from analyzing nearly a million real software failures for root cause, across decades of programs. What that analysis found is that the sheer diversity of software failures is deceptive: underneath it, the same few hundred generic, functional root causes keep repeating.

Those root causes are cataloged across four levels of analysis — Top Level (the whole software LRU), Capability Level (one feature or use case), Specification Level (one requirement statement), and Interface Level (the boundary between two systems or organizations) — so a software FMEA can be scoped to whatever level actually fits the time available, without starting from a blank page.

Why a closed list matters Recognition, not invention

A software FMEA built from scratch asks engineers to invent every failure mode from memory — slow, inconsistent, and dependent on who's in the room. A software FMEA built from the CDE asks engineers to recognize which of a few hundred known root causes apply to their design — faster, more repeatable, and not dependent on any one person's experience.

2Categories

10 failure mode categories

Every root cause in the CDE falls into one of ten failure mode categories. Each category has its own letter code, used as the middle segment of every CDE identifier (for example, TL-SM-2 — a Top Level, State Management root cause).

1 · Faulty State Management
Code SM
The software can't maintain state correctly — executing prohibited transitions, allowing valid transitions under invalid conditions, or getting stuck in a dead state.
Example: a flight control system commands landing gear to "Retracted" while the weight-on-wheels sensor still reads "Idle."
2 · Faulty Error Handling
Code EH
The software fails to detect a known system fault, or detects it but doesn't handle it correctly — hardware faults, communication faults, computational faults, power faults, and more.
Example: a sensor fault occurs but is never detected, so downstream logic keeps trusting bad data.
3 · Faulty Processing
Code PR
The software can't handle peak loading, extended duration, file I/O, or concurrent operations — the things that only show up under real operational stress.
Example: the software loses accuracy or stops responding after running for an extended period with no reboot.
4 · Faulty Timing
Code T
The software does the right thing at the wrong time — too early, too late, too often, not often enough, or with a race condition between two events.
Example: watchdog timers or heartbeats are missing, so a hang goes undetected.
5 · Faulty Sequencing
Code SE
The software executes the right steps in the wrong order — or the specification never made clear whether order mattered in the first place.
Example: a multi-step operation lists the required steps but never states whether they must happen in that order.
6 · Faulty Data Definition
Code DD
Wrong or incompatible definitions of unit of measure, scale, size, or type between software components — or a failure to detect corrupt, missing, shifted, or out-of-range data.
Example: one component uses radians while another expects degrees, with no conversion between them.
7 · Faulty Algorithm
Code A
The math itself is wrong — from a denominator that can approach zero, to an algorithm that fails to converge, to sample rates that are insufficient for the signal being measured.
Example: software can't correctly handle crossing the international date line or the equator.
8 · Faulty Usability
Code U
Usability faults that lead to real mission faults — not cosmetic complaints, but interfaces that cause the operator to make the wrong call under pressure.
Example: the software floods the user with too many concurrent error messages to act on any of them.
9 · Faulty SQL
Database & Query-Specific
Failures specific to databases and SQL — undetected or mishandled read/write errors, failed SQL connections, connection limits, and failed service requests.
Example: a failed SQL connection isn't detected, so the software keeps operating on stale or absent data.
10 · Faulty Machine Learning
Code ML
Faults specific to AI/ML systems — training data bias, input data errors, model performance issues like overfitting or reward hacking, and problems with model updates and retraining.
Example: training data is not fully representative of the real-world scenarios the system will actually encounter.
3Origin Point

Where these defects actually originate

Most defect taxonomies are built around code — the bug in the function, the off-by-one error, the null pointer. That's a real category of defect, but Mission Ready Software's own benchmarking study of real project data found that coding defects account for only about 30% of the failures that actually happen. The rest originate earlier — in the specifications, the architecture, and the design — long before anyone writes a line of code.

Code-Centric Taxonomies

Organized around coding constructs — the kind of defect a static analyzer or code reviewer can catch. Covers roughly 30% of what actually causes software to fail, and can't be applied until code exists to analyze.

The CDE

Organized around functional root causes that trace back to specifications, architecture, and design — the majority of what actually causes software to fail, and can be applied before a single line of code is written.

The categories aren't just where the defects originate earlier — they're also easier to spot once an analyst knows what to look for. A state transition matrix either has a prohibited transition path or it doesn't. A unit of measure either matches across components or it doesn't. The CDE turns "what could go wrong" into a checklist of specific, recognizable questions instead of an open-ended brainstorm.

46D CDE

Built into the 6D CDE Software FMEA

The CDE isn't just a reference document — it's the engine behind the 6D CDE Software FMEA. During Structure Analysis, root causes are brainstormed across six causal design element (CDE) categories — Software, Electronics, System, Users, Mission Time, and Environment — and mapped directly to the failure mode categories above. From there, Failure Analysis connects each root cause to system effects and hazards, and Risk Analysis and Optimization turn the results into design controls and test cases.

Because the categories are already validated against nearly a million real failures, teams using the CDE aren't guessing at what could go wrong — they're working through a known, closed list.

5Reading

Further reading

Where to go next to see the CDE in the source document, in a short video walkthrough, or applied inside the Software FMEA product and process.