# Fault-Management Maturity and Mission-Anomaly Survival: a Hazard Model of Safe-Mode Entries and Recovery Outcomes

**A Doctoral Dissertation**

**Candidate:** JPL_AUTONOMY_EDL_04

**Program:** COLLEGIUM 1st Battalion

**NORTH STAR / JPL category:** Autonomous Systems and Robotics

**Hall-of-Shoulders anchors:** Robert W. Fogel (cliometric discipline) and Nassim N. Taleb (tail-risk discipline)

**Stage:** Design-stage dissertation. No hazard ratio is fitted on the assembled population; every numerical value is illustrative or expected, never an executed finding.

**Date:** 2026-06-15


## Abstract

Every robotic spacecraft that leaves Earth carries the work and the hopes of the teams that built it, and the duty of stewardship over that investment does not end at launch. Spacecraft fault management is the set of onboard and ground functions that detect anomalous conditions, isolate their cause, and act to preserve the vehicle and the mission. Programs differ widely in how much of this function they delegate to onboard autonomy rather than to a human ground loop. This dissertation asks whether higher-autonomy onboard fault management measurably lowers the hazard of a mission-ending outcome once a spacecraft has entered a fault state. The contribution is a single falsifiable proposition. The null hypothesis is that the level of fault-management autonomy has no effect on the hazard of a mission-ending anomaly conditional on entry into a fault state. The alternative is that higher autonomy is associated with a lower hazard, after accounting for mission complexity, distance from Earth, and spacecraft age.

The proposed method is a Cox proportional-hazards survival model estimated on a constructed event-history dataset. That dataset draws on NASA Technical Reports Server and Government Accountability Office anomaly and lessons-learned reports, Jet Propulsion Laboratory mission anomaly records, and TechPort technology-readiness classifications used to score fault-management maturity. The unit of analysis is the fault episode, defined as a discrete entry into a safe mode or comparable fault state, with the time-to-event measured from fault entry to either confirmed recovery or mission-ending loss. The work is presented at the design stage. It specifies the estimator, the variable construction, the identification strategy, and the threats to validity, and it states expected directions of effect that are labeled as not yet executed on the full dataset.

Two methodological anchors structure the work. Fogel's cliometric discipline requires that the claim be stated quantitatively, embedded in an explicit counterfactual, and exposed to falsification; the hazard ratio on the autonomy variable is the social-saving analogue, a single number that supports or refutes the autonomy claim. Taleb's work on tail risk requires that the analysis treat mission-ending loss as a rare, heavy-tailed event for which sample means are unreliable and for which precaution, not point optimization, is the correct decision frame. The intended outcome is a reproducible estimate of whether autonomy maturity changes post-anomaly survival, an explicit accept-or-reject decision on the null hypothesis, and an honest account of what would refute it. Executed on the assembled dataset, the plan yields a decision-relevant answer to a question NASA and JPL program managers face whenever they decide how much of fault management to entrust to the spacecraft itself, whether the result rejects the null in favor of a protective effect or fails to reject it.


## Table of Contents

**Front Matter**
- Abstract
- Table of Contents
- List of Tables and Figures

**Chapter 1. Introduction**
- 1.0 The chapter thesis
- 1.1 The problem in full
- 1.2 The gap in the literature
- 1.3 The single falsifiable contribution
- 1.4 Why conditional, and why a hazard model
- 1.5 Significance for NASA, JPL, and the named stakeholders
- 1.6 Scope, delimitations, and definitions
- 1.7 Design-stage posture
- 1.8 Roadmap of the dissertation

**Chapter 2. Theoretical Framework**
- 2.0 The chapter thesis
- 2.1 Fault management and the autonomy spectrum as the object the treatment variable measures
- 2.2 The Fogelian frame: the empirical claim as a quantitative, counterfactual, falsifiable proposition
- 2.3 The cliometric method as hypothesis-testing science
- 2.4 The Talebian frame: mission-ending loss as a heavy-tailed, undersampled event
- 2.5 The non-naive precautionary principle and the tail-concentrated-benefit hypothesis
- 2.6 Synthesis: how the two anchors jointly specify the conceptual model

**Chapter 3. Literature Review**
- 3.0 The chapter's answer, and the shape of the argument it defends
- 3.1 Branch A, part one: the autonomy anchor demonstrations
- 3.2 Branch A, part two: fault-protection architectures and the reference patterns
- 3.3 Branch A, part three: formal specification and verification of autonomous systems
- 3.4 Branch A, part four: FDIR and model-based diagnosis
- 3.5 Branch C: onboard anomaly detection and health monitoring
- 3.5a How the literature licenses the ordinal autonomy scale
- 3.6 Branch A and C synthesis through worked anomaly cases
- 3.7 Branch B: the spacecraft reliability-statistics tradition
- 3.7a Why the conditional question is the decision-relevant one the literature has not asked
- 3.8 Cross-branch synthesis tables
- 3.9 The gap, stated explicitly
- 3.10 The propositions that follow
- 3.11 Chapter synthesis

**Chapter 4. Data and Measurement**
- 4.0 The chapter thesis
- 4.1 Named sources, provenance, and access paths
- 4.2 Unit of analysis and the recurrent-episode rule
- 4.3 The survival object and the autonomy treatment
- 4.4 Control construction
- 4.5 Importing and redirecting the validated reliability-statistics apparatus
- 4.6 Coverage, limitations, data quality, validation, and ethics

**Chapter 5. Research Design and Identification**
- 5.0 The chapter thesis
- 5.1 The estimator: the Cox proportional-hazards model and why it dominates the alternatives
- 5.2 Identification: what the autonomy coefficient is identified off
- 5.3 The base model specification
- 5.4 Robustness specifications
- 5.5 Threats to validity and the design response

**Chapter 6. Analysis Plan and Expected Results**
- 6.0 The chapter thesis
- 6.1 The six-step estimation procedure
- 6.2 Pre-analysis checks: proportional hazards, influence, and event-count feasibility
- 6.3 The fixed decision rule on H0
- 6.4 Design-stage illustrative expectations and the tail-subgroup analysis
- 6.5 Power, feasibility, reproducibility, and confidence

**Chapter 7. Discussion**
- 7.0 The chapter thesis
- 7.1 Implications if H1 is supported
- 7.2 Implications if H0 is not rejected
- 7.3 The theoretical contribution back to each anchor
- 7.4 Rival explanations and the responses to them
- 7.5 The Talebian tail reading
- 7.6 External validity
- 7.7 Synthesis: the symmetric value of the estimate

**Chapter 8. Conclusion**
- 8.0 The answer this dissertation reaches
- 8.1 The contribution restated: one hazard ratio, or one credible failure to find one
- 8.2 The bridge between two literatures
- 8.3 How the anchors sharpened the test
- 8.4 What stands even if H1 is not confirmed
- 8.5 Limitations
- 8.6 From design to execution: the path to the full estimate
- 8.7 How the argument closes

**Scope, Assumptions, and Limitations**

**References**
**Appendices**
- Appendix A. Fault-episode coding protocol and episode-inventory template
- Appendix B. The three-pass autonomy-score rubric and inter-coder reliability schema
- Appendix C. Complexity-index construction and distance-regime coding
- Appendix D. Pre-registration of specifications, decision rule, and power analysis
- Appendix E. Variable and data dictionary, derivations, instrument and query details, and extended literature


## List of Tables and Figures

**Tables**
- Table 3.1. The seam between the literatures (Chapter 3, Section 3.8)
- Table 3.2. Design elements imported from the reliability tradition and redirected (Chapter 3, Section 3.8)
- Table 4.1. Consolidated measurement table mapping each construct to its operational definition, source, and scale (Chapter 4, Section 4.3.5)
- Table E.1. Variable and data dictionary (Appendix E, Section E.1)

**Figures**
- No figures are presented. The dissertation is a design-stage measurement study; all result tables are specified in structure and deliberately left unpopulated, and the model-implied survival profiles described in Chapter 6 are pre-specified for the executed analysis rather than displayed here.


\newpage

# Chapter 1. Introduction

## 1.0 The chapter thesis

When a distant spacecraft falls silent in a fault, the question that matters to those who built it and to those who must answer for it is a steady one: can the vehicle help itself, and does that capability change whether it survives. This dissertation delivers the first population-level, conditional hazard estimate of whether onboard fault-management autonomy lowers a spacecraft's risk of mission-ending loss once it has already entered a fault state. The deliverable is a single hazard ratio, or a credible and equally informative failure to find one, that converts a long-standing engineering intuition at the National Aeronautics and Space Administration (NASA) and the Jet Propulsion Laboratory (JPL), the intuition that autonomy buys survivability, into a parameter that an architecture trade can actually use. That is the answer this chapter develops. The rest of this introduction exists to establish why the answer is worth pursuing, why the question must be posed conditionally rather than unconditionally, why a survival model rather than a binary regression is the natural estimator, and what would count as having answered it well or badly.

The decision to lead with the answer is deliberate. A dissertation introduction that opens with several pages of background before disclosing its claim asks the reader to hold context without a purpose for it. This introduction takes the opposite order. It states its contribution first, then frames the problem it addresses, identifies what present practice cannot supply, explains why that absence matters, and only then marshals the evidence. The chapter follows that order. Section 1.1 establishes the problem in full. Section 1.2 specifies the gap between two literatures that do not meet. Section 1.3 states the single falsifiable contribution as a null and an alternative hypothesis, carried verbatim from the approved prospectus. Section 1.4 explains why the conditional framing and the hazard estimator are the correct technical choices rather than convenient ones. Section 1.5 establishes significance for NASA, JPL, and the named stakeholders. Section 1.6 fixes scope and delimitations and defines the key terms. Section 1.7 states the design-stage posture that governs every empirical statement in the document. Section 1.8 provides the roadmap of the dissertation.

A word on confidence and posture is owed at the outset, because it conditions how every claim in this dissertation should be read. The work is presented at the design stage. The estimator, the variable construction, the identification strategy, and the threats to validity are fully specified. No hazard ratio has been fitted on the assembled population, and every numerical value that appears anywhere in the document is labeled as illustrative or expected, never as an executed finding. The confidence attached to the design claims, that the proposed estimator is appropriate, that the identification strategy is the most defensible available, that the threats are correctly enumerated, is high and rests on an established statistical literature. The confidence attached to any directional expectation about the result itself is withheld, because withholding it is what design-stage honesty requires. The contribution is the apparatus and the pre-registered test, not a foregone conclusion.

## 1.1 The problem in full

### 1.1.1 Current state: safe mode is routine, and a fraction of fault entries precede loss

Robotic deep-space and Earth-orbiting spacecraft routinely encounter conditions their designers did not fully anticipate. A single-event upset flips a bit in a memory cell; a star tracker loses lock; a thruster valve sticks; a reaction wheel draws anomalous current; a power bus sees a transient it cannot explain. When onboard monitors detect such a condition and cannot immediately reconcile it with the expected state of the vehicle, the standard protective response is to enter a safe mode. Safe mode is a reduced, stable configuration that suspends the planned activity, orients the solar arrays toward the Sun to guarantee power, establishes a communications geometry that lets the ground reach the vehicle, and waits. The Galileo mission's safing and recovery sequence after its high-gain antenna and tape-recorder anomalies is a canonical worked example of this behavior under severe constraint ([\[74\]](#ref-74)). CloudSat's recovery from a battery anomaly that forced the spacecraft into a degraded mode, and the operational lessons drawn from it, is a more recent example of the same pattern in Earth orbit ([\[70\]](#ref-70)). The Geoscience Laser Altimeter System's loop-heat-pipe anomaly and the on-orbit testing that followed it document the same arc on an instrument subsystem ([\[75\]](#ref-75)).

Safe mode is a success of design in a narrow and important sense: the vehicle detected a threat it did not understand and placed itself in a configuration that preserved its own survival rather than continuing blindly into possible loss. It is also a mission interruption. Science stops. The planned sequence is abandoned. Operators on the ground must diagnose what happened, decide whether the configuration is safe to leave, and construct and uplink a recovery. In some fraction of cases the entry into a fault state is not merely an interruption but the antechamber to permanent loss: the spacecraft enters safe mode, the ground cannot diagnose or cannot recover in time, a secondary failure cascades, or the very condition that triggered safing proves terminal. The Dawn mission's reaction-wheel failures, and the operational improvisation required to complete its tour of Vesta and Ceres without a full complement of wheels, illustrate how a fault that is survived on one occasion can recur and progressively constrain a mission toward its end ([\[37\]](#ref-37)). The arc from fault entry to either recovery or loss is the arc this dissertation studies.

The frequency of safe-mode entry on long-duration missions is the first fact that makes the problem worth studying. Fault entry is not an exotic event reserved for failing missions. It occurs on essentially every spacecraft that operates long enough, and on flagship deep-space missions it can occur many times across a multi-year tour. NASA's catalogue of in-flight anomalies and the radiation-performance lessons drawn from them documents this directly: anomalies are a recurring feature of the operational record, not an aberration in it ([\[130\]](#ref-130)). The decision-relevant question, therefore, is not whether faults will occur. They will. The question is what happens after they occur, and whether the spacecraft's own capability changes the outcome.

### 1.1.2 The function under study: fault management and the autonomy spectrum

The onboard and ground function that governs this behavior is fault management, sometimes called fault protection, integrated vehicle health management, or systems health management depending on the program and the era. Fault management spans three logically distinct tasks: detection, the recognition that the vehicle is in an anomalous state; isolation, the diagnosis of which condition or component is responsible; and recovery, the action that returns the vehicle to a safe or nominal configuration. The integrated vehicle health management technology experiment flown in support of the X-37 program is one early, explicit attempt to mature these functions as an integrated onboard capability rather than as a scatter of independent monitors ([\[123\]](#ref-123)). The same integration logic, extended to small spacecraft with constrained processors and sensor suites, is documented in the work on integrated software and sensor health management for small platforms ([\[126\]](#ref-126)). The broader engineering discipline of fault diagnostics for industrial cyber-physical systems, surveyed in a scoping study that situates spacecraft fault management within a wider family of safety-critical diagnostic problems, supplies the methodological vocabulary that the spacecraft literature shares ([\[127\]](#ref-127)).

The observation that matters for this dissertation is that fault management can be implemented anywhere along a spectrum from fully ground-dependent to highly autonomous. At the ground-dependent end, the spacecraft safes itself and then waits. Human operators diagnose the condition from telemetry, often over multiple communication passes, and construct and uplink a recovery sequence; the vehicle's own role ends at detection and the protective transition to safe mode. At the autonomous end, the spacecraft carries onboard models of its own behavior, diagnostic reasoning that can isolate the fault, and recovery logic that can reconfigure or resume without waiting for a ground command cycle. The Remote Agent Experiment flown on Deep Space One is the flight demonstration that anchors the autonomous end of this spectrum: it integrated onboard planning, a reactive executive, and model-based fault diagnosis and recovery, and it demonstrated in flight that the full detection-isolation-recovery chain could close onboard ([\[16\]](#ref-16), [\[17\]](#ref-17)). The early NASA technical literature on onboard fault management for autonomous spacecraft anticipated this architecture and framed the case for it ([\[18\]](#ref-18)).

The level of autonomy in fault management is not a binary. It is an ordering, and the position of a given mission's fault-management implementation along that ordering is the explanatory variable at the center of this dissertation. A spacecraft that only detects faults and safes itself sits at one end; a spacecraft that detects, isolates, and recovers onboard sits at the other; and many real implementations sit between, detecting onboard and executing some limited autonomous response while still depending on a ground loop for the harder diagnoses. The recent surveys of autonomy for space robots, and of artificial intelligence applications and challenges in space missions, map this spectrum and document that the field has produced many architectures and several flight demonstrations across it ([\[19\]](#ref-19), [\[20\]](#ref-20)). The agent-based approaches surveyed for distributed space systems extend the same autonomy gradient to multi-spacecraft mission management ([\[35\]](#ref-35)).

### 1.1.3 Desired state: a conditional, quantitative estimate of whether autonomy changes post-anomaly survival

The desired state is a defensible, reproducible estimate of whether fault-management autonomy maturity changes the probability that a spacecraft survives a fault episode, conditional on the episode having begun, and an honest account of the uncertainty attached to that estimate. Concretely, the desired state is a hazard ratio: a single number expressing the multiplicative change in the risk of mission-ending loss associated with a one-level increase in fault-management autonomy, holding constant the factors that plausibly drive both autonomy investment and anomaly outcomes. The desired state also includes the apparatus that makes such a number interpretable: an explicit decision rule for when the number rejects the null hypothesis, a set of robustness checks that probe whether the number is an artifact of a particular specification, and a candid statement of what the number can and cannot support given the rarity of the terminal event.

### 1.1.4 The gap and the consequence of leaving it

The gap between the current state and the desired state is that no such estimate exists. Programs decide how much of fault management to delegate to onboard autonomy on the strength of an engineering intuition, namely that long one-way light times make a ground loop slow, and that a slow ground loop is dangerous in exactly the situations where faults are hardest to handle. The intuition is reasonable. Deep-space missions do face light times measured in tens of minutes one way, and a vehicle that must wait two round-trip light times plus ground processing for every step of a recovery is genuinely exposed during the wait. The Solar Probe Plus mission, operating in the harsh near-Sun environment, and the BepiColombo two-spacecraft mission to Mercury, are concrete examples of missions whose distance and environment make the ground loop expensive precisely when it is most needed ([\[125\]](#ref-125), [\[82\]](#ref-82)). But the intuition is an assertion about expected benefit. It has never been tested against the survival record of past missions. The consequence of leaving the gap unaddressed is that autonomy investment, which is expensive in onboard software, in verification burden, and in the shift of safety-critical authority from a human ground team to flight code, is weighed by intuition rather than evidence, and that deep-space architecture trades in the Autonomous Systems and Robotics portfolio lack a quantitative survival complement to the ordinal, non-survival technology-readiness scale they already use.

The argument the dissertation defends turns on a single proposition: that the absence of a conditional, population-level estimate of the autonomy-survival relationship is a genuine and consequential gap, not a settled matter dressed up as an open one. Three lines of documented evidence establish it. Safe-mode entry is routine across the mission record ([\[130\]](#ref-130), [\[74\]](#ref-74), [\[70\]](#ref-70), [\[75\]](#ref-75)); a full autonomy spectrum from ground-dependent to onboard closed-loop demonstrably exists ([\[16\]](#ref-16), [\[19\]](#ref-19)); and program decisions demonstrably rely on the slow-ground-loop intuition rather than on a fitted estimate ([\[125\]](#ref-125), [\[82\]](#ref-82)). The inference from these facts to the gap is straightforward: a decision repeatedly made under an untested assumption, about a quantity that is in principle measurable from existing records, is a decision that an estimate would materially improve. The principle that licenses that inference is the cliometric premise, developed in Chapter 2, that a counterfactual claim of the form "outcome could not have occurred without factor" remains unmeasured until it is stated quantitatively and exposed to falsification ([\[13\]](#ref-13), [\[39\]](#ref-39)). One qualification is essential and is protected throughout: the estimate this dissertation proposes is a conditional association under a defended control set, not a randomized causal effect, and its confidence is bounded by the rarity of the terminal event. The obvious objection, that the gap is illusory because individual mission post-mortems already tell us autonomy helps, is addressed directly in Section 1.2: case narratives establish feasibility and plausibility, not a population-level conditional estimate, and the two are not substitutes.
## 1.2 The gap in the literature

Two literatures bear on the question this dissertation poses, and they do not meet. Naming the gap precisely matters, because the whole contribution rests on its being real.

The first literature is spacecraft reliability statistics. Castet and Saleh and their collaborators assembled on-orbit failure data across hundreds of spacecraft and subsystems and fit nonparametric and parametric reliability models to it, establishing that spacecraft failure behavior is statistically tractable at the population level and that it varies systematically by subsystem, by mass class, and by mission type ([\[5\]](#ref-5)). This is a mature, validated, population-level survival apparatus. Its object, however, is the unconditional time to hardware failure: it models when a spacecraft or a subsystem fails, starting from launch. It does not model the conditional question of survival after a fault has occurred, and, decisively for this dissertation, it does not treat the level of fault-management autonomy as an explanatory variable. The apparatus is the right kind of tool applied to a different question. Part of the methodological contribution here is to import that validated apparatus and redirect it from the unconditional hardware-failure question to the conditional post-fault-survival question, adding autonomy as the covariate the prior work omits.

The second literature is fault-management engineering. It describes architectures, formal specification and verification methods, diagnostic algorithms, and flight demonstrations across the autonomy spectrum ([\[123\]](#ref-123), [\[126\]](#ref-126), [\[16\]](#ref-16), [\[17\]](#ref-17), [\[18\]](#ref-18)). Its concern is largely whether a given design is correct and assurable, and whether a particular autonomy capability can be shown feasible in flight. It establishes well that closed-loop onboard fault management can work; the Remote Agent Experiment settled that question in 1999 ([\[16\]](#ref-16)). What this literature rarely does is ask, across many missions, whether more autonomous fault management is associated with better recovery outcomes once trouble actually starts. When it makes claims of that kind, they tend to rest on individual case narratives, the story of a mission that recovered because its onboard logic acted faster than the ground could have, rather than on a hazard model fit to a population of fault episodes. The recent autonomy surveys fit this pattern: they catalogue capability and demonstration, not population-level outcome ([\[19\]](#ref-19), [\[20\]](#ref-20), [\[35\]](#ref-35)).

The gap is therefore a specific empirical one, and it can be stated in a single sentence. No published study estimates the effect of fault-management autonomy level on the hazard of mission-ending loss conditional on fault entry, while controlling for the confounders that plausibly drive both autonomy investment and anomaly outcomes. That conditional, population-level estimate is the object of this dissertation. The absence of a direct autonomy-versus-survival empirical precedent is not a weakness of the present bibliography; it is the gap the dissertation fills. The contribution is novel precisely because the estimate has not been made, and that novelty is a strength to be claimed, not a hole to be patched with tangential citations.

Read together, the two literatures yield the reasoning that licenses the study. The reliability-statistics tradition proves that population-level survival modeling of spacecraft is feasible and validated; it supplies the method. The fault-management engineering tradition proves that the autonomy spectrum is real, varied, and flyable; it supplies the treatment variable. Neither tradition has joined the method to the treatment. Their convergence, a feasible survival method on one side and a real, orderable treatment on the other, is what makes the proposed estimate both possible and unprecedented. Confidence in this reading is high, because it rests not on the interpretation of any single ambiguous source but on the structural complementarity of two well-established and individually uncontested bodies of work.

## 1.3 The single falsifiable contribution

The contribution is one testable proposition about post-anomaly survival, stated as a null hypothesis and an alternative. The statement here is carried verbatim from the approved prospectus and the shared bible that governs every chapter of this dissertation; it is not to be re-derived, softened, or re-scoped.

**H0 (null).** The level of onboard fault-management autonomy has no effect on the hazard of a mission-ending anomaly conditional on entry into a fault state. Formally, the coefficient on the autonomy variable in the hazard model is zero, so that the implied hazard ratio equals one.

**H1 (alternative).** Higher onboard fault-management autonomy is associated with a lower hazard of a mission-ending anomaly conditional on fault entry, after controlling for mission complexity, distance from Earth, and spacecraft age. Formally, the coefficient on the autonomy variable is negative and the implied hazard ratio is below one.

The contribution is the measurement: a fitted hazard ratio on the autonomy variable, its ninety-five percent confidence interval, and an explicit accept-or-reject decision on H0. The proposition is falsifiable in the strict sense. A non-negative coefficient, or a coefficient statistically indistinguishable from zero, fails to reject H0 and refutes H1. A coefficient whose sign reverses once confounders are included shows that the raw association was confounding rather than effect, and likewise refutes H1. A hazard ratio above one with an interval excluding one would refute H1 in the strongest possible way, indicating that conditional on a fault, higher autonomy is associated with worse survival; that would be a substantively important negative finding rather than a non-result. The symmetry of these outcomes is the point. The dissertation is designed so that either branch of the disjunction, rejecting H0 or failing to reject it, is decision-relevant and reportable. A fitted protective hazard ratio would furnish an architecture-trade parameter; a credible null would tell program managers that the engineering case for autonomy must rest on grounds other than population-average post-fault survival, which is itself valuable information.

This proposition rests on a chain of reasoning that the whole dissertation carries and that this chapter opens. The problem is real: safe-mode entry is routine and sometimes terminal, and the autonomy-survival link is asserted rather than measured. The problem is material: autonomy investment and deep-space architecture trades turn on the assertion. The design addresses the causal mechanism: a conditional hazard model on autonomy, with confounder control, measures exactly the counterfactual contrast the question requires. The design improves on the alternatives: the hazard model dominates a binary regression on episode outcome and a mean-based approach, for reasons developed in the next section. The residual risk is acceptable and bounded: rare events, measurement error in the autonomy score, and unobserved confounding are addressed by penalized estimation, second-reader coding, pre-flight scoring, and explicit signed-bias reasoning. Each of these five links is developed in its proper chapter; the chain is named here so the reader can hold the shape of the argument from the start.

## 1.4 Why conditional, and why a hazard model

Two technical choices define this dissertation, and both are choices of substance rather than convenience. The first is that the question is posed conditionally, on survival after a fault, rather than unconditionally, on mission success overall. The second is that the estimator is a survival, or hazard, model rather than a binary regression on episode outcome. This section argues for both, because a reader could reasonably wonder whether a simpler framing would do, and the answer is that a simpler framing would answer a different and less useful question.

### 1.4.1 The case for conditioning on fault entry

An unconditional comparison of mission outcomes by autonomy level answers a question that is real but not the one a program manager faces. It tells you whether autonomous missions fail less often overall. That comparison is dominated by whether missions encounter faults at all, and by every other systematic difference between autonomous and non-autonomous programs: their budgets, their complexity, their destinations, their eras, their test rigor. A finding that autonomous missions succeed more often would be almost uninterpretable, because autonomy would be standing in for the entire bundle of attributes that distinguishes a flagship deep-space mission from a simple Earth-orbiter.

The decision a program manager actually faces is conditional. A fault has occurred or will occur on essentially every long-duration mission; safe-mode entries are routine, not exceptional, as the anomaly record documents ([\[130\]](#ref-130)). The relevant question is what happens next, and specifically whether the spacecraft's own fault-management capability changes the probability that the episode ends in recovery rather than loss. Conditioning on fault entry isolates that decision-relevant quantity and discards the noise of differing fault-arrival rates. It answers the manager's real question, "given that my spacecraft will get into trouble, does onboard autonomy help it get out," rather than the diffuse question, "are autonomous missions better overall." The causal mechanism the conditioning isolates is specific and nameable: higher onboard autonomy lets the detection-isolation-recovery chain execute without waiting for a ground command cycle, which produces faster, light-time-independent resolution of the fault episode before it can become terminal, which, if the mechanism operates, shows up as a hazard ratio below one on the autonomy variable. Conditioning is what lets the data speak to that mechanism rather than to the confound of who encounters faults in the first place.

### 1.4.2 The case for a hazard model rather than a binary regression

Given the decision to condition on fault entry, one might still ask why the outcome is modeled as a time-to-event rather than as a simple binary, recovered or lost, with a logistic regression. There are three reasons, and together they make the hazard model the natural rather than the merely acceptable estimator.

First, the time the spacecraft spends in the fault state before resolving carries information that a binary outcome discards. An episode that resolves in hours and an episode that drags on for weeks before recovery are not equivalent, and an episode that ends in loss after a long struggle is different evidence from one that ends in loss almost immediately. A hazard model uses the dwell time; a logistic regression on the final state throws it away.

Second, many episodes are censored. Missions are still operating at the close of the observation window, and an episode that has not yet terminated cannot be coded as either recovered or lost without distortion. Survival models handle right-censoring directly and correctly; a binary regression must either drop censored episodes, which biases the sample, or misclassify them, which biases the estimate. The Cox proportional-hazards model, which is the estimator this dissertation adopts, was constructed precisely to accommodate censoring without parameterizing the shape of the underlying hazard ([\[25\]](#ref-25)).

Third, episodes recur within missions, and the terminal event is rare. A single spacecraft can contribute several fault episodes, which violates the independence a naive regression assumes; this is handled by a robust variance estimator clustered on the spacecraft. And mission-ending loss is, mercifully, an uncommon outcome, which means the analysis lives in the small-event-count regime where mean-based and large-sample approximations are least reliable. The hazard framework, with penalized partial-likelihood variants for the rare-event case, tolerates this regime better than the alternatives.

These three reasons connect directly to the dependent-variable discipline that Chapter 2 develops from Taleb's work on tail risk ([\[23\]](#ref-23)). Mission-ending loss is a rare, heavy-tailed event. The historical record undersamples the tail, and sample means understate the true exposure. An estimator that leans on the stability of a mean is therefore the wrong tool, and a hazard formulation that handles censoring and small event counts is the right one. The Talebian frame is not decorative; it is the reason the estimator family is chosen as it is, and it carries a further consequence for interpretation. Autonomy's value may concentrate disproportionately in the worst episodes, those with the least time and the least ground insight, so that a pooled estimate averaging over all episodes could understate the tail benefit. That consideration motivates the pre-specified tail subgroup analysis described in later chapters. The consequences of mission-ending loss are not always localized to the lost vehicle; the runaway, feedback-driven dynamics of the orbital debris environment are a standing reminder that a loss in a congested regime can impose costs beyond the spacecraft itself ([\[24\]](#ref-24)).

## 1.5 Significance for NASA, JPL, and the named stakeholders

The significance of this work is that it would replace an intuition with an estimate at exactly the point where the intuition is most expensive to act on wrongly. The decision to invest in autonomous fault management is consequential along three axes at once. It adds onboard software, which must be written, tested, and maintained. It adds verification burden, because autonomy moves safety-critical decisions into flight code that must be assured to a high standard before launch; the formal-methods and assurance literature exists precisely because this burden is real. And it shifts authority from a human ground team to the spacecraft itself, a governance change with implications for operations, for accountability, and for how a program reasons about the trust it places in code. The standard argument for accepting these costs is the slow-ground-loop argument, and the standard evidence for it is a destination's light time, not a survival record. For missions in environments as demanding as the near-Sun pass of a solar probe or the dual-spacecraft cruise to Mercury, the light-time argument is at its most forceful, and so is the value of testing it ([\[125\]](#ref-125), [\[82\]](#ref-82)).
For NASA broadly, a defensible estimate of whether autonomy maturity changes post-anomaly survival, and by how much, would give the agency an evidence base for autonomy investment across its robotic portfolio rather than a reliance on the persuasiveness of individual mission stories. For JPL specifically, which operates the deep-space and Earth-science missions where the distance term is largest and the ground loop slowest, the estimate would inform architecture trades in the Autonomous Systems and Robotics category directly: a program could weigh the cost of moving its fault-management implementation up one autonomy level against the estimated reduction in loss hazard, conditional on its own complexity and distance regime. This is the single permitted point at which the fitted hazard ratio touches an architecture trade, and it touches it conceptually, as an input parameter to a decision, not as a system or capability to be modeled in its own right. The dissertation does not claim to architect a fault-management system; it claims to supply a number that an architecture decision can consume.

The named stakeholders for whom this matters are the program managers and mission architects who must make the autonomy-investment decision under cost pressure and schedule pressure, the systems and fault-protection engineers who design the onboard logic and must justify its assurance cost, and the agency-level decision-makers who allocate technology-maturation funding across competing autonomy investments. To each of them the current state offers an intuition; the desired state offers a hazard ratio with an interval and a pre-registered decision rule. The difference between those two is the significance of the work.

## 1.6 Scope, delimitations, and definitions

### 1.6.1 Scope and delimitations

The scope of this dissertation is the population of identifiable fault episodes on NASA and JPL robotic spacecraft for which fault entry, end state, and autonomy level can be coded from the named documentary sources. Coverage is strongest for flagship and competed deep-space and Earth-science missions, which are well documented in the public record, and for JPL-operated missions with releasable anomaly records. The expected scale is a sample in the low hundreds of fault episodes across several dozen spacecraft.

Several delimitations bound the claim. They are stated here so that no reader mistakes the dissertation for something larger than it is. The study is observational, not experimental, and it does not claim a randomized causal effect; it claims a conditional association under an explicit and defended set of controls. The study concerns robotic spacecraft; crewed vehicles, with their different fault-management philosophy and human-in-the-loop authority, are outside its scope. The study concerns NASA and JPL missions documented in the public and releasable record; commercial constellations, small-satellite swarms, and non-NASA government programs are outside the sampled population, and any extension to them is a hypothesis for future work rather than a claim of this dissertation. The autonomy score is deliberately ordinal and coarse, not a continuous cardinal measurement, because the underlying documentation does not support finer distinctions; the hazard ratio is therefore read per autonomy level, not per unit of some continuous autonomy quantity that does not exist. Last, the dissertation is presented at the design stage: it specifies and pre-registers a test, and it does not report a fitted result from the assembled population.

### 1.6.2 Definitions of key terms

The following terms carry fixed meanings throughout the dissertation, taken without alteration from the shared bible.

**Fault management.** The set of onboard and ground functions that detect anomalous conditions, isolate their cause, and act to preserve the vehicle and the mission. Synonymous in this document with fault protection, integrated vehicle health management, and systems health management, which are program-specific and era-specific names for the same function.

**Safe mode.** A reduced, stable spacecraft configuration entered as a protective response to a detected anomaly: planned activity is suspended, power is secured by Sun-pointing the arrays, a communications geometry is established, and the vehicle holds pending diagnosis and recovery.

**Fault episode.** The unit of analysis. A discrete entry into a safe mode or comparable fault state by a single spacecraft. A mission can contribute multiple fault episodes; recurrent episodes within a mission are handled in estimation by a robust variance estimator clustered on the spacecraft.

**Time-to-event.** The duration measured from fault entry to either confirmed recovery to nominal operations, which is treated as censoring, or mission-ending loss, which is treated as the event. Missions still operating at the close of the observation window are right-censored.

**Mission-ending anomaly.** The dependent-variable event. Permanent loss of the spacecraft or of its primary mission objective, traceable to the fault episode.

**Fault-management autonomy level.** The primary explanatory variable. An ordered score for each mission's fault-management implementation, built in three passes: a technology-readiness anchor for the flown fault-management or systems-health-management technology, a placement on the ordered detection-isolation-recovery scale from design documentation, and an independent second-reader re-coding with rubric adjudication. The minimum ordering distinguishes ground-loop-dependent recovery, onboard detection with limited autonomous response, and onboard autonomous detection-isolation-recovery. Treated as ordinal, not cardinal.

**Mission complexity.** A control variable. An index constructed from subsystem count, instrument count, and program cost class as reported in the documentary sources.

**Distance.** A control variable. The Earth-spacecraft range regime at the time of the fault episode, which sets the one-way light time and therefore the cost of a ground loop. It may enter the model as a time-dependent covariate because a single mission can transit from near-Earth to deep-space regimes.

**Spacecraft age.** A control variable. Time since launch at fault entry, capturing the wear-in and wear-out effects documented in the reliability literature.

**Hazard ratio.** The quantity of interest. The multiplicative change in the hazard of mission-ending loss associated with a one-level increase in fault-management autonomy, holding the controls fixed. A hazard ratio below one indicates a protective effect of autonomy; a hazard ratio of one indicates no effect; a hazard ratio above one indicates that higher autonomy is associated with worse conditional survival.

The canonical estimating equation, used in exactly this form throughout the dissertation, is

\[ h_i(t) = h_0(t)\,\exp\!\left(\beta_1\,\text{autonomy}_i + \beta_2\,\text{complexity}_i + \beta_3\,\text{distance}_i + \beta_4\,\text{age}_i\right) \qquad\qquad (1) \]

for fault episode i, where \(h_0(t)\) is the unparameterized baseline hazard, the \(\beta\) coefficients are estimated by partial likelihood, and the quantity of interest is the hazard ratio \(\exp(\beta_1)\) on the autonomy variable.

## 1.7 Design-stage posture

This section states a posture that binds every empirical statement in the dissertation, and it states it before the roadmap so that the reader carries it through every chapter that follows. The work is presented at the design stage. The procedures specified throughout, the estimation steps, the robustness specifications, the decision rule, are specified but not yet executed on the full dataset. Wherever a numerical value appears, including the illustrative hazard ratios used in later chapters to make the decision rule concrete, that value illustrates the shape a result might take, not an estimate drawn from the data. The illustrative figures that recur in the analysis-plan chapter, a hazard ratio near 0.6 with an interval excluding one as the shape of a result consistent with the alternative hypothesis, and a hazard ratio near 0.95 with an interval including one as the shape of a result that fails to reject the null, are decision-rule illustrations chosen to bracket the interpretive range. They are not findings. No fitted coefficient from the assembled population is reported anywhere in this dissertation. This honesty is not a caveat appended to the work; it is a structural feature of it, and it is what distinguishes a pre-registered design from a result narrative written after the fact.

The epistemic calibration that follows from this posture is deliberate. The dissertation expresses high confidence in its design claims, that the Cox model is the appropriate estimator for this data structure, that conditioning on the named confounders is the most defensible identification strategy available given the absence of a credible instrument, and that the enumerated threats to validity are the right ones to worry about, because these claims rest on an established and uncontested statistical and methodological literature. The dissertation expresses no directional confidence about the result itself, because expressing such confidence at the design stage would be the precise error the design is built to avoid. What evidence would raise or lower confidence in the eventual result is stated as part of the design: a larger event count would narrow the interval and raise confidence in any directional finding; a demonstrated contamination of the autonomy score by post-loss documentation would lower confidence in a protective finding; sign stability across the robustness specifications would raise confidence, and sign instability would lower it. Stating in advance what would move the conclusion is the cliometric commitment to letting the data decide.

## 1.8 Roadmap of the dissertation
The dissertation proceeds in eight chapters and a backmatter.

**Chapter 2, Theoretical Framework,** develops the two methodological anchors that give the work its discipline. Fogel's cliometric program disciplines the empirical claim: a counterfactual proposition must be stated quantitatively, embedded in an explicit counterfactual, and exposed to falsification. The hazard ratio on autonomy is the analogue of Fogel's social-saving estimate, a single number that supports or refutes the claim. Taleb's work on tail risk disciplines the dependent variable: mission-ending loss is a heavy-tailed, undersampled event for which sample means are unreliable and for which precaution rather than point optimization is the correct decision frame. The chapter establishes how the two anchors jointly fix both the estimator family and its interpretation.

**Chapter 3, Literature Review,** maps the field along three mutually exclusive branches: the fault-management engineering tradition of architectures, formal verification, and flight demonstrations; the spacecraft reliability-statistics tradition that supplies the validated survival apparatus; and the onboard anomaly-detection and autonomy-survey literature. Each branch is read to the same throughline. The field has many designs and several flight demonstrations but no population-level outcome study, and the reliability tradition models the unconditional hardware-failure question while omitting autonomy as a covariate.

**Chapter 4, Data and Measurement,** specifies the four named sources, the fault-episode unit of analysis, and the construction of every variable. It attends in particular to the three-pass construction of the autonomy score, the most delicate construct because it is the treatment. The chapter makes the construct-validity argument for scoring autonomy from pre-flight documentation to defeat reverse coding, and it imports the reliability-statistics apparatus explicitly while stating what is redirected.

**Chapter 5, Research Design,** defends the Cox model as the estimator, develops the identification strategy of conditioning on observed confounders and the explicit rejection of an instrumental-variable approach, signs the residual confounding so that the conditional estimate is bounded rather than merely asserted, and lays out the four-way threats-to-validity matrix with the design response to each threat.

**Chapter 6, Analysis Plan,** specifies the six-step estimation procedure, fixes the decision rule on the null hypothesis, presents the explicitly non-empirical illustrative expected-results block, specifies the pre-registered tail subgroup analysis, and works through the power and feasibility analysis that follows from the events-not-episodes governance of effective sample size in survival models.

**Chapter 7, Discussion,** develops the implications under each branch of the disjunction, addresses the three rival explanations and the responses to them, develops the Talebian tail reading, bounds the external validity of the estimate, and describes in plain prose the conceptual endpoint at which the hazard ratio enters an architecture trade.

**Chapter 8, Conclusion,** restates the contribution as a single conditional hazard estimate under either branch of the disjunction, summarizes the bridge between the two literatures, recapitulates how the anchors sharpened the test, and names the steps required to convert the design into an executed study.

The **backmatter** provides the full reference list with clickable identifiers, the fault-episode coding protocol, the three-pass autonomy-score rubric with its inter-coder reliability schema, the complexity-index and distance-regime construction, and the pre-registration of the baseline specification, the robustness specifications, and the fixed decision rule.

Read as a whole, the dissertation is a single sustained argument. It leads with its answer, a conditional hazard estimate of autonomy's effect on post-fault survival. It frames the problem as a gap between a validated method and an untested intuition. It defends each major claim by stating the evidence, the reasoning that connects that evidence to the claim, and the strength with which the claim is held. It names the causal mechanism rather than resting on correlation. And it carries a through-line from "the problem is real" to "the remaining risk is acceptable." Because the contribution is a measurement rather than a system, it touches an architecture decision only at the single conceptual point where a fitted number becomes an input to a trade. The chapters that follow develop that argument; this one has stated it.

\newpage

# Chapter 2. Theoretical Framework

## 2.0 The chapter thesis

The conceptual model this dissertation will test rests on two methodological commitments that, taken together, fix both the form of the estimator and the way its single output must be read. The thesis is this: the question of whether onboard fault-management autonomy lowers a spacecraft's risk of mission-ending loss, conditional on the spacecraft having entered a fault state, is answerable only if the claim is posed as a quantitative, counterfactual, falsifiable proposition in the manner of Robert Fogel, and only if the dependent variable, mission-ending loss, is treated as the rare, heavy-tailed, undersampled event that Nassim Taleb's work shows it to be. Fogel disciplines the empirical claim. Taleb disciplines the dependent variable. The first commitment tells us that the contribution must be a number, the hazard ratio on the autonomy variable, embedded in an explicit comparison of what happens to comparable fault episodes that differ in autonomy level. The second tells us that the number must be a hazard, not a mean, and that it must be read with precaution rather than as a license to optimize fault-management economics against the most likely case. Neither anchor is decorative. Each does specific load-bearing work in choosing the estimator family, in justifying the conditional framing, and in disciplining the interpretation of the result the empirical chapters will produce.

This is not the conventional order of a theory chapter, which often opens with a long survey of the engineering object and arrives at its method only at the end. The order is inverted on purpose: the answer leads, and the development follows. The engineering object, the spectrum of fault-management autonomy that the treatment variable orders, is introduced first only because the two anchors need something concrete to bite on. The bulk of the chapter is then the two anchors developed as full argumentative units. Each states its claim, the evidence behind it, the reasoning that connects evidence to claim, the strength with which it is held, and the condition under which it would fail, and each closes on a named causal mechanism rather than a bare correlation. The chapter ends by showing how the two anchors jointly specify the conceptual model: Fogel determines that the model is a conditional counterfactual hazard, and Taleb determines that the hazard is read in a tail-aware, precautionary register. That joint specification is the bridge to the design and analysis chapters, where the model is operationalized as a Cox proportional-hazards regression and exposed to a fixed decision rule.

A word on the problem this chapter addresses, framed as current state, desired state, gap, and consequence. The current state of the field is that programs decide how much of fault management to entrust to onboard autonomy on the strength of an engineering intuition: that long one-way light times make a ground recovery loop slow, and that a spacecraft able to recover itself will therefore survive more of its faults. The desired state is a defensible conceptual model under which that intuition becomes a testable proposition with a measurable answer and an honest account of its uncertainty. The gap is that the engineering literature has no theoretical apparatus that converts the autonomy-survival intuition into a falsifiable, population-level quantity, and the reliability-statistics literature has the apparatus but has never pointed it at the conditional question or at autonomy as an explanatory variable. Leaving the gap open carries a cost: autonomy investment, which is expensive and which shifts decision authority from a human ground team into flight code, continues to be argued from intuition rather than from evidence. This chapter closes the theoretical half of that gap by importing two frameworks from outside aerospace engineering and showing, in detail, how each transfers to the problem.

## 2.1 Fault management and the autonomy spectrum as the object the treatment variable measures

Before either anchor can do its work, the engineering object they will theorize must be defined with enough precision that a treatment variable can be built from it. Fault management is the set of onboard and ground functions that detect anomalous conditions, isolate their cause, and act to preserve the vehicle and the mission. The function can be implemented anywhere along a spectrum that runs from fully ground-dependent recovery to fully autonomous onboard detection, isolation, and recovery. The treatment variable in this dissertation, the ordered autonomy score, is an attempt to place each mission's flown fault-management implementation on that spectrum. The theory chapter's first task is therefore to characterize the spectrum itself, because the two anchors theorize a comparison between points on it.

The layered, monitor-and-response architecture formalized for the Cassini spacecraft is the reference pattern for the ground-anchored end of the spectrum and for the architectural vocabulary the field still uses ([\[2\]](#ref-2)). In that design, fault protection is organized as a hierarchy of monitors that watch for off-nominal conditions and responses that fire when a monitor trips, with the highest-authority response being entry into a safe, sun-pointed, communications-favorable standby configuration from which a human ground team diagnoses the condition and uplinks a recovery sequence. The architecture is autonomous in the narrow sense that the spacecraft can safe itself without a ground command, but the diagnosis-and-recovery step, the part that determines whether the episode ends in resumption or in loss, remains a ground function. The Cassini pattern matters here not as a historical artifact but as the concrete instantiation of the lower-autonomy pole that the treatment variable's ordering must distinguish from higher-autonomy designs. It establishes that "safe mode entry" is a routine, designed behavior, which is exactly why the unit of analysis is the fault episode and why the decision-relevant question is conditional on fault entry rather than unconditional.

The opposite pole of the spectrum is anchored by architectures in which the diagnosis-and-recovery step also executes onboard, without waiting for a ground command cycle. The hybrid procedural and deductive executive developed for autonomous spacecraft is the reference pattern here ([\[12\]](#ref-12)). That executive integrated a reactive, procedural execution layer with a deductive, model-based reasoning layer, so that the spacecraft could detect a fault, safe itself, reason about the fault's cause, and select or synthesize a recovery without a human in the loop. The significance of the hybrid executive for the present argument is that it demonstrates the existence of the upper end of the autonomy spectrum as a real, flyable engineering object rather than a notional ideal. The treatment variable's highest level, onboard autonomous detection-isolation-recovery, is not a hypothetical category; it corresponds to an architectural family with a documented heritage. Between the Cassini pole and the hybrid-executive pole lies the intermediate level the treatment variable also distinguishes, onboard detection with limited autonomous response, in which detection and safing are onboard but isolation and recovery remain partly or wholly a ground function.

The interpretive consequence of characterizing the spectrum this way is that the treatment variable is ordinal and coarse by construction, and the theory chapter must own that coarseness rather than disguise it. The autonomy spectrum is multidimensional. A design can be highly autonomous in detection and weakly autonomous in recovery, or autonomous for some fault classes and ground-dependent for others. Compressing that multidimensional reality into a three-level ordering loses information. The two anchors are what justify accepting that loss. Fogel's framework, developed below, requires only that the comparison be between higher- and lower-autonomy designs facing comparable faults, a comparison an ordinal ordering supports. Taleb's framework, also developed below, cautions that the benefit of moving up the spectrum may concentrate in the hardest episodes, a hypothesis an ordinal ordering can still test through a tail subgroup. The spectrum is the engineering object; the two anchors are the lenses that turn an ordinal placement on that object into a testable theory of survival.

## 2.2 The Fogelian frame: the empirical claim as a quantitative, counterfactual, falsifiable proposition

The first anchor is Robert Fogel's cliometric program, and the major claim it grounds is methodological rather than substantive. The claim is this: a proposition of the form "outcome Y could not have occurred without factor X," or its weaker cousin "factor X changes the probability of outcome Y," is an unmeasured counterfactual until it is stated quantitatively, embedded in an explicit counterfactual comparison, and exposed to the possibility of falsification by data. Applied to this dissertation, the claim is that the engineering intuition "autonomy buys survivability" is, in its prevailing form, exactly such an unmeasured counterfactual, and that the contribution of the dissertation is to convert it into Fogel's three-part disciplined form.

The case for this claim begins with Fogel's own demonstration in the study of railroads and American economic growth ([\[13\]](#ref-13)). Fogel confronted a proposition that was, at the time, treated as self-evident: that the railroad was indispensable to nineteenth-century American economic growth, that the economy could not have grown as it did without it. He refused to accept the proposition as self-evident and instead built an explicit counterfactual world in which the railroad was absent, with the transport demand of that world met by the next-best alternative of canals and wagons, and computed the difference in national income. The resulting quantity, the social saving, was a single number that measured the railroad's actual indispensability against the counterfactual. The number turned out to be modest, which refuted the strong indispensability thesis. The methodological lesson, which is what transfers here, is independent of whether the number was large or small: the discipline lies in stating the proposition quantitatively, in constructing the counterfactual explicitly, and in letting the computed number, rather than the prior intuition, decide.

What connects the railroad case to this dissertation, licensing the move from one to the other, is that the two propositions share the same logical structure. The railroad proposition asserts that a factor (the railroad) is responsible for an outcome (economic growth); the autonomy proposition asserts that a factor (fault-management autonomy) changes an outcome (survival after a fault). Both are causal claims about the contribution of a single factor, and both are vulnerable to the same failure mode, the failure of accepting an intuitively compelling causal story without measuring the counterfactual it implicitly invokes. Fogel's method is not specific to economics; it is a general discipline for any claim of the form "X mattered for Y," and the autonomy-survival claim is precisely such a claim. The hazard ratio on the autonomy variable, the quantity this dissertation will estimate, is the direct analogue of the social saving: a single number that supports or refutes the claim that autonomy matters for survival, embedded in the counterfactual contrast between higher- and lower-autonomy episodes.
What establishes Fogel's method as a recognized scientific discipline rather than one economist's idiosyncrasy is the cliometric tradition that grew from it, surveyed below in Section 2.3. For now it is enough to record that the methodology-of-history literature treats Fogel's counterfactual move as a legitimate scientific method, not a rhetorical device ([\[44\]](#ref-44)). Counterfactual reasoning is not idle speculation about what might have been. It is the only way to give content to a causal claim about a factor's contribution, because a causal claim is intrinsically a claim about a comparison to a world in which the factor is different. The most natural objection to the autonomy-survival study, that one cannot rerun history with and without autonomy, is exactly the objection Fogel's method answers: one does not rerun history; one constructs the counterfactual comparison statistically, within the data one has, by conditioning.

One qualification must be stated and protected, because an unqualified claim would overreach. Conditioning in an observational hazard model is a weaker counterfactual than a randomized experiment, and the resulting estimate is a conditional association defended as causal, not a randomized causal effect. Fogel's social saving was itself an observational counterfactual, computed from historical data under explicit assumptions about the next-best alternative, and it inherited the vulnerabilities of any such construction. The autonomy hazard ratio inherits the same vulnerabilities. The dissertation therefore claims a conditional, confounder-adjusted association with a defended and explicit control set, and it states plainly which unobserved confounders could still bias the estimate. Honoring that qualification means never upgrading the language from "conditional association under a defended control set" to "causal effect" in the unqualified sense, however favorable the estimate.

The Fogelian claim would fail if the counterfactual contrast were so contaminated by confounding that the conditioning failed to isolate the autonomy effect at all. If programs that invest in autonomy differ systematically from those that do not in ways the control set does not capture, then the within-stratum comparison is not a clean higher-versus-lower-autonomy contrast but a contrast confounded by the omitted attribute, and the hazard ratio measures the omitted attribute rather than autonomy. This objection is not fatal, and the way it is handled is itself a Fogelian move. Fogel did not pretend his counterfactual was assumption-free; he stated his assumptions and bounded his estimate. This dissertation does the same by reasoning through the sign of the most likely residual confounding. The most plausible unobserved confounder is overall program quality, which is positively associated with both autonomy investment and survival. An unconditioned estimate would therefore overstate autonomy's protective effect. Conditioning on complexity and cost class absorbs part of program quality. If, after conditioning, the autonomy hazard ratio remains below one, the residual program-quality bias works in the same direction as the estimated effect, which makes the conditional estimate an upper bound on autonomy's benefit rather than a lower one. Stating the sign of the likely bias bounds the claim rather than asserting it, the Fogelian commitment in its sharpest form.

The named causal mechanism that the Fogelian frame both presupposes and helps to test must be stated explicitly, because a Fogelian claim is a causal claim, and a causal claim without a mechanism is a bare correlation. The mechanism is this. Higher onboard fault-management autonomy is the driver. The mechanism proper is that onboard detection, isolation, and recovery execute without waiting for a ground command cycle, so that the resolution of the fault episode does not have to traverse the one-way light time to Earth and back, nor wait for a human ground team to convene, diagnose, and uplink. The observable effect is faster, light-time-independent resolution of the fault episode before it escalates into a terminal outcome. The operational consequence, the quantity this dissertation measures, is a hazard ratio on the autonomy variable below one, meaning a reduced instantaneous risk of mission-ending loss per autonomy level. The strategic implication is an evidence-based architecture-trade parameter for NASA and JPL deep-space autonomy investment, a number a program can weigh against the cost of moving up one autonomy level. Naming the mechanism this way specifies what the hazard ratio is supposed to measure: not a bare statistical association between an autonomy score and a survival outcome, but the operational footprint of a specific physical mechanism, the removal of the ground loop from the recovery path. Where the data can only show the association and not the intervening mechanism directly, the dissertation says so and downgrades its confidence accordingly, the honest counterpart of naming the mechanism.

The confidence attached to the Fogelian claim is high, and it is worth saying what would raise or lower it. The claim is a methodological one, that the autonomy-survival proposition must be posed quantitatively, counterfactually, and falsifiably, and the confidence in that methodological claim is high because it rests on a well-established and Nobel-recognized tradition rather than on any single contested empirical finding. What is design-stage, and therefore held at lower confidence, is not the method but its yield: whether the assembled population will support an estimate precise enough to discriminate H0 from H1. That lower confidence is a function of event counts, not of the framework, and it is the subject of the power analysis specified in the design chapter. The framework's confidence and the estimate's confidence are distinct, and the chapter keeps them distinct.

## 2.3 The cliometric method as hypothesis-testing science

The methodological premise promised in the previous section requires its own development, because a chapter that leaned on Fogel's single 1964 study and stopped there would be resting a methodological claim on one example. The cliometric tradition that grew from that study shows that Fogel's counterfactual discipline is a science, a repeatable method with explicit principles, rather than a one-time tour de force. This section converts "Fogel did this once impressively" into "this is an established methodology with stated principles that this dissertation follows."

Cliometrics is a defined research program with articulated principles, the core of which is the disciplined, quantitative, counterfactual testing of causal propositions about the past. The tradition named, codified, and reflected on its own method over decades. Its principles were stated explicitly in the field's own retrospective accounting of itself a decade into its journal's life, which defined cliometrics as the application of economic theory and quantitative method, including counterfactual and inferential discipline, to historical questions ([\[41\]](#ref-41)). The field's history has been written more than once, tracing how a narrative discipline was transformed into a mathematical one and how that transformation reached its symbolic culmination when Fogel and Douglass North received the Nobel Prize in 1993 ([\[58\]](#ref-58), [\[57\]](#ref-57)). The impact of that transformation on both economics and history has been assessed in its own right, with the verdict that cliometrics struck a deliberate balance between measuring phenomena and explaining them ([\[43\]](#ref-43)). The field has been analyzed as a scientific community responding to the demands placed on it, a community that remade the practice of economic history and then diffused its methods internationally ([\[45\]](#ref-45)). Its subsequent evolution, from the strict application of standard economics to a broader formal reflection on social history, has itself been charted ([\[47\]](#ref-47)), and the whole apparatus has been consolidated into a reference handbook ([\[46\]](#ref-46)).

The convergence of these accounts establishes the three Fogelian requirements as the settled core of a recognized method, not as the dissertation's own invention. When the field's self-definition ([\[41\]](#ref-41)), its multiple histories ([\[58\]](#ref-58), [\[57\]](#ref-57)), its impact assessment ([\[43\]](#ref-43)), its sociological analysis ([\[45\]](#ref-45)), and its forward evolution ([\[47\]](#ref-47)) all locate the quantitative-counterfactual-falsifiable triad at the center of what cliometrics is, the dissertation's adoption of that triad is a use of an established standard rather than a bespoke methodological argument that would itself need defending. This bears on the dissertation's design: the proposition that the conditional hazard model addresses the right thing rests partly on the proposition that the right thing is Fogel's counterfactual contrast, and that proposition is supported by an entire field's worth of methodological reflection.

A second strand of backing comes from outside economic history proper, from the use of explicit counterfactual reasoning to assess the consequences of an innovation. The closest structural analogue to this dissertation's question in the broader literature is the counterfactual research agenda proposed for the consequences of financial innovation, which argued that the social-welfare implications of an innovation can be assessed only by examining what would have happened had the innovation never been invented or adopted ([\[42\]](#ref-42)). The structural parallel is exact and worth drawing out. Financial innovation, like fault-management autonomy, is widely praised as beneficial and occasionally blamed as harmful, and in both cases the praise and the blame rest on case narratives rather than on a measured counterfactual. The proposed remedy in the financial-innovation case, systematic examination of counterfactual histories in which the innovation is absent, is the same remedy this dissertation applies to autonomy: a systematic, conditional comparison of episodes that differ in the presence of the innovation. The autonomy-survival question is thus an instance of a general class of innovation-consequence questions, and the counterfactual method recommended for that class is the method this dissertation adopts. The same caution carries over. The financial-innovation agenda was explicit that counterfactual assessment is hard and assumption-laden, which is precisely why this dissertation states its assumptions and signs its biases rather than claiming a clean experimental effect.

## 2.4 The Talebian frame: mission-ending loss as a heavy-tailed, undersampled event

The second anchor is Nassim Taleb's work on tail risk, and it disciplines the dependent variable rather than the empirical claim. The major claim it grounds is this: mission-ending loss is a rare event drawn from a heavy-tailed process, the historical record systematically undersamples the tail of such a process, and sample means computed over such a record understate the true exposure. The estimator must therefore be one that handles censoring and small event counts without relying on the stability of a mean, and the result must be read with precaution rather than as a license to optimize against the most likely case.

This claim rests on a body of empirical work demonstrating that consequential rare events in many domains are governed by heavy-tailed distributions for which the sample mean is an unreliable and unstable estimator. The tail behavior of contagious diseases has been shown to be so heavy that the sample mean of historical fatalities badly understates the true risk, because the distribution's moments are dominated by a small number of extreme realizations that the historical record happens to have sampled sparsely ([\[49\]](#ref-49)). The same property has been demonstrated for violent conflicts, whose fatality distributions are heavy-tailed to the point that conventional means and variances are not informative about the underlying process ([\[52\]](#ref-52)). The lesson generalizes beyond these specific domains: extreme-value methods exist precisely because, in heavy-tailed settings, the events that matter most for risk are the ones the sample contains fewest of, and estimating their probability from the bulk of the data fails ([\[50\]](#ref-50)). Tail risk has been shown to be priced into asset markets in a way that ordinary moment-based measures miss ([\[51\]](#ref-51)), and the origins of macroeconomic tail risk have been traced to the interaction of idiosyncratic shocks with network structure, producing systematic departures from the normal-distribution expectation precisely in the tail even when the bulk of the distribution looks approximately normal ([\[48\]](#ref-48)).

What connects this body of work to the dissertation is that mission-ending loss has the defining features of the heavy-tailed, undersampled events these studies analyze. Mission-ending losses are rare relative to the population of fault episodes; the historical record of NASA and JPL spacecraft contains a small absolute number of them; and the catastrophic episodes, the ones with the least reaction time and the least ground insight, are exactly the ones the record is least likely to contain in representative numbers, because there are so few of them and because the worst conceivable episode may simply not have occurred yet. The statistical pathology these studies document, the unreliability of the mean in the presence of a thin, consequential tail, applies to mission-ending loss by virtue of its shared distributional character, and the methodological prescriptions that follow from that pathology apply too. The Acemoglu result is an apt confirmation, because it shows that a process can look benign and approximately normal in its bulk while harboring a heavy tail, which is the exact condition of the spacecraft fault record: most fault episodes resolve routinely and look statistically tame, and the danger lives in the rare tail that the bulk gives no warning of.

The first consequence this licenses, and the one with the most direct bearing on estimator choice, is that the analysis must not rely on a mean-based summary of episode outcomes. This is part of why the dissertation adopts a hazard formulation rather than, for example, a comparison of mean survival times or a logistic regression treated as a stable summary of average outcome. A hazard model is built from the risk sets at event times and handles right-censoring directly, so its inferential content comes from the timing and incidence of the rare events rather than from a mean over a sample that undersamples the tail. The Talebian frame does not by itself select the Cox model from among hazard models; that selection is argued on separate grounds in the design chapter. What the Talebian frame establishes is the prior commitment that the estimator must belong to the family that tolerates censoring and small event counts and that does not lean on the stability of a mean, which excludes the mean-based alternatives and points toward survival analysis.

The second consequence is interpretive and concerns where autonomy's benefit, if any, is located. The Talebian view holds that in a heavy-tailed loss process the value of a protective measure may concentrate disproportionately in the worst realizations, because the worst realizations are where the unprotected case is most catastrophic and therefore where protection has the most to subtract. Transposed to autonomy, this yields a specific, pre-registered hypothesis: autonomy's protective effect may be largest in the hardest fault episodes, those at the greatest distance from Earth and with the shortest reaction time, where the ground loop is slowest and most useless and where onboard recovery has the most room to matter. The interpretive consequence is that a pooled hazard ratio averaged over all episodes, easy and hard alike, may understate autonomy's benefit in exactly the episodes that dominate the risk. The chapter therefore commits, in advance, to a tail subgroup analysis restricted to the hardest episodes, so that a modest or null pooled estimate is not read as evidence that autonomy is useless if the benefit is concentrated where the tail lives. The mechanism here is the same light-time mechanism named in Section 2.2, but its relevance is now conditioned on episode difficulty: the harder the episode, the larger the share of the recovery path that the ground loop occupies, and so the larger the potential effect of removing it.

One qualification on the Talebian claim is that heavy-tailedness is an argument about the inadequacy of certain estimators and the location of risk, not a license to abandon estimation. The Talebian frame does not say the question is unanswerable; it says the question must be answered with an estimator suited to thin tails and read with awareness of what the tail can hide. This guards against an over-reading in which the rarity of mission-ending loss is taken as a reason not to estimate at all, or as a reason to treat every favorable estimate as untrustworthy. The dissertation's position is the disciplined middle: estimate with a tail-appropriate hazard model, report interval estimates rather than point estimates alone, use small-sample-robust methods where event counts are thin, and read the result with precaution. The Talebian framing would be the wrong lens only under a demonstration that mission-ending loss is not in fact heavy-tailed, that its outcomes are well-behaved and mean-stable, in which case a simpler mean-based analysis would suffice and the precautionary reading would be unnecessary. The chapter does not assume that condition away; it treats the heavy-tailedness of mission-ending loss as a strongly supported but design-stage assumption, held at moderate-to-high confidence on the strength of the cross-domain evidence above and the small absolute event count expected in the sample, and it notes that the assumption is itself open to examination once the population is assembled.

## 2.5 The non-naive precautionary principle and the tail-concentrated-benefit hypothesis

The Talebian frame carries a further commitment that deserves its own treatment, because it governs how the dissertation's eventual number may and may not be used. The commitment is the non-naive precautionary principle: in the presence of a heavy-tailed catastrophic outcome, decisions should be made under precaution rather than by point optimization against the most likely case. The precautionary principle, in its disciplined form, constrains the inference the dissertation licenses about autonomy investment, and this constraint is a feature of the conceptual model rather than an afterthought to it.

The principle in question is the formulation developed specifically for systems with heavy-tailed, potentially irreversible harms ([\[23\]](#ref-23)). That formulation distinguishes a non-naive precaution, which applies where the harm is fat-tailed, systemic, and potentially irreversible, from a naive blanket precaution that would forbid all action and is therefore incoherent. The non-naive version is tailored to situations where a point estimate of expected outcome, however carefully computed, fails to capture the risk because the risk lives in a tail the expectation averages over. It connects to the dissertation because mission-ending loss, by the heavy-tailedness argument of Section 2.4, is exactly the kind of outcome for which the non-naive precautionary principle is designed: rare, catastrophic, and, for a deep-space mission, irreversible. The principle therefore applies to decisions about fault-management autonomy, which are decisions taken in the shadow of that tail.

The interpretive consequence is sharp and is built directly into how the dissertation frames its own contribution. The hazard ratio the empirical work will produce is a point estimate of a conditional average effect. The non-naive precautionary principle cautions against treating any such single point estimate, including the dissertation's own, as a license to optimize fault-management economics against the most likely case while neglecting the catastrophic case. Concretely, the dissertation will not present its hazard ratio as a formula for buying exactly as much autonomy as the average episode justifies and no more. If autonomy's benefit concentrates in the tail, as the tail-concentrated-benefit hypothesis allows, then optimizing against the average would under-invest in precisely the episodes that dominate the loss. The conceptual model therefore reports the hazard ratio with its uncertainty and explicitly considers the tail subgroup, and it frames the result as an input to a precautionary decision rather than as the objective function of an optimization. This is a real constraint on the dissertation's own conclusions, and stating it here, in the theory chapter, commits the later chapters to honor it.

Support for treating the precautionary principle as a serious decision discipline, rather than a slogan, comes from both its critics and its careful applications. The principle has been subjected to rigorous critique, most notably the argument that in its strongest form it is paralyzing because every course of action, including inaction, creates some risk, so a principle that forbids risk-creating action forbids everything ([\[54\]](#ref-54), [\[53\]](#ref-53)). This critique is not a reason to discard the principle; it is the reason the dissertation adopts the non-naive form, which survives the critique by restricting itself to fat-tailed, systemic, irreversible harms rather than to all risk whatsoever. Engaging the strongest objection and adopting the version that answers it is what keeps the precautionary commitment defensible. The principle's disciplined application in high-stakes domains supplies further backing: it has been applied to prioritize cancer treatment under pandemic conditions, where the irreversibility of foregone treatment justified precaution ([\[55\]](#ref-55)), and to wireless-technology exposure policy, where systemic and uncertain harms were argued to warrant precautionary regulation ([\[56\]](#ref-56)). These applications show the principle doing real, contested work in decisions structurally like the autonomy decision, decisions under uncertainty about a potentially irreversible harm, which is the work the dissertation asks it to do.

A final element of the Talebian frame concerns the consequences of loss, and it widens the lens beyond the lost vehicle. The precautionary case for autonomy is strengthened if mission-ending loss is not always a self-contained event whose harm is bounded by the value of the spacecraft. The long-term dynamics of the orbital-debris environment are a reminder that the consequences of a loss can propagate beyond the vehicle, because a spacecraft lost in a populated orbital regime becomes a debris source whose collisions can seed further fragments in a feedback-driven process ([\[24\]](#ref-24)). The mechanism named here is distinct from the survival mechanism of Section 2.2: it is an externality mechanism, in which the loss of one vehicle raises the collision risk for others, with the operational consequence that the social cost of a mission-ending loss in a crowded regime exceeds the private cost to the mission, and the strategic implication that the precautionary case for survival-enhancing autonomy is correspondingly stronger in such regimes. One bound is stated to avoid overreach: this externality argument bears on Earth-orbiting missions in populated regimes, not on deep-space missions where a lost vehicle creates no comparable debris hazard, and the dissertation does not claim the debris externality for its deep-space cases. The point is bounded. Where loss has consequences beyond the vehicle, the value of avoiding it is understated by any accounting that stops at the vehicle, which reinforces the precautionary reading of the autonomy result for the subset of missions to which it applies.

## 2.6 Synthesis: how the two anchors jointly specify the conceptual model

The two anchors do not operate independently; between them, they specify both the form of the estimator and the register of its interpretation, and the synthesis is the conceptual model the empirical chapters will test. This closing section states that joint specification and traces it forward, so that the design and analysis chapters inherit a model rather than a pair of loose lenses.
Fogel specifies the form. The Fogelian requirement that the claim be quantitative, counterfactual, and falsifiable determines that the model must produce a single estimable number supporting or refuting the autonomy claim, that the number come from an explicit counterfactual comparison of higher- and lower-autonomy episodes, and that the comparison be operationalized as conditioning on the confounders that drive both autonomy investment and survival. This is what selects a conditional model. The counterfactual contrast Fogel demands is, in the language of survival analysis, a comparison of the hazard of mission-ending loss across autonomy levels within strata defined by complexity, distance, and age. The autonomy coefficient in such a model is the social-saving analogue. The decision rule the dissertation fixes, reject the null in favor of the alternative only if the estimated hazard ratio is below one and its interval excludes one in the pre-registered specification and the sign is stable across robustness specifications, is the Fogelian commitment to letting the number, not the intuition, decide. The conditional, counterfactual, falsifiable structure of the empirical contribution is, in this precise sense, a deduction from the Fogelian frame.

Taleb specifies the register and constrains the family. The Talebian requirement that mission-ending loss be treated as a heavy-tailed, undersampled event determines that the number must be a hazard rather than a mean, that it be estimated by a method tolerant of censoring and small event counts, that it be reported with its uncertainty rather than as a point summary, and that it be read under the non-naive precautionary principle rather than as the objective of an optimization against the average case. The Talebian frame also installs, in advance, the tail-concentrated-benefit hypothesis and the corresponding tail subgroup analysis, so that the conceptual model includes not only a pooled estimate but a pre-specified test of whether autonomy's benefit lives in the hardest episodes. Where Fogel makes the model conditional and counterfactual, Taleb makes it tail-aware and precautionary.

The two specifications are complementary rather than redundant, and the division of labor deserves precision, because a reader could mistake them for two ways of saying the same thing. Fogel is silent on the distributional character of the outcome; his discipline would apply equally to a thin-tailed and a heavy-tailed dependent variable, because his concern is the logical form of the causal claim and the explicitness of the counterfactual. Taleb is silent on the counterfactual structure of the comparison; his discipline would apply equally to an experimental and an observational design, because his concern is the distributional character of the outcome and the decision frame appropriate to it. Neither anchor alone specifies the model. Fogel without Taleb would license a conditional comparison estimated by any convenient method, including a mean-based one that the heavy tail would render unreliable. Taleb without Fogel would license a tail-aware estimator with no disciplined counterfactual, no explicit conditioning, and no falsifiable decision rule. The conceptual model this dissertation tests is the intersection: a conditional, counterfactual, falsifiable hazard model, estimated by a method suited to a thin-tailed event, reported with its uncertainty, and read under precaution with a pre-specified tail subgroup. That intersection is what the canonical estimating equation encodes, in which the hazard of mission-ending loss for fault episode i at time t is the product of an unparameterized baseline hazard and an exponential function of the autonomy variable and the three controls, with the hazard ratio on the autonomy variable as the quantity of interest. Fogel is responsible for the conditional, counterfactual, falsifiable structure of that equation; Taleb is responsible for the choice of a hazard rather than a mean as its left-hand side and for the precautionary reading of its output.

The argument that runs through the whole dissertation is advanced, not completed, by this chapter, and the record should be exact about which of its parts the two anchors supply. That the problem is real is an empirical matter for the literature and data chapters, but the theory chapter establishes why it is worth measuring rather than asserting: the autonomy-survival link is currently an unmeasured Fogelian counterfactual. That the problem is material is supported by the named light-time mechanism of Section 2.2 and the precautionary stakes of Section 2.5, which together establish that the autonomy decision is consequential and taken under a heavy-tailed risk. That the intervention addresses the causal mechanism is the direct yield of the synthesis: the conditional hazard model is the operationalization of Fogel's counterfactual contrast, and it is aimed at the specific light-time mechanism named in Section 2.2 rather than at a bare correlation. That the chosen approach improves on the alternatives is foreshadowed here by the Talebian exclusion of mean-based methods and is completed in the design chapter, which argues the Cox model against logistic-on-outcome and parametric mean-based rivals on the basis of censoring, dwell time, recurrent episodes, and small event counts. That the residual risk is acceptable is grounded here in the signed-bias reasoning of Section 2.2, which bounds the most likely confounder, and in the precautionary discipline of Section 2.5, which forbids over-reading a favorable point estimate; the remaining elements, small-sample-robust estimation and pre-flight scoring of the treatment, are completed in the data and design chapters. The theory chapter supplies the mechanism argument outright, materially supports the materiality and residual-risk arguments, and hands the others forward with their theoretical groundwork laid.

One scope decision remains to be made explicit. This dissertation is an observational survival-analysis measurement study, not the specification of a real system, capability, or data-service exchange. There is no system architecture to specify, and the chapter deliberately avoids forcing engineering-specification vocabulary onto what is a methodological and statistical contribution. The single point of contact with architecture is conceptual and is reserved for the discussion: the fitted hazard ratio, once it exists, is describable in plain prose as an input to an autonomy architecture trade, the endpoint at which a program weighs the cost of moving up one autonomy level against the estimated reduction in loss hazard. That is the strategic implication named at the end of the causal mechanism in Section 2.2, and it is the furthest the conceptual model reaches toward architecture. The model itself is a hazard, the anchors are Fogel and Taleb, and the contribution is a number read under counterfactual discipline and precautionary care.

The chapter has kept faith throughout with the design-stage posture of the dissertation. No estimate has been reported as executed. Every reference to the hazard ratio has been to a quantity the empirical work will produce, not to a quantity it has produced, and the illustrative shapes that make the decision rule concrete, an estimate below one with an interval excluding one as the alternative-consistent shape and an estimate near one with an interval spanning one as the fail-to-reject shape, are decision-rule illustrations rather than findings. The conceptual model is fully specified and the two anchors are fully developed, but the number that will fill the model remains, as it must at this stage, unestimated. What the chapter delivers is the theoretical machinery that determines what that number will mean when it exists: a conditional, counterfactual, falsifiable hazard, read in a tail-aware and precautionary register, that either supports or refutes the claim that onboard fault-management autonomy lowers a spacecraft's risk of mission-ending loss once it has entered a fault state.

\newpage

# Chapter 3. Literature Review

## 3.0 The chapter's answer, and the shape of the argument it defends

This chapter defends one claim, and everything in it is arranged to make that claim survive scrutiny: the two literatures that bear on spacecraft fault management and mission survival are mature, internally rigorous, and complementary, yet they do not meet at the precise point this dissertation occupies, so the conditional, population-level question the dissertation asks is genuinely open rather than answered-by-implication. Stated as the chapter thesis, the engineering tradition has built and flown autonomous fault management and has argued for it from architecture and from case narrative, while the reliability-statistics tradition has shown that spacecraft failure is statistically tractable at the population level; neither has estimated the effect of fault-management autonomy on the hazard of mission-ending loss conditional on a spacecraft having already entered a fault state. The gap is therefore not a deficiency of either literature on its own terms. It is a seam between two literatures, and the contribution of this dissertation lives in that seam.

Framed as a problem the chapter must resolve, the current state of the literature is two well-developed but unjoined bodies of work. The desired state is a synthesis that locates, against a real bibliography, the exact unanswered question and shows that answering it requires importing the survival apparatus of one tradition and redirecting it onto the explanatory variable the other tradition treats as a design property rather than a covariate. The gap between current and desired state is the absence of any study that joins them. Leaving the gap unaddressed means program managers continue to weigh autonomy investment, which carries real software, verification, and authority-shift costs, against an asserted but unmeasured survival benefit. The remainder of this chapter walks the literature branch by branch so that the seam becomes visible and the proposition that follows from it becomes unavoidable.

The review is organized along three branches that are distinct from one another and that together cover the relevant terrain. Branch A is the fault-management engineering tradition: the flight demonstrations that anchor the autonomous end of the design spectrum, the fault-protection architectures that became reference patterns, the formal specification and verification work that arose because autonomy moves safety-critical decisions into code, and the fault detection, isolation, and recovery (FDIR) and model-based diagnosis literature that operationalizes those decisions. Branch B is the spacecraft reliability-statistics tradition, the body of work that established population-level survival modeling for spacecraft and that supplies the validated estimator this dissertation imports. Branch C is the onboard anomaly-detection and autonomy-survey literature, which sits between the other two and which has matured from limit-checking into machine learning on telemetry. Each branch is presented in the same way: a statement of what the branch establishes, the evidence from the cited sources, and the reasoning that connects that evidence to the gap. The chapter closes by stating the gap explicitly and naming the propositions that follow from it, which the later design chapters operationalize.

Throughout, each major claim is held to the same discipline. The claim is stated; the cited findings that support it are given; the inferential rule that licenses moving from those findings to the claim is made explicit, along with its methodological or empirical basis; the strength with which the claim is held is stated; and the condition under which the claim would fail is named. Confidence is reported on a four-level scale (low, moderate, high, very high) and is calibrated to the grade of the underlying evidence, because at the design stage the strength of a literature claim is a function of how well the cited work supports it, not of any result this dissertation has produced.

## 3.1 Branch A, part one: the autonomy anchor demonstrations

The autonomous end of the fault-management spectrum is not a hypothetical; it has flown, and the flight demonstrations establish that onboard detection, isolation, and recovery without a ground command cycle is technically feasible. This matters because the dissertation's treatment variable, the ordered autonomy score, presupposes that the high-autonomy category is occupied by real designs rather than by aspiration.

The anchor demonstration is the Remote Agent Experiment flown on the Deep Space One technology-validation mission. The architecture that supported it integrated three capabilities that previously lived in the ground segment: an onboard planner-scheduler that generated activity plans from goals rather than from a ground-uplinked command sequence ([\[17\]](#ref-17)), a reactive executive that executed those plans robustly while tracking how well they were being accomplished, and a model-based mode-identification and reconfiguration component that diagnosed faults and recovered from them onboard. Bernard and colleagues describe the design of the experiment, in which the spacecraft was given a list of goals rather than a detailed command sequence, generated a plan to achieve them, and executed that plan while monitoring its own state ([\[84\]](#ref-84)). The flight-experience report on the same experiment documents what actually happened in flight, including the anomalies encountered during the demonstration and how the onboard agent handled them ([\[16\]](#ref-16)). The prototype that preceded flight is documented across two papers that describe the autonomous-agent architecture and its integration of real-time monitoring and control with constraint-based planning, robust multi-threaded execution, and model-based diagnosis and reconfiguration ([\[86\]](#ref-86), [\[12\]](#ref-12)). The hybrid procedural and deductive executive that supported the integration is described as a distinct architectural contribution: a way of combining the responsiveness of procedural execution with the generality of deductive reasoning in a single onboard executive ([\[12\]](#ref-12)).

The convergence across these five sources is that closed-loop onboard autonomy spanning planning, execution, and model-based fault diagnosis and recovery was demonstrated in flight, not merely simulated. For the dissertation, this convergence does two things. First, it validates the construct of an autonomy spectrum with an occupied high end, which the ordered autonomy score requires; if the high-autonomy category were empty, the score would be degenerate and the treatment contrast undefined. Second, and more subtly, the flight-experience report's honest account of in-flight anomalies during the experiment itself ([\[16\]](#ref-16)) is a reminder that demonstrating autonomy is not the same as demonstrating that autonomy improves survival, which is exactly the unmeasured step the dissertation targets. The demonstrations show capability; they do not, and were never designed to, estimate a population-level survival effect.

A capability demonstrated in flight on a representative deep-space platform is evidence that the capability is real and deployable, not speculative, and the cumulative engineering record of the Deep Space One mission documented in the cited primary sources supplies that demonstration. This rests on A-grade and B-grade primary engineering reports of an actual flight experiment, so it can be held with high confidence. The one circumstance that would weaken it is if the demonstrated autonomy were shown to be so narrow or so dependent on ground preparation that the high-autonomy category collapses back toward the ground-dependent end in practice; the dissertation's three-pass scoring rubric, which distinguishes which of detection, isolation, and recovery actually executes onboard, is designed precisely to detect that collapse rather than to assume it away.

A second line of evidence extends the autonomy claim past the single anchor mission and into a broader research program. Surveys of autonomy for space robots map the past, present, and prospective state of the field and document that autonomous capability has continued to develop across mission classes rather than remaining frozen at the Deep Space One demonstration ([\[19\]](#ref-19)). The application of artificial intelligence across space missions has been reviewed at the level of both opportunities and the assurance challenges that autonomy introduces ([\[20\]](#ref-20)). More recent work surveys agent-based approaches for distributed space systems and mission management, cataloguing methodologies, current practices, and open challenges, which places the autonomy question in the contemporary multi-spacecraft context that future JPL architectures inhabit ([\[35\]](#ref-35)). The autonomy concept has even been extended to the end-of-life regime, with work on autonomous self-removal of spacecraft that requires onboard status detection, removal triggering, and passivation without a ground loop ([\[36\]](#ref-36)). The throughline across these surveys is consistent with the anchor demonstrations: the high-autonomy end of the spectrum is occupied, populated, and growing, and the field's own framing of it foregrounds capability and assurance rather than measured survival benefit. That framing is the negative space into which the dissertation's question fits.

## 3.2 Branch A, part two: fault-protection architectures and the reference patterns

Spacecraft fault protection has a small number of reference architectures that recur across missions, and the spectrum from ground-dependent to onboard-autonomous fault protection is an architectural property that can be read from design documentation. This underwrites the second pass of the autonomy-score construction, which places a mission's implementation on the ordered detection-isolation-recovery scale by reading its architecture.

The Cassini fault-protection design is the canonical layered, monitor-and-response reference pattern. The system-level fault-protection design has been documented as a formalized architecture of monitors and responses ([\[2\]](#ref-2)), and subsystem-level treatments show how the pattern propagates downward: the command-and-data-subsystem fault-protection architecture is described in terms of fault detections, error filtering, event-activation rules, and response triggering across specific subsystem regions ([\[66\]](#ref-66)), and the attitude-control-subsystem fault protection is described in terms of detection, location, and recovery algorithms integrated into the object-oriented flight software with explicit interactions between subsystem-level and system-level fault protection ([\[69\]](#ref-69)). These three sources together establish the Cassini lineage as a coherent, layered, and well-documented reference pattern. Against that heavy, hand-built lineage, the literature also documents deliberate attempts to reduce cost and complexity: a component-based fault-protection architecture proposes capturing fault-protection domain knowledge in reusable components that compose into a spacecraft-level strategy validated by formal analysis and simulation before implementation ([\[65\]](#ref-65)); a robust fault-protection strategy for a commercial-off-the-shelf-based spacecraft addresses how to protect a vehicle built from parts not originally space-qualified ([\[15\]](#ref-15)); and the SPIDER work proposes a simple emergent system architecture for autonomous fault protection as an alternative to the heavyweight layered pattern ([\[4\]](#ref-4)). The lineage of the whole idea reaches back to early framing of fault-tolerant design as a route to spacecraft autonomy ([\[1\]](#ref-1)), and the design-attribute literature names the properties that distinguish autonomy systems from one another, specifically understandability, flexibility, and verifiability, as the dimensions along which spacecraft fault-management autonomy systems actually differ in practice ([\[59\]](#ref-59)).

The interpretive payoff of this branch is that the autonomy of a fault-protection implementation is legible from its architecture. The Cassini lineage is recognizably more onboard-capable in detection and response than a purely ground-dependent design, the COTS and component-based and emergent variants occupy different points on the cost-and-autonomy plane, and the attribute literature gives a vocabulary for distinguishing them. This legibility is precisely what the second pass of the autonomy score depends on: a coder reading NTRS and design documentation can place an implementation on the detection-isolation-recovery scale because the architectures are documented at that granularity. The branch also supplies a caution that the dissertation must respect. The same documentation that makes architecture legible was, in several cases, written by the design teams themselves, which means the autonomy score read from it inherits whatever optimism those teams brought to describing their own designs. The dissertation's response, second-reader re-coding with rubric adjudication, is a direct answer to that documentation-bias risk.

Recurring, documented architectural patterns can be classified reliably by trained readers using a fixed rubric, and the patterns themselves exist in the cited primary literature alongside the attribute taxonomy that names their differentiating properties ([\[59\]](#ref-59)). The existence and legibility of the patterns can be held with high confidence; that they can be ordered into three clean autonomy levels without loss can be held only with moderate confidence, because real architectures are multidimensional and the ordinal score compresses them. The ordering would fail if the architectural dimensions that matter for survival are orthogonal to the detection-isolation-recovery axis the score uses, in which case a mission could score high on the axis and still recover slowly; the dissertation flags this as a construct-validity threat and treats the score as deliberately coarse rather than claiming cardinal precision.

## 3.3 Branch A, part three: formal specification and verification of autonomous systems
A substantial literature treats the verification of autonomous spacecraft and robotic systems as a first-order problem, and it does so because autonomy relocates safety-critical decisions from a human ground loop into flight code that must be trusted before launch. This supports the dissertation's identification logic in two ways. It confirms that autonomy is an investment with a real and named cost, the verification burden, and it confirms that the autonomy score should be anchored to pre-flight artifacts, because verification is a pre-flight activity that leaves a pre-flight documentary trail.

The survey of formal specification and verification of autonomous robotic systems catalogues the methods brought to bear and the open problems, establishing the breadth and the difficulty of the verification task for autonomous systems generally ([\[3\]](#ref-3)). Within the spacecraft domain specifically, formal methods have been applied to validate fault tolerance in autonomous spacecraft, with a methodological framework aimed at the early life-cycle phases of fault-tolerant systems engineering and an emphasis on verifying fault-tolerance properties using model-based formalisms ([\[62\]](#ref-62)). The use of formal methods in spacecraft early-design validation catches design faults before they are built in, moving verification upstream into the design phase where the autonomy decisions are made ([\[14\]](#ref-14)). A complementary architectural-level treatment of fault tolerance lays out the fundamental concepts (voting, fault detection, clock synchronization, agreement, diagnosis, and reliability analysis) that any verifiable fault-tolerant architecture must address ([\[68\]](#ref-68)).

The verification literature shows directly that autonomy is not free. The mechanism is plain. Higher autonomy moves a decision that a human operator would otherwise make into onboard code; that code must be specified and verified before flight because there is no human in the loop to catch its errors in operation; specification and verification consume engineering effort and schedule; and that effort is the cost a program weighs against any survival benefit. This is the cost side of the architecture trade the dissertation's hazard ratio is meant to inform. The verification literature also has a quieter methodological consequence. Because verification is a pre-flight activity, the artifacts it produces (specifications, validation reports, formal models) are pre-flight documents, and the dissertation's autonomy score, by drawing on pre-flight TechPort and design documentation rather than post-loss narratives, can lean on exactly these artifacts to defeat reverse coding. The score's date stamp is, in effect, before the outcome it is used to explain.

A literature that treats verification as a first-order problem is itself evidence that the thing being verified, autonomy, carries a cost commensurate with the effort spent verifying it, and the survey and primary-method sources cited establish that effort. That the verification cost is real and pre-flight can be held with high confidence; that the verification trail is uniformly available across the dissertation's intended sample can be held only with moderate confidence, because verification rigor itself varies by program and the thinly documented missions may lack the trail. If verification rigor is itself an unobserved confounder, correlated with both autonomy and survival, then conditioning on the autonomy score alone would not absorb it. The dissertation names test rigor and operations-team experience explicitly as the most plausible unobserved confounders and reasons about the sign of the resulting bias rather than claiming to have removed it.

## 3.4 Branch A, part four: FDIR and model-based diagnosis

Fault detection, isolation, and recovery is a distinct engineering practice with its own architectures and algorithms, and within it model-based diagnosis is the dominant route to onboard autonomy. The practice is mature enough to populate the high-autonomy end of the score, but it is documented as a set of designs and demonstrations rather than as a population-level outcome study. This is the most important branch for the dissertation, because FDIR is the engineering object the treatment variable measures.

The FDIR practice has been surveyed as a module in satellite onboard software, with attention to which faults are subject to onboard identification and onboard recovery and which are not, and to the software architecture that supports cost-effective FDIR implementation ([\[73\]](#ref-73), [\[94\]](#ref-94)). Model-based fault management is documented as a route to rapid algorithm development and reduced verification burden, with a high-fidelity attitude-control model used to validate a model-based fault-management system intended for robotic and crewed missions ([\[61\]](#ref-61)). The same research line developed a model-based off-nominal state detection and isolation system using constraint suspension for autonomous fault management, motivated by the goal of isolating failures to the component level to enable faster and more targeted recovery ([\[90\]](#ref-90)). Dynamic Bayesian networks have been applied to FDIR for autonomous spacecraft, addressing partial observability, uncertain system evolution, and the prediction and mitigation of imminent failures, and integrating diagnosis with prognosis in a single FDIR cycle ([\[60\]](#ref-60)). The broader aerospace-systems FDIR literature surveys advanced model-based techniques and frames the open challenges and opportunities for the field ([\[89\]](#ref-89)). FDIR strategies have been characterized for autonomous satellite formations, with centralized, mixed, and distributed strategies compared in terms of knowledge, algorithm, and communication requirements ([\[92\]](#ref-92)). The autonomy concept has been integrated with physics-based fault-tolerant control in a fault-tolerant remote-agent architecture for attitude management, combining symbolic AI planning with control-theoretic reconfiguration ([\[63\]](#ref-63)). Adjacent fault-tolerance literature documents the hardware substrate on which recovery often depends, including fault-tolerant three-phase motor-drive topologies with their cost and capability trade-offs ([\[67\]](#ref-67)) and fault-tolerant attitude-sensor approaches such as particle-filter-based sensor fault detection and isolation ([\[93\]](#ref-93)). Model-based autonomy has even been pursued in the limiting case of diagnosis from functional models without embedded human expertise, with an honest account of how far a weak-logic search can get and where it hits its limits ([\[88\]](#ref-88)). The end-to-end recovery question, root-cause determination and recovery rather than detection alone, has been pursued in a hybrid on-board autonomous fault, anomaly, detection, diagnosis, and recovery line of work reported across successive years ([\[31\]](#ref-31), [\[32\]](#ref-32), [\[33\]](#ref-33)).

The synthesis of this branch is the heart of the chapter's gap argument. The FDIR and model-based-diagnosis literature is rich, methodologically diverse, and genuinely concerned with recovery, not just detection. Yet read as a body, it answers the question "can we design and assure a system that detects, isolates, and recovers autonomously?" and not the question "across many missions, does a more autonomous FDIR implementation lower the probability that a fault episode ends in loss rather than recovery?" The Kolcio line is explicit that component-level isolation is pursued because it should enable faster and more targeted recovery ([\[90\]](#ref-90)), which is a mechanism hypothesis, exactly the causal chain the dissertation formalizes, but it is asserted from the design's intent and validated on a model, not estimated against the survival record of a population of fault episodes. The Stottler line pursues recovery and root-cause determination end to end ([\[33\]](#ref-33)), and it is C-grade conference material rather than a peer-reviewed outcome study. The pattern is uniform: the field has the designs, several have flight or high-fidelity-model validation, and the recovery-benefit claim is made at the level of the individual architecture's intended behavior. No member of this branch fits a hazard model to a population of fault episodes with autonomy level as the covariate. That absence is not a weakness of the FDIR literature; it is a different question that the FDIR literature was never built to answer.

A literature consisting of designs, algorithms, and single-system validations does not constitute a population-level outcome estimate, no matter how numerous its members, and every one of the cited FDIR sources is architecture, algorithm, or single-system validation rather than a multi-mission survival regression. This is a claim about the form of the literature, which is directly inspectable rather than about any contested empirical result, so it can be held with very high confidence. It would be refuted by the existence of even one study that estimates the conditional hazard of mission-ending loss on autonomy level across a population of fault episodes. The corpus assembled for this dissertation contains none, and the design chapters treat the discovery of such a study during execution as a falsification trigger that would reframe the contribution from "first estimate" to "replication and extension."

Some precision is warranted here about why the branch's mechanism hypotheses, however plausible, do not substitute for the dissertation's estimate. A mechanism hypothesis of the form "component-level isolation enables faster recovery" ([\[90\]](#ref-90)) or "onboard root-cause determination enables recovery without a ground loop" ([\[33\]](#ref-33)) names a driver and an intended observable effect. It does not name the operational consequence in survival terms, because it is not fit to survival data; it does not bound the effect with an interval; and it does not condition on the confounders (complexity, distance, age) that plausibly drive both autonomy investment and outcomes. The dissertation's contribution is the conversion of these qualitative mechanism hypotheses, which the FDIR literature asserts repeatedly, into a single estimable, falsifiable parameter, the hazard ratio on the autonomy variable, with its confidence interval and its explicit confounder control. That conversion is the move from a correlational or design-intent claim to a conditional, counterfactual estimate.

## 3.5 Branch C: onboard anomaly detection and health monitoring

Onboard anomaly detection has matured from limit-checking into a distinct machine-learning practice on spacecraft telemetry, and this maturation matters to the dissertation in two ways. It enriches the high-autonomy end of the spectrum with detection capability, and it introduces a specific confound: better detection can both raise the count of recorded fault episodes and improve the chance of acting on them in time, which the dissertation must address rather than ignore.

The classical-to-modern arc is documented across several reviews and primary studies. Automatic anomaly-detection techniques for spacecraft health monitoring have been developed as an improvement over manual limit-checking ([\[21\]](#ref-21)). A mixed unsupervised-learning and expert-input approach to mode and anomaly detection from long-duration robotic-mission telemetry moves toward more automated detection in time-series data ([\[72\]](#ref-72)). Deep-learning approaches to spacecraft fault detection and isolation have been studied, including for attitude-determination sensors and actuators whose failure has a significant negative mission impact ([\[96\]](#ref-96)). Onboard machine learning has been demonstrated on a flying CubeSat, with TensorFlow Lite, unsupervised learning, and online machine learning running on the OPS-SAT platform, which broke the pattern of restricting AI to ground-trained models uplinked to the spacecraft ([\[91\]](#ref-91)). Onboard detection of events of scientific interest has been developed for the Europa Clipper context, with algorithms for detecting thermal anomalies, compositional anomalies, and plumes under the constraints of the onboard computing environment ([\[80\]](#ref-80)). Two recent reviews survey the state of anomaly detection in spacecraft telemetry specifically ([\[79\]](#ref-79)) and the broader practice of smart anomaly detection in sensor systems from a multi-perspective standpoint ([\[22\]](#ref-22)). Digital-twin methodologies using fault and behavior trees have been proposed for spacecraft and ground-station operations, extending model-based diagnosis into the operations phase ([\[95\]](#ref-95)). The human side of the autonomy transition has been framed in the human-autonomy-teaming literature, which distinguishes automation from autonomy and draws on human-human teaming to reason about how operators collaborate with autonomous systems ([\[64\]](#ref-64)).

This branch establishes that detection capability, the first link in the detection-isolation-recovery chain, has its own rich and rapidly advancing literature, and that some of it now runs onboard in flight ([\[91\]](#ref-91), [\[80\]](#ref-80)). For the autonomy score, this means the detection sub-dimension is well populated and legible. For the identification strategy, this branch raises the instrumentation confound directly. A mission with sophisticated onboard anomaly detection will tend to record more fault episodes, because it detects conditions a cruder mission would miss, and it may also survive more of them, because early detection buys reaction time. If detection capability and survival share this common cause in instrumentation quality, the autonomy score and the survival outcome are partly endogenous, and a naive estimate would attribute to autonomy an effect that belongs to instrumentation. The dissertation's response is twofold and is foreshadowed here so that the design chapters can complete it: the competing-risks specification distinguishes recovery from loss as competing terminal events rather than collapsing them, and the frailty specification absorbs unobserved mission-level heterogeneity such as overall instrumentation quality into a shared random effect. Neither fully eliminates the confound, and the dissertation says so; the contribution is honest bounding, not a claim of clean identification.

A maturing detection literature both populates the autonomy spectrum and introduces a common-cause confound that any survival estimate on autonomy must confront, as the cited detection literature and the common-cause reasoning above together show. That detection has matured and runs onboard can be held with high confidence; that the instrumentation confound can be adequately bounded by competing-risks and frailty specifications can be held only with moderate confidence, because residual endogeneity may remain. If instrumentation quality dominates the autonomy score so completely that the two are empirically inseparable in the assembled sample, the dissertation's estimate would be uninterpretable as an autonomy effect. The design chapters specify a reduced model and a frailty term as diagnostics for exactly this failure mode, and commit to reporting it as a limitation rather than masking it.

## 3.5a How the literature licenses the ordinal autonomy scale

The three branches reviewed so far do more than establish that an autonomy spectrum exists; read together they license the specific ordinal structure the dissertation's treatment variable imposes, namely a scale that asks, function by function, how much of the detection-isolation-recovery chain executes onboard without a ground command cycle. This subsection makes the licensing explicit, because the credibility of the entire study rests on the autonomy score being a defensible reading of the engineering record rather than an analyst's invention.

Working function by function, the detection-isolation-recovery decomposition is not imposed from outside the literature; it is the literature's own organizing structure for FDIR. The survey treatments of fault detection, isolation, and recovery as a software module name exactly these three functions and observe that not all failures are subject to onboard identification and not all are subject to onboard recovery, which is precisely the statement that the three functions can be allocated independently between spacecraft and ground ([\[73\]](#ref-73), [\[94\]](#ref-94)). That independent allocability is what makes an ordinal scale possible. A design can detect onboard but recover only with a ground-uplinked sequence; another can detect, isolate, and recover onboard. The scale orders designs by how far down this chain onboard execution reaches.

For the detection function, the anomaly-detection branch establishes both the ground-dependent floor and the onboard ceiling. Manual limit-checking against ground-monitored telemetry is the historical floor ([\[21\]](#ref-21)); onboard machine learning running on a flying platform is a contemporary ceiling ([\[91\]](#ref-91)), as is onboard detection of scientifically significant events under flight computing constraints ([\[80\]](#ref-80)). A coder placing a mission on the scale can therefore distinguish, from documentation, whether detection waited for a ground analyst or executed onboard. For the isolation function, the model-based-diagnosis literature supplies the discriminating evidence: constraint-suspension and model-based off-nominal state isolation are designed to isolate failures to the component level onboard ([\[90\]](#ref-90)), and dynamic-Bayesian-network FDIR integrates onboard diagnosis with prognosis under partial observability ([\[60\]](#ref-60)), whereas the Cassini-lineage architectures document isolation through monitor-and-response rules whose recovery triggering may still hand off to ground for the harder cases ([\[69\]](#ref-69), [\[66\]](#ref-66)). For the recovery function, the end-to-end autonomy demonstrations occupy the ceiling, with onboard plan generation and model-based reconfiguration closing the loop without ground intervention ([\[84\]](#ref-84), [\[17\]](#ref-17), [\[12\]](#ref-12)), while the worked anomaly cases document the ground-dependent floor, in which the spacecraft safes itself and human flight teams diagnose and uplink the recovery ([\[74\]](#ref-74), [\[70\]](#ref-70)).

The interpretive payoff is that each of the three ordering functions has, in the literature, a documented floor and a documented ceiling, and intermediate designs sit between them in a way that trained readers can classify from pre-flight design documentation. This is what justifies treating the autonomy variable as ordinal rather than nominal: the levels are ordered by a real, literature-grounded property (depth of onboard execution along the FDIR chain), not by an arbitrary ranking. It also justifies treating the variable as ordinal rather than cardinal: the literature gives no basis for asserting that the gap between ground-dependent and limited-onboard-response is the same size as the gap between limited-onboard-response and full-onboard-recovery, so the score claims order without claiming equal spacing, and the hazard ratio is read per level rather than per unit of a continuous quantity that the documentation cannot support.

An ordinal scale is defensible when its ordering property is documented in the source literature and its levels have literature-anchored floors and ceilings, and the FDIR literature's own three-function decomposition ([\[73\]](#ref-73), [\[94\]](#ref-94)) together with the floor-and-ceiling evidence for each function cited above supplies exactly that documentation. That the ordering is literature-grounded can be held with high confidence; that every intended-sample mission can be placed unambiguously can be held only with moderate confidence, because borderline designs and thin documentation will produce coding disagreements. The scale would fail if the three functions were so entangled in real designs that they could not be assessed separately. The dissertation's three-pass rubric, with its independent second-reader re-coding and adjudication against documentation, is the instrument that detects and resolves exactly that entanglement, and the inter-coder reliability schema reported in the data chapter is the evidence on which the scale's defensibility ultimately rests.

## 3.6 Branch A and C synthesis through worked anomaly cases

The documented record of individual mission anomalies, read across missions, shows that safe-mode entry is routine on long-duration missions and that a fraction of fault episodes precede or threaten permanent loss; the same record shows that recovery outcomes vary, but it does not, episode by episode, attribute that variation to autonomy level in a way that supports a population estimate. The worked cases are therefore evidence for the reality and materiality of the problem and simultaneously evidence for the gap.

The anomaly-and-recovery literature provides concrete episodes. The Galileo spacecraft entered its system fault-protection safing routine on four in-flight occasions, and the flight team developed and refined a recovery process whose efficiency depended on quick diagnosis and on the minimization of permanent capability degradation; the documented case includes the focused recovery planning for a specific potential failure during the Gaspra asteroid encounter ([\[74\]](#ref-74)). The CloudSat battery anomaly placed the spacecraft into emergency mode and rendered it operations-incapable, threatening the A-Train constellation it flew in, and recovery required a complex sequence executed within a single sunlit period ([\[70\]](#ref-70)). The GLAS instrument on ICESat experienced a loop-heat-pipe anomaly that drove its electronics to a hot safing temperature and required several days of recovery, with multiple candidate physical explanations ([\[75\]](#ref-75)). Mission in-orbit-performance and instrument reports document the operational constraints and limiting resources that govern long-duration missions and the environments they survive in, across platforms including INTEGRAL ([\[71\]](#ref-71)), STEREO's heliospheric imagers ([\[77\]](#ref-77)), Venus Express radio science ([\[78\]](#ref-78)), GEOTAIL's energetic-particle instrument ([\[83\]](#ref-83)), and the two-spacecraft BepiColombo mission to Mercury's harsh environment ([\[82\]](#ref-82)). The Dawn mission's documented lessons span its journey to Vesta and Ceres and include the operational realities of running a long deep-space mission, including anomaly handling ([\[37\]](#ref-37)). The environmental drivers of anomalies are themselves reviewed: the space environment's effects on spacecraft vary by orbit and include radiation, plasma, and particle effects that induce off-nominal conditions ([\[81\]](#ref-81)), and the security-and-reliability literature for low-Earth-orbit systems catalogues reliability risks and enhancement solutions for the increasingly populated LEO regime ([\[76\]](#ref-76)).

Read together, these cases establish that the problem is real: safe-mode entry recurs (four times on Galileo alone), it sometimes threatens loss (CloudSat's constellation threat), and recovery is neither automatic nor uniform (the multi-day GLAS recovery, the single-period CloudSat recovery). They also establish that it is material, because the environmental reviews show that the fault-inducing conditions are pervasive and orbit-dependent rather than rare ([\[81\]](#ref-81), [\[76\]](#ref-76)). But the same cases expose the gap with unusual clarity. Each is a single mission's narrative. The Galileo recoveries succeeded partly because of human flight-team ingenuity under specific boundary conditions ([\[74\]](#ref-74)); the CloudSat recovery succeeded through bold operator-developed procedures ([\[70\]](#ref-70)). These are exactly the case narratives the prospectus warns against treating as a substitute for a hazard model. They cannot, individually or pooled by hand, yield a conditional estimate of the autonomy effect, because they are not a sample drawn and coded to a common rubric, they are not time-to-event records with consistent censoring, and they do not hold complexity, distance, and age fixed. The dissertation's data chapter converts precisely this kind of narrative into coded fault episodes; the literature here is the raw material, not the answer.
Individual anomaly narratives establish that the phenomenon exists and recurs, but by their nature they cannot deliver a population-level conditional estimate, and the form of the cited cases, each a single-mission report, is what makes this so; the point can be held with high confidence. It would weaken only if the case literature were shown to constitute a complete, uniformly coded census of fault episodes, which it does not. Its heterogeneity is one of the four data limitations the dissertation names, because well-documented flagship anomalies are over-represented relative to quietly handled or lightly documented episodes.

## 3.7 Branch B: the spacecraft reliability-statistics tradition

A mature reliability-statistics tradition has established that spacecraft failure is statistically tractable at the population level. It has produced validated survival and multi-state models of spacecraft and subsystem failure, and it has documented the structural features (mass-category variation, infant-mortality and wear-out regimes, multi-state degradation) that any spacecraft survival model should respect. This tradition supplies the estimator and the structural priors the dissertation imports. It also omits fault-management autonomy as a covariate and models the unconditional rather than the conditional question, which is the precise omission the dissertation fills.

The foundational work assembled on-orbit failure data across hundreds of spacecraft and fit nonparametric and Weibull reliability models, establishing that satellite and subsystem reliability is amenable to statistical data analysis and modeling at the population level ([\[5\]](#ref-5)). The same research program extended the analysis in several directions that bear directly on the dissertation's design. It moved beyond a binary failed-or-operational view to multi-state failure analysis, distinguishing degraded states from fully failed states in a statistical framework ([\[6\]](#ref-6)). It compared single-Weibull against mixture-Weibull specifications for nonparametric satellite reliability, addressing the shape of the baseline hazard and the coexistence of distinct failure regimes ([\[7\]](#ref-7)). It asked whether spacecraft size matters by analyzing reliability statistically across mass categories, finding that failure behavior differs by mass class ([\[9\]](#ref-9)). It analyzed small-satellite reliability in the same tradition, extending the apparatus to the small end of the mass spectrum ([\[10\]](#ref-10)). And it analyzed the attitude-control subsystem specifically, with reliability, multi-state, and comparative failure-behavior results for one of the subsystems most implicated in safe-mode entry ([\[11\]](#ref-11)).

The interpretive work of this branch is to show that the dissertation does not invent a statistical apparatus for spacecraft; it imports a validated one and redirects it. Three features of the reliability tradition map directly onto design choices the later chapters make, and naming the mapping here is what makes the import disciplined rather than opportunistic. First, the finding that failure behavior differs by mass category ([\[9\]](#ref-9)) and the related small-satellite extension ([\[10\]](#ref-10)) justify stratification and a complexity control rather than a single pooled baseline; the dissertation's mission-class stratification is the direct descendant of this finding. Second, the documented coexistence of infant-mortality and wear-out regimes, surfaced in the single-versus-mixture-Weibull comparison ([\[7\]](#ref-7)), justifies including spacecraft age as a covariate and testing whether its effect is monotone rather than assuming it; the dissertation's age control and its planned proportional-hazards testing on that covariate follow from this. Third, the multi-state framing that distinguishes degraded from failed states ([\[6\]](#ref-6)) is the conceptual ancestor of the competing-risks specification, in which recovery and loss are competing terminal events out of the fault state rather than a single absorbing failure. The attitude-control-subsystem result ([\[11\]](#ref-11)) matters because attitude faults are a common trigger of safe-mode entry, so the subsystem most likely to generate the dissertation's fault episodes is also the one with the most developed reliability baseline to borrow from.

The redirection is the contribution's hinge. The reliability tradition models the unconditional question, time from launch to hardware failure, and it treats every spacecraft as a unit whose reliability is to be characterized. The dissertation conditions on fault entry and asks the survival question downstream of the fault, which is a different origin, a different risk set, and a different decision-relevant quantity. The reliability tradition has no autonomy covariate at all; fault-management autonomy is simply not in its model, because its question does not require it. The dissertation adds that covariate and makes it the object of interest. The relationship is therefore one of methodological inheritance with substantive redirection: the estimator family, the structural priors about mass and age and multi-state degradation, and the demonstrated feasibility of population-level spacecraft survival modeling all come from this branch, while the conditioning on fault entry and the autonomy covariate are the dissertation's own.

A validated population-level survival apparatus developed for the unconditional spacecraft-failure question can be redirected to a conditional post-fault-survival question by changing the origin and the risk set and adding a covariate, without inventing new statistics, and the cited body of reliability work, all A-grade, both demonstrates the apparatus and supplies the structural priors. That the apparatus is importable can be held with very high confidence, because the import changes the data definition and the covariate set, not the estimator's mathematics, which are standard survival analysis. The import would be inappropriate if conditioning on fault entry induced a selection that the reliability apparatus cannot accommodate, for example if fault episodes are so non-randomly recorded that the risk sets are biased; the dissertation names under-recording of silently handled episodes as a data limitation and confines its inference to the documented population rather than claiming to characterize all fault episodes.

## 3.7a Why the conditional question is the decision-relevant one the literature has not asked

Neither literature has produced the dissertation's estimate, and the reason is not oversight but a difference in the question each was built to answer. Articulating that difference precisely shows why the conditional framing is the one a program manager actually needs, and why a hazard model, rather than a logistic regression on episode outcome, is the natural estimator for it. This subsection isolates the conceptual move that the contribution turns on, drawing the distinction sharply enough that the design chapters can build on it without re-arguing it.

Consider the three questions one could ask of the same missions. The first is unconditional and mission-level: do autonomous missions fail less often overall? This is the reliability tradition's natural extension, and it is dominated by whether missions encounter faults at all and by every other systematic difference between autonomous and non-autonomous programs, so its answer conflates fault-arrival rates with post-fault survival and is not the quantity a manager deciding how much autonomy to buy can use. The second is conditional and episode-level but outcome-only: among fault episodes, does a higher-autonomy spacecraft end the episode in recovery rather than loss? This is closer, and it is what a logistic regression on episode outcome would estimate, but it discards the information in how long the spacecraft dwells in the fault state before resolving and it cannot represent episodes that are still unresolved at the observation window's close. The third is conditional and episode-level with timing: among fault episodes, how does autonomy change the hazard, the instantaneous rate of transition to loss, over the time the spacecraft spends in the fault state? This is the dissertation's question, and it is the only one of the three that uses the dwell time, handles right-censoring of episodes that recover or remain open, and accommodates recurrent episodes within a mission without double-counting.

The literature reviewed in this chapter answers neither the second nor the third question at the population level. The reliability tradition answers a fourth, distinct question (time from launch to hardware failure) and stops at the spacecraft rather than the episode ([\[5\]](#ref-5), [\[9\]](#ref-9)). The engineering tradition gestures at the second and third questions through mechanism hypotheses and case narratives but never fits them: the FDIR literature's claim that component-level isolation enables faster, more targeted recovery ([\[90\]](#ref-90)) is a hazard claim in disguise, because "faster recovery" is a statement about the rate of transition out of the fault state, yet it is asserted from design intent and validated on a single model rather than estimated as a rate across episodes. The Stottler recovery line pursues root-cause determination and recovery end to end ([\[33\]](#ref-33)) without expressing the benefit as a survival rate. The worked cases narrate dwell-and-recover sequences (the single-sunlit-period CloudSat recovery, the multi-day GLAS recovery) that are exactly time-to-event observations ([\[70\]](#ref-70), [\[75\]](#ref-75)), but they are narrated, not coded into a survival object with a common origin and censoring rule.

The decision relevance follows directly. A fault has occurred or will occur on essentially every long-duration mission, because safe-mode entry is routine rather than exceptional, as the recurrence record shows ([\[74\]](#ref-74)). The manager's live question is therefore not whether autonomy reduces fault arrivals but what happens next once a fault has arrived, and specifically whether the spacecraft's own fault-management capability changes the probability that the episode ends in recovery rather than loss in the time available. Conditioning on fault entry isolates that decision-relevant quantity and discards the noise of differing fault-arrival rates; the hazard formulation then extracts the timing information that the dwell-and-recover record contains and that an outcome-only model would throw away. This is why the contribution is framed as a conditional hazard estimate and not as an unconditional comparison or a logistic outcome model, and the framing is a direct response to what the reviewed literature does and does not provide.

The estimator should match the decision the estimate informs, and the decision here is conditional and timing-sensitive, so the estimator must be conditional and timing-sensitive. This follows from the reliability tradition's demonstration that population survival modeling of spacecraft is feasible ([\[5\]](#ref-5)) combined with the engineering literature's repeated framing of the benefit as faster recovery ([\[90\]](#ref-90)), which is a rate, hence a hazard. Because it is an argument about the alignment of question and estimator rather than about a contested result, it can be held with very high confidence. The conditional framing would be the wrong choice if conditioning on fault entry introduced a collider bias that an unconditional design would avoid; the design chapters confront this by reasoning that fault entry is on the causal path from autonomy to outcome rather than a common effect of autonomy and an unobserved cause of survival, so conditioning on it isolates rather than distorts the decision-relevant contrast, and the threats-to-validity matrix records the assumption explicitly.

## 3.8 Cross-branch synthesis tables

The three branches can be summarized along the two axes that define the gap: what question each body of work answers, and whether it treats fault-management autonomy as an explanatory variable. The first table positions the branches; the second maps the imported design elements to their reliability-tradition source.

**Table 3.1. The seam between the literatures.**

| Branch | Representative sources | Question it answers | Autonomy as covariate? | Conditional on fault entry? |
|--------|------------------------|---------------------|------------------------|------------------------------|
| A.1 Autonomy demonstrations | Bernard1999DS1, Muscettola1997Onboard, Pell1998Hybrid, Gao2021Autonomy | Can onboard detection-isolation-recovery work in flight? | Implicit (the design is the autonomy) | No (capability, not outcome) |
| A.2 Fault-protection architectures | RasmussenCassini1996, Brown1998, Brown2002, Ong2003, SPIDER2001, RobustCOTS2007 | What architecture detects and responds to faults? | No (architecture is described, not scored across missions) | No |
| A.3 Formal V&V | Luckcuck2019Formal, Ayache2002, Bozzano2014Formal, Butler2013 | Is the autonomous design correct and assurable? | No | No |
| A.4 FDIR / model-based diagnosis | Kolcio2014, Kolcio2016, CodettaRaiteri2014, Zolghadri2012, SalarKaleji2013, Stottler2024AMOS | Can a system diagnose and recover autonomously? | Design-intent only | No (single-system validation) |
| C Anomaly detection | HealthMon2016, Biswas2020, Voss2019, Labrche2022, Fejjari2025, Erhan2021Anomaly | Can faults be detected onboard from telemetry? | No | No (detection, not survival) |
| B Reliability statistics | CastetSaleh2009, CastetSaleh2010Multistate, CastetSaleh2011Mass, Dubos2014Small, Saleh2013ACS | How long until hardware fails, at population scale? | No (autonomy absent from the model) | No (unconditional, from launch) |
| **This dissertation** | (the contribution) | **Does autonomy lower the hazard of loss given fault entry?** | **Yes (the object of interest)** | **Yes (origin = fault entry)** |

The bottom row is the only one with "Yes" in both right-hand columns. That joint emptiness above it is the gap, displayed rather than asserted.

**Table 3.2. Design elements imported from the reliability tradition and redirected.**

| Design element in this dissertation | Reliability-tradition source | What is inherited | What is redirected |
|-------------------------------------|------------------------------|-------------------|---------------------|
| Population-level survival modeling of spacecraft | CastetSaleh2009 | Feasibility and method of fitting survival models to spacecraft failure data | Origin moved from launch to fault entry; outcome conditioned on fault state |
| Mission-class stratification | CastetSaleh2011Mass, Dubos2014Small | Failure behavior varies by mass/complexity class | Used as a complexity control and stratification variable, not the object of study |
| Spacecraft age covariate and monotonicity testing | CastetSaleh2010Weibull | Coexistence of infant-mortality and wear-out regimes | Age included as a control; PH/monotonicity tested rather than assumed |
| Competing-risks specification | CastetSaleh2010Multistate | Multi-state degradation distinguishing degraded from failed | Recovery and loss modeled as competing terminal events out of the fault state |
| Subsystem-level baseline (attitude control) | Saleh2013ACS | Reliability and multi-state behavior of the subsystem most implicated in safing | Borrowed as a structural prior for the subsystem most likely to generate episodes |

These tables make the chapter's thesis legible at a glance. Branch B hands the dissertation a validated estimator and a set of structural priors; Branches A and C hand it a populated, legible autonomy spectrum and the materiality of the problem; and no branch, alone or in combination, has produced the conditional, autonomy-covariate estimate that the bottom row of Table 3.1 names.

## 3.9 The gap, stated explicitly

The current state of the literature is now fully characterized, and the gap can be stated without hedging. Two literatures bear on the question of whether fault-management autonomy improves spacecraft survival, and they do not meet. The reliability-statistics tradition (Branch B) models the unconditional time from launch to hardware failure, treats the spacecraft as the unit, and contains no fault-management-autonomy covariate; it is the right estimator pointed at the wrong question for present purposes ([\[5\]](#ref-5), [\[6\]](#ref-6), [\[9\]](#ref-9), [\[10\]](#ref-10), [\[11\]](#ref-11)). The fault-management engineering tradition (Branches A and C) builds, verifies, and demonstrates autonomous detection, isolation, and recovery, and argues for autonomy's recovery benefit from architecture and from individual mission case narratives; it is the right substantive concern pointed away from population-level estimation ([\[90\]](#ref-90), [\[60\]](#ref-60), [\[16\]](#ref-16), [\[74\]](#ref-74), [\[70\]](#ref-70), [\[33\]](#ref-33)).

No study in the assembled corpus estimates the effect of fault-management autonomy level on the hazard of mission-ending loss conditional on fault entry, while controlling for the confounders (complexity, distance, age) that plausibly drive both autonomy investment and anomaly outcomes. This is a specific empirical absence, and three things must be said about it so that it is read correctly. First, the absence is structural, not accidental: it exists because the two literatures answer different questions, and bridging them requires importing one tradition's estimator into the other tradition's substantive domain, which neither has had reason to do. Second, the absence is the contribution, not a weakness of the corpus: the dissertation's value rests on the claim that no prior study estimates this conditional hazard, and so the absence of a direct precedent is the gap the work fills rather than a bibliographic hole to be patched with tangential citations. Third, the absence is bounded by the corpus's coverage: the claim is that no such study exists in a corpus assembled across the cliometrics, tail-risk, fault-management-engineering, FDIR, anomaly-detection, and reliability-statistics literatures via the vault APIs and local brains, and the design chapters treat the discovery of a counterexample during execution as a falsification trigger rather than as a result to be defended against.

The consequence of leaving the gap unfilled is the one the dissertation exists to remove: programs decide how much fault management to delegate to onboard autonomy on the strength of an engineering intuition (long light times make a ground loop slow) that has never been tested against the survival record of past missions, and they weigh autonomy's real costs (the verification burden documented in Branch A.3, the shifted authority documented across the autonomy-survey literature) against an asserted but unmeasured survival benefit. Filling the gap converts that intuition into an architecture-trade parameter.
## 3.10 The propositions that follow

Three propositions follow from the gap, and the later chapters operationalize them. They are stated here as the bridge from literature to design, and they carry the named causal mechanism that the engineering literature asserts qualitatively and that the dissertation will estimate.

**Proposition 1 (the estimable effect).** If higher onboard fault-management autonomy lowers the hazard of mission-ending loss conditional on fault entry, then in a conditional hazard model of the form

\[ h_i(t) = h_0(t)\,\exp\!\left(\beta_1\,\text{autonomy}_i + \beta_2\,\text{complexity}_i + \beta_3\,\text{distance}_i + \beta_4\,\text{age}_i\right) \qquad\qquad (1) \]

the coefficient on the autonomy variable is negative and the implied hazard ratio \(\exp(\beta_1)\) is below one. This is the alternative hypothesis H1; the null H0 is that \(\beta_1 = 0\) and \(\exp(\beta_1) = 1\). The proposition makes the literature's recurring mechanism hypothesis ([\[90\]](#ref-90), [\[33\]](#ref-33), [\[16\]](#ref-16)) estimable. The driver is higher autonomy; the mechanism is that onboard detection, isolation, and recovery executes without waiting for a ground command cycle; the observable effect is faster, light-time-independent resolution of the fault episode before it becomes terminal; the operational consequence is a hazard ratio below one on the autonomy variable; and the strategic implication is an evidence-based architecture-trade parameter for NASA and JPL deep-space autonomy investment. Where the engineering literature asserts the mechanism from design intent, the dissertation estimates the operational consequence and reports it with an interval, downgrading from causal language to conditional-association language wherever the observational design cannot support a randomized-effect claim. **Confidence that the mechanism is plausible: moderate-to-high**, grounded in the FDIR literature's consistent mechanism hypothesis and the demonstrated feasibility of onboard recovery; **confidence about the sign and size of the estimate: deliberately withheld**, because the study is at the design stage and no coefficient has been fit. Evidence that would raise confidence in the estimate is a fitted, sign-stable, interval-excluding-one hazard ratio across the robustness specifications; evidence that would lower it is a sign reversal upon adding controls or an interval that includes one.

**Proposition 2 (the confounding to be conditioned away).** Programs that invest in autonomy are not a random subset of missions. Deep-space missions face long light times and therefore both invest more in autonomy and operate in a harsher recovery environment; flagship missions are more complex and better funded. The unconditioned autonomy-survival association thus conflates autonomy with distance, complexity, and program richness. The literature supplies the justification for treating these as confounders: the reliability tradition shows that failure behavior depends on mass and complexity class ([\[9\]](#ref-9), [\[10\]](#ref-10)) and on age regime ([\[7\]](#ref-7)), and the autonomy literature shows that long light time is the standard engineering argument for autonomy ([\[19\]](#ref-19), [\[20\]](#ref-20)), which is to say distance drives both treatment and recovery environment. Conditioning on complexity, distance, and age operationalizes Fogel's counterfactual contrast as covariate adjustment, comparing the survival of comparable fault episodes that differ in autonomy level. **Confidence that these are the right confounders to condition on: high**, because each has a documented link to both treatment and outcome; **confidence that conditioning removes all confounding: low**, by construction, because the design is observational and unobserved confounders (test rigor, operations-team experience, instrumentation quality flagged in Branch C) remain, which is why the dissertation signs the residual bias rather than claiming to eliminate it.

**Proposition 3 (the tail-aware reading).** Mission-ending loss is a rare, heavy-tailed event whose historical record undersamples the tail. The estimator must therefore handle censoring and small event counts rather than rely on the stability of a mean, and the interpretation must consider whether autonomy's benefit concentrates in the worst episodes (greatest distance, shortest reaction time) even when the pooled estimate is modest. The reliability tradition's multi-state and competing-risks ancestry ([\[6\]](#ref-6)) and the survival-analysis apparatus jointly justify the estimator choice, which Chapter 5 develops. **Confidence that the dependent variable is tail-distributed and rare: high**, grounded in the rarity of documented mission-ending losses relative to safe-mode entries across the worked cases ([\[74\]](#ref-74), [\[70\]](#ref-70), [\[75\]](#ref-75)); **confidence that a tail-concentrated benefit exists: low and explicitly hypothesis-only**, to be probed by the pre-specified hardest-episode subgroup analysis rather than assumed.

## 3.11 Chapter synthesis

This chapter has carried the argument to the point the literature can take it. The problem is real: safe-mode entry recurs on long-duration missions and a fraction of episodes threaten loss, documented across Galileo, CloudSat, GLAS, and the wider anomaly record ([\[74\]](#ref-74), [\[70\]](#ref-70), [\[75\]](#ref-75), [\[81\]](#ref-81), [\[76\]](#ref-76)). The problem is material: autonomy carries documented verification and authority-shift costs ([\[3\]](#ref-3), [\[14\]](#ref-14), [\[68\]](#ref-68)), and the architecture trade that weighs those costs against an asserted survival benefit is made by intuition because no measured benefit exists ([\[19\]](#ref-19), [\[20\]](#ref-20), [\[35\]](#ref-35)). The intervention addresses the mechanism: a conditional hazard model on autonomy, with confounder control, directly measures the counterfactual contrast that the FDIR literature asserts but never estimates ([\[5\]](#ref-5), [\[6\]](#ref-6), [\[90\]](#ref-90)). The approach improves on the available alternatives in the literature because the case-narrative method the engineering tradition relies on ([\[74\]](#ref-74), [\[70\]](#ref-70)) cannot deliver a conditional population estimate, while the reliability tradition's estimator ([\[5\]](#ref-5)) can, once redirected. The remaining limitations are acknowledged rather than hidden: the autonomy score is a coarse ordinal compression of a multidimensional property, unobserved confounding remains, and the event of interest is rare, all of which the design and analysis chapters address through second-reader coding, pre-flight scoring, signed-bias reasoning, competing-risks and frailty specifications, and Firth-penalized estimation. The chapter's contribution is therefore complete: the literature shows the problem is real and material, shows that the intervention addresses a mechanism the literature itself names, and shows that no prior work has measured it, which is what justifies the contribution that follows.

The chapter's thesis stands. Two rigorous literatures bear on the autonomy-survival question and do not meet. The reliability tradition supplies a validated estimator pointed at the unconditional question and omits autonomy; the engineering tradition supplies the substantive concern and the mechanism hypothesis but argues from design and case narrative; and the conditional, population-level, autonomy-covariate estimate that sits in the seam between them is the object of this dissertation. The propositions that follow are the bridge to the data, measurement, and design chapters, where the autonomy score is constructed, the survival object is defined, the Cox estimator is specified, and the threats named here are met one by one.
## References cited in this chapter

The reference numbers cited above are listed here for convenience; full bibliographic entries with clickable DOI or URL appear in the dissertation backmatter. Grade-C grey-literature items (the AMOS conference papers [\[31\]](#ref-31), [\[32\]](#ref-32), [\[33\]](#ref-33)) are marked as such in the backmatter and are cited here only as illustrations of the FDIR-and-recovery design line, never as outcome evidence.

[\[1\]](#ref-1), [\[2\]](#ref-2), [\[3\]](#ref-3), [\[4\]](#ref-4), [\[5\]](#ref-5), [\[6\]](#ref-6), [\[7\]](#ref-7), [\[8\]](#ref-8), [\[9\]](#ref-9), [\[10\]](#ref-10), [\[11\]](#ref-11), [\[12\]](#ref-12), [\[14\]](#ref-14), [\[15\]](#ref-15), [\[16\]](#ref-16), [\[17\]](#ref-17), [\[19\]](#ref-19), [\[20\]](#ref-20), [\[21\]](#ref-21), [\[22\]](#ref-22), [\[31\]](#ref-31), [\[32\]](#ref-32), [\[33\]](#ref-33), [\[35\]](#ref-35), [\[36\]](#ref-36), [\[37\]](#ref-37), [\[59\]](#ref-59), [\[60\]](#ref-60), [\[61\]](#ref-61), [\[62\]](#ref-62), [\[63\]](#ref-63), [\[64\]](#ref-64), [\[65\]](#ref-65), [\[66\]](#ref-66), [\[67\]](#ref-67), [\[68\]](#ref-68), [\[69\]](#ref-69), [\[70\]](#ref-70), [\[71\]](#ref-71), [\[72\]](#ref-72), [\[73\]](#ref-73), [\[74\]](#ref-74), [\[75\]](#ref-75), [\[76\]](#ref-76), [\[77\]](#ref-77), [\[78\]](#ref-78), [\[79\]](#ref-79), [\[80\]](#ref-80), [\[81\]](#ref-81), [\[82\]](#ref-82), [\[83\]](#ref-83), [\[84\]](#ref-84), [\[86\]](#ref-86), [\[88\]](#ref-88), [\[89\]](#ref-89), [\[90\]](#ref-90), [\[91\]](#ref-91), [\[92\]](#ref-92), [\[93\]](#ref-93), [\[94\]](#ref-94), [\[95\]](#ref-95), [\[96\]](#ref-96).

\newpage

# Chapter 4. Data and Measurement

## 4.0 The chapter thesis

This chapter delivers the measurement spine of the dissertation: a fault-episode event-history dataset, constructed from four named NASA and Jet Propulsion Laboratory documentary sources, on which the conditional hazard of mission-ending loss can be estimated with a treatment variable that orders onboard fault-management autonomy and a defended set of controls. The chapter's answer is that every quantity in the estimating equation, including the delicate ordinal autonomy score, can be operationalized from documentation that exists prior to and independent of the survival outcome it is used to explain, and that the principal threats to measurement validity (reverse coding, reporting heterogeneity, and the compression of a multidimensional engineering property into a coarse ordinal) are bounded by construction choices rather than waved away. The autonomy score is the most fragile construct because it is the treatment; the chapter therefore builds it in three documented passes, anchors it to an externally published technology-readiness assessment, scores it from pre-flight material, and subjects it to an independent second reading. The remaining variables (the mission-ending event, the time-to-event clock, the complexity index, the distance regime, and spacecraft age) are imported from a validated reliability-statistics measurement apparatus and redirected from the unconditional hardware-failure question to the conditional post-fault-survival question. The chapter is written at the design stage. No episode has yet been coded against the assembled population; the worked examples are drawn from published mission post-mortems to illustrate how the coding rubric resolves a real case, and the coverage numbers are intended targets, not realized counts.

The problem this chapter addresses is a measurement problem with four parts. The **current state** is that the two literatures the dissertation bridges supply, between them, the statistical apparatus for spacecraft survival modeling [\[5\]](#ref-5), [\[6\]](#ref-6) and a large descriptive record of fault-management architectures and flight anomalies [\[18\]](#ref-18), [\[74\]](#ref-74), [\[70\]](#ref-70), but neither supplies a coded, episode-level dataset in which autonomy is an explanatory variable and post-fault survival is the outcome. The **desired state** is exactly such a dataset, with every variable in the canonical estimating equation operationalized to a documented source, a documented scale, and a documented quality check. The **gap** is that the treatment variable has no off-the-shelf measurement instrument: there is no published autonomy scale calibrated to fault management, so it must be constructed, and its construction is where the study's validity is won or lost. The **consequence of leaving the gap open** is that any hazard ratio fit to a poorly measured autonomy variable would be attenuated toward the null by classical measurement error and contaminated by reverse coding, so that a true protective effect could be masked and a spurious one manufactured. This chapter closes the gap by specifying the instrument before any estimate is attempted.

The canonical estimating equation, carried unchanged from the prospectus and the shared bible, fixes what must be measured:

\[ h_i(t) = h_0(t)\,\exp\!\left(\beta_1\,\text{autonomy}_i + \beta_2\,\text{complexity}_i + \beta_3\,\text{distance}_i + \beta_4\,\text{age}_i\right) \qquad\qquad (1) \]

for fault episode \(i\), where \(h_0(t)\) is the unparameterized baseline hazard and the \(\beta\)s are estimated by partial likelihood. Five quantities follow directly from this equation and organize the chapter: the survival object (the event and the time-to-event clock), the treatment \(\text{autonomy}_i\), and the three controls \(\text{complexity}_i\), \(\text{distance}_i\), and \(\text{age}_i\). Section 4.1 establishes the four named sources and their access paths. Section 4.2 defines the unit of analysis and the recurrent-episode rule. Section 4.3 operationalizes the dependent variable and the autonomy treatment. Section 4.4 constructs the three controls. Section 4.5 imports and redirects the reliability-statistics apparatus. Section 4.6 states coverage, the four material data limitations, data-quality and validation procedures, and the ethics and access posture. A consolidated measurement table in Section 4.3.5 maps every construct to its operational definition, source, and scale.

## 4.1 Named sources, provenance, and access paths

The analysis draws on four named documentary sources. Each is treated here as primary data, not as bibliography: the named sources supply the raw material from which fault episodes, outcomes, timing, autonomy, and controls are coded. This distinction matters for how the chapter is read. Where the chapter cites the reliability-statistics or methods literature, those are citations to published findings that justify a modeling choice. Where the chapter refers to NTRS, GAO, JPL anomaly records, or TechPort, those are references to the data substrate itself. The evidence-balance note in the expansion plan is therefore not a weakness to be patched: a data chapter whose variables are constructed from primary source documentation will be thin in secondary citations by construction, because the documents are the data.

### 4.1.1 NASA Technical Reports Server (NTRS)

NASA Technical Reports Server provides public access to NASA technical reports, conference papers, and lessons-learned documents through a citation-search interface at `https://ntrs.nasa.gov/api/citations/search`. The API returns structured citation records (title, authors, abstract, publication date, document type, and a resolvable identifier) and, where the underlying document is released, a link to full text. For this study NTRS is the primary instrument for two functions: identifying fault episodes and narratively coding autonomy behavior during a fault. The provenance chain is explicit. A fault episode enters the dataset when an NTRS document, or a corroborating GAO or JPL record, describes a discrete entry into a safe mode or comparable fault state on an identified spacecraft, with enough detail to fix the entry time and the end state. The early NTRS reference on onboard fault management for autonomous spacecraft [\[18\]](#ref-18) is illustrative of the document class that supplies design-intent material for the autonomy score: it describes the intended onboard detection-isolation-recovery behavior of a fault-management implementation in the candidate's own words before flight, which is exactly the pre-flight material the autonomy coding requires.

The **coverage** of NTRS is strongest for flagship and competed missions that produce conference papers and post-mission assessments, and weakest for missions that do not generate public technical reporting. The **known biases** are a documentation-effort bias (well-staffed flagship programs report more) and a survivorship-of-records bias (older or cancelled programs have thinner public trails). The **unit** NTRS supplies is the document; the coding protocol (Appendix A) maps from documents to episodes, and a single episode may be supported by several NTRS documents while a single document may describe several episodes.

### 4.1.2 Government Accountability Office (GAO) assessments

The Government Accountability Office publishes recurring assessments of major NASA projects that document development and on-orbit anomalies, schedule and cost consequences, and program-level attributes such as complexity class and cost category. GAO reports are accessed through the public GAO website. Their value to this study is twofold. First, they supply independent corroboration of mission-ending outcomes: because GAO is an external oversight body rather than the implementing program, a loss documented in a GAO assessment is less subject to the implementing program's framing than a self-report. Second, they supply the program-level attributes that feed the complexity control: subsystem and instrument counts and a cost class are reported or inferable from GAO project descriptions. The **provenance** advantage of GAO is its independence; the **bias** is that GAO concentrates on major projects above a reporting threshold, which reinforces the flagship over-representation already present in NTRS. GAO records are program-level, so they corroborate and contextualize episodes rather than time them.

### 4.1.3 JPL mission anomaly and incident-surprise-anomaly (ISA) records

JPL maintains mission anomaly and incident records for the deep-space and Earth-science missions it operates, including incident-surprise-anomaly reporting where releasable. These records supply the fine-grained fault-entry and recovery timing that the time-to-event variable demands, at a resolution that NTRS conference papers and GAO assessments usually do not reach. The Galileo safing-and-recovery record is a published example of the genre [\[74\]](#ref-74): it documents an anomaly, the spacecraft's safing response, and the recovery sequence with the temporal detail needed to fix a fault-entry origin and a recovery time. The **access** posture is the most constrained of the four sources because some ISA content is not publicly releasable; the coding protocol therefore restricts JPL-derived timing to releasable records and flags any episode whose timing rests on a non-public source so that a reproducibility audit can identify it. The **bias** is that releasable ISA records are a non-random subset of all anomalies, plausibly skewed toward episodes whose resolution was clean enough to document and release. This is the same under-recording-of-silent-episodes concern that recurs as a data limitation in Section 4.6, and the JPL stream is where it bites hardest.

### 4.1.4 NASA TechPort technology-readiness classifications

NASA TechPort catalogs technology projects with technology-readiness-level assessments. TechPort entries for fault-management, autonomy, and systems-health-management technologies are used to construct the **anchor** of the autonomy-maturity score: the readiness level of the flown fault-management or systems-health-management technology gives an objective, externally documented floor for the autonomy claim, so that the score does not rest solely on a single analyst's reading of design prose. The provenance virtue of TechPort is that the TRL assessment is made for technology-management purposes unrelated to this study's hypothesis, so it is exogenous to the autonomy-survival question; it was not produced to argue that autonomy helps or hurts survival. The **bias** is that TRL is a maturity scale, not an autonomy scale: a high TRL records that a technology is flight-proven, not that it executes the full detection-isolation-recovery chain onboard without a ground loop. The autonomy score therefore uses TRL as a floor and corroborating anchor, not as the autonomy measure itself; the ordinal detection-isolation-recovery placement (Section 4.3.3) is what carries the autonomy content, and the TRL anchor guards it against unsupported claims of maturity.

### 4.1.5 Worked-example missions as documented anomaly substrate

Beyond the four named source streams, the corpus carries a set of published mission descriptions and post-mortems that serve as worked examples for the coding rubric and as a check that the rubric resolves real cases. The Dawn mission to Vesta and Ceres [\[37\]](#ref-37), the Galileo safing-and-recovery record [\[74\]](#ref-74), and the CloudSat anomaly-recovery account [\[70\]](#ref-70) each document a fault entry and a recovery or loss outcome at a granularity that lets the coding protocol be exercised end to end before it is applied to the full population. Mission-design references such as the CHEOPS mission description [\[120\]](#ref-120), the Solar Probe Plus (Parker) mission description [\[125\]](#ref-125), and the BepiColombo two-spacecraft architecture [\[82\]](#ref-82) supply complexity and distance-regime context for missions that may contribute episodes. These are used illustratively in this chapter; they are not a claim that the population has been coded.

The Dawn record [\[37\]](#ref-37) is worth dwelling on as a coverage exemplar because it spans the full episode genre the study targets. Dawn was an ion-propulsion deep-space mission that visited two bodies and experienced reaction-wheel anomalies that forced operational reconfiguration over a long operating life; its published lessons document both safing entries and the ground-and-onboard recovery responses to them, at a range regime that places the ground loop at deep-space light times. A mission of this kind can contribute several episodes to the dataset, each with a documented entry, a documented terminal state, and a distance regime that is itself time-varying over the mission, which is precisely why the distance covariate must be allowed to be time-dependent rather than fixed at a single mission-level value. The CloudSat account [\[70\]](#ref-70) sits at the opposite end of the distance spectrum, an Earth-orbiting mission whose anomaly and recovery occurred at near-Earth light times where a ground loop is fast, and the contrast between the two is exactly the variation the distance control is meant to absorb so that it does not leak into the autonomy coefficient.

### 4.1.6 Cross-source record linkage

A measurement concern that is invisible until the four sources are used together is record linkage: an episode is frequently identified from one source, timed from a second, given its outcome corroboration from a third, and given its autonomy and complexity attributes from a fourth, so the episode record is an assembled object that must be linked across sources without error. The linkage key is the spacecraft-and-event pair: a documented fault entry on a named spacecraft at a documented time is matched across sources by spacecraft identity and by temporal proximity of the described anomaly. The linkage is fallible in two ways, each with a coding rule. First, a single underlying anomaly may be described in two sources with slightly different timing or framing; the protocol adopts the more authoritative timing (JPL ISA over a conference paper over a GAO summary, in that order, because ISA records are operational and closest to the event) and records the discrepancy. Second, two genuinely distinct episodes on the same spacecraft may be conflated if their descriptions are vague about timing; the protocol resolves this conservatively by treating ambiguous cases as a single episode rather than inventing a second, which biases the episode count downward but protects against manufacturing spurious recurrence. The linkage decisions are recorded per episode in the coding log so that a reproducibility reviewer can audit how a given assembled episode was built from its constituent source documents. The linkage discipline is the practical guarantee behind the measurement table in Section 4.3.5: each construct's source column names where that construct's value comes from, and the linkage protocol is what entitles the table to draw different columns of the same row from different documents.

## 4.2 Unit of analysis and the recurrent-episode rule

The unit of analysis is the **fault episode**: a discrete entry into a safe mode or comparable fault state by a single spacecraft. This definition is carried verbatim from the bible and is load-bearing for the whole design, so it is worth stating precisely what is and is not an episode. An episode begins at a fault entry, defined as the moment the spacecraft transitions from nominal operation into a protective reduced configuration (safe mode, standby, sun-point, or a comparable named fault state) in response to an onboard-detected anomalous condition. An episode ends at one of two terminal states: confirmed recovery to nominal operations, or mission-ending loss of the spacecraft or its primary objective traceable to the fault episode. The interval between entry and terminal state is the episode duration and is the raw material for the time-to-event clock.

A mission can contribute multiple episodes. This is not an inconvenience to be averaged away; it is a structural feature of the data with a clear methodological consequence. Long-duration missions enter safe mode repeatedly over their operating lives, and treating each entry as an independent observation would understate the standard errors because episodes from the same spacecraft share unobserved spacecraft-level attributes (build quality, operations-team experience, design conservatism) that make their durations correlated. The recurrent-episode rule is therefore a **robust variance estimator clustered on the spacecraft**: the point estimates are computed from the pooled episodes, but the variance is adjusted so that within-spacecraft dependence does not inflate apparent precision. This is the measurement-stage commitment; the estimation-stage detail (the clustered robust variance and the alternative shared-frailty specification that absorbs spacecraft heterogeneity into the model rather than only into the variance) is developed in Chapter 5. The multi-state failure framing in the reliability-statistics tradition [\[6\]](#ref-6), which distinguishes degraded from failed subsystem states, is the conceptual ancestor of treating recovery and loss as distinct terminal states out of a common fault state, and it justifies the episode-as-unit choice: the episode is the spacecraft-level analogue of the subsystem state transition that the multi-state literature models.

Two boundary cases require coding rules, stated here and detailed in Appendix A. First, a fault entry that the spacecraft handles and clears without escalation, and that is documented, is a valid episode ending in recovery; the under-documentation of such silent episodes is a coverage limitation (Section 4.6), not a definitional exclusion. Second, when a single anomalous condition causes a cascade of entries within a short window, the protocol codes the cascade as one episode with the first entry as origin, rather than as several episodes, to avoid double-counting a single underlying fault. The adjudication of cascade-versus-distinct is documented per episode so that a second reader can audit it.

## 4.3 The survival object and the autonomy treatment

### 4.3.1 Dependent variable: the mission-ending anomaly event

The event is the **mission-ending anomaly**: permanent loss of the spacecraft or of its primary mission objective traceable to the fault episode. The construct has two components that the coding protocol separates. The first is permanence: a recovered safe-mode entry is not an event, even a severe one, because the mission continued. The second is traceability: the loss must be attributable to the fault episode, not to an unrelated later event. A spacecraft that recovers from a safe-mode entry and is lost two years later to an independent cause contributes a recovered (censored) episode at the first entry, not an event. This traceability requirement is what keeps the dependent variable conditional on the fault episode, which is the entire point of the design: the dissertation measures survival of the episode, not survival of the mission.

**Time-to-event** is measured from fault entry. The clock starts at the documented entry time and runs to one of three stopping conditions: confirmed recovery (the episode is censored at the recovery time), mission-ending loss (the episode is an event at the loss time), or the close of the observation window while the mission is still operating (the episode is censored at window close). Right-censoring is thus the rule for every non-event episode, and the Cox partial likelihood handles it directly without any assumption about the unobserved post-censoring survival [\[25\]](#ref-25). The choice to measure time from fault entry rather than from launch is what makes the model answer the conditional question; an analysis clocked from launch would answer the unconditional time-to-failure question that the reliability-statistics literature already addresses [\[5\]](#ref-5).

The dependent variable is also where the competing-risks structure originates. Recovery and loss are competing terminal events out of the fault state: a given episode can end in one or the other but not both, and the occurrence of recovery removes the episode from risk of loss. The base specification treats recovery as censoring; a robustness specification treats recovery and loss as competing risks so that the cause-specific hazard of loss is estimated without the assumption that a recovered episode would have been at the same risk of loss had it not recovered [\[29\]](#ref-29). The competing-risks detail belongs to Chapter 5; what matters at the measurement stage is that the coding protocol records the **type** of terminal state, not only its time, so that both the base and competing-risks specifications can be run from the same coded data.

### 4.3.2 The autonomy treatment: why it is the most delicate construct

The primary explanatory variable \(\text{autonomy}_i\) is an **ordered** fault-management autonomy score for each mission's fault-management implementation. It is the treatment, and its measurement quality determines whether the study can answer its question, so it receives more construction detail than any other variable. Two properties are fixed by the bible and may not be relaxed. First, the score is **ordinal, not cardinal**: it distinguishes levels of autonomy without claiming that the gaps between levels are equal, and the hazard ratio is therefore read per level, not per unit of some continuous autonomy quantity that does not exist. Second, the score is built from **pre-flight** documentation, specifically TechPort readiness anchors and design documentation produced before or independent of the survival outcome, precisely so that a mission-ending loss cannot retroactively contaminate the autonomy coding. The reverse-coding threat is concrete: if documentation written after a loss describes the fault management as inadequate, and the analyst scored autonomy from that post-loss narrative, the autonomy score would be partly an echo of the outcome it is meant to explain, and the estimated effect would be an artifact. Scoring from pre-flight material defeats this by construction.

The minimum ordering, carried from the bible, has three levels:

- **Level 1, ground-loop-dependent recovery.** The spacecraft detects the fault and safes itself, then waits for human operators to diagnose the condition and uplink a recovery sequence. The detection function is onboard; isolation and recovery are on the ground.
- **Level 2, onboard detection with limited autonomous response.** The spacecraft detects and executes a constrained onboard response (for example, switching to a redundant unit or entering a pre-scripted recovery), but substantive isolation and reconfiguration still require a ground command cycle.
- **Level 3, onboard autonomous detection-isolation-recovery.** Detection, isolation, and recovery all execute onboard without waiting for a ground command cycle, as in the model-based fault-diagnosis-and-recovery behavior that anchors the autonomous end of the spectrum [\[18\]](#ref-18).

The ordering reflects how much of the detection-isolation-recovery chain executes without a ground command cycle, which is exactly the property the causal mechanism predicts should matter: light-time-independent resolution of a fault before it becomes terminal is what higher levels of the ordering buy.

### 4.3.3 The three-pass construction of the autonomy score

The autonomy score is built in three documented passes, each producing an auditable artifact retained in the coding log (Appendix B).

**Pass one: the TechPort technology-readiness anchor.** Each mission's flown fault-management or systems-health-management technology is matched to a TechPort entry, and its technology-readiness level is recorded as an objective, externally documented floor for the autonomy claim. The anchor does not by itself place the mission on the three-level ordering; it constrains the placement by ruling out autonomy claims that the readiness record does not support. A mission cannot be coded Level 3 on the strength of design prose if no flight-proven onboard isolation-and-recovery technology is documented for it. The anchor is exogenous to the hypothesis because TRL is assessed for technology-management purposes, not to argue about survival, and this exogeneity is the construct-validity virtue that the chapter leans on hardest given the absence of a purpose-built autonomy scale.

**Pass two: the detection-isolation-recovery placement.** The analyst reads NTRS and program design documentation to place the implementation on the ordered three-level scale, asking for each of the three functions (detection, isolation, recovery) whether it executes onboard without a ground command cycle. The placement is recorded with the supporting document quotations so that the basis for each level assignment is traceable. This is the pass that carries the autonomy content; the TRL anchor only bounds it.

**Pass three: the independent second-reader re-coding.** A second reader, using the same rubric and the same pre-flight documentation, independently re-codes each mission's autonomy level. Disagreements between the two readers are adjudicated against the documentation, not split or averaged, and the adjudicated basis is recorded. The inter-coder agreement is reported as a reliability statistic (the schema is in Appendix B). The purpose of the third pass is reproducibility: the ordering must be a property of the documentation and the rubric, not of a single analyst's judgment, and the second reading is what converts an analyst's reading into a measured variable with a stated reliability.

The score is deliberately **coarse**. Three levels, not ten, because the underlying documentation does not support finer distinctions, and because an over-precise score would create a false impression of measurement quality that the data cannot honor. The coarseness is a deliberate construct-validity choice, not a limitation to apologize for: a finer scale would invite the analyst to manufacture distinctions the documents do not contain, which is exactly the measurement error that attenuates coefficients toward the null. Treating the variable as ordinal also disciplines the interpretation downstream, because the hazard ratio is read per level rather than per unit of a continuous quantity that has no documentary basis.

It is worth being explicit about the direction in which residual autonomy-score measurement error pushes the estimate, because stating the sign of a bias is the Fogelian move of bounding a claim rather than asserting it [\[13\]](#ref-13). Classical, non-differential measurement error in an ordinal treatment, error that is unrelated to the outcome, attenuates the estimated coefficient toward the null and therefore toward H0. This is a conservative direction for the study: it makes a rejection of H0 harder to obtain, so a rejection achieved despite the coarse score is credible, while a failure to reject must be read with the attenuation acknowledged as one possible cause among others. The more dangerous error is **differential** error, error correlated with the outcome, which is exactly the reverse-coding contamination the pre-flight-scoring rule is built to prevent: if the autonomy score were read from post-loss narratives, a loss could systematically depress the recorded autonomy, manufacturing a spurious protective effect. Scoring from pre-flight TechPort and design documentation breaks the correlation between the score and the outcome at its source, so the residual error is plausibly non-differential and therefore conservative rather than spurious. The mechanism is concrete: pre-flight documents are written before the survival outcome exists, so they cannot encode it, which means the score they support cannot be an echo of the outcome it is used to explain. This is why the chapter has insisted on the pre-flight provenance of every pass of the autonomy construction rather than treating it as a procedural footnote.

### 4.3.4 A worked autonomy-coding example

To make the rubric concrete, consider how a published anomaly record is coded, using the Galileo safing-and-recovery record [\[74\]](#ref-74) as the illustrative case. The document describes an anomaly, an onboard safing response, and a recovery sequence executed with ground involvement. Under the rubric, pass two would examine whether detection, isolation, and recovery each executed onboard without a ground command cycle. The record's description of a safing response followed by a ground-directed recovery sequence places the detection function onboard and the recovery function partly on the ground, which is the signature of Level 1 or low Level 2 rather than Level 3. Pass one would check whether any flight-proven onboard isolation-and-recovery technology is documented in TechPort for the relevant fault-management implementation, bounding the placement. Pass three would have a second reader confirm or contest the level against the same record. The example is illustrative of the coding procedure, not a claim about Galileo's contribution to the fitted estimate; the point is that the rubric resolves a real, published case to a documented level with an auditable basis, which is the property the construct-validity argument requires.

### 4.3.5 Consolidated measurement table

The following table maps every construct in the estimating equation to its operational definition, its primary source, and its scale. It is the chapter's measurement contract: every quantity the model consumes is defined here, and nothing the model consumes is defined only in prose.

| Construct | Operational definition | Primary source | Scale / coding |
|-----------|------------------------|----------------|----------------|
| Fault episode (unit) | Discrete entry into safe mode or comparable fault state by one spacecraft; cascade within a short window coded as one episode | NTRS narratives; JPL ISA records | Identifier per episode; clustered on spacecraft |
| Event (dependent) | Permanent loss of spacecraft or primary objective traceable to the episode | GAO assessments (independent corroboration); NTRS; JPL ISA | Binary event indicator (1 = loss, 0 = censored) |
| Time-to-event | Time from documented fault entry to recovery (censored), loss (event), or window close (censored) | JPL ISA timing; NTRS; GAO | Continuous duration; right-censored |
| \(\text{autonomy}_i\) (treatment) | Level of onboard fault-management autonomy on the detection-isolation-recovery chain | TechPort TRL anchor (pass 1); NTRS/design docs (pass 2); second reader (pass 3) | Ordinal, three levels (1 ground-loop; 2 limited onboard; 3 onboard DIR) |
| \(\text{complexity}_i\) (control) | Index of mission complexity | GAO / NTRS subsystem count, instrument count, program cost class | Constructed index (continuous or ordinal band) |
| \(\text{distance}_i\) (control) | Earth-spacecraft range regime at episode time; sets one-way light time | NTRS / GAO mission descriptions; mission-design references | Regime categories; may enter as time-dependent covariate |
| \(\text{age}_i\) (control) | Time since launch at fault entry | NTRS / GAO launch dates; episode entry time | Continuous duration |

## 4.4 Control construction

The three controls are not nuisance parameters; they are the confounders whose conditioning operationalizes the Fogelian counterfactual. The identification logic, developed fully in Chapter 5, is that programs investing in autonomy are not a random subset of missions, so the within-stratum comparison of comparable episodes that differ in autonomy is what isolates the autonomy effect. That comparison is only as good as the controls that define the strata, so the measurement of the controls is itself part of the identification argument.

### 4.4.1 Complexity

Mission complexity is proxied by an index built from subsystem count, instrument count, and program cost class as reported in GAO and NTRS documentation. The construct it targets is the latent difficulty and richness of a mission, which plausibly drives both autonomy investment (richer programs can afford autonomy) and anomaly outcomes (more complex spacecraft have more failure modes). The three components are each independently documented in GAO project descriptions and NTRS mission papers, which keeps the index auditable. The index is deliberately a coarse banding rather than a precise scalar, for the same reason the autonomy score is coarse: the underlying counts and cost classes are reported at varying precision across missions, and a falsely precise index would import noise. The construction weights are documented in Appendix C so that the index can be reproduced and so that the sensitivity of the autonomy estimate to the weighting can be probed. The reliability-statistics finding that failure behavior differs by mass category [\[9\]](#ref-9) is what justifies including a complexity control at all: if size and class shift the baseline failure behavior, then comparing autonomy across missions without conditioning on complexity would conflate autonomy with class.

### 4.4.2 Distance

Distance is the Earth-spacecraft range regime at the time of the fault episode, which determines one-way light time and therefore the cost of a ground loop. It is the confounder with the tightest theoretical link to the treatment, because the long light times of deep-space missions are the standard engineering argument for investing in autonomy, and they simultaneously make the recovery environment harsher. A spacecraft at Mercury's distance [\[82\]](#ref-82) or approaching the Sun [\[125\]](#ref-125) faces a ground loop measured in many minutes or tens of minutes, while a near-Earth spacecraft faces seconds. Distance is coded as a regime rather than a continuous range because the documentary precision on instantaneous range at the moment of a fault is usually coarse, and because the mechanism (the cost of waiting for a ground cycle) is well captured by regime bands. Distance may enter the model as a **time-dependent covariate**, because a single mission can transit from a near-Earth regime to a deep-space regime over its life, and an episode's distance is the regime at the episode's entry time, not at launch. The time-dependent treatment of distance is a measurement commitment recorded in Appendix C and an estimation detail handled in Chapter 5.

### 4.4.3 Spacecraft age

Spacecraft age is time since launch at fault entry, capturing the wear-in and wear-out effects documented in the reliability literature. Age is the cleanest of the three controls to measure, because launch date and episode entry time are both documented, and the difference is the age. Its inclusion is warranted by the documented mixture of infant-mortality and wear-out regimes in spacecraft failure behavior [\[7\]](#ref-7): early-life failures and end-of-life wear-out are distinct hazard regimes, so age must enter the model and its functional form must be allowed to be non-monotone rather than assumed linear. The reliability-statistics work on attitude-control subsystem failure behavior across the operating life [\[11\]](#ref-11) reinforces that the age effect is subsystem- and time-varying, which is why the model tests rather than assumes the shape of the age term. Age is also the control most robust to reverse coding, because launch and entry dates are recorded for operational reasons unrelated to any later loss.

## 4.5 Importing and redirecting the validated reliability-statistics apparatus

The dissertation does not invent a statistical measurement apparatus for spacecraft survival; it imports a validated one and redirects it. This section makes the import explicit, because doing so is itself a construct-validity argument: the measurement choices below are not novel and untested, they are borrowed from a body of work that established their adequacy on spacecraft data, and the only novelty is the redirection from the unconditional to the conditional question and the addition of the autonomy covariate.

Three features of the reliability-statistics tradition are imported. First, **mass-category stratification**. The finding that failure behavior differs by mass class [\[9\]](#ref-9) is imported as the justification for the complexity control and for the mission-class-stratified robustness specification, rather than fitting a single pooled baseline hazard that would average over heterogeneous classes. Second, the **infant-mortality and wear-out regime structure**. The documented mixture of early-life and wear-out failure regimes [\[7\]](#ref-7) is imported as the justification for including spacecraft age as a covariate with a flexible functional form. Third, the **multi-state ancestry of competing risks**. The multi-state failure framing that distinguishes degraded from failed states [\[6\]](#ref-6) is the conceptual ancestor of the competing-risks specification in which recovery and loss are competing terminal events out of the fault state [\[29\]](#ref-29). The small-satellite reliability analysis in the same tradition [\[10\]](#ref-10) and the more recent femtosatellite mission-assurance work [\[38\]](#ref-38) extend the apparatus to the small end of the mass spectrum and confirm that the survival-modeling machinery transfers across classes, which bounds the external-validity discussion: the apparatus is validated across classes even though this study's sample concentrates on the flagship end.

What is **redirected** is the question, not the machinery. The reliability-statistics tradition models the unconditional time to hardware failure: the clock runs from launch, the event is a subsystem or spacecraft failure, and the covariates describe the hardware [\[5\]](#ref-5). This dissertation reclocks the analysis to fault entry, redefines the event as conditional mission-ending loss out of a fault state, and adds the autonomy covariate that the prior work omitted. The redirection is the contribution at the measurement level: every other measurement choice is borrowed and validated, so the construct-validity burden concentrates on the two genuinely new measurements (the conditional time-to-event clock and the autonomy score), which is exactly where this chapter has spent its detail.

## 4.6 Coverage, limitations, data quality, validation, and ethics

### 4.6.1 Coverage

The intended sample is the population of identifiable fault episodes on NASA and JPL robotic spacecraft for which fault entry, end state, and autonomy level can be coded from the four named sources. Coverage is strongest for flagship and competed deep-space and Earth-science missions, which are well documented in NTRS and GAO, and for JPL-operated missions with releasable anomaly records. The target is the largest defensible set of episodes consistent with reliable coding, with an expectation of a sample in the low hundreds of episodes across several dozen spacecraft. These figures are design-stage targets, not realized counts; no episode has been coded against the assembled population, and the realized sample will be reported with the executed analysis. The coverage target is set by feasibility rather than by a power calculation, because the binding constraint is the number of codable episodes, and the consequence of the small expected event count for statistical power is taken up in Chapter 6.

### 4.6.2 The four material data limitations

The data have four notable limitations, carried from the prospectus and elaborated here because each has a measurement consequence and a design response.

**Reporting heterogeneity.** Well-documented flagship missions are over-represented relative to small or classified missions, because flagship programs generate more public technical reporting. The mechanism is a documentation-effort bias: coverage tracks reporting effort, not the true incidence of fault episodes, so the sample is skewed toward complex, high-investment spacecraft. The consequence is for external validity (the estimate generalizes most safely to the flagship class) rather than for internal validity, and it is addressed by stating the generalization bound explicitly rather than by a coverage correction the data cannot support.

**Coarse ordinal autonomy score.** The autonomy score is a three-level ordering, not a continuous measurement, and it compresses real architectural variety into three bins. The mechanism is deliberate coarsening to match documentary precision (Section 4.3.3). The measurement consequence is that genuine within-level autonomy variation is unmodeled, which attenuates the estimated effect toward the null if higher-autonomy implementations within a level survive better. This is a conservative bias: it works against finding an effect, so a rejection of H0 despite it is robust, and a failure to reject must be read with the attenuation in mind.

**Under-recorded silent episodes.** Fault episodes that were handled onboard and never escalated may be under-recorded, because a clean, undocumented recovery leaves no public trail. The mechanism is a selection on documentation: the recorded episodes are a non-random subset skewed toward episodes severe or interesting enough to document. The measurement consequence is a truncation of the low-severity, fast-recovery end of the duration distribution, which is most acute in the JPL ISA stream. The direction of the resulting bias on the autonomy estimate is not obvious a priori, because silent episodes are plausibly more common on higher-autonomy spacecraft (which is the whole point of autonomy), so under-recording them could either understate autonomy's benefit (by dropping its successes) or leave it unaffected (if the dropped episodes would all have been recoveries anyway). The honest position is that the direction is uncertain, and the discussion downgrades confidence accordingly rather than asserting a convenient sign.

**Rare events and the thin tail.** Mission-ending losses are rare, so the event count is small relative to the censored episodes. This is the heavy-tailed, undersampled-tail condition that the Talebian frame warns about [\[23\]](#ref-23): the historical record undersamples the tail, and sample means understate exposure, so any mean-based estimator would be unreliable in exactly the region that matters. The measurement consequence is that the effective sample size for the Cox model is governed by the event count, not the episode count, which constrains statistical power and is the reason the design favors a hazard formulation that handles censoring and small event counts over a mean-based approach. The tail-risk discipline also shapes interpretation: the value of autonomy may concentrate in the worst episodes, those at the greatest distance with the least reaction time, so a pre-specified tail-subgroup analysis is part of the plan, and a favorable pooled average is not treated as a tail guarantee. The contagious-disease tail-risk analysis in the same tradition [\[49\]](#ref-49) is the methodological precedent for treating rare catastrophic outcomes as heavy-tailed rather than thin-tailed, and the orbital-environment dynamics literature [\[24\]](#ref-24) is the reminder that the consequences of a loss are not always localized to the lost vehicle, which raises the stakes of underestimating tail exposure.

### 4.6.3 Data quality and validation against known values

Data quality is enforced at three points, each producing a retained artifact. First, **source triangulation**: an episode's outcome is corroborated across sources where possible, with GAO's independent oversight reporting used to confirm mission-ending losses that an implementing-program self-report might frame differently. Second, **second-reader coding** of the autonomy score (Section 4.3.3) and a documented adjudication of disagreements, with an inter-coder reliability statistic reported. Third, **a retained coding log** (Appendices A and B) recording, per episode, the supporting documents, the entry and terminal times, the terminal type, the autonomy level and its basis, and any flag for non-public timing.

Validation against known values is the construct-validity check that the measurement apparatus is not producing artifacts. Two validations are planned. The first validates the imported survival machinery against the published reliability-statistics baselines: fitting the unconditional survival of the spacecraft in the sample and comparing the recovered failure behavior against the documented mass-category and age-regime patterns [\[9\]](#ref-9), [\[7\]](#ref-7) confirms that the data and the estimator reproduce known spacecraft failure behavior before the conditional autonomy question is asked of them. A sample whose unconditional behavior departs sharply from the validated baselines would signal a coding or assembly error, not a discovery. The second validates the autonomy score against its external anchor: the TechPort TRL floor (Section 4.3.1) is a known external value, and any mission whose pass-two detection-isolation-recovery placement contradicts its TRL anchor is re-examined, because a Level 3 placement on a technology with no documented flight-proven onboard recovery is a coding error to be caught, not a finding. These validations are the measurement-stage analogue of the falsifiability commitment: the apparatus is checked against known values before it is trusted to produce a new one.

### 4.6.4 Ethics, access, and reproducibility

The ethics and access posture is straightforward because the study uses documentary records of spacecraft, not human subjects, so there is no human-subjects protection question. Two access constraints nonetheless bear on reproducibility. First, some JPL incident-surprise-anomaly content is not publicly releasable, so the coding protocol restricts JPL-derived timing to releasable records and flags any episode whose timing rests on a non-public source. This keeps the dataset auditable: a reproducibility reviewer can identify exactly which episodes depend on non-public material and assess the conclusion with and without them. Second, the named public sources (NTRS, GAO, TechPort) are accessed through their public interfaces, and the access paths (the NTRS citation-search API, the GAO website, the TechPort catalog) are documented so that the source pulls are reproducible. The reproducibility commitment is therefore concrete: the four named sources, the coding protocol (Appendix A), the autonomy-score rubric and inter-coder schema (Appendix B), the complexity-index weights and distance-regime coding (Appendix C), and the retained per-episode coding log together let an independent analyst reconstruct the dataset from the same documents. No internal or working-note material is used; the data substrate is public documentation and releasable JPL records only.

### 4.6.5 Confidence statement and what would change it

The confidence in the measurement design is, at this stage, **moderate**, and the calibration is deliberate. It is moderate rather than high because the treatment variable has no off-the-shelf instrument and must be constructed, and because the under-recording of silent episodes introduces a selection whose sign on the autonomy estimate is uncertain. It is moderate rather than low because the construction choices that matter most are defended: the autonomy score is anchored to an exogenous external readiness assessment, scored from pre-flight material to defeat reverse coding, and independently re-coded, and the rest of the apparatus is imported from a validated tradition and checked against known baselines. The evidence that would **raise** confidence is the realized inter-coder reliability statistic on the autonomy score (a high agreement would confirm the ordering is a documentary property, not an analyst's judgment) and the validation of the sample's unconditional survival against the reliability-statistics baselines (a match would confirm the assembly is sound). The evidence that would **lower** confidence is a low inter-coder agreement, a sample whose unconditional behavior departs from the validated baselines, or a finding that the realized event count is so small that the autonomy score's coarseness and the silent-episode truncation jointly dominate the signal. Stating in advance what would raise and lower confidence is the measurement-stage counterpart of the falsifiability commitment that organizes the whole dissertation [\[13\]](#ref-13): the apparatus is built to be checked, and the checks are named before the data are touched.

The measurement spine assembled here is what the next two chapters consume. Chapter 5 takes the survival object, the autonomy treatment, and the three controls and specifies the Cox estimator, the identification strategy that gives the autonomy coefficient its conditional interpretation, and the robustness specifications that probe the threats this chapter has catalogued. Chapter 6 takes the same coded data and specifies the estimation procedure, the fixed decision rule on H0, the design-stage illustrative expectations, and the power analysis whose binding constraint is the event count this chapter has flagged as thin. Nothing in those chapters can be better than the measurement here, which is why this chapter has spent its length defending the two genuinely new constructs, the conditional time-to-event clock and the ordinal autonomy score, rather than restating the borrowed machinery it imports intact.

\newpage

# Chapter 5. Research Design and Identification

## 5.0 The chapter thesis

This chapter delivers the inferential engine of the dissertation: a Cox proportional-hazards survival model, estimated by partial likelihood on the fault-episode event-history dataset built in Chapter 4, whose single coefficient of interest is the log hazard ratio on the ordinal autonomy variable. The chapter's answer is that this estimator, conditioned on a small and theoretically motivated control set and hardened by a five-specification robustness battery, identifies a conditional, population-level contrast that no prior study has measured: among fault episodes of comparable mission complexity, distance regime, and spacecraft age, whether higher-autonomy spacecraft survive their fault states at a different rate. The estimator is chosen, not defaulted to. It dominates the two obvious alternatives, a logistic regression on episode outcome and any mean-based summary of survival time, because it uses the information in the dwell time before resolution, handles the right-censoring that pervades an in-service spacecraft population, tolerates a small event count better than a parametric mean model, and accommodates the recurrent, within-mission clustering of episodes through a robust variance estimator. The identification is observational and the chapter says so plainly: the autonomy coefficient is a conditional association under a defended set of controls, not a randomized treatment effect, and the chapter signs the direction of the most likely residual confounder so that the conditional estimate is read as an upper bound on autonomy's benefit rather than a point claim. The chapter is written at the design stage. No coefficient is fitted on the assembled population; every numerical illustration is labeled as a decision-rule shape, not an estimate.

The problem this chapter addresses is an inferential problem with four parts. The **current state** is that Chapter 4 has produced a measurement spine, a coded survival object with a treatment and three controls, but a measurement spine is inert until an estimator extracts a contrast from it, and the wrong estimator would either discard information the data carry or import assumptions the data cannot support. The **desired state** is an estimator whose target parameter is exactly the decision-relevant quantity, the conditional hazard ratio on autonomy, and whose identifying assumptions are stated formally, argued from the structure of the data, and exposed to falsification rather than asserted. The **gap** is that the decision-relevant quantity is conditional and time-structured: it lives in the survival of an episode after fault entry, it must respect censoring and recurrence, and it must be purged of the confounding that makes autonomous and non-autonomous programs non-comparable in the raw. No off-the-shelf application of a default regression closes that gap; the estimator and its identification must be specified deliberately. The **consequence of leaving the gap open** is that a hazard ratio fit by an ill-chosen estimator, or identified off an undefended set of controls, would answer a different and less useful question than the one the dissertation poses, and would do so with a false air of precision. This chapter closes the gap by specifying the Cox estimator, the conditioning strategy that gives its autonomy coefficient a conditional-counterfactual interpretation, the model structure that respects the data's censoring and clustering, the robustness specifications that probe each modeling choice, and the four-way threats-to-validity matrix that names every way the inference could fail and the design response to each.

The canonical estimating equation, carried unchanged from the prospectus and the shared bible, fixes the target of inference:

\[ h_i(t) = h_0(t)\,\exp\!\left(\beta_1\,\text{autonomy}_i + \beta_2\,\text{complexity}_i + \beta_3\,\text{distance}_i + \beta_4\,\text{age}_i\right) \qquad\qquad (1) \]

for fault episode \(i\), where \(h_0(t)\) is the unparameterized baseline hazard and the \(\beta\)s are estimated by partial likelihood. The quantity of interest is the hazard ratio \(\exp(\beta_1)\). The hypotheses, also carried verbatim, are that the autonomy coefficient is zero under the null (H0: \(\beta_1 = 0\), \(\exp(\beta_1) = 1\)) and negative under the alternative (H1: \(\beta_1 < 0\), \(\exp(\beta_1) < 1\)), so that higher onboard fault-management autonomy is associated with a lower hazard of mission-ending loss conditional on fault entry, after controlling for complexity, distance, and age. Section 5.1 establishes the estimator and why it dominates its alternatives. Section 5.2 sets out the identification strategy: what \(\beta_1\) is identified off, conditioning as the operationalized Fogelian counterfactual, the consideration and rejection of instrumental-variable identification, and the signing of the program-quality bias. Section 5.3 specifies the base model: the clustered robust variance, the proportional-hazards test, and distance as a time-dependent covariate. Section 5.4 sets out the five robustness specifications. Section 5.5 presents the four-way threats-to-validity matrix and the design response to each threat, and closes with a calibrated confidence statement and a synthesis of how the chapter advances the argument.

## 5.1 The estimator: the Cox proportional-hazards model and why it dominates the alternatives

This section argues that the Cox proportional-hazards model is the correct estimator for the dissertation's question, and that its selection is forced by three properties of the data rather than chosen by convention. Those properties are the structure of the fault-episode dataset: the outcome is a time to a terminal event measured from fault entry, the data are heavily right-censored because most episodes resolve in recovery and most missions are still operating at window close, the events of interest are rare, and the episodes are clustered within spacecraft because a single mission contributes several. What connects these properties to the estimator is the canonical result that the Cox model specifies the hazard as a product of an unspecified baseline hazard and an exponential function of covariates, estimates the covariate coefficients by partial likelihood without parameterizing the baseline, and thereby delivers a hazard ratio that is interpretable, censoring-robust, and free of any assumption about the shape of the baseline hazard [\[25\]](#ref-25). This is underwritten by the large-sample theory that established the partial-likelihood estimator's consistency and asymptotic normality for counting-process data, which is precisely the data structure of recurrent fault episodes accumulating over mission time [\[26\]](#ref-26). One qualification is that the model's central assumption, proportionality of hazards across covariate levels, must be tested rather than assumed, and the possibility that proportionality fails for one or more covariates is anticipated and handled in Section 5.3 by Schoenfeld-residual testing and respecification. No claim of estimator adequacy is made without this test as its protection.

The dominance argument is comparative, and it must be made against the two estimators a reader would otherwise reach for. The first alternative is a logistic regression on the binary episode outcome, recovery versus loss. This estimator is inferior here for a specific, statable reason: it discards the dwell time. The time a spacecraft spends in a fault state before resolving carries information directly relevant to the mechanism the dissertation tests. The named causal mechanism is that higher autonomy permits onboard detection-isolation-recovery to execute without waiting for a ground command cycle, which produces a faster, light-time-independent resolution of the fault episode before it becomes terminal. A logistic model on the outcome alone is blind to the speed of resolution and therefore blind to the observable signature of the mechanism; two episodes that both end in recovery look identical to it whether one resolved in an hour onboard and the other in a week of ground diagnosis. A survival model, by contrast, reads the resolution time as data, which is why the standard treatments of failure and survival analysis treat time-to-event as the object of inference rather than a binary state [\[99\]](#ref-99), [\[103\]](#ref-103). The Cox model's specific form, the proportional-hazards regression, is the workhorse of that tradition for exactly this reason: it estimates how covariates shift the instantaneous risk of the terminal event over time, not merely whether the event eventually occurred [\[114\]](#ref-114), [\[116\]](#ref-116), [\[115\]](#ref-115). Choosing the Cox model over logistic regression is therefore not a stylistic preference; it is the choice to use the information the mechanism predicts will be present, and to forgo it would be to test the hypothesis with one hand tied.

The second alternative is any mean-based summary of survival, a comparison of average time-in-fault or average survival by autonomy level. This estimator fails for a reason rooted in the dissertation's Talebian frame, and the failure is doubly disqualifying. First, mean-based comparisons cannot accommodate censoring without bias: the missions still operating and the episodes that ended in recovery are not failures, and treating their observed durations as if they were complete event times, or dropping them, distorts the estimate in a direction that depends on the censoring pattern. The Cox model handles censoring directly in the partial likelihood, which is built from the risk sets at observed event times and never requires the analyst to impute the unobserved event times of censored cases [\[25\]](#ref-25), [\[26\]](#ref-26). Second, and more fundamentally, the dependent variable is a rare, heavy-tailed event, and the historical record undersamples the tail, so sample means understate true exposure and are unreliable estimators of the quantity that matters [\[23\]](#ref-23). The contagious-disease tail-risk literature in the same tradition establishes that catastrophic rare outcomes are heavy-tailed rather than thin-tailed, so that the empirical mean is a poor and slowly converging summary precisely in the region of interest [\[49\]](#ref-49). A hazard formulation sidesteps the unreliable mean entirely: it estimates the multiplicative effect of a covariate on the instantaneous risk, an estimand that is well-defined and estimable even when the event count is small and the loss distribution is fat-tailed. The mechanism-to-estimator link is therefore tight on both sides of the dissertation's anchor pair. Fogel's demand for a single quantitative counterfactual number is met by the hazard ratio \(\exp(\beta_1)\), the social-saving analogue [\[13\]](#ref-13). Taleb's demand that a rare, heavy-tailed loss not be summarized by a mean is met by the choice of a censoring-robust, risk-set-based estimator over any mean-based comparison [\[23\]](#ref-23), [\[49\]](#ref-49).

It is worth stating the partial-likelihood mechanics explicitly, because they are what make the Cox model the right instrument for a thin-event sample and they govern several downstream design choices. The partial likelihood is constructed not from the full distribution of event times but from the conditional probability, at each observed event time, that the episode that failed was the one that did fail, given the set of episodes still at risk at that instant. The baseline hazard \(h_0(t)\) cancels out of these conditional probabilities, which is why it need never be parameterized; the estimator extracts the covariate effects from the ordering and the risk-set composition at event times alone [\[25\]](#ref-25). Two consequences follow directly and are load-bearing for the design. First, only the times at which a mission-ending loss occurs contribute risk sets to the likelihood, so the information that identifies \(\beta_1\) is concentrated in the small number of loss events, not spread across the many censored recoveries; this is the formal statement of the rule, used throughout, that events and not episodes govern the effective sample size. Second, a censored recovery is not discarded but contributes to the risk sets of every loss event that occurs before its own censoring time, so the censoring is handled by inclusion in risk sets rather than by imputation or deletion, which is exactly the property that disqualifies the mean-based alternatives. The counting-process formalization of Andersen and Gill recasts this construction as a martingale estimating equation and proves the consistency and asymptotic normality of the resulting estimator under the recurrent-event accumulation that characterizes the data [\[26\]](#ref-26), and the same formalization is what licenses the time-dependent-covariate and robust-variance extensions used in Section 5.3.

A third property of the data, recurrent and clustered episodes, requires the Cox model to be extended rather than replaced, and the extension is well established. A single spacecraft contributes multiple fault episodes, so the episodes are not independent: an unobserved mission attribute that makes one episode more survivable makes the others more survivable too. The counting-process formulation of the Cox model, on which the large-sample theory rests, is the natural framework for recurrent events because it treats each spacecraft's episode history as a counting process and accumulates the partial-likelihood contributions across the risk sets at event times [\[26\]](#ref-26). The recurrent-event survival literature supplies the practical apparatus: a robust, cluster-corrected variance estimator that accounts for the within-spacecraft dependence without requiring a parametric model of it [\[112\]](#ref-112). The process point of view that underlies this machinery is the modern foundation of event-history analysis [\[111\]](#ref-111), [\[113\]](#ref-113), and it is what licenses the clustered base specification in Section 5.3. The upshot is that the Cox model, in its counting-process form with a cluster-robust variance, is not merely adequate to the recurrent structure of the data; it is the framework built for it.

The confidence in the estimator choice is **high**, and the calibration rests on the convergence of three independent justifications: the Cox model uses the dwell-time information the mechanism predicts, it handles the censoring and rare-event structure that disqualify mean-based alternatives, and its counting-process extension is purpose-built for recurrent clustered episodes. What would lower this confidence is a finding, at execution, that the proportional-hazards assumption fails so pervasively across covariates that the model must be heavily stratified and time-interacted, at which point the clean single-hazard-ratio interpretation would be compromised; Section 5.3 specifies the test and the respecification that would catch and repair this, and Section 5.5 carries it as a statistical-conclusion-validity threat. What would raise confidence is the opposite, a clean Schoenfeld-residual test on the assembled data, which would confirm that the single hazard ratio is a faithful summary of the autonomy effect across the observation window.

## 5.2 Identification: what the autonomy coefficient is identified off

This section argues that the autonomy coefficient \(\beta_1\) is identified off a within-stratum comparison of comparable fault episodes that differ in autonomy level, that this comparison is the operationalized form of Fogel's counterfactual, and that the identification, though observational rather than experimental, is defensible because the control set is small, theoretically motivated, and its principal residual bias is signed rather than assumed away. The point of departure is the structure of the confounding problem, which is real and must be stated before it is addressed. Conditioning on the observed confounders that drive both the treatment and the outcome isolates the decision-relevant contrast, and the cliometric methodology that requires a historical causal claim to be embedded in an explicit, quantitative counterfactual rather than asserted from intuition supplies the deeper justification [\[13\]](#ref-13). One qualification, stated emphatically, is that this is a conditional association under a defended control set, not a randomized causal effect, and the possibility that an unobserved confounder could still bias the estimate is met not by denial but by signing the likely direction of that bias so that the claim is bounded.

The identification problem is confounding, and naming its mechanism is the first step. Programs that invest in autonomous fault management are not a random subset of missions. Deep-space missions face long one-way light times that make a ground recovery loop slow, which is simultaneously the standard engineering argument for investing in autonomy and a feature of a harsher recovery environment in which any episode is more dangerous [\[19\]](#ref-19), [\[20\]](#ref-20). Flagship missions are more complex and also better funded, so they both carry more autonomy and differ in a dozen other ways from leaner programs. Spacecraft age tracks both the accumulation of wear and the era of the mission's design, which correlates with the autonomy technology available at build time. The driver-to-consequence chain of the confounding is therefore explicit: an unconditioned comparison of survival by autonomy level would attribute to autonomy the combined effect of autonomy and of distance, complexity, and program richness, producing a hazard ratio that conflates the treatment with its correlates. This is the bare-correlation trap the dissertation's argument standard forbids; the design's job is to convert a confounded correlation into a conditional contrast with a named identifying assumption.

The strategy is conditioning on observed confounders, and the choice of which confounders to condition on is disciplined rather than kitchen-sink. Distance, complexity, and age are the three covariates with the clearest theoretical link to both the treatment and the outcome, and all three are codable from the named sources of Chapter 4. The identifying assumption is conditional independence of the autonomy assignment and the potential survival outcomes given these three controls: among fault episodes of comparable complexity, distance regime, and spacecraft age, the autonomy level is taken as if unrelated to the unobserved determinants of post-fault survival. Conditioning on these three in the partial likelihood isolates the within-stratum comparison, which is exactly the counterfactual contrast Fogel's method demands, operationalized as covariate adjustment rather than as the construction of a synthetic counterfactual world [\[13\]](#ref-13). The decision to keep the control set small is itself an identification choice with statistical force, not a concession: the events that drive the partial likelihood are scarce, and a useful rule of thumb in survival modeling requires on the order of ten events per estimated covariate to keep the maximum-partial-likelihood estimates approximately unbiased, so every added control consumes scarce events and risks over-parameterization against a thin event count. The covariate set is therefore held to the three confounders that theory identifies as first-order, and the temptation to add controls in search of significance is refused, because doing so would trade identification for noise. This restraint is revisited in Section 5.4 through a reduced model containing only autonomy and the single most important confounder, distance, which lets the reader see whether the conclusion survives when the event count is spent on the fewest possible parameters.

Instrumental-variable identification was considered and is rejected, and stating the rejection explicitly is part of the identification argument rather than an omission. A valid instrument would have to shift autonomy investment without affecting post-fault survival except through autonomy, the exclusion restriction. No such variable is credibly available. Every plausible candidate fails the restriction by inspection: mission era shifts autonomy investment but also shifts hardware reliability, ground-system capability, and operational experience, all of which plausibly affect survival through channels other than autonomy; program budget shifts autonomy investment but also shifts test rigor, redundancy, and staffing, again with direct survival channels. An instrument that violates its exclusion restriction imports an untestable assumption that is more likely false than the conditional-independence assumption it would replace, and it does so while typically being weak, which inflates variance and bias together. Honest conditioning with a defended, theoretically motivated control set, accompanied by explicit reasoning about the remaining bias, is more defensible than a weak instrument that smuggles in an exclusion restriction no one can verify. The rejection of IV is therefore not a failure to find a clever design; it is a judgment that the available instruments are worse than the conditioning strategy on the criterion that matters, the credibility of the identifying assumption.

The final and most important identification move is to sign the residual confounding rather than to assume it away, and this is the chapter's sharpest Fogelian commitment. Conditioning reduces but does not eliminate confounding, and the honest question is what an unobserved confounder would do to the estimate. The most likely unobserved confounder is overall program quality, the bundle of test rigor, redundancy, staffing depth, and operations-team experience that the three named controls capture only partially. Program quality is plausibly positively associated with both autonomy investment, because high-quality programs can afford and verify autonomy, and post-fault survival, because high-quality programs survive faults better for reasons unrelated to autonomy. An unobserved confounder that is positively associated with both treatment and outcome biases an unconditioned protective estimate further in the protective direction, so an estimate that did not condition on quality would overstate autonomy's benefit. Conditioning on complexity and cost class absorbs part of program quality, because larger and costlier programs are on average higher-quality, but it cannot absorb all of it. The signed-bias reasoning then yields a bound: if, after conditioning, the autonomy hazard ratio remains below one, the residual program-quality bias works in the same direction as the estimated effect, so the conditional estimate is an upper bound on autonomy's true protective benefit, not a lower bound. This is a Fogelian move in the precise sense that it bounds the claim rather than asserting it [\[13\]](#ref-13): the design does not pretend to have removed all confounding, it reasons through the sign of what remains and reports the estimate as a ceiling. The multi-state failure analysis in the reliability-statistics tradition, which distinguishes degraded from failed states and models the transitions between them, is the conceptual precedent for treating the post-fault trajectory as a structured process whose confounders can be reasoned about rather than a black box [\[6\]](#ref-6).

The signed bound is reinforced, not replaced, by a formal sensitivity analysis specified in advance. Signing the direction of the residual bias establishes that a surviving protective estimate is conservative, but it does not say how large an unobserved confounder would have to be to overturn the qualitative conclusion. The design therefore commits to a sensitivity calculation that asks the quantitative version of the question: how strongly would an unmeasured mission-level confounder have to be associated with both autonomy and post-fault survival to drive the autonomy hazard ratio back to one. If that threshold association is implausibly large relative to the associations of the measured confounders, the conclusion is robust to plausible unmeasured confounding; if it is small, the conclusion is fragile and the design says so. This is the natural complement to the frailty robustness specification of Section 5.4, which models the residual mission-level heterogeneity as a latent term: the frailty model estimates the effect net of an absorbed latent severity, while the sensitivity analysis characterizes how much unabsorbed confounding the conclusion can tolerate. Together they convert the unobserved-confounding threat from a rhetorical caveat into a bounded and partly quantified residual, which is the most an observational design can honestly offer. The multi-state failure framework imported from the reliability-statistics tradition again supplies the precedent for treating the determinants of a transition out of a fault state as structured and reasoned-about rather than opaque [\[6\]](#ref-6).

The confidence in the identification is **moderate**, and the calibration is deliberate and matched to the design-stage evidence grade. It is moderate rather than high because the identifying assumption is conditional independence given three controls, which is observational and untestable, and because program quality is incompletely absorbed. It is moderate rather than low because the control set is theoretically motivated and codable, IV was considered and correctly rejected, and the principal residual bias is signed so that the estimate is bounded rather than open-ended. What would raise confidence is evidence at execution that the autonomy hazard ratio is stable when the complexity and cost-class controls are varied in their construction, which would suggest the program-quality channel is well absorbed; what would lower it is a hazard ratio that swings materially with the complexity-index specification, which would signal that the controls are doing more work than they should and that residual confounding is large.

## 5.3 The base model specification

This section sets out the base specification: a single Cox model with the three named controls, a robust spacecraft-clustered variance, a formal proportional-hazards test, and distance entered as a time-dependent covariate, with each of these four choices forced by a documented feature of the data rather than added for show. Those features are the data structure established in Chapter 4 and Section 5.1: recurrent within-mission episodes, the proportionality assumption that the Cox model rests on, and the fact that a single long mission transits between distance regimes during its life. Each choice is justified by the survival-analysis methods literature, cited at the point of use. The base specification is the pre-registered primary model against which H0 is tested, and the robustness specifications of Section 5.4 are its planned probes, not alternatives that could be substituted after seeing the result.

The base estimating equation is the canonical one, restated to fix the primary specification:

\[ h_i(t) = h_0(t)\,\exp\!\left(\beta_1\,\text{autonomy}_i + \beta_2\,\text{complexity}_i + \beta_3\,\text{distance}_i + \beta_4\,\text{age}_i\right) \qquad\qquad (1) \]

with \(t\) the time since fault entry, \(h_0(t)\) the unparameterized baseline hazard estimated nonparametrically, the four \(\beta\)s estimated by partial likelihood, and the standard errors computed by a robust, sandwich-form variance estimator clustered on the spacecraft. The clustering is the first non-default choice and it is forced by the recurrent structure: because a spacecraft contributes multiple episodes that share unobserved mission-level attributes, the naive variance estimator would understate the standard errors by treating correlated episodes as independent observations, inflating apparent precision and the risk of a false rejection of H0. The cluster-robust variance corrects this by computing the variance from spacecraft-level score contributions rather than episode-level ones, an approach grounded in the recurrent-event survival literature that handles exactly this dependence structure [\[112\]](#ref-112) and consistent with the counting-process foundation of the model [\[26\]](#ref-26). The practical effect is to widen the confidence interval on \(\exp(\beta_1)\) to reflect the true information content of a clustered sample, which is the honest treatment of a dataset in which the effective number of independent units is the number of spacecraft, not the number of episodes.

The second non-default choice is the formal test of the proportional-hazards assumption, and it is what protects the proportionality caveat noted in Section 5.1. The Cox model's interpretive cleanliness, a single hazard ratio per covariate, holds only if the hazards are proportional across covariate levels over the observation window, that is, if the covariate's effect on the log hazard does not itself vary with time. This assumption is tested, not assumed, using scaled Schoenfeld residuals: a covariate whose scaled residuals exhibit a systematic trend against time violates proportionality, and the test provides both a per-covariate statistic and a global statistic [\[27\]](#ref-27). The respecification rule is fixed in advance to prevent specification search. Where proportionality fails for a covariate, that covariate is either stratified, so that each stratum receives its own baseline hazard and the covariate is removed from the exponential term, or interacted with a function of time, so that its time-varying effect is modeled explicitly. The methods literature on non-proportional hazards establishes both repairs and the conditions under which each is preferred [\[98\]](#ref-98), and the time-varying-coefficient machinery is well developed and implemented in standard software [\[110\]](#ref-110), [\[28\]](#ref-28). The test-and-repair protocol is the design response to the principal estimator-level threat, and it is pre-specified so that the choice of repair is governed by the residual diagnostic rather than by which repair produces the more congenial autonomy coefficient.

The third non-default choice is to permit distance to enter as a time-dependent covariate, and it is forced by mission physics. A single deep-space mission does not occupy a fixed distance regime: it transits from a near-Earth regime at launch to a deep-space regime at its destination, and the one-way light time, which is what distance proxies for the cost of a ground loop, changes accordingly over the mission and therefore over the times at which its fault episodes occur. Treating distance as a fixed, mission-level covariate would mismeasure it for episodes that occur during transit and would blur the very quantity the control is meant to capture. The Cox model accommodates time-dependent covariates within its counting-process formulation without difficulty: the covariate value entering each risk set is the value at the episode's time, and the partial-likelihood machinery is unchanged in form [\[28\]](#ref-28), [\[110\]](#ref-110). The design therefore codes distance at the time of each fault episode, which is what Chapter 4's distance-regime coding supplies, and enters it as a time-dependent term so that the distance control reflects the actual recovery environment of each episode rather than a mission-level average. This is the specification-level expression of the mechanism: distance matters because it sets the cost of the ground loop, autonomy matters because it removes the dependence on that loop, and the model must let distance vary as the mission moves if it is to separate the two.

The fourth choice concerns the functional form of the controls, and it is governed by the reliability-statistics evidence imported in Chapter 4. Spacecraft age enters with a flexible form rather than a single linear term, because the documented mixture of infant-mortality and wear-out failure regimes implies a non-monotone age effect that a linear term would mismodel [\[6\]](#ref-6). Whether the age effect is best captured by a polynomial, a spline, or a categorical regime indicator is determined at execution by the fit, with the choice pre-registered as a decision rule rather than left to post-hoc selection. Complexity enters as the constructed index of Chapter 4, and its measurement error is carried forward as a construct-validity threat in Section 5.5 rather than denied here. The base specification is thus fully determined before any data are fit: the three controls, the cluster-robust variance, the Schoenfeld test with its fixed respecification rule, and distance as a time-dependent term constitute the pre-registered primary model, and the hazard ratio \(\exp(\beta_1)\) it produces is the dissertation's headline estimand.

## 5.4 Robustness specifications

This section argues that the autonomy coefficient's interpretation is protected by five pre-specified robustness specifications, each of which probes a distinct modeling assumption of the base model, and that the decision rule on H0 requires the sign of \(\beta_1\) to be stable across all five, not merely significant in the base model alone. The reason this matters is that any single specification embeds choices, about how recovery and loss are treated as terminal states, about unobserved mission-level heterogeneity, about mass-class baselines, about small-sample bias, and about how many controls the event count can support, that could individually drive the result. A result robust to all five is far less likely to be an artifact of one of these choices than a result that holds in the base model alone. The five specifications are not a menu from which the most congenial is selected; they are a battery, all reported, and the sign-stability requirement binds the conclusion to their agreement.

The first robustness specification is a competing-risks formulation, and it probes the base model's treatment of recovery as censoring. In the base model, an episode that ends in recovery is right-censored at the recovery time, which treats recovery as the absence of the event of interest. But recovery and mission-ending loss are not absence-and-presence; they are two competing terminal states out of the fault state, and an episode that recovers cannot subsequently be lost from the same fault, so recovery is a competing risk rather than neutral censoring. The competing-risks specification models this directly. The subdistribution-hazard approach estimates the effect of autonomy on the cumulative incidence of mission-ending loss in the presence of the competing recovery event, which is the quantity a program manager actually cares about, the probability of loss accounting for the fact that recovery removes the episode from risk [\[101\]](#ref-101). The cause-specific-hazard approach, fit as a complementary view, estimates the instantaneous rate of loss among episodes still in the fault state and is the natural companion to the subdistribution model [\[104\]](#ref-104), [\[29\]](#ref-29). The competing-risks literature establishes when each is the appropriate estimand and cautions against reading a subdistribution hazard ratio as a cause-specific one [\[102\]](#ref-102), [\[117\]](#ref-117), [\[118\]](#ref-118). Reporting both, and confirming that the autonomy coefficient's sign agrees with the base model under each, guards against the possibility that the base model's censoring of recovery has manufactured or masked the effect. This specification is also the direct descendant of the multi-state failure analysis imported in Chapter 4, which distinguished degraded from failed states and is the conceptual ancestor of treating recovery and loss as competing terminal events [\[6\]](#ref-6).

The second robustness specification is a shared-frailty model, and it probes the base model's treatment of unobserved mission-level heterogeneity. The cluster-robust variance of the base model corrects the standard errors for within-spacecraft dependence but does not model the dependence; a shared-frailty model goes further by introducing a multiplicative random effect, the frailty, that is shared by all episodes of a spacecraft and absorbs the unobserved mission-level attributes that make some spacecraft more survivable than their covariates predict [\[30\]](#ref-30). The frailty term is the structural alternative to the cluster-robust variance: where clustering corrects inference for dependence, frailty models the dependence as a latent mission-level effect and estimates the autonomy coefficient net of it [\[106\]](#ref-106), [\[109\]](#ref-109). This matters for the identification argument of Section 5.2, because the principal residual confounder, program quality, is exactly the kind of unobserved mission-level attribute a frailty term is built to absorb. If the autonomy coefficient survives the inclusion of a shared frailty, the inference that autonomy and not unmodeled mission quality drives the result is strengthened; if it collapses, the frailty has revealed that the base model attributed to autonomy what was in fact mission-level heterogeneity. The penalized-likelihood implementation of frailty models is standard and well documented, and the same penalized machinery underwrites the Firth correction discussed below [\[108\]](#ref-108). The frailty-index methodology from the broader survival literature confirms that a latent severity construct can be operationalized and estimated from observed indicators, which is the formal analogue of treating program quality as an estimable latent term rather than an unmeasured nuisance [\[107\]](#ref-107).

The third robustness specification is mission-class stratification, and it probes the assumption of a common baseline hazard across heterogeneous spacecraft classes. The reliability-statistics tradition documented that failure behavior differs by mass class, so a single pooled baseline hazard would average over classes whose baseline risk genuinely differs [\[6\]](#ref-6). A stratified Cox model gives each mission class its own baseline hazard while constraining the covariate coefficients, including the autonomy coefficient, to be common across strata, which removes between-class baseline differences from the autonomy contrast [\[27\]](#ref-27). This is the specification-level implementation of the warning, carried from Chapter 4, that the complexity control and the mass-class stratification together guard against the autonomy coefficient absorbing a pure class effect. Confirming that the autonomy coefficient is sign-stable under stratification establishes that the effect is a within-class contrast, not an artifact of comparing flagship to lean missions whose baselines differ for reasons unrelated to autonomy.

The fourth robustness specification is Firth-penalized partial likelihood, and it probes the small-sample behavior of the estimator under the rare-event condition. Mission-ending losses are rare, so the event count is small relative to the censored episodes, and ordinary maximum partial likelihood is biased away from zero in small samples and can fail entirely under separation, where a covariate perfectly predicts the outcome in the available events. The Firth-type penalty corrects the small-sample bias and resolves separation by penalizing the partial likelihood, and it is the design's primary estimator when the realized event count is low rather than a mere check; the penalized-survival-model machinery that implements it is the same that underwrites the frailty models [\[108\]](#ref-108), [\[98\]](#ref-98). Using a penalized estimator under rare events is the statistical-conclusion-validity counterpart of the Talebian warning that rare-event samples are thin in exactly the region that matters [\[23\]](#ref-23), [\[49\]](#ref-49): the penalty is what keeps the estimate honest when the events that drive it are few. The design commits in advance to reporting the Firth-penalized estimate alongside the ordinary partial-likelihood estimate whenever the event count is low, so that the reader can see whether the conclusion depends on the small-sample correction.

The fifth robustness specification is the reduced autonomy-plus-distance model, and it probes whether the conclusion depends on fitting all four covariates against a thin event count. The events-per-variable concern of Section 5.2 implies that a four-covariate model may be over-parameterized when losses are scarce, so the design also estimates the autonomy effect in a reduced model containing only autonomy and the single most important confounder, distance. Distance is the chosen retained confounder because it is the covariate most tightly linked to the mechanism: it sets the one-way light time and therefore the cost of the ground loop that autonomy removes. If the autonomy coefficient is sign-stable and similar in magnitude between the full and reduced models, the reader can be confident the conclusion is not an artifact of fitting four parameters against few events; if it diverges, the divergence localizes the fragility to the controls the thin event count cannot support. This specification is the design's most direct concession to the rare-event constraint, and reporting it is the honest alternative to either over-fitting the full model or hiding the model's dependence on a thin event count.

The decision rule binds these five specifications to the conclusion. H0 is rejected in favor of H1 if and only if the estimated hazard ratio \(\exp(\beta_1)\) is below one and its 95 percent confidence interval excludes one in the pre-registered base specification, and the sign of \(\beta_1\) is stable across all five robustness specifications. A hazard ratio whose base-model interval includes one fails to reject H0. A hazard ratio whose sign reverses or whose significance disappears under any of the five robustness specifications is reported as fragile, and the contribution is downgraded accordingly rather than claimed. The confidence in the robustness battery is **high** as a design: the five specifications are distinct, each is grounded in a cited methodological literature, and the sign-stability requirement is a demanding and pre-committed standard. What would lower confidence at execution is a pattern in which the autonomy coefficient holds in the base model but fails under the frailty specification, which would indicate that unobserved mission-level heterogeneity, the program-quality channel, was driving the base result; that specific failure mode is why the frailty model is included rather than omitted.

### 5.4.6 Pre-registration commitment and the computational and software plan

The robustness battery and the decision rule are only credible if they are fixed before the data are seen and executed in a reproducible computational environment, so the design states both commitments explicitly. The **pre-registration** commitment is that the base specification of Section 5.3, the five robustness specifications of this section, the scaled-Schoenfeld respecification rule, the functional-form decision rule for the age covariate, the pre-specified tail subgroup carried into Chapter 6, and the fixed decision rule on H0 are all recorded in a time-stamped pre-registration before any episode-level outcome is linked to its autonomy score. The pre-registration is the anti-search device named in Section 5.5.4: it removes the researcher degrees of freedom that would otherwise let the choice among specifications be governed by which yields a significant autonomy coefficient, and it converts the robustness battery from a menu into a falsification test. Any deviation from the pre-registered protocol that the data force, for example a proportional-hazards failure that requires a repair not anticipated by the respecification rule, is reported as a deviation with its rationale rather than silently absorbed, so that a reproducibility reviewer can separate pre-planned analyses from data-driven ones.

The **computational and software plan** is specified so the analysis is reproducible by an independent analyst from the same coded data. The estimation is implemented in established, openly documented survival-analysis software whose Cox, competing-risks, frailty, stratified, and penalized-partial-likelihood routines are the reference implementations of the methods cited in this chapter: the proportional-hazards model with cluster-robust variance and the scaled-Schoenfeld diagnostic follow the implementation that accompanies the canonical extension of the Cox model [\[27\]](#ref-27); the penalized-partial-likelihood routines that deliver both the Firth-type correction and the shared-frailty estimates are the same penalized-survival machinery [\[108\]](#ref-108); the time-varying-covariate construction follows the standard counting-process data layout in which each episode is split at the times its time-dependent distance regime changes [\[110\]](#ref-110), [\[28\]](#ref-28); and the competing-risks estimands are computed with the subdistribution and cause-specific routines of that literature [\[101\]](#ref-101), [\[104\]](#ref-104). The plan commits to a fixed software-version record, a scripted and version-controlled analysis pipeline that runs end to end from the coded episode dataset to the reported hazard ratios without manual intervention, and a retained random-seed record for any procedure with a stochastic component, so that every number in the executed analysis is regenerable. The broader survival-analysis ecosystem confirms that these estimands and diagnostics are standard and portable across modern implementations rather than bespoke [\[105\]](#ref-105), [\[97\]](#ref-97), [\[100\]](#ref-100), which means the reproducibility commitment does not depend on a single proprietary tool. The reproducibility artifacts retained are the pre-registration, the analysis scripts, the software-version and seed records, and the coding log carried from Chapter 4, which together let an independent analyst reconstruct every reported estimate from the same documents and the same code.

## 5.5 Threats to validity and the design response

This section argues that the inference faces threats along all four standard validity dimensions, internal, external, construct, and statistical-conclusion, and that each named threat has a specific design response that bounds it rather than a general reassurance that dismisses it. The basis for the argument is the catalogued limitations of the data from Chapter 4 and the modeling choices of this chapter. Its logic is that a design which names its threats and matches each to a mitigation is more credible than one that asserts validity, and that stating the threats in advance is the falsifiability commitment that organizes the dissertation [\[13\]](#ref-13). The necessary caveat is that no design response eliminates a threat; each bounds it, and the residual is acknowledged. The four-way matrix is presented threat by threat, with the mechanism of the threat named and the design response stated.

### 5.5.1 Internal validity

The principal internal-validity threat is unobserved confounding, and its mechanism is the one developed in Section 5.2: a mission attribute correlated with both autonomy and survival but absent from the control set, of which overall program quality, test rigor, and operations-team experience are the leading instances. The design response is threefold and each part is already specified. First, conditioning on the three named confounders absorbs the part of program quality that travels with complexity, cost class, distance, and age. Second, the shared-frailty robustness specification models the residual mission-level heterogeneity as a latent term and re-estimates the autonomy coefficient net of it, so the threat is not merely acknowledged but partially estimated [\[30\]](#ref-30), [\[108\]](#ref-108). Third, and decisively, the residual bias is signed: because the leading unobserved confounder is positively associated with both treatment and outcome, the conditional estimate is an upper bound on autonomy's benefit, so a protective hazard ratio that survives conditioning is biased, if at all, in the direction of overstating rather than inventing the effect [\[13\]](#ref-13). The threat is reduced, modeled, and bounded; it is not claimed to be removed.

The second internal-validity threat is reverse coding, and its mechanism is subtle and specific to this study. If a mission-ending loss causes documentation to retrospectively describe the fault management as inadequate, the autonomy score could be contaminated by the very outcome it is meant to explain, manufacturing a spurious association between low autonomy and loss. The design response is the pre-flight scoring rule established in Chapter 4: the autonomy score is anchored to the TechPort technology-readiness assessment, which is produced for technology-management purposes before and independent of the survival outcome, and is placed on the detection-isolation-recovery scale from pre-flight design documentation rather than from post-loss narratives. Scoring the treatment from material that exists prior to the outcome breaks the reverse-coding channel by construction. The residual is that some design documentation may itself have been revised after a loss, which the coding protocol flags where detectable; the threat is bounded by the pre-flight rule, not eliminated by it.

### 5.5.2 External validity

The principal external-validity threat is flagship over-representation, and its mechanism is the documentation-effort bias of Chapter 4: well-documented flagship and competed NASA and JPL missions generate the public technical reporting from which episodes are coded, so the sample skews toward complex, high-investment spacecraft and away from small satellites, commercial constellations, and non-NASA programs. The design response is not a coverage correction the data cannot support but an explicit generalization bound: the estimate is claimed to generalize to the class of missions that dominate the sample, complex well-documented robotic spacecraft, and extension to small satellites and commercial constellations is named as a hypothesis for future work rather than a claim of this dissertation. The reliability-statistics tradition's demonstration that the survival-modeling apparatus transfers across mass classes supports the conjecture that the method generalizes even where this sample does not, which bounds the threat to the estimate rather than the method [\[6\]](#ref-6).

The second external-validity threat is tail undersampling, and its mechanism is the Talebian one that gives the dissertation its dependent-variable discipline. Mission-ending loss is a rare, heavy-tailed event, and the historical record undersamples the catastrophic tail, so a pooled estimate built on a sample thin in the worst episodes may not generalize to the conditions where autonomy matters most, the hardest faults at the greatest distance with the least reaction time [\[23\]](#ref-23), [\[49\]](#ref-49). The design response is the pre-specified tail-subgroup analysis carried into Chapter 6: a subgroup restricted to the hardest episodes is specified in advance to test whether autonomy's benefit concentrates in the tail even if the pooled estimate is modest, and the interpretation refuses to treat a favorable pooled average as a guarantee in the tail. The threat is met by a precautionary reading, not by a claim that the sample represents the tail it cannot represent.

### 5.5.3 Construct validity

The principal construct-validity threat is the compression of fault-management autonomy, a multidimensional engineering property, into a three-level ordinal score, and its mechanism is classical measurement error. Compressing a continuous, multidimensional construct into a coarse ordinal introduces measurement error in the treatment, which attenuates the estimated coefficient toward the null. The design response has two parts. First, the score is validated against independent coders and against the TechPort technology-readiness anchor, as specified in Chapter 4, which limits the measurement error by grounding the ordering in a documentary property checked by a second reader rather than a single analyst's judgment. Second, and importantly, the direction of the attenuation is known: classical measurement error in the treatment biases the coefficient toward zero, so it works against finding an effect, which means a rejection of H0 despite the coarse score is robust to this threat, and a failure to reject must be read with the attenuation in mind. The threat is bounded by validation and by the conservative direction of its bias.

The second construct-validity threat is the constructed complexity index, whose components, subsystem count, instrument count, and program cost class, are combined into a single index that may mismeasure the latent complexity it proxies. The mechanism is again measurement error, but here in a control rather than the treatment, which can bias the autonomy coefficient in either direction depending on how the mismeasured control correlates with autonomy. The design response is to carry the complexity index's construction into the robustness battery: the mission-class stratification specification removes between-class baseline differences without relying on the index's exact form, and the reduced autonomy-plus-distance model shows whether the conclusion depends on the complexity control at all. If the autonomy coefficient is stable across the indexed, stratified, and reduced specifications, the complexity construct's measurement error is not driving the result; if it moves, the movement localizes the dependence on the complexity index, which is reported rather than hidden.

### 5.5.4 Statistical-conclusion validity

The principal statistical-conclusion threat is the rare-event condition, and its mechanism is that the effective sample size for a Cox model is the number of events, not the number of episodes, because the partial likelihood is built from the risk sets at event times [\[25\]](#ref-25), [\[26\]](#ref-26). With a small number of mission-ending losses, power is limited, confidence intervals are wide, and the asymptotic partial-likelihood approximation is stressed. The design response is the suite developed in Section 5.4 and elaborated in Chapter 6: the covariate set is held small and theory-driven to respect the events-per-variable constraint, the Firth-penalized estimator is the primary estimator under low event counts to control small-sample bias and separation [\[108\]](#ref-108), [\[98\]](#ref-98), the reduced model provides a thin-data check, and the analysis reports interval estimates rather than point estimates alone so that the limited power is visible rather than masked. Where a stratum is underpowered, the design commits to reporting that limitation rather than over-interpreting a wide interval, which is the statistical-conclusion-validity counterpart of the Talebian warning [\[23\]](#ref-23).

The second statistical-conclusion threat is specification search, the risk that fitting many specifications and reporting the most congenial would inflate the false-rejection rate. The mechanism is that the five robustness specifications and the proportional-hazards respecification rule create researcher degrees of freedom that, if exercised after seeing the result, would invalidate the inference. The design response is pre-registration: the base specification, the five robustness specifications, the Schoenfeld respecification rule, and the fixed decision rule are committed in advance, so that the choice among specifications is governed by the pre-registered protocol rather than by which produces a significant autonomy coefficient. The decision rule's demand for sign-stability across all five robustness specifications is itself an anti-search device, because it forecloses the option of selecting the one specification in which the effect appears. Pre-registration converts the robustness battery from a fishing expedition into a falsification test, which is the methodological point of the whole exercise.

### 5.5.5 How this chapter advances the argument, with a confidence statement

The five threats and their responses can be read against the through-line of the dissertation's argument. The problem is real: fault entry is routine on long-duration missions and a fraction of episodes precede loss, and the autonomy-survival link is asserted rather than measured. The problem is material: autonomy investment and deep-space architecture trades turn on this assumption, and the long light time makes the ground loop slow exactly when faults are hardest [\[19\]](#ref-19), [\[20\]](#ref-20). The design addresses the causal mechanism: a conditional Cox hazard on autonomy, with confounder control, measures Fogel's counterfactual contrast directly [\[25\]](#ref-25), [\[13\]](#ref-13). It beats the alternatives: the Cox model dominates logistic-on-outcome and mean-based approaches because it uses dwell time, handles censoring and clustering, and tolerates a small event count, and IV was considered and rejected for want of a credible exclusion restriction [\[26\]](#ref-26), [\[101\]](#ref-101), [\[30\]](#ref-30). The residual risk is acceptable and, critically, bounded: rare events are met with Firth penalization, measurement error in the treatment attenuates toward the null and is validated against a second reader, unobserved confounding is signed as an upper-bound bias and modeled with frailty, and the design is framed honestly at the design stage with every numerical illustration labeled as a decision-rule shape rather than an estimate [\[108\]](#ref-108), [\[23\]](#ref-23), [\[49\]](#ref-49), [\[6\]](#ref-6).

The confidence in the research design as a whole is **moderate-to-high**, and the asymmetry between its two components is deliberate. The estimator choice is held at high confidence because three independent justifications converge on the Cox model and its robustness extensions, all grounded in an established methods literature. The identification is held at moderate confidence because it is observational, rests on an untestable conditional-independence assumption, and absorbs program quality only partially, though the signed-bias bound and the frailty specification together make the residual confounding a bounded and partially estimated quantity rather than an open one. What would raise the overall confidence to high is execution-stage evidence that the autonomy coefficient is sign-stable across all five robustness specifications, survives the frailty term, and is similar in the full and reduced models, the joint pattern that would indicate the effect is neither a censoring artifact, nor unmodeled heterogeneity, nor an over-fit of a thin event count. What would lower it is the opposite pattern, a base-model effect that fails the frailty or reduced-model probes, which the design is explicitly built to detect and report rather than to suppress. This calibrated, threat-matched, pre-registered design is what Chapter 6 executes in procedure: it takes the estimator, identification, base specification, and robustness battery fixed here and sets out the six-step estimation procedure, the formal decision rule, the design-stage illustrative expectations, the pre-specified tail subgroup, and the power and feasibility analysis whose binding constraint is the thin event count this chapter has carried as its central statistical-conclusion threat.

\newpage

# Chapter 6. Analysis Plan and Expected Results

## 6.0 The chapter thesis

This chapter delivers the pre-registered analytic protocol that converts the measurement spine of Chapter 4 and the estimator of Chapter 5 into a single, falsifiable verdict on the dissertation's hypothesis. Its answer is that the verdict can be made binding in advance: a fixed sequence of estimation steps, a fixed decision rule stated before any coefficient is fit, a set of expected signs each defended by a named mechanism rather than asserted, and a power-and-feasibility analysis whose binding constraint is the event count, not the episode count. The chapter commits to all of this at the design stage. No hazard ratio is reported here as an executed estimate; the numerical values that appear are illustrative shapes used to make the decision rule concrete, and the result tables are specified but left unpopulated by design. The discipline is deliberate. Pre-specifying the procedure, the rule, and the refutation conditions before touching the assembled population is what protects the eventual estimate from the specification search that turns an honest hazard ratio into a manufactured one, and it is the procedural counterpart of the falsifiability commitment that organizes the whole dissertation [\[13\]](#ref-13). The chapter is therefore not a report of findings. It is a contract about how findings will be produced and how they will be allowed to refute the claim that motivated them.

The problem this chapter addresses is a problem of analytic credibility, and it has four parts. The **current state** is that Chapter 5 has chosen the Cox proportional-hazards model and defended its identification, but a chosen estimator is not yet an analysis: it does not say in what order the data are touched, which diagnostics gate which decisions, what numerical pattern counts as support for the hypothesis and what pattern counts against it, or how a thin event count is to be handled honestly rather than papered over. The **desired state** is a step-by-step plan specific enough that an independent analyst, handed the coded dataset and this chapter, would reach the same accept-or-reject decision the candidate would reach, with no degrees of freedom left for outcome-driven choices. The **gap** is that, absent such a plan, the rare-event setting (a small number of mission-ending losses against a larger body of censored and recovered episodes) creates exactly the conditions under which flexible analysis produces false discovery: a small number of events means a few influential episodes can swing a coefficient, and a researcher free to choose the specification after seeing the data can find a hazard ratio below one by selection alone. The **consequence of leaving the gap open** is that even a correctly measured dataset and a correctly chosen estimator would yield an estimate of uncertain evidential value, because the reader could not distinguish a genuine conditional effect from the product of analytic freedom. This chapter closes the gap by fixing the procedure and the rule in advance and by stating, equally in advance, what the data would have to show to refute the hypothesis.

The canonical estimating equation, carried unchanged from the prospectus and the shared bible, is the object every step below operates on:

\[ h_i(t) = h_0(t)\,\exp\!\left(\beta_1\,\text{autonomy}_i + \beta_2\,\text{complexity}_i + \beta_3\,\text{distance}_i + \beta_4\,\text{age}_i\right) \qquad\qquad (1) \]

for fault episode \(i\), where \(h_0(t)\) is the unparameterized baseline hazard, the \(\beta\)s are estimated by partial likelihood [\[25\]](#ref-25), [\[26\]](#ref-26), and the quantity of interest is the hazard ratio \(\exp(\beta_1)\) on the ordinal autonomy variable. The hypotheses are equally fixed. H0 holds that the level of onboard fault-management autonomy has no effect on the hazard of a mission-ending anomaly conditional on entry into a fault state, so that \(\beta_1 = 0\) and \(\exp(\beta_1) = 1\). H1 holds that higher autonomy is associated with a lower hazard conditional on fault entry, after controlling for complexity, distance, and age, so that \(\beta_1 < 0\) and \(\exp(\beta_1) < 1\). The contribution is the measurement of \(\exp(\beta_1)\) and its confidence interval, together with an explicit accept-or-reject decision on H0. This chapter specifies how that measurement is produced and adjudicated.

The chapter proceeds in five sections. Section 6.1 lays out the six-step estimation procedure in the order it will be executed. Section 6.2 specifies the pre-analysis checks (proportional-hazards testing, influence and leverage diagnostics, and the event-count feasibility gate) that condition the steps that follow. Section 6.3 states the fixed decision rule on H0. Section 6.4 presents the design-stage illustrative expectations, with every number flagged as a decision-rule illustration and not an estimate, and specifies the Talebian tail-subgroup analysis in advance. Section 6.5 sets out the power and feasibility analysis, the rare-event mitigations, and the reproducibility commitments, and states the chapter's confidence and what would raise or lower it.

## 6.1 The six-step estimation procedure

The chapter's first claim is that the estimation should proceed in a fixed, pre-registered order, because the order itself carries evidential weight. A six-step sequence (assemble, construct the survival object, fit the base model, test and respecify, fit the robustness variants, conduct inference) executed in that order and committed in advance is what makes the resulting hazard ratio interpretable as a test of H0 rather than as the endpoint of a search. This follows from the method's own structure: the counting-process formulation of the Cox model gives a well-defined partial likelihood only once the survival object (entry, exit, event indicator, and the at-risk structure) is correctly constructed, and the large-sample properties of the estimator are established for that formulation [\[26\]](#ref-26), so the order is not arbitrary but follows the dependency structure of the method. A pre-specified analysis order removes the analyst's freedom to reorder steps in response to interim results, which is the freedom that, in a small-event setting, converts noise into apparent signal. This reflects the standard methodological position that pre-registration of the estimation sequence and the decision rule is the principal defense against specification search, a position the dissertation adopts wholesale and operationalizes here. The order is fixed but not rigid against discovery: where a pre-analysis check (Section 6.2) reveals a violated assumption, the pre-registered respecification path is itself part of the plan, so that respecification is a planned response to a named diagnostic rather than an unplanned reaction to a disappointing coefficient. The objection it must survive is that pre-registration is theater when the analyst has already seen the data; the answer is that the design-stage posture is genuine here, because no episode has yet been coded against the assembled population, so the procedure is committed before the data that would tempt its violation exist.

**Step one: assemble the episode-level dataset.** The first step codes fault entries, end states, and timing from the NASA Technical Reports Server, Government Accountability Office, and JPL incident-surprise-anomaly records, following the Chapter 4 coding protocol, and merges the TechPort-anchored ordinal autonomy score with the GAO- and NTRS-derived complexity index, the distance regime, and the spacecraft-age covariate. The output of this step is the coded episode inventory, retained as a coding log so that every episode's supporting documents, entry and terminal times, terminal type, and autonomy basis are auditable. This step is where the measurement decisions of Chapter 4 become a dataset, and the chapter inherits Chapter 4's flag that the JPL stream's silent-episode under-recording truncates the low-severity end of the duration distribution; the analysis plan does not attempt to repair that truncation by imputation, because imputing unobserved fast recoveries would manufacture data, and instead carries the limitation forward into the interpretation.

**Step two: construct the survival object.** The second step builds the time-to-event structure with fault entry as the time origin, recovery to nominal operations or observation-window close as the censoring event, and mission-ending loss as the event of interest. Recurrent episodes within a mission are entered as multiple records clustered on the spacecraft, and the at-risk structure is built so that an episode enters the risk set at its fault entry and leaves at its terminal time. The counting-process representation is what allows the model to use the dwell time in the fault state, to handle right-censoring of still-operating missions directly, and to accommodate the time-dependent distance covariate that changes as a mission transits from near-Earth to deep-space regimes [\[28\]](#ref-28). The mechanism by which this step matters is concrete: a misbuilt risk set (for instance, one that lets a recovered episode remain at risk after its recovery) would corrupt the partial likelihood and bias every coefficient, so the survival object is validated against the coding log before any model is fit.

**Step three: fit the base Cox model.** The third step fits the canonical four-covariate specification by partial likelihood with a robust variance estimator clustered on the spacecraft. The clustered robust variance is the device that handles the within-mission dependence introduced by recurrent episodes: a mission that safes itself repeatedly contributes correlated records, and treating them as independent would understate the standard error on \(\beta_1\) and overstate the precision of the autonomy estimate. The output of this step is the point estimate of \(\exp(\beta_1)\) and its clustered confidence interval, but the chapter is explicit that this output is not yet the verdict, because the verdict (Section 6.3) requires the diagnostics of step four and the robustness pattern of step five to hold.

**Step four: test the proportional-hazards assumption and respecify where it fails.** The fourth step subjects the base model to the proportional-hazards test using scaled Schoenfeld residuals, covariate by covariate [\[98\]](#ref-98). The proportional-hazards assumption is that each covariate's effect on the log-hazard is constant over the time since fault entry; a covariate whose Schoenfeld residuals trend with time violates it. The pre-registered response is specific and not discretionary: a covariate that fails the test is either stratified (its baseline hazard is allowed to differ across its levels without estimating a single proportional effect) or interacted with a function of time so that its effect is permitted to change over the episode, following the standard extension of the Cox model to non-proportional and time-varying effects [\[98\]](#ref-98), [\[28\]](#ref-28). Distance is permitted to enter as a time-dependent covariate from the outset, because a single long mission can occupy more than one distance regime, so its potential non-proportionality is anticipated rather than discovered. The mechanism this step protects against is interpretive: a hazard ratio reported under a violated proportionality assumption is an average over a changing effect and can mislead about both magnitude and sign, so the test gates the interpretation of \(\beta_1\) rather than merely decorating it.

**Step five: fit the robustness specifications.** The fifth step fits the pre-registered family of robustness variants, each probing a specific threat catalogued in Chapter 5. The competing-risks formulation treats recovery and mission-ending loss as competing terminal events out of the fault state, so that the autonomy effect on the loss-specific hazard is estimated without treating recovery as mere censoring [\[29\]](#ref-29), [\[101\]](#ref-101); this matters because recovery is not an uninformative dropout but the very outcome autonomy is hypothesized to make more likely, and the competing-risks lens prevents the analysis from conflating "recovered" with "still at risk." The shared-frailty specification adds a mission-level random effect to absorb unobserved heterogeneity across spacecraft [\[30\]](#ref-30), [\[108\]](#ref-108), probing whether the autonomy coefficient survives the introduction of a term that soaks up program-level differences the four covariates do not capture. The mission-class stratification allows the baseline hazard to differ across mission classes, testing whether the autonomy effect is an artifact of pooling heterogeneous baselines. The Firth-penalized partial likelihood re-estimates the autonomy effect under a penalty that reduces the small-sample bias and the separation problems that afflict ordinary partial likelihood when events are rare [\[108\]](#ref-108), and the reduced model containing only autonomy and the single most important confounder (distance) shows whether the conclusion depends on fitting all four covariates against a thin event count. Each variant produces its own estimate of \(\exp(\beta_1)\), and the pattern across them (not any single one) feeds the decision rule.

**Step six: conduct inference on H0 versus H1.** The sixth step conducts the formal inference on \(\beta_1\) using the Wald and likelihood-ratio tests in the base specification, reporting the hazard ratio with its 95 percent confidence interval. The two tests are reported together because they can disagree in small samples, and a disagreement is itself diagnostic of a thin or ill-conditioned likelihood. The likelihood-ratio test, which compares the maximized partial likelihood of the full model against that of a model omitting the autonomy term, is generally the more reliable of the two when events are scarce, because the Wald statistic depends on a variance estimate that is itself unstable in small samples and can produce the aberrant pattern in which a large coefficient carries a small test statistic. The plan therefore privileges the likelihood-ratio test for the headline inference and reports the Wald test alongside it as a consistency check, treating a material divergence between them as a signal to fall back on the penalized estimator of Section 6.5 rather than to trust the asymptotic interval. This step produces the number that the decision rule of Section 6.3 adjudicates, but the chapter stresses that the inference is conducted only after steps four and five have established that the base model's assumptions hold and that the sign of the autonomy effect is stable across the robustness family. Inference on a model that failed its own diagnostics would be inference on an artifact.

To make the six steps concrete without anticipating any result, consider how a single illustrative fault episode flows through them. Suppose a deep-space mission, well documented in NTRS and corroborated by a GAO assessment, enters a safe mode at a known date some years after launch, while operating at a distance regime that implies a one-way light time of tens of minutes, and that the program documentation describes onboard detection with a limited autonomous response and a ground-uplinked recovery sequence. Step one codes this episode's fault-entry date, its terminal type and date (here, a confirmed recovery to nominal operations), its autonomy level from the pre-flight TechPort anchor and the detection-isolation-recovery placement of Chapter 4, its complexity index, its distance regime, and its spacecraft age at entry, and it records every supporting document in the coding log. Step two enters the episode as a record whose clock starts at fault entry and ends at recovery, with the event indicator set to zero because recovery is censoring rather than the loss event, and it places the record in the risk set for the interval it was at risk; if the same spacecraft later safes itself again, that second episode is a second record clustered on the same spacecraft. Step three includes the record in the partial likelihood, where it contributes to the risk sets at the event times of whichever other episodes ended in loss, and where its own censoring at recovery removes it from later risk sets. Step four checks whether this and every other record's contribution is consistent with proportional hazards. Step five re-enters the episode under the competing-risks lens, where its recovery is now an informative competing terminal event rather than uninformative censoring, and under the frailty lens, where it shares a mission-level random effect with the spacecraft's other episodes. Step six is unaffected by any single episode but aggregates all of them into the inference on \(\beta_1\). The walkthrough illustrates the design's core commitment: a recovered episode is not discarded but carries information through the risk sets it populates and, in the competing-risks variant, through the recovery event itself, which is exactly the information a logistic regression on final outcome would throw away.

The confidence in the procedure as specified is **high**. It is high because the six steps follow the dependency structure of a well-established estimator [\[25\]](#ref-25), [\[26\]](#ref-26) rather than an idiosyncratic recipe, because each step's output is defined in advance, and because the respecification paths are named responses to named diagnostics rather than free choices. What would lower this confidence is a discovery, at execution, that the coded dataset cannot support the survival object as specified (for instance, that entry or terminal times are too coarsely documented to define dwell time), which would force a coarser discrete-time formulation and is flagged here as a contingency rather than assumed away.

## 6.2 Pre-analysis checks: proportional hazards, influence, and event-count feasibility

The chapter's second claim is that three pre-analysis checks must gate the estimation, and that the third of them (the event-count feasibility gate) can in principle stop the headline analysis before it begins. Proportional-hazards testing, influence and leverage diagnostics, and an event-count feasibility assessment are not optional post-hoc robustness exercises but pre-conditions whose results determine which models are permitted to carry interpretive weight. Each check targets a specific way the rare-event Cox setting can produce a misleading coefficient: non-proportionality makes the reported hazard ratio an average over a changing effect, a single high-leverage episode can dominate a partial likelihood built on few events, and an event count below a defensible floor makes the four-covariate model over-parameterized regardless of any diagnostic it passes. A coefficient is only as trustworthy as the checks it has survived, and in a thin-event setting the checks are more consequential than the point estimate. The checks gate interpretation, not publication: a model that fails a check is not discarded silently but reported with the failure named and the respecified or penalized alternative carried forward, so that the reader sees the diagnostic trail. The objection this must survive is that excessive diagnostic gating can itself become a garden of forking paths; the answer is that the checks and their consequences are pre-registered here, so the gating is itself fixed rather than chosen after the fact.

**Proportional-hazards testing.** The scaled Schoenfeld residual test is applied to each covariate and to the global model [\[98\]](#ref-98). The interpretation is mechanistic. A covariate whose residuals trend upward with time has an effect that strengthens as the fault episode lengthens; one whose residuals trend downward has an effect that decays. For the autonomy variable specifically, a time-trending Schoenfeld residual would have substantive meaning: it would suggest that autonomy's protective effect is concentrated early in the episode (when fast onboard resolution matters most) or late (when a ground loop would have run out of options), and either pattern is more informative than a single averaged hazard ratio. The pre-registered response, stratification or time interaction, therefore does double duty: it repairs the assumption and it surfaces a substantive feature of when autonomy matters. The chapter notes that this is one of the places where a methodological check and a Talebian reading meet, because a benefit concentrated in the late, hardest portion of an episode is exactly the tail-concentrated benefit the dependent-variable frame anticipates [\[23\]](#ref-23).

**Influence and leverage diagnostics.** Because the partial likelihood in a rare-event setting is built from a small number of risk sets at the event times, a single influential episode can exert outsized leverage on \(\beta_1\). The plan therefore specifies score-residual and dfbeta diagnostics that quantify how much each episode moves the autonomy coefficient, and it pre-commits to a transparent response: an episode found to dominate the estimate is not deleted, because deleting inconvenient data is the cardinal sin the design exists to prevent, but is flagged, its documentary basis re-examined for a coding error, and the estimate reported both with and without it so that the reader can see the dependence. The mechanism this guards against is the rare-event analogue of an outlier in least squares: with few events, the deletion or retention of one terminal episode can flip a conclusion, and an honest analysis exposes that fragility rather than concealing it.

The plan illustrates the influence concern with the kind of pattern it is built to catch, stated as a contingency and not a finding. Suppose, at execution, that a single mission-ending loss occurred on the one high-autonomy spacecraft in an otherwise low-autonomy distance stratum. With few events overall, that one episode could, on its own, push the autonomy coefficient toward or above one and reverse what the rest of the data suggest, and a careless analysis that reported only the pooled coefficient would let that single episode silently dictate the verdict. The dfbeta diagnostic quantifies exactly this dependence by measuring how much the autonomy coefficient moves when each episode is left out in turn, and the pre-committed response (flag, re-examine the documentary basis for a coding error, and report the estimate with and without the episode) exposes the fragility instead of burying it. The point is not to remove the episode, which would be the data deletion the design forbids, but to make the reader see that the conclusion rests on it, so that a result driven by one influential loss is recognized as fragile rather than presented as robust.

**Event-count feasibility.** The third check is the one with teeth. The effective sample size for a Cox model is governed by the number of events, not the number of episodes, because the partial likelihood is assembled from the risk sets at event times and the censored episodes contribute only through the risk sets they populate [\[26\]](#ref-26). A useful and widely used rule of thumb holds that roughly ten events are needed per estimated covariate to keep the maximum-partial-likelihood estimates approximately unbiased; with four covariates this implies a floor of roughly forty mission-ending events below which the base model is over-parameterized. The plan pre-registers this gate: before the four-covariate base model is granted headline status, the realized event count is compared against the floor, and if it falls below, the headline analysis shifts to the reduced autonomy-plus-distance model and the Firth-penalized estimator (Section 6.5), with the four-covariate model reported as a supporting rather than a primary specification. The chapter is candid that the Chapter 4 coverage target, a sample in the low hundreds of episodes across several dozen spacecraft with a small number of mission-ending losses, makes this gate a live constraint and not a formality, and that the most likely realized condition is one in which the event count is near or below the four-covariate floor. Naming this in advance is the statistical-conclusion-validity counterpart of the tail-risk warning that the historical record is thin in exactly the region that matters [\[23\]](#ref-23), [\[49\]](#ref-49).

The confidence in the pre-analysis checks as a gating apparatus is **high**, because each check is a standard, well-understood instrument applied for a clearly stated purpose, and because their consequences are pre-registered. What would lower this confidence is a realized event count so small that even the penalized reduced model strains the asymptotic approximation, a contingency Section 6.5 addresses with exact and penalized methods and an honest statement of the resulting limits.

## 6.3 The fixed decision rule on H0

The chapter's third claim is its load-bearing one: the decision on H0 is fixed in advance, stated as a conjunction of conditions, and not negotiable after the estimate is seen. Stated verbatim from the shared bible, the rule is that H0 is rejected in favor of H1 if and only if the estimated hazard ratio \(\exp(\beta_1)\) on autonomy is below one and its 95 percent confidence interval excludes one in the pre-registered base specification, and the sign of the effect is stable across the robustness specifications (competing risks, frailty, mission-class stratification, Firth-penalized, and the reduced autonomy-plus-distance model). A confidence interval that includes one fails to reject H0. A hazard ratio above one with an interval excluding one would refute H1 in the strongest way, indicating that, conditional on a fault, higher autonomy is associated with worse survival, which would be a substantively important negative finding. This rule maps directly onto the formal content of the hypotheses (H0 is \(\exp(\beta_1) = 1\); H1 is \(\exp(\beta_1) < 1\)) and onto the standard frequentist apparatus of interval estimation, so it adds no interpretive discretion beyond what the hypotheses already fix. A decision rule fixed before estimation is what gives the eventual accept-or-reject statement its evidential force, because it forecloses the move of redefining success after seeing the data. This is the falsifiability commitment inherited from the cliometric frame [\[13\]](#ref-13): a quantitative proposition is only a hypothesis if the conditions under which it would be abandoned are stated in advance.

The rule deserves three points of elaboration, each of which closes a discretion an unscrupulous or merely careless analyst might otherwise exploit. First, the rule requires both that the point estimate be below one and that the interval exclude one; it does not accept a point estimate below one with an interval spanning one as support for H1, because such a result is consistent with no effect and the design refuses to read suggestive-but-imprecise as confirmatory. This is the deliberate choice to let the rare-event setting fail to reject H0 honestly rather than to lower the bar to manufacture a finding. Second, the rule requires sign stability across the robustness family, not significance in every variant. The distinction matters: with a thin event count, the frailty or stratified model may yield a wider interval that includes one even when the base model's interval excludes it, and demanding significance everywhere would make the rule hostage to the least-powered specification. Sign stability is the defensible middle requirement, demanding that the direction of the autonomy effect not reverse when the specification changes, which is the pattern that would betray the base result as a confounding artifact rather than an effect [\[29\]](#ref-29), [\[30\]](#ref-30). Third, the rule treats a sign reversal under control inclusion as decisive against H1: a hazard ratio that is below one in a raw comparison but moves to or above one once complexity, distance, and age are conditioned on demonstrates that the apparent protective association was confounding, not effect, which is precisely the Fogelian test that the counterfactual contrast, not the raw correlation, carries the claim [\[13\]](#ref-13), [\[39\]](#ref-39).

A fourth point concerns the ordinal nature of the treatment, which the decision rule must respect rather than override. The autonomy variable is an ordered score read per level, not a cardinal quantity, so \(\exp(\beta_1)\) is the multiplicative change in the hazard associated with a one-level increase in autonomy, and the rule's "below one" condition is a statement about the per-level effect. The plan pre-commits to entering autonomy as an ordered variable under the assumption of a monotone per-level effect, and to checking that assumption by also estimating a specification in which the autonomy levels enter as separate indicator contrasts, so that a non-monotone pattern (for instance, a benefit that appears only at the highest level and not at the intermediate one) would be visible rather than masked by the linear-in-levels form. A non-monotone pattern would not by itself refute H1, but it would qualify the interpretation of the hazard ratio, and the plan commits to reporting it. This is the analytic counterpart of Chapter 4's insistence that the score is deliberately ordinal and coarse: the decision rule reads it per level because finer reading is not supported by the measurement, and the indicator-contrast check is the guard against the ordinal coding hiding a threshold effect.

The rule adjudicates the pooled, population-level question and does so symmetrically: a failure to reject H0 is not a non-result but a cautionary finding of equal decision value, indicating that autonomy maturity does not by itself change post-fault survival across the documented population and that the engineering case for autonomy must rest on other grounds. The objection the rule must survive is that a fixed rule is brittle in the face of a genuinely nuanced result, for instance a pooled null coexisting with a real effect in the hardest episodes. The answer is that the pre-specified tail-subgroup analysis (Section 6.4) is the planned home for exactly that nuance, so the fixed pooled rule and the planned subgroup analysis together can express the most likely complex outcome (a pooled null with a tail effect) without either bending the pooled rule or treating the subgroup result as an unplanned fishing expedition.

The confidence that the decision rule is well-specified is **very high**, because the rule is a direct restatement of the hypotheses in the language of interval estimation, because its three elaborations close the discretions that would otherwise undermine it, and because it is committed before any estimate exists. There is little that could lower this confidence at the level of specification; what remains uncertain is not the rule but which branch of it the data will trigger, and that uncertainty is the point.

## 6.4 Design-stage illustrative expectations and the tail-subgroup analysis

The chapter's fourth claim is that the expected direction of the autonomy effect can be reasoned to a sign and a mechanism without being estimated, and that illustrative numerical shapes can make the decision rule concrete without ever being mistaken for results. Under H1, the autonomy coefficient is expected to be negative (hazard ratio below one) for a specific mechanistic reason, and the magnitude is left to the data. The reason is the named causal mechanism carried from the shared bible: higher onboard fault-management autonomy means that the detection-isolation-recovery chain executes without waiting for a ground command cycle, which yields faster and light-time-independent resolution of the fault episode before it becomes terminal, which is what a hazard ratio below one would register. A faster terminal-event-averting response, holding the difficulty of the fault fixed by conditioning on complexity, distance, and age, lowers the instantaneous risk of crossing from a recoverable fault state to permanent loss, which is exactly what the hazard function measures. The mechanism's plausibility rests on the flight-demonstration and survey record that onboard autonomy can in fact close the detection-isolation-recovery loop without ground intervention [\[19\]](#ref-19), establishing that it is a real engineering capability and not a hypothesized one. The caution here is heavy and deliberate: the sign is an expectation, not a finding; the mechanism's existence does not guarantee its population-level signal will survive confounding control and a thin event count; and the entire subsection is illustrative. The objection this must survive is that the mechanism could run the other way, because added autonomy adds software and shifts authority to flight code that can itself fail, so a higher-autonomy spacecraft might enter recoverable faults that its own logic mishandles into losses; the plan does not assume this away but treats a hazard ratio above one as a live, refutation-grade possibility that the decision rule is built to detect.

Against that mechanism, the chapter states the illustrative shapes that bound the interpretive range. These numbers are decision-rule illustrations, not estimates from the data, and they are presented only to make the fixed rule legible. An illustrative hazard ratio of 0.6 on a one-level increase in autonomy, paired with an illustrative 95 percent confidence interval of 0.4 to 0.9, would reject H0 in the direction of H1: it would describe roughly a forty percent lower hazard of mission-ending loss per autonomy level, conditional on complexity, distance, and age, and its interval excludes one, so under the fixed rule (and given sign stability across the robustness family) it would support H1. An illustrative hazard ratio of 0.95 with an interval of 0.7 to 1.3 would fail to reject H0: the point estimate is near one and the interval spans one, so the rule reads it as consistent with no effect. These two illustrations bound the range the actual estimate could occupy; the estimate itself will fall wherever the assembled population places it, and the chapter commits to reporting that location whatever it is. The result tables that will hold the executed estimates are specified in structure and left unpopulated here by design: a primary table reporting \(\exp(\beta_1)\) with its 95 percent interval and the Wald and likelihood-ratio test statistics in the base specification; a robustness table reporting \(\exp(\beta_1)\) across the competing-risks, frailty, stratified, Firth-penalized, and reduced specifications; and a diagnostics table reporting the Schoenfeld test statistics and the influence summary. No cell in these tables is filled at the design stage, because filling them would be fabrication.

The chapter then specifies, in advance, the Talebian tail-subgroup analysis, and this is its second claim in the section. A subgroup analysis restricted to the hardest episodes, those at the greatest distance and the shortest reaction time, is pre-registered to test whether autonomy's benefit concentrates in the tail even if the pooled estimate is modest or null. The motivation is the dependent-variable frame: mission-ending loss is a rare, heavy-tailed event, and the value of autonomy is hypothesized to concentrate disproportionately in the worst episodes, those with the least time and the least ground insight, where a light-time-independent onboard response has the most to add over a ground loop [\[23\]](#ref-23). A pooled hazard ratio averages over all episodes and can dilute a benefit that is real but concentrated, so a pre-specified subgroup is the appropriate instrument to detect a tail-concentrated effect without inflating the false-discovery risk that an unplanned subgroup search would carry. This is grounded in the tail-risk literature's central finding that in heavy-tailed processes the aggregate statistic systematically understates the contribution of the extreme realizations [\[23\]](#ref-23), [\[49\]](#ref-49), so a method that looks only at the pooled average is structurally blind to exactly the region the frame says matters. The tail subgroup will be even thinner in events than the pooled sample, so its interval will be wider and its conclusion weaker, and the plan commits to reporting that subgroup result as suggestive rather than decisive and to refusing to treat a favorable pooled average as a guarantee in the tail. The objection it must survive is that a single pre-specified subgroup is still a multiple comparison; the answer is that it is one comparison, named in advance for a theorized reason, and reported with its weakened inferential status stated, which is the disciplined opposite of a post-hoc subgroup trawl.

The interpretation of the fitted result is not exhausted by the single hazard ratio; the plan also specifies how the survival profile itself is to be read. Because the Cox model leaves the baseline hazard unparameterized, the natural object for visual interpretation is the estimated survival profile out of the fault state for episodes at contrasting autonomy levels, holding the controls at representative values. The plan pre-specifies that the executed analysis will present, for the higher- and lower-autonomy contrast, the model-implied profile of remaining in a recoverable state as a function of time since fault entry, so that the shape of any autonomy effect over the episode is legible and not compressed into a single ratio. This profile reading is where a time-trending Schoenfeld residual on autonomy (Section 6.2) would become substantively visible: a benefit concentrated in the late portion of the episode would appear as profiles that diverge only as the episode lengthens, which is the graphical signature of the tail-concentrated benefit the dependent-variable frame anticipates [\[23\]](#ref-23). The profile is interpretive, not a separate test; the decision rule remains the hazard ratio and its interval, and the profile is the means of seeing what the ratio averages over.

The plan also takes seriously the rival mechanism under which the sign runs the other way, because honest design names the way the hypothesis could be wrong rather than only the way it could be right. Higher autonomy adds onboard software and shifts recovery authority from a human ground team to flight code, and that flight code can itself contain the fault that turns a recoverable safe-mode entry into a loss: an autonomous recovery routine that misdiagnoses a condition and commands the wrong reconfiguration could destroy a vehicle a patient ground loop would have saved. Under this rival mechanism, the driver (higher autonomy) produces the opposite observable effect (a higher loss hazard) through a different mechanism (autonomous mishandling), and the operational consequence would be a hazard ratio above one. The plan does not adjudicate between the protective and the harmful mechanism by assumption; it lets the data do so, and the decision rule's provision for a hazard ratio above one with an interval excluding one is exactly the channel through which the harmful mechanism, if it dominates, would announce itself as a substantively important negative finding. Stating the rival mechanism in advance, and building the rule to detect it, is the design's refusal to stack the test in favor of the engineering intuition it is meant to test.

The most likely nuanced outcome, the chapter notes, is a pooled hazard ratio whose interval includes one (a failure to reject H0 at the population level) coexisting with a tail-subgroup hazard ratio below one but imprecisely estimated. The plan treats this combination not as an embarrassment to be resolved in favor of one side but as a substantive finding in its own right: it would say that autonomy does not change average post-fault survival across the documented population but may matter where it is hardest, which is a more useful and more honest message to a program manager than either a clean rejection or a clean null. The confidence in the expected sign is **moderate**: the mechanism is real and the direction is principled, but the population-level signal is uncertain in the face of confounding and thin events, and the chapter calibrates its modality accordingly, using "expected" and "would" throughout and never asserting the sign as established. What would raise this confidence toward the eventual estimate is the realized hazard ratio and interval; what would lower it is a sign reversal under control inclusion or a robustness family in which the sign does not hold.

## 6.5 Power, feasibility, reproducibility, and confidence

The chapter's final claim is that the analysis is feasibility-limited rather than precision-rich, that this limit is governed by the event count, and that the honest response is to bound what the data can support rather than to over-interpret a wide interval. A formal power analysis, computing the minimum detectable hazard ratio given the realized event count, is part of the plan and conditions which models are adequately powered. The reason, again, is that the effective sample size for a Cox model is the event count, not the episode count [\[26\]](#ref-26), so that a sample of low-hundreds of episodes with a small number of mission-ending losses is, for inferential purposes, a small sample. A power analysis tied to the realized event count converts the abstract worry about thin tails into a specific statement (the smallest autonomy effect the design could reliably detect), which is the information a reader needs to interpret a null as either "no effect" or "underpowered to find one." This extends the events-per-variable reasoning of Section 6.2 [\[26\]](#ref-26) from a feasibility gate to a power computation. The power analysis is itself contingent on the realized event count, which is unknown at the design stage, so the chapter specifies the computation rather than its result. The objection it must survive is that a feasibility-limited study should not be run; the answer is that the conditional, design-stage estimate is decision-relevant under either branch of its disjunction, that a credible failure to find an effect is as useful to an architecture trade as a found one, and that the honest reporting of wide intervals is more valuable than the absence of any population-level estimate at all.

The power computation itself is specified, not its result, because the result depends on the realized event count that does not yet exist. The quantity the plan computes is the minimum detectable hazard ratio: given the realized number of mission-ending events, the distribution of the autonomy variable across episodes, and a conventional two-sided significance level and target power, the smallest departure of \(\exp(\beta_1)\) from one that the design could reliably detect. The mechanism linking event count to detectable effect is direct. The information the partial likelihood carries about \(\beta_1\) accrues at the event times, so fewer events means a flatter likelihood, a wider interval, and a larger minimum detectable effect; in the limit of very few events, the design can detect only an implausibly large protective effect and is effectively blind to a modest one. The plan commits to reporting this minimum detectable hazard ratio explicitly alongside any null result, because a failure to reject H0 means something entirely different depending on it. A null paired with a minimum detectable hazard ratio of, illustratively, 0.5 would say the design could have caught a halving of the hazard and did not, which is informative evidence against a large effect; the same null paired with a minimum detectable hazard ratio of, illustratively, 0.2 would say only that the design was too thin to catch anything short of an extreme effect, which is not evidence against a modest one. These illustrative figures are presented solely to show how the minimum detectable hazard ratio conditions the reading of a null and are not computed values. Reporting the detectable effect with every null is the discipline that prevents the most common misreading of an underpowered study, the treatment of "we found no effect" as "there is no effect" [\[23\]](#ref-23).

Three mitigations are pre-registered for the realistic case where events are scarce, and each is a specific response to a specific failure mode of rare-event survival analysis. First, **the covariate set is kept deliberately small and theoretically motivated** rather than expanded in search of significance: four covariates, each with a defended link to both the treatment and the outcome, and no atheoretical additions, because every added covariate consumes events the design cannot spare. Second, **Firth-type penalized partial likelihood is used as the primary estimator when the event count is low**, because the penalty reduces the small-sample bias of ordinary partial likelihood and resolves the separation problems that arise when a covariate perfectly or near-perfectly predicts the rare event [\[108\]](#ref-108); the mechanism is that the penalty shrinks the estimate toward a less extreme value, trading a small bias for a large reduction in variance and instability, which is the correct trade when events are few. Third, **the autonomy effect is also estimated in a reduced model containing only autonomy and the single most important confounder, distance**, so that a reader can see whether the conclusion depends on fitting all four covariates against a thin event count; if the reduced and full models agree in sign and rough magnitude, the conclusion is robust to the dimensionality, and if they diverge, the divergence is itself reported as a limit on what the data support. Reporting all three (the full model, the penalized model, and the reduced model) keeps the inference honest about what the data can and cannot bear, which is the statistical-conclusion-validity counterpart of the tail-risk warning that rare-event samples are thin in exactly the region that matters [\[23\]](#ref-23), [\[49\]](#ref-49).

Where power is insufficient for a stratum, the plan commits to reporting that insufficiency rather than presenting a wide interval as if it were an informative estimate. This is a substantive commitment and not a hedge: a mission-class stratum with two or three events cannot support a four-covariate model, and the plan will say so and decline to report a stratum-specific hazard ratio rather than print a number whose interval spans an order of magnitude. The chapter also notes that small event counts stress the asymptotic partial-likelihood approximation itself, so exact or penalized methods are used as a check where event counts are very small [\[108\]](#ref-108), and a material disagreement between the asymptotic and the exact or penalized result is reported as evidence that the asymptotic interval should not be trusted at face value. The methodological precedent for applying time-to-event survival analysis to a sparse, non-clinical space-domain process is itself thin, which the chapter acknowledges; the closest analogue in the immediate corpus is the use of survival analysis to model maneuver occurrence for non-cooperative satellites [\[34\]](#ref-34), a grey-literature precedent flagged as such, which establishes that the time-to-event apparatus has been brought to a space-operations question before, while not supplying a rare-event small-sample template the present design could simply adopt.

Reproducibility is the plan's closing commitment, and it is concrete rather than aspirational. The retained coding log from step one, the pre-registered baseline specification, the five robustness specifications, and the fixed decision rule together constitute a protocol that an independent analyst could execute on the same coded dataset to reach the same verdict. The pre-registration of the specification and the rule before the data are touched is what gives that reproducibility its force, because it removes the analyst's degrees of freedom from the path between data and conclusion. The chapter records that the design-stage posture is genuine: the procedure, the rule, the expected signs, the tail subgroup, and the power computation are all committed before any episode is coded against the assembled population, so that the eventual execution is a test of a fixed plan and not the endpoint of a search.

The chapter's overall confidence in the analysis plan is **high at the level of specification and deliberately uncommitted at the level of outcome**. The specification confidence is high because the estimation procedure follows the dependency structure of a well-established estimator [\[25\]](#ref-25), [\[26\]](#ref-26), the diagnostics are standard instruments applied for stated purposes [\[98\]](#ref-98), the robustness family targets named threats with appropriate methods [\[29\]](#ref-29), [\[101\]](#ref-101), [\[30\]](#ref-30), [\[108\]](#ref-108), and the decision rule is a direct restatement of the hypotheses committed in advance [\[13\]](#ref-13). The outcome confidence is uncommitted by design, because the whole point of the plan is to let the data place the hazard ratio wherever it falls and to read either branch of the disjunction honestly. The evidence that would resolve the outcome uncertainty is the executed estimate itself: the realized event count, the fitted \(\exp(\beta_1)\) and its interval, the Schoenfeld diagnostics, the robustness pattern, and the tail-subgroup result. The evidence that would lower confidence in the plan as specified, were it to surface at execution, is a coded dataset too coarse to support the survival object, an event count so small that even the penalized reduced model is unstable, or an inter-coder reliability on the autonomy score (from Chapter 4) low enough that the treatment variable's measurement error dominates the signal. Naming these contingencies in advance, and the responses to them, is the procedural form of the falsifiability commitment that organizes the dissertation [\[13\]](#ref-13), and it is the discipline that the tail-risk frame demands of a study whose dependent variable is a rare, heavy-tailed catastrophe undersampled by the very record used to study it [\[23\]](#ref-23), [\[49\]](#ref-49).

This plan is what Chapter 7 interprets. Chapter 7 takes the disjunction this chapter has fixed (a hazard ratio below one with an interval excluding one and a stable sign, versus an interval that includes one) and works out the implications of each branch for NASA and JPL architecture trades, addresses the rival explanations the robustness family is built to probe, develops the tail-concentrated-benefit reading the pre-specified subgroup is built to detect, and bounds the external validity of whichever estimate the executed plan produces. Nothing in that interpretation can outrun the plan specified here, which is why this chapter has spent its length fixing the procedure, the rule, and the refutation conditions before any number exists to tempt their revision.

\newpage

# Chapter 7. Discussion

## 7.0 The chapter thesis

This chapter argues a single claim and then defends it against the alternatives: the value of this dissertation does not depend on which way the data fall. Whether the assembled population of fault episodes yields a hazard ratio on autonomy below one with an interval excluding one, or a hazard ratio statistically indistinguishable from one, the estimate is decision-relevant for NASA and the Jet Propulsion Laboratory, because in both cases it converts a long-standing engineering intuition into a measured quantity with stated uncertainty. The chapter develops this symmetric-value thesis by interpreting each branch of the disjunction in turn, returning the resulting interpretation to each of the two methodological anchors that structure the work, drawing out the policy and mission consequences for program managers who must decide how much of fault management to entrust to flight code, confronting in full the three rival explanations that could unseat a causal reading, and closing with an honest statement of how far the estimate travels beyond the population that produced it.

The current state is a field that decides autonomy investment by assertion. Programs reason that long one-way light times make a ground recovery loop slow, conclude that onboard autonomy must therefore buy survivability, and fund accordingly, without ever testing that conclusion against the survival record of the missions that already flew [\[16\]](#ref-16), [\[17\]](#ref-17), [\[19\]](#ref-19). The desired state is an architecture-trade input: a defensible, reproducible, conditional estimate of whether autonomy maturity changes post-anomaly survival and by how much, carried with calibrated uncertainty rather than confidence. The gap between the two is precisely the conditional hazard ratio this design is built to estimate. The consequence of leaving the gap open is that deep-space architecture trades in the Autonomous Systems and Robotics portfolio continue to lack a survival complement to the technology-readiness scale, and autonomy continues to be priced against intuition. This chapter's task is to show that, on either outcome, the estimate closes enough of that gap to matter, and to be explicit and disciplined about what it cannot close.

Two interpretive guardrails govern everything that follows. First, the design-stage posture is binding: no coefficient reported here is fitted; the illustrative magnitudes used to make the decision rule concrete are decision-rule illustrations, not estimates, and are labeled as such wherever they appear. Second, this dissertation does not produce a systems or capability architecture. It is an observational survival-analysis measurement study, not a study of a real capability, system, or data-service exchange, so the chapter speaks of the hazard ratio as a plain-prose input to an architecture trade and populates no architecture table. Where the discussion reaches the objective-to-decision endpoint, it does so in words, not in a DoDAF or BEA construct.

## 7.1 Implications if H1 is supported

The chapter thesis, applied to the favorable branch, is that a hazard ratio on autonomy below one with an interval excluding one would do something the field has not previously been able to do: it would price autonomy maturity in the currency of survival. The argument is developed, grounded, traced to its mechanism, and then immediately qualified, because the qualification is what keeps it defensible.

If the assembled population yields an estimated hazard ratio \(\exp(\beta_1)\) below one whose ninety-five percent confidence interval excludes one in the pre-registered base specification, and the sign is stable across the competing-risks, frailty, mission-class-stratified, Firth-penalized, and reduced autonomy-plus-distance specifications, then higher onboard fault-management autonomy is associated with measurably lower hazard of mission-ending loss conditional on fault entry, and the magnitude of that association is itself the deliverable.

This rests on the structure of the estimating equation and the decision rule fixed in the design. The Cox model specifies the hazard of mission-ending loss at time \(t\) for fault episode \(i\) as

\[ h_i(t) = h_0(t)\,\exp\!\left(\beta_1\,\text{autonomy}_i + \beta_2\,\text{complexity}_i + \beta_3\,\text{distance}_i + \beta_4\,\text{age}_i\right) \qquad\qquad (1) \]

with \(h_0(t)\) left unparameterized and the betas estimated by partial likelihood [\[25\]](#ref-25). The quantity of interest is \(\exp(\beta_1)\), the multiplicative change in the loss hazard associated with a one-level increase in fault-management autonomy, holding complexity, distance regime, and spacecraft age fixed. Under H1 this quantity is below one. Because the autonomy variable is ordinal and read per level, the hazard ratio is interpretable directly as the proportional change in instantaneous loss risk from moving a program's fault-management implementation up one rung of the detection-isolation-recovery ladder.

What licenses moving from the coefficient to the program-relevant claim is the conditioning logic of the design. A hazard ratio below one in the conditional model is not a raw correlation between autonomy and survival; it is a within-stratum contrast, the comparison of comparable fault episodes that differ in autonomy level while sharing complexity, distance regime, and age. This is the operationalization of Fogel's counterfactual requirement: the conditional model constructs the world in which the only thing that differs is the supposed indispensable factor and reads off the difference it makes [\[13\]](#ref-13), [\[39\]](#ref-39). The hazard ratio is the social-saving analogue, a single number that supports or refutes the autonomy claim rather than narrating it.

Treating the conditional hazard ratio as a trustworthy contrast, rather than as one more confounded comparison, is justified by the signed-bias reasoning carried from the identification strategy. The most plausible unobserved confounder, overall program quality, is positively associated with both autonomy investment and survival, so an unconditioned estimate would overstate autonomy's protective effect. Conditioning on complexity and cost class absorbs part of program quality. If, after conditioning, the hazard ratio remains below one, the residual program-quality bias works in the same direction as the estimated effect. The conditional estimate is therefore an upper bound on autonomy's benefit, not a lower one, and a program reading a hazard ratio of, illustratively, the H1-consistent shape would know it is reading a ceiling on the protective effect rather than an exaggeration to be discounted further.

The confidence attached to this reading is moderate, and it is bounded above by the design-stage posture and by the event count. No coefficient is fitted here. Even when fitted, the effective sample size for the Cox partial likelihood is governed by the number of mission-ending events, not the number of episodes, because the partial likelihood is built from the risk sets at event times. With mission-ending loss a rare event, the realized interval will be wide, and a favorable point estimate sitting inside a wide interval is a weaker basis for a large architecture commitment than its midpoint suggests. The illustrative H1-consistent shape, a hazard ratio of 0.6 with an interval of 0.4 to 0.9, is offered only to fix the decision rule; it is not a forecast of where the data will land, and the lower precision of the realized interval would temper any inference drawn from it.

The reading is defeated, even on the favorable branch, if the sign of \(\beta_1\) reverses or its interval crosses one in the robustness specifications, if the proportional-hazards assumption fails for the autonomy covariate in a way that stratification or a time interaction cannot repair [\[98\]](#ref-98), [\[27\]](#ref-27), or if the favorable pooled estimate is shown to be an artifact of a handful of high-leverage episodes. The decision rule's insistence on sign stability across all five robustness specifications, including the Firth-penalized estimator that guards against the small-sample bias and separation that plague ordinary partial likelihood with rare events [\[108\]](#ref-108), is what makes that challenge a live test rather than a formality.

The mechanism that would underwrite a favorable estimate is named and traced, not assumed. The driver is higher onboard fault-management autonomy. The mechanism is that onboard detection, isolation, and recovery execute without waiting for a ground command cycle. The observable effect is faster, light-time-independent resolution of the fault episode before it crosses into a terminal state. The operational consequence is a hazard ratio below one on the autonomy variable. The strategic implication is an evidence-based architecture-trade parameter for deep-space autonomy investment. Each link is a claim about a process, not a bare correlation, and the chain is most legible exactly where the engineering argument has always located autonomy's value: at large distance, where the ground loop is slowest and the difference between a spacecraft that can recover itself and one that must wait is largest [\[17\]](#ref-17), [\[19\]](#ref-19), [\[20\]](#ref-20).

The actionability of a favorable estimate is therefore not uniform across the mission portfolio, and this matters for how a program should use it. The estimate would be most actionable for deep-space JPL missions, where the distance term is large and the ground loop is slow, and least actionable for near-Earth missions, where a ground recovery cycle is cheap and the marginal survival benefit of onboard autonomy is plausibly small. A program in the former class could weigh the cost of moving its fault-management implementation up one autonomy level, the onboard software, the verification burden, the shifted authority from a human ground team to flight code, against the estimated reduction in loss hazard conditional on its own complexity and distance regime. That is the objective-to-decision endpoint in plain prose: a strategic objective of surviving anomalies translates, through the fitted hazard ratio, into a quantified input to the decision of how much detection-isolation-recovery to entrust to the spacecraft. It is stated as a sentence, not a capability-to-system trace, because the contribution is a measurement and not an architecture.

The policy and mission consequences of a favorable estimate are worth drawing out concretely, because the difference a measured hazard ratio makes is in the structure of the decision it informs, not merely in its existence. Today an autonomy investment decision is made on a qualitative scale: the technology-readiness level of a candidate fault-management implementation tells a program how mature the technology is, but says nothing about what surviving an anomaly is worth, so the trade between readiness and survivability is made by judgment. A favorable hazard ratio would add the missing axis. A program could express the autonomy decision as a comparison between two quantities in compatible units: on one side the lifecycle cost of the additional onboard software, the verification and validation burden it imposes, and the assurance cost of moving safety-critical decisions into flight code; on the other side the expected reduction in loss hazard, converted through the program's own anomaly-arrival expectation and the value it places on the mission, into an expected avoided loss. Neither side is free of uncertainty, and the hazard-ratio side carries the wide interval the rare-event sample produces, but the decision would for the first time be a comparison of estimated quantities rather than a contest of intuitions. For NASA at the portfolio level, a favorable estimate would also bear on how much of a future deep-space line's risk reserve should be allocated to autonomy maturation versus to redundant hardware or to operations staffing, because it would let those competing risk reductions be compared on a survival metric they currently lack in common. The stakeholder reach extends past the engineering organization: a quantified autonomy-survival relationship is the kind of evidence that program review boards and budget authorities can interrogate, which moves the autonomy case from advocacy into accountability. The contemporary deep-space mission set, from inner-system solar missions to multi-spacecraft planetary missions operating at light-times where a ground loop is measured in tens of minutes, is exactly the population for whom this reframing of the decision would be most consequential [\[125\]](#ref-125), [\[82\]](#ref-82), [\[120\]](#ref-120).

## 7.2 Implications if H0 is not rejected

The chapter thesis, applied to the cautionary branch, is that a failure to reject the null is not a failure of the dissertation but a finding with its own teeth. The same discipline applies here, because a null is exactly the kind of result that tempts an author into over-interpretation in one direction or under-interpretation in the other.

If the assembled population yields a hazard ratio on autonomy whose ninety-five percent confidence interval includes one in the pre-registered base specification, the data fail to reject H0, and the correct inference is that, across the documented population and conditional on complexity, distance, and age, fault-management autonomy maturity does not by itself measurably change survival after a fault.

This follows from the decision rule, applied symmetrically. The rule rejects H0 for H1 only when the hazard ratio is below one and its interval excludes one and the sign is stable across robustness specifications. An interval including one, by the same rule, fails to reject H0. The illustrative fail-to-reject shape, a hazard ratio of 0.95 with an interval of 0.7 to 1.3, is the decision-rule illustration of this branch; like its counterpart it is not an estimate, only a marker of what the data would have to look like to leave the null standing.

A null can be read as informative rather than empty because the null here is not the absence of a test but the result of one. The proposition was stated quantitatively, embedded in an explicit counterfactual, and exposed to falsification, which is the whole of Fogel's requirement [\[13\]](#ref-13). A proposition that survives that exposure unrefuted in the direction of its alternative has been measured, not merely left unexamined. The engineering intuition that autonomy buys survivability would, on this branch, have been confronted with the survival record and found not to be supported at the population level, and that confrontation is the contribution whether or not it confirms the intuition.

The reading turns on the distinction between a null that says autonomy is worthless and a null that says autonomy's survival benefit is not visible at the pooled level conditional on these controls. These are different statements, and the design is built to keep them separate. A pooled null is consistent with autonomy mattering for reasons the dependent variable does not capture, and it is consistent with autonomy mattering only in a subgroup that the pooled estimate averages away. The competing-risks specification, which distinguishes mission-ending loss from recovery as competing terminal events rather than collapsing them, exists partly to guard against a pooled null masking a real effect on the recovery side that the loss-hazard model alone would miss [\[29\]](#ref-29), [\[101\]](#ref-101), [\[6\]](#ref-6).

The confidence in a null finding is itself conditioned on power. With a small number of mission-ending events and four covariates, the base model approaches the rule-of-thumb floor of roughly ten events per covariate below which maximum partial-likelihood estimates become unreliable. A null produced under low power is weak evidence for the absence of an effect; it may instead be the failure of a thin dataset to detect an effect that exists. The design's response, reporting the minimum detectable hazard ratio given the realized event count, is what converts a bare null into a calibrated one: the honest statement is not autonomy has no effect but the data can rule out a protective effect larger than such-and-such and can say nothing about effects smaller than that. This is the statistical-conclusion-validity counterpart of the Talebian warning that rare-event samples are thin in exactly the region that matters.

The null reading is itself overturned if the pre-specified tail subgroup, the hardest episodes at the greatest distance and shortest reaction time, shows a protective effect that the pooled model does not. A pooled null combined with a tail effect in the hardest-episode subgroup is, by the design's own anticipation, the most likely nuanced outcome, and it would not be a null in the sense that matters; it would be a finding that autonomy's benefit concentrates where the engineering argument always located it, invisible in the average and present in the tail.

The most important consequence of a pooled null is that it would relocate, rather than dissolve, the engineering case for autonomy. If autonomy maturity does not by itself change conditional survival across the documented population, then the justification for autonomy investment must rest on grounds the survival model does not measure: operational cost, because a spacecraft that recovers itself does not consume a ground recovery cycle; mission cadence, because autonomous recovery shortens the dead time between fault and resumption; and the mission phases where no ground loop is possible at all. Entry, descent, and landing is the limiting case. During an EDL sequence the one-way light time can exceed the entire duration of the event, so there is no ground loop to depend on and autonomy is not an investment to be traded against a human alternative but the only available form of fault management. A pooled null on the survival metric would say nothing against autonomy in that regime, because the regime is one the population-level loss hazard, dominated by long-duration cruise and orbital operations, barely samples. The cautionary value of the null is thus precise: it would caution program managers against justifying autonomy on a generic survivability claim while leaving entirely intact the phase-specific and operational justifications that the metric does not reach.

This relocation has a sharper edge when read against the trajectory of the autonomy field itself. The surveys that map the past, present, and future of autonomy for space robots, and the broader application of artificial intelligence in space missions, describe a field expanding the scope of what onboard systems decide, not contracting it [\[19\]](#ref-19), [\[20\]](#ref-20), [\[35\]](#ref-35). A pooled null would not contradict that trajectory, because the trajectory is driven precisely by the regimes the survival model under-samples: deep-space science operations where cadence and operational cost dominate, EDL and proximity operations where a ground loop is physically unavailable, and distributed multi-spacecraft missions where coordinating recovery through the ground is impractical at scale. The honest reading of a null is therefore not that the field has over-invested in autonomy, but that the population-level post-fault survival metric is the wrong instrument for detecting autonomy's value in the regimes that motivate its growth. A program that read a null as a reason to disinvest would be making the inferential error the design is most concerned to prevent: treating the absence of a signal on one metric, measured over a population that under-samples the decisive regimes, as evidence of absence across all the metrics and regimes that matter. The null's lesson is about the limits of the survival metric, not about the limits of autonomy, and stating that distinction clearly is the difference between a null that informs and a null that misleads.

## 7.3 The theoretical contribution back to each anchor

The chapter thesis has so far been argued in the language of program decisions. It must also be returned to the two frameworks that gave the design its discipline, because a dissertation that borrows a method owes that method something back. This section states what the work contributes to each anchor, under either outcome.

The contribution to the Fogelian frame is a demonstration that the cliometric move travels from economic history into spacecraft engineering without losing its force. Fogel's insistence was that a claim of the form outcome Y could not have occurred without factor X is an unmeasured counterfactual until it is stated quantitatively, embedded in an explicit counterfactual, and exposed to falsification, and that the discipline of constructing the counterfactual world and computing the difference is what separates measured history from asserted history [\[13\]](#ref-13), [\[39\]](#ref-39). The engineering field's claim that autonomy buys survivability has exactly the form Fogel distrusted: an indispensability claim defended by case narrative. This dissertation's theoretical contribution to the Fogelian program is to show that the same apparatus, the quantitative proposition, the conditioning that builds the counterfactual into the design, and the pre-committed refutation conditions, applies to a non-economic indispensability claim, and that the hazard ratio plays the role the social-saving figure plays in the railroad study: a single number that bounds and either supports or refutes the claim. The signed-bias reasoning is part of this contribution rather than a hedge against it. Fogel bounded his estimate; this design signs the direction of the most plausible residual confounding and thereby states whether its conditional estimate is a ceiling or a floor on the effect, which is the cliometric move of bounding a claim rather than asserting it, carried into a new domain. The contribution holds under either outcome: a favorable estimate is a Fogelian confirmation with a signed upper bound, and a null is a Fogelian refutation of the indispensability claim at the population level, and both are measured rather than narrated.

The contribution to the Talebian frame is a worked instance of treating a rare, heavy-tailed loss as the tail event it is rather than as a draw whose mean can be trusted. Taleb's argument is that in heavy-tailed processes the historical record undersamples the tail, sample means understate true exposure, and precaution rather than point optimization is the correct decision frame [\[23\]](#ref-23), [\[49\]](#ref-49), [\[52\]](#ref-52). Mission-ending loss is such an event, and the design encodes the Talebian discipline in three places: in the choice of a hazard formulation that handles censoring and small event counts over any mean-based approach, in the pre-specification of the tail subgroup so that autonomy's benefit can be detected where it is hypothesized to concentrate even if it is invisible in the pooled estimate, and in the refusal to treat any single point estimate, including the one this design will produce, as a license to optimize fault-management economics against the most-likely case while ignoring the catastrophic case. The theoretical contribution back to the Talebian frame is to show that the precautionary stance is not merely an interpretive overlay but a constraint that shapes estimator choice and subgroup design before any data are seen. The same financial and epidemiological tail-risk literature that motivates the precautionary reading, the work on tail risk in asset prices and in the microeconomic origins of macroeconomic tail risks, underlines that the cost of a tail event is frequently non-local and propagates through a system [\[51\]](#ref-51), [\[48\]](#ref-48). The orbital analogue is direct: the consequences of a lost vehicle are not always localized to the vehicle, because debris from a catastrophic loss feeds the long-term population dynamics of the orbital environment, so the precautionary reading of autonomy's tail benefit carries a systemic dimension that a vehicle-by-vehicle cost-benefit calculation misses [\[24\]](#ref-24). The contribution holds under either outcome here too: a favorable pooled estimate is read with tail-aware humility rather than as a tail guarantee, and a pooled null is read against the tail subgroup rather than as license to disinvest from autonomy in the worst episodes.

It is worth being precise about what kind of contribution this is to the cliometric tradition specifically, because the tradition has been the subject of methodological scrutiny that bears directly on the present claim. The social-saving method was not accepted without challenge; the literature that grew up around it interrogated whether the counterfactual construction was complete, whether the indispensability claim was being tested or merely restated in quantitative dress, and whether the single summary number obscured more than it revealed. The lasting result of that scrutiny was not the abandonment of the method but its discipline: a cliometric claim earns its standing by making its counterfactual explicit, by stating the direction and plausible magnitude of the biases it cannot remove, and by committing in advance to what would refute it. The present design inherits each of those disciplines. Its counterfactual is the within-stratum contrast that conditioning constructs; its principal bias, program quality, is signed rather than assumed away; and its refutation conditions, a non-negative coefficient, a sign reversal under conditioning, a sign reversal under robustness, are fixed before estimation. The theoretical contribution back to the cliometric frame is therefore not merely that the method transfers to a new domain, but that the matured, scrutiny-tested form of the method, the form that bounds and signs rather than the form that merely quantifies, is the form this dissertation carries into spacecraft engineering [\[13\]](#ref-13), [\[39\]](#ref-39). A claim that survives that fuller discipline is a stronger claim than one that merely attaches a number to an assertion, and the dissertation's value to the tradition is the demonstration that the discipline is portable.

There is a synthesis claim that belongs to neither anchor alone. The two frameworks jointly specify both the estimator family and its interpretation. Fogel drives the choice of a conditional counterfactual hazard, because the counterfactual contrast is what conditioning operationalizes. Taleb drives the tail-aware, precautionary reading of whatever that hazard model returns, because the dependent variable is a heavy-tailed rare loss. The contribution of the dissertation to the methodological literature is the demonstration that these two disciplines are complementary rather than competing: the Fogelian apparatus supplies the measurement and the Talebian apparatus supplies the humility about what the measurement can be trusted to mean, and a study of rare engineering catastrophe needs both.

## 7.4 Rival explanations and the responses to them

The chapter thesis is that the estimate is decision-relevant under either outcome, but that relevance depends on the estimate meaning what it appears to mean. Three rival explanations threaten the causal reading of a favorable estimate, and each must be confronted rather than waved off. This section treats each as an objection to be answered, states the design's response, and is candid about the residual that survives the response.

The first rival explanation is that autonomy is a marker for overall program quality rather than a cause of survival. On this reading, the programs that invest in autonomous fault management are the same programs that test more rigorously, staff their operations teams more deeply, and manage risk more carefully, and it is that bundle of unmeasured quality, not autonomy as such, that produces the better survival. The answer is partial and is stated as partial. Conditioning on complexity and cost class absorbs the component of program quality that travels with complexity and funding, which is a substantial component, because the most complex and best-funded programs are disproportionately the high-quality ones. The signed-bias reasoning then does the remaining work: because program quality is positively associated with both autonomy and survival, any residual quality not absorbed by the controls biases the autonomy hazard ratio downward, toward a stronger protective effect than is real, so a hazard ratio that remains below one after conditioning is an upper bound on autonomy's benefit and the residual confounding works in the same direction as the estimate rather than against it. The honesty owed here is that conditioning reduces but cannot eliminate this confounder, and the design does not claim a randomized causal effect; it claims a conditional association with a defended control set and an explicit, signed account of the residual. That is a weaker claim than a randomized effect and a stronger claim than a raw correlation, and stating exactly where it sits is the response's real content.

The second rival explanation is that better-instrumented missions both detect more faults and survive more of them, so the autonomy score and the survival outcome share a common cause in instrumentation. On this reading, richer onboard instrumentation simultaneously raises a mission's autonomy-score by enabling onboard detection and isolation and raises its survival by giving operators and onboard logic more to work with, and the apparent autonomy effect is an instrumentation effect. The answer runs through two of the robustness specifications. The competing-risks formulation distinguishes the recovery terminal state from the loss terminal state, which matters because an instrumentation common cause would be expected to inflate detection and therefore the count of recorded episodes without necessarily improving the loss-versus-recovery split conditional on an episode having been recorded; if instrumentation drives the result, its signature should appear differently across the two competing transitions than a genuine autonomy effect would [\[29\]](#ref-29), [\[101\]](#ref-101). The shared-frailty specification absorbs unobserved mission-level heterogeneity, including the instrumentation-richness that is common within a mission across its episodes, into a mission-specific random term, so that the autonomy coefficient is identified off variation that the frailty has not already explained [\[30\]](#ref-30), [\[108\]](#ref-108). The residual that survives is that neither specification can fully separate instrumentation from autonomy when the two are nearly collinear in the population, and the design states that a near-perfect collinearity between instrumentation richness and autonomy level would be a genuine limit on what any conditional model can recover.

The third rival explanation is reverse causation in the documentation. On this reading, a mission-ending loss leads the post-mission documentation to describe the fault management as inadequate, so the autonomy score is contaminated by the outcome it is meant to predict, and the association is an artifact of how losses get written up rather than of how autonomy performed. This is the most insidious rival because it would corrupt the treatment variable itself. The answer is the design choice to score autonomy from pre-flight TechPort technology-readiness anchors and pre-flight design documentation rather than from post-loss narratives [\[18\]](#ref-18). A score built on the readiness level of the flown fault-management technology and on the design-stage placement on the detection-isolation-recovery ordinal scale, fixed before the outcome is known to the coder, cannot be contaminated by a narrative written after the loss. The three-pass construction, with an independent second-reader re-coding against the same rubric and adjudication of disagreements against the documentation, further insulates the score from any single coder's hindsight. The residual that survives is that pre-flight documentation is itself sometimes revised, and that a coder cannot be fully blinded to which famous missions ended in loss; the design treats this as a bounded rather than eliminated threat and commits to a retained coding log so that the provenance of every score is auditable.

There is a fourth challenge that is not a rival causal explanation but a methodological objection, and it is answered here for completeness. The objection is that an instrumental-variable design would identify the autonomy effect more cleanly than conditioning. The answer is that a valid instrument would need to shift autonomy investment without affecting post-fault survival except through autonomy, and no such variable is credibly available: every plausible candidate, mission era or budget, plausibly affects survival through other channels, so an instrument would import an untestable exclusion restriction in exchange for removing a confounder the conditioning strategy already signs. Honest conditioning with a defended control set and explicit reasoning about the remaining bias is more defensible than a weak instrument, and choosing the former is itself a Fogelian commitment to bounding a claim rather than dressing it in machinery that hides the assumption.

## 7.5 The Talebian tail reading

The chapter thesis acquires its sharpest form in the tail. The argument here is that the pooled estimate, favorable or null, is not the whole of what the data can say about autonomy, because autonomy's value is hypothesized to concentrate in the worst episodes, and a study that reported only the average would under-serve exactly the decision the tail governs.

Autonomy's protective effect, if it exists, is expected to be larger in the hardest fault episodes, those at the greatest distance and the shortest reaction time, than in the average episode, and the design's pre-specified tail subgroup is built to detect that concentration even when the pooled estimate is modest or null.

This expectation follows from the mechanism itself. The benefit of onboard autonomy is that detection, isolation, and recovery execute without waiting for a ground command cycle, and the value of not waiting scales with how long the wait would otherwise be. In a near-Earth episode the ground loop is short and autonomy saves little time; in a deep-space episode the ground loop is long and a spacecraft that must wait for a human recovery sequence may exhaust its margin before the sequence arrives. The hardest episodes are precisely those where the light-time-independent resolution that autonomy provides has the most room to change the outcome, so the mechanism predicts a larger autonomy effect in the tail [\[17\]](#ref-17), [\[19\]](#ref-19).

Taking the tail seriously even against a modest pooled estimate is licensed by the Talebian observation that in a heavy-tailed loss process the average is dominated by the common, mild episodes and undersamples the rare, severe ones, so a pooled estimate that averages over all episodes can understate the benefit that lives in the tail [\[23\]](#ref-23), [\[49\]](#ref-49). Reporting only the pooled hazard ratio would commit the precise error Taleb warns against: optimizing against the most-likely case while the catastrophic case, where autonomy may matter most, is washed out of the average.

This is reinforced by the design decision to specify the tail subgroup in advance rather than to discover it after seeing the pooled result. A subgroup found by searching for significance after a disappointing pooled estimate would be a specification-search artifact; a subgroup pre-registered as the hardest episodes, defined by distance regime and reaction-time before any fitting, is a genuine test of the tail-concentration hypothesis. The non-naive precautionary principle adds that no single point estimate, pooled or tail, should be treated as a license to optimize fault-management economics against the most-likely case [\[23\]](#ref-23), and the broader precautionary literature, including the case for prioritizing protective action under deep uncertainty about catastrophic outcomes, reinforces that a favorable average is not a guarantee in the tail [\[55\]](#ref-55), [\[53\]](#ref-53), [\[54\]](#ref-54).

The confidence in any tail finding is lower than the confidence in the pooled estimate, not higher, because the tail subgroup is smaller and its event count thinner, so its interval will be wider still. The honest statement is that the tail analysis can suggest concentration but will rarely establish it with the precision a pooled estimate could achieve on a larger sample, and that a tail point estimate more favorable than the pooled one must be read against a correspondingly wider interval before it is allowed to drive a decision.

The tail reading is overturned if the tail subgroup shows no larger effect than the pooled estimate, which would indicate that autonomy's benefit, whatever its size, does not concentrate where the mechanism predicts, and would weaken the mechanistic story even if the pooled estimate were favorable. It is also overturned, in the other direction, if the tail subgroup is so small that its interval spans every substantively interesting value, in which case the correct conclusion is that the data cannot speak to the tail and the precautionary stance must be held on the mechanism rather than on measurement.

The practical upshot of the tail reading is a specific caution to program managers. The precautionary point is that the value of autonomy may lie disproportionately in the worst fault episodes, those with the least time and the least ground insight, so a program that prices autonomy against the average episode is pricing it against the case where it matters least. A favorable pooled estimate should not be read as a guarantee in the tail, and a null pooled estimate should not be read as license to disinvest from autonomy in the regimes the average undersamples, because in a heavy-tailed loss process the average is the least informative statistic about the catastrophe. The systemic dimension sharpens the caution: a loss in the tail is not always a localized cost, since debris from a catastrophic loss can feed the orbital environment's long-term dynamics, so the precautionary case for autonomy in the tail carries a consequence beyond the lost vehicle [\[24\]](#ref-24). This is the one place the discussion reaches past the mission and toward the environment, and it does so to make the precautionary frame complete rather than to expand the claim.

## 7.6 External validity

The chapter thesis is about decision-relevance, and decision-relevance is bounded by the population the estimate describes. This section states how far the estimate travels, and is deliberately conservative, because over-claiming external validity is the failure mode most likely to turn a defensible study into an indefensible one.

The estimate generalizes most safely to the class of missions that dominate the sample: complex, well-documented NASA and JPL robotic spacecraft. Extension to small satellites, commercial constellations, and non-NASA programs is a hypothesis for future work, not a claim of this dissertation.

This restriction follows from the coverage structure of the data. Coverage is strongest for flagship and competed deep-space and Earth-science missions, which are well documented in the NASA Technical Reports Server and in Government Accountability Office assessments, and for JPL-operated missions with releasable anomaly records. Reporting is heterogeneous, and well-documented flagship missions are over-represented relative to small or classified missions, which biases coverage toward complex, high-investment spacecraft. The reliability-statistics tradition that supplies the importable apparatus has shown that failure behavior differs by mass category and mission class, which is direct evidence that an estimate built on one class should not be assumed to hold for another [\[5\]](#ref-5), [\[10\]](#ref-10), [\[6\]](#ref-6).

There is a deeper reason to restrict the generalization: the mechanism's strength is itself class-dependent. The autonomy benefit scales with light time and with the absence of a cheap ground loop, so it is strongest in the deep-space flagship class that dominates the sample and weakest in the near-Earth small-satellite class that the sample under-represents. An estimate dominated by the class where the mechanism is strongest cannot be extrapolated to a class where the mechanism is weaker without re-estimation, and the documented mass-category differences in failure behavior make that extrapolation a hypothesis rather than a deduction. The contemporary mission record that motivates the deep-space framing, from solar and inner-system missions to multi-spacecraft planetary missions, sits squarely in the well-documented flagship class that defines the safe generalization domain [\[125\]](#ref-125), [\[120\]](#ref-120), [\[82\]](#ref-82).

The Talebian caution about tail undersampling applies here too. The sample over-represents complex, well-funded missions and undersamples the catastrophic tail, so an estimate built on a population that undersamples the tail of catastrophic episodes may understate autonomy's benefit in exactly the conditions where it matters most, and may also fail to capture the failure modes of mission classes outside the sample entirely [\[23\]](#ref-23), [\[49\]](#ref-49). The honest external-validity statement is therefore doubly bounded: bounded to the flagship class by coverage, and bounded away from any guarantee in the tail by undersampling.

The confidence in the within-class generalization is moderate and in the cross-class generalization is low. The estimate is offered as a defensible inference about complex NASA and JPL robotic spacecraft and as no more than a motivating hypothesis about small satellites, commercial constellations, and the rapidly growing population of distributed and agent-managed space systems whose fault-management practices differ from the flagship lineage [\[35\]](#ref-35), [\[10\]](#ref-10). The growth of that population is a reason to extend the study, not a reason to assume the flagship estimate applies to it.

The generalization claim would be overturned if a future study on a different mission class returned a materially different autonomy hazard ratio, which would confirm that the flagship estimate does not travel and would convert the present generalization bound from a caution into a documented limit. The design anticipates this by stating the bound in advance rather than discovering it after an over-broad claim has been made.

The mission-anomaly record that grounds the worked framing of this study is itself drawn from the flagship class, which both supports the within-class generalization and illustrates its limits. Documented anomaly recoveries on major missions, the safing and recovery of a flagship outer-planet spacecraft and the anomaly-recovery and operational lessons of an Earth-science mission among them, are the kind of well-reported episode the sample is rich in, and they are precisely the episodes whose generalization to a thinly documented small-satellite population is unwarranted [\[74\]](#ref-74), [\[70\]](#ref-70), [\[75\]](#ref-75), [\[37\]](#ref-37). The external-validity statement is thus not an abstract caveat but a direct reading of which episodes the data actually contain.

## 7.7 Synthesis: the symmetric value of the estimate

The chapter has argued one claim through six developments, and it closes by drawing them together. The through-line that carries the whole dissertation holds across this discussion. The problem is real: safe-mode entry is routine on long-duration missions and a fraction of fault episodes precede permanent loss, and the autonomy-survival link has been asserted rather than measured [\[74\]](#ref-74), [\[70\]](#ref-70), [\[16\]](#ref-16). The problem is material: autonomy investment and deep-space architecture trades turn on this assumption, and long light time makes the ground loop slow exactly when faults are hardest [\[19\]](#ref-19), [\[20\]](#ref-20), [\[82\]](#ref-82). The intervention addresses the mechanism: a conditional Cox hazard on autonomy with confounder control measures Fogel's counterfactual contrast directly [\[25\]](#ref-25), [\[26\]](#ref-26), [\[13\]](#ref-13). It improves on the alternatives: the Cox model uses dwell time, handles censoring and clustered recurrent episodes, and tolerates a small event count better than a logistic-on-outcome or mean-based model, and the instrumental-variable alternative was considered and rejected for lack of a credible exclusion restriction [\[25\]](#ref-25), [\[29\]](#ref-29), [\[30\]](#ref-30). The remaining risk is acceptable: rare events, measurement error in the autonomy score, and unobserved program-quality confounding are bounded by Firth penalization, second-reader coding, pre-flight scoring, signed-bias reasoning, and honest design-stage framing [\[108\]](#ref-108), [\[98\]](#ref-98), [\[23\]](#ref-23).

The symmetric-value thesis is the conclusion these developments support. Under the favorable branch, the estimate prices autonomy maturity in the currency of survival and supplies an architecture-trade parameter most actionable for deep-space JPL missions. Under the cautionary branch, the estimate relocates the engineering case for autonomy onto operational, cadence, and phase-specific grounds the survival metric does not reach, and it does so with a calibrated null that states what protective effect the data can and cannot rule out. Under the most likely nuanced branch, a pooled null with a tail effect in the hardest episodes, the estimate says autonomy's benefit concentrates where the mechanism predicts and where the average is least able to see it, which is itself a contribution. In every branch the work converts an intuition into a measurement with stated uncertainty, signs the direction of its residual bias, reads its result with tail-aware humility, and states honestly how far the result travels. That is the contribution the discussion defends, and it does not depend on the data being kind.

The remaining task, which the conclusion takes up, is to convert this design into execution: to code the episode inventory from the named sources, to anchor and second-reader-score the autonomy variable, to realize the power the event count allows, and to report the fitted hazard ratio, or the credible failure to find one, against the pre-registered decision rule. The discussion has shown why that estimate matters before it exists. The design-stage honesty of the chapter is that it claims no more than that: a defensible account of what the measurement would mean, held strictly apart from any claim about what the measurement is.

\newpage

# Chapter 8. Conclusion

## 8.0 The answer this dissertation reaches

The answer this dissertation reaches is that the question of whether onboard fault-management autonomy buys post-anomaly survival can be converted, for the first time, into a single estimable parameter, and that the value of the work does not depend on which way that parameter falls. The contribution is the construction of a conditional hazard estimate, the hazard ratio \(\exp(\beta_1)\) on an ordinal autonomy score in a Cox proportional-hazards model fit to a population of fault episodes, together with the identification strategy, the measurement protocol, and the falsification conditions that make the estimate interpretable. Under either branch of the disjunction, a hazard ratio below one with a confidence interval excluding one, or a hazard ratio whose interval includes one, the dissertation returns a decision-relevant result to NASA and Jet Propulsion Laboratory program managers who must currently weigh autonomy investment on intuition alone. This chapter states that claim, defends what stands even if the alternative hypothesis is not confirmed, sets out the limitations honestly, names the concrete program of work that converts the design into an executed estimate on the full dataset, and closes.

The problem this chapter must resolve is one of closure rather than of new evidence. The current state at the end of a design-stage dissertation is a fully specified but unexecuted research program: an estimator chosen, variables constructed, an identification argument defended, and refutation conditions pre-registered, but no coefficient fit to the assembled population. The desired state is a reader who understands precisely what the dissertation has and has not established, what its result will mean whichever direction it takes, and what remains to be built. The gap between the two is the risk that a design-stage contribution reads as an unfinished empirical paper rather than as a complete methodological proposal. The consequence of leaving that gap unaddressed is that the genuine contribution, a falsifiable measurement instrument for an architecture question that two literatures have left unanswered, would be mistaken for a missing finding. This chapter closes the gap by separating, sharply, what is settled by the design from what awaits execution.

## 8.1 The contribution restated: one hazard ratio, or one credible failure to find one

The central claim of this dissertation is that it specifies the first population-level, conditional hazard estimate of the effect of fault-management autonomy on spacecraft survival after a fault, and that the specification is itself the contribution regardless of the sign of the eventual coefficient. The claim rests on the four elements assembled across the preceding chapters: a unit of analysis (the fault episode, a discrete entry into a safe mode or comparable fault state), a dependent variable (mission-ending anomaly, with time measured from fault entry and recovery treated as censoring), a primary explanatory variable (an ordinal autonomy score built in three passes from a TechPort technology-readiness anchor, design-documentation placement on the detection-isolation-recovery scale, and an independent second-reader re-coding), and an estimator (the Cox model of Cox [\[25\]](#ref-25), with the counting-process large-sample properties of Andersen and Gill [\[26\]](#ref-26) and the extensions catalogued by Therneau and Grambsch [\[27\]](#ref-27)). What connects these elements to the claim is Fogel's cliometric principle [\[13\]](#ref-13): a proposition of the form "autonomy changes survival" is an unmeasured counterfactual until it is stated quantitatively, embedded in an explicit counterfactual contrast, and exposed to falsification, and the estimating equation

\[ h_i(t) = h_0(t)\,\exp\!\left(\beta_1\,\text{autonomy}_i + \beta_2\,\text{complexity}_i + \beta_3\,\text{distance}_i + \beta_4\,\text{age}_i\right) \qquad\qquad (1) \]

does exactly that. This principle is itself underwritten by the cliometric tradition's demonstration, from Fogel's railroad social-saving computation forward [\[13\]](#ref-13), that historical claims of indispensability become testable only when reduced to a single estimated number against an explicit no-treatment world, a discipline that Leunig's survey of the social-savings method documents as a durable methodological standard rather than a one-off device [\[39\]](#ref-39).

One qualification on this claim is essential and must be protected. The contribution is the conditional estimate and its decision rule, not a confirmed effect; this dissertation does not assert that autonomy lowers the hazard, only that it builds the instrument that would establish or refute that proposition. The objection the claim must survive is that a design-stage proposal contributes nothing until it is run. That objection fails on the symmetry of the result. Consider the two terminal branches. If the assembled population yields a hazard ratio below one with a 95 percent confidence interval excluding one and a sign stable across the competing-risks, frailty, mission-class-stratified, Firth-penalized, and reduced autonomy-plus-distance specifications, H0 is rejected and the magnitude of \(\exp(\beta_1)\) becomes an architecture-trade parameter: a program can weigh the cost of moving up one autonomy level against the estimated reduction in loss hazard, conditional on its complexity and distance regime. If instead the interval includes one, H0 is not rejected, and the implication is equally usable: across the documented population and conditional on the controls, autonomy maturity does not by itself change survival after a fault, and the engineering case for autonomy must rest on other grounds such as operational cost, mission cadence, or the entry-descent-and-landing phases where no ground loop is physically possible. A hazard ratio above one with an interval excluding one would be the strongest refutation of H1, a substantively important negative finding that higher autonomy is associated with worse conditional survival. In all three cases the dissertation returns information that the field does not currently possess. The confidence in the symmetry argument is high, because it follows deductively from the pre-registered decision rule rather than from any anticipated data realization; what it does not and cannot establish at the design stage is which branch obtains, which remains the open empirical question.

## 8.2 The bridge between two literatures

The contribution's durable value lies in joining two literatures that bear on the autonomy-survival question and have not met, as the literature review documents. The first literature is the spacecraft reliability-statistics tradition of Castet and Saleh and collaborators, which assembled on-orbit failure data and fit nonparametric and Weibull reliability models across hundreds of spacecraft and subsystems, establishing that failure behavior is statistically tractable at the population level [\[5\]](#ref-5) and that it varies by subsystem, mass class, and mission type, and which extended into multi-state failure analysis distinguishing degraded from failed states [\[6\]](#ref-6). The second is the fault-management engineering tradition, which builds architectures and flight demonstrations, anchored at the autonomous end by the Deep Space One Remote Agent Experiment that integrated onboard planning, a reactive executive, and model-based fault diagnosis in flight [\[16\]](#ref-16), [\[17\]](#ref-17), and surveyed in its present and prospective state by Gao and colleagues [\[19\]](#ref-19) and by the broader artificial-intelligence-in-space literature [\[20\]](#ref-20).

What links these two literatures to the bridging claim is that they answer adjacent but distinct questions and that the dissertation's question sits precisely in the unoccupied space between them. Reliability statistics models the unconditional time to hardware failure and does not include fault-management autonomy as a covariate; fault-management engineering argues for autonomy from case narratives and assurance arguments rather than from a hazard model fit to a population of fault episodes. The bridge rests on methodological continuity: this dissertation does not invent a new statistical apparatus for spacecraft. It imports the validated survival-modeling machinery the reliability tradition established, redirects it from the unconditional hardware-failure question to the conditional post-fault-survival question, and adds the autonomy covariate the prior work omitted. The multi-state framing that distinguished degraded from failed states [\[6\]](#ref-6) is the conceptual ancestor of the competing-risks specification used here, in which recovery and loss are competing terminal events out of the fault state. The bridge is a redirection and an extension, not a refutation of either parent literature; both remain correct within their own scope, and the dissertation depends on the reliability tradition's demonstration that population-level spacecraft survival modeling is feasible at all. The objection that the bridge is merely rhetorical is answered by the concrete inheritance: the stratification by mission class, the inclusion of spacecraft age to capture the infant-mortality-and-wear-out mixture, and the clustered robust variance for recurrent episodes are all directly traceable to findings in the reliability literature, not invented for the occasion.

## 8.3 How the anchors sharpened the test

The two methodological anchors are not decorative framing but load-bearing constraints that determined both the estimator family and its interpretation, and without them the design would be weaker in specific, nameable ways. The Fogelian anchor [\[13\]](#ref-13) supplied three requirements that shaped the design directly. First, it forced the proposition to be quantitative: not "autonomy helps" but "autonomy changes the post-anomaly hazard by \(\exp(\beta_1)\), with this confidence interval." Second, it forced the counterfactual into the design as conditioning rather than as narrative: the within-stratum comparison of comparable fault episodes that differ in autonomy level is the operationalized analogue of Fogel's explicit no-railroad world. Third, and most consequentially, it disciplined the handling of residual confounding. This third point rests on the signed-bias argument developed in the research design: the most plausible unobserved confounder, overall program quality, is positively associated with both autonomy investment and survival, so an unconditioned estimate would overstate autonomy's protective effect, and conditioning on complexity and cost class absorbs part of program quality. It follows that if, after conditioning, the autonomy hazard ratio remains below one, the residual program-quality bias works in the same direction as the estimated effect, which makes the conditional estimate an upper bound on autonomy's benefit rather than an unbounded assertion. This is Fogel's own practice of bounding rather than asserting a counterfactual magnitude. Signing the bias does not eliminate it; it bounds the claim, and the bound holds only for the direction reasoned through and only for the confounders named.

The Talebian anchor [\[23\]](#ref-23) supplied the discipline for the dependent variable, and its influence is equally concrete. Mission-ending loss is a rare, heavy-tailed event, and Taleb's tail-risk program supplies the principle that the historical record undersamples the tail and that sample means understate true exposure for such events. The first operational consequence, which the design adopts, is the preference for a hazard formulation that handles censoring and small event counts over any approach that relies on the stability of a mean; this is why the dissertation uses a survival model rather than a logistic regression on episode outcome, and why Firth-type penalized partial likelihood [\[108\]](#ref-108) is the primary estimator when the event count is low. The second consequence, also adopted, is precaution over point optimization: the pre-specified tail subgroup analysis, restricted to the hardest episodes at the greatest distance and shortest reaction time, tests whether autonomy's benefit concentrates in exactly the conditions where the ground loop is slowest, even if the pooled estimate is modest. The basis for treating loss as a tail phenomenon comes from the demonstrated unreliability of mean-based inference in fat-tailed processes documented by Cirillo and Taleb in the contagion setting [\[49\]](#ref-49), a domain chosen for its statistical kinship to rare catastrophic events rather than for any substantive analogy to spacecraft. The third consequence is interpretive: the non-naive precautionary principle [\[23\]](#ref-23), and the broader caution in the precautionary-principle literature against treating the principle as either paralyzing or as license [\[53\]](#ref-53), [\[55\]](#ref-55), warn against treating any single point estimate, including the one this dissertation will eventually produce, as license to optimize fault-management economics against the most likely case while ignoring the catastrophic case. The Talebian reading constrains interpretation, not estimation: the hazard ratio is still a point estimate with an interval, but the discussion of what that estimate licenses is precaution-bounded. One objection worth pre-empting is that the tail framing is overstated for an Earth-orbiting context; the reminder that the consequences of loss are not always localized to the lost vehicle, given the feedback-driven dynamics of the orbital-debris environment [\[24\]](#ref-24), answers it for the subset of episodes where a lost spacecraft becomes an environmental hazard.

## 8.4 What stands even if H1 is not confirmed

The dissertation's value is robust to the failure of its alternative hypothesis, a point worth making explicitly. This is the symmetry argument of 8.1 developed in full. The argument turns on the fact that the contribution is the instrument and the decision rule, not a confirmed effect, and that a credible failure to find an effect is itself a finding the field lacks. The reason this matters is that program managers currently invest in autonomous fault management on the strength of an engineering intuition, that long one-way light times make a ground loop slow [\[19\]](#ref-19), which is an assertion about expected benefit that has never been tested against the survival record of past missions. A rigorous null, conditional on a defended control set and stable across robustness specifications, would replace that intuition with evidence that autonomy maturity does not by itself change post-fault survival, redirecting the engineering case for autonomy toward the grounds where it is genuinely strongest, namely the EDL and proximity-operations phases where no ground loop exists at all.

The most likely nuanced outcome, and the one the design is built to detect, is a pooled null combined with a tail effect in the hardest-episode subgroup. This shape is anticipated on the Talebian expectation that autonomy's value concentrates in the worst episodes, those with the least time and the least ground insight, so that an estimate averaging over all episodes can understate autonomy's tail benefit even when it is real. A finding of that form would be a contribution in its own right: it would tell programs that autonomy does not buy survival on the average safe-mode entry but does buy it in the rare, light-time-dominated, fast-onset episode, which is a more precise and more actionable conclusion than either a blanket endorsement or a blanket null. This anticipated shape is a design-stage expectation about where signal would plausibly sit, not a prediction of the result; the pre-registration commits the analysis to report the pooled and subgroup estimates whatever they show. The objection that a subgroup analysis on a thin event count invites overfitting is acknowledged and bounded by pre-specifying the single subgroup in advance, by reporting it with its wide interval rather than as a point claim, and by treating it as hypothesis-generating for future work where the tail dominates. The risk that remains, that the hardest-episode subgroup is simply too small to support any inference, is accepted and disclosed rather than concealed, which is the honest design-stage posture the whole dissertation maintains.

## 8.5 Limitations

The design's limitations are material, named, and bounded, not fatal. Four limitations carry across from the data and the design and must be restated plainly at the close. First, reporting is heterogeneous: well-documented flagship and competed deep-space and Earth-science missions are over-represented relative to small or classified missions, which biases coverage toward complex, high-investment spacecraft and limits external validity to that class. The estimate generalizes most safely to complex, well-documented NASA and JPL robotic spacecraft; extension to small satellites and commercial constellations is a hypothesis for future work, not a claim of this dissertation. Second, the autonomy score is a coarse ordinal ordering rather than a continuous measurement, and it compresses real architectural variety into a small number of levels; the hazard ratio is therefore read per level and not per unit of any continuous autonomy quantity that does not exist, and the measurement error inherent in the compression risks attenuating the coefficient toward the null. Third, fault episodes that were silently handled and never escalated may be under-recorded, truncating the low-severity end of the distribution and biasing the episode population toward more serious events. Fourth, mission-ending losses are rare, so the event count is small relative to the censored episodes, which limits statistical power, widens confidence intervals, and stresses the asymptotic partial-likelihood approximation; this is precisely the heavy-tailed, undersampled-tail condition the Talebian frame warns about.

These limitations are bounded rather than disqualifying because each has a specific design response, and the responses are honest about what they can and cannot achieve. The reverse-coding threat, that a mission-ending loss leads documentation to retrospectively describe the fault management as inadequate and so contaminates the autonomy score with the outcome, is mitigated by scoring autonomy from pre-flight TechPort and design documentation rather than from post-loss narratives; the mitigation reduces but does not eliminate the threat, because some pre-flight documentation is itself revised after the fact. The measurement-error and construct-validity threats are limited by the independent second-reader re-coding and the TRL anchor, which make the ordering reproducible rather than a single analyst's judgment, but cannot recover the architectural detail the ordinal scale deliberately discards. The rare-event threat is addressed by keeping the covariate set deliberately small and theoretically motivated, by using Firth-penalized partial likelihood as the primary estimator when events are scarce [\[108\]](#ref-108), and by estimating a reduced autonomy-plus-distance model so the reader can see whether the conclusion depends on fitting all four covariates against a thin event count; the rule of thumb of roughly ten events per covariate sets a floor below which the base model is over-parameterized and below which the dissertation will report the limitation rather than over-interpret a wide interval. The caveat that governs all four is that the design reduces these threats to a level where the estimate is interpretable with stated uncertainty, not to zero; the residual is disclosed and treated as acceptable rather than as resolved. The deepest limitation, unobserved confounding by an attribute correlated with both autonomy and survival that is not in the control set, such as test rigor or operations-team experience, cannot be removed by conditioning and is bounded only by the signed-bias reasoning of 8.3, which establishes a direction for the most plausible confounder but not for every possible one.

## 8.6 From design to execution: the path to the full estimate

The path from this design to an executed estimate on the full dataset is concrete, sequenced, and reproducible, not aspirational, resting on the six-step estimation procedure pre-specified in the analysis plan and the appendices that operationalize it. The remaining build work falls into four stages, stated here as the program a successor execution would follow.

The first stage is episode assembly. This requires coding fault entries, end states, and timing from the NASA Technical Reports Server citation-search API, Government Accountability Office major-project assessments, and JPL mission anomaly and incident-surprise-anomaly records, following the fault-episode coding protocol in Appendix A. The worked mission post-mortems already in the corpus, including the Dawn mission's documented anomaly and recovery history [\[37\]](#ref-37), serve as calibration cases for the coding rubric before it is applied at scale. It is the first and rate-limiting stage because every downstream quantity depends on the episode inventory, and the inventory is the most labor-intensive and judgment-laden artifact in the program.

The second stage is autonomy scoring. This applies the three-pass rubric of Appendix B: a TechPort technology-readiness anchor for the flown fault-management or systems-health-management technology, a placement on the ordered detection-isolation-recovery scale read from NTRS and design documentation, and an independent second-reader re-coding with rubric adjudication and a reported inter-coder reliability statistic. The second reader is required by construct validity: the autonomy variable is the treatment, and its measurement quality determines whether the study can answer its question at all, so the reproducibility of the ordering is not optional. The TechPort anchoring sub-step is the one the expansion plan flagged as warranting a focused source sweep before drafting, and a successor execution should harden the TRL provenance for each flown implementation rather than inferring it.

The third stage is control construction and estimation. This builds the complexity index from subsystem count, instrument count, and program cost class per Appendix C, codes the distance regime as a time-dependent covariate, computes spacecraft age at fault entry, and then fits the base Cox model by partial likelihood with spacecraft-clustered robust variance, tests the proportional-hazards assumption with scaled Schoenfeld residuals, respecifies by stratification or time interaction where the assumption fails, and fits the competing-risks [\[29\]](#ref-29), frailty [\[30\]](#ref-30), [\[108\]](#ref-108), mission-class-stratified, Firth-penalized, and reduced robustness variants. This stage is governed by the pre-registration in Appendix D, which fixes the baseline specification, the five robustness specifications, and the decision rule before any coefficient is seen, so that the inference on H0 versus H1 is protected from specification search.

The fourth stage is power realization and inference. A formal power analysis computes the minimum detectable hazard ratio given the realized event count and determines whether the pooled model, the stratified models, or only the pooled model are adequately powered; where a stratum is under-powered, the limitation is reported rather than over-interpreted. The whole path is constrained in one respect: its feasibility is governed by events, not episodes, because the partial likelihood is built from the risk sets at event times, and the realized count of mission-ending losses is the binding constraint that the assembly stage will reveal and the power stage will quantify. The reproducibility commitment that closes the program is the retained coding log: every episode coding decision, every autonomy-score adjudication, and every specification choice is recorded so that the constructed dataset and the fitted estimate can be independently reconstructed and challenged, which is the operational form of the Fogelian insistence that the data, not the analyst, decide [\[13\]](#ref-13).

## 8.7 How the argument closes

The argument rests, finally, on a chain of commitments the preceding chapters have established in turn. The phenomenon at its center is genuine: safe-mode entry is routine on long-duration missions and a fraction of those entries precede permanent loss, yet the autonomy-survival link has been asserted from flight demonstrations [\[16\]](#ref-16), [\[17\]](#ref-17) rather than measured. The stakes are not academic, because autonomy investment and deep-space architecture trades turn on this very assumption, and long light time renders the ground loop slow exactly when faults are hardest [\[19\]](#ref-19). The design reaches the underlying mechanism rather than circling it: the named causal chain, higher autonomy leading to onboard detection-isolation-recovery without a ground command cycle, leading to faster light-time-independent resolution before an episode becomes terminal, leading to a hazard ratio below one, is precisely what the conditional Cox model on autonomy estimates [\[25\]](#ref-25), with conditioning supplying the Fogelian counterfactual contrast [\[13\]](#ref-13). It also earns its place against the obvious alternatives, because the Cox model uses the dwell time a logistic regression on outcome would discard, handles censoring and recurrent clustered episodes, and tolerates a small event count better than a mean-based approach, and because instrumental-variable identification was considered and set aside for want of a credible exclusion restriction. What residual risk remains is contained rather than concealed: rare events, measurement error in the autonomy score, and unobserved confounding are bounded by Firth penalization [\[108\]](#ref-108), second-reader coding, pre-flight scoring, signed-bias reasoning, and honest design-stage framing, and whatever survives those responses is disclosed plainly.

What this dissertation finally offers is not a confirmed effect but a converted question. The assertion that autonomy buys survivability, long held as engineering intuition across the NASA and JPL Autonomous Systems and Robotics portfolio, becomes a falsifiable proposition with a pre-registered decision rule and a reproducible measurement protocol. Executed on the assembled population, the design returns a single hazard ratio with its uncertainty, or a credible and equally informative failure to find one, that a program manager can carry into an architecture trade in place of an intuition. The discipline that makes the question answerable is borrowed and acknowledged: Fogel's requirement that the claim be quantitative, counterfactual, and falsifiable, and Taleb's requirement that mission-ending loss be treated as the heavy-tailed event it is, read with precaution rather than optimized against the most likely case. The contribution is narrow by design and complete at the design stage, and its completeness is what licenses the closing claim that, whichever way the coefficient eventually falls, the field will know something it did not know before about whether, and where, a spacecraft's own fault-management capability changes its odds of surviving the trouble it was built to survive. That is the service this work seeks to render: to replace a confident intuition with a measured one, so that the stewardship of each distant vehicle, and of the public trust invested in it, rests on evidence rather than on hope.

\newpage

# Scope, Assumptions, and Limitations

This closing section gathers, in one place, the assumptions on which the study's inference rests, the bounds within which its conclusions hold, and the limitations that survive the design responses, so that a reader can weigh the contribution against what it does and does not claim.

The study rests on five assumptions, each made explicit rather than buried. First is the conditional independence of autonomy assignment and potential post-fault survival given complexity, distance, and spacecraft age, the identifying assumption that is observational and untestable, partially relaxed by the shared-frailty specification and bounded by signed-bias reasoning (Chapter 5, Section 5.2). Second is that mission-ending loss is a rare, heavy-tailed event for which sample means are unreliable, held at moderate-to-high confidence on cross-domain evidence and the small expected event count, and itself open to examination once the population is assembled (Chapter 2, Section 2.4). Third is that the ordinal autonomy score is a defensible reading of the engineering record, scored from pre-flight documentation so that it cannot be an echo of the survival outcome, with reproducibility evidenced by inter-coder reliability (Chapter 4, Section 4.3; Appendix B). Fourth is that the named documentary sources (NTRS, GAO, JPL ISA, TechPort) supply codable fault-entry, end-state, timing, autonomy, and control values for the intended population at the targeted scale (Chapter 4, Sections 4.1, 4.6). Fifth is that the proportional-hazards assumption holds for the autonomy covariate, or is repairable by stratification or a time interaction where it fails, tested rather than assumed via scaled Schoenfeld residuals (Chapter 5, Section 5.3; Chapter 6, Section 6.2).

The conclusions hold within definite bounds. The study is observational, not experimental; it claims a conditional association under a defended control set, not a randomized causal effect. It concerns robotic NASA and JPL spacecraft documented in the public and releasable record; crewed vehicles, commercial constellations, small-satellite swarms, and non-NASA programs are outside the sampled population, and extension to them is a hypothesis for future work. The estimate generalizes most safely to the complex, well-documented flagship class that dominates the sample. The whole work is presented at the design stage: it specifies and pre-registers a test and reports no fitted result from the assembled population.

Three limitations survive the design responses and are accepted with disclosure. First, unobserved confounding by an attribute correlated with both autonomy and survival but absent from the control set (test rigor, operations-team experience) cannot be removed by conditioning; it is bounded by signed-bias reasoning, which establishes that the most plausible confounder, program quality, biases a surviving protective estimate toward overstatement rather than invention, making the conditional estimate an upper bound, and it is partially modeled by the shared-frailty specification and partly quantified by the pre-specified sensitivity analysis. Second, the rare-event condition limits statistical power, widens intervals, and stresses the asymptotic partial-likelihood approximation; it is met by Firth penalization, a deliberately small covariate set, a reduced autonomy-plus-distance model, and the commitment to report the minimum detectable hazard ratio with any null rather than over-interpret a wide interval. Third, the under-recording of silently handled episodes truncates the low-severity end of the duration distribution with a sign on the autonomy estimate that is uncertain; the honest position is that the direction is not known a priori, and confidence is downgraded accordingly rather than a convenient sign asserted. Each limitation is named, bounded where bounding is possible, and disclosed where it is not, which is the most an observational, design-stage study can honestly offer.


\newpage

# References

This back matter exists so that a reader who accepts none of the dissertation's claims on trust can nonetheless reconstruct every one of them. The body of the dissertation argues a single falsifiable proposition: that higher onboard fault-management autonomy lowers the hazard of mission-ending loss conditional on a spacecraft having entered a fault state, formalized as a negative coefficient \(\beta_1\) and a hazard ratio \(\exp(\beta_1) < 1\) in the Cox model

\[ h_i(t) = h_0(t)\,\exp\!\left(\beta_1\,\text{autonomy}_i + \beta_2\,\text{complexity}_i + \beta_3\,\text{distance}_i + \beta_4\,\text{age}_i\right). \qquad\qquad (1) \]

A proposition is only falsifiable in Robert Fogel's sense [\[13\]](#ref-13) if the apparatus that would test it is fully exposed, and it is only reproducible in the sense the design-stage posture demands if every source, variable, derivation, and decision rule is written down before the data are touched. The reference list below compiles, in a single consistent numbered style with clickable digital object identifiers or resolvable links, every work the dissertation relies on; the numbering [\[1\]](#ref-1) through [\[30\]](#ref-30) is carried unchanged from the prospectus reference list so that cross-references in the chapters resolve identically, and [\[31\]](#ref-31) onward are the expansion corpus. The five appendices then supply the reproducibility substrate the chapters reference but do not contain in full: the fault-episode coding protocol (Appendix A), the three-pass autonomy-score rubric and its inter-coder reliability schema (Appendix B), the complexity-index construction and distance-regime time-dependent-covariate coding (Appendix C), the pre-registration of the baseline and robustness specifications with the fixed decision rule and the planned power analysis (Appendix D), and the extended literature table and the consolidated variable and data dictionary, derivations, and instrument and query details (Appendix E). Grey-literature and conference-poster items are flagged inline so the reader can weight them appropriately; no internal or working-note material is cited, consistent with the governing prohibition on non-public sources.

<span id="ref-1"></span>[1] J. R. Fox et al., "Fault tolerant design and autonomous spacecraft," *3rd Computers in Aerospace Conference*, 1981. doi: [10.2514/6.1981-2170](https://doi.org/10.2514/6.1981-2170)

<span id="ref-2"></span>[2] R. D. Rasmussen et al., "System fault protection design for the Cassini spacecraft," *IEEE Aerospace Applications Conference*, 1996. doi: [10.1109/aero.1996.495890](https://doi.org/10.1109/aero.1996.495890)

<span id="ref-3"></span>[3] M. Luckcuck, M. Farrell, L. A. Dennis, C. Dixon, and M. Fisher, "Formal Specification and Verification of Autonomous Robotic Systems: A Survey," *ACM Computing Surveys*, 2019. doi: [10.1145/3342355](https://doi.org/10.1145/3342355)

<span id="ref-4"></span>[4] "SPIDER: A simple emergent system architecture for autonomous spacecraft fault protection," *AIAA Space 2001 Conference and Exposition*, 2001. doi: [10.2514/6.2001-4685](https://doi.org/10.2514/6.2001-4685)

<span id="ref-5"></span>[5] J.-F. Castet and J. H. Saleh, "Satellite and satellite subsystems reliability: Statistical data analysis and modeling," *Reliability Engineering and System Safety*, 2009. doi: [10.1016/j.ress.2009.05.004](https://doi.org/10.1016/j.ress.2009.05.004)

<span id="ref-6"></span>[6] J.-F. Castet and J. H. Saleh, "Beyond reliability, multi-state failure analysis of satellite subsystems: A statistical approach," *Reliability Engineering and System Safety*, 2010. doi: [10.1016/j.ress.2009.11.001](https://doi.org/10.1016/j.ress.2009.11.001)

<span id="ref-7"></span>[7] J.-F. Castet and J. H. Saleh, "Single versus mixture Weibull distributions for nonparametric satellite reliability," *Reliability Engineering and System Safety*, 2010. doi: [10.1016/j.ress.2009.10.001](https://doi.org/10.1016/j.ress.2009.10.001)

<span id="ref-8"></span>[8] "Assurance of model-based fault diagnosis," *2018 IEEE Aerospace Conference*, 2018. doi: [10.1109/aero.2018.8396550](https://doi.org/10.1109/aero.2018.8396550)

<span id="ref-9"></span>[9] J.-F. Castet and J. H. Saleh, "Statistical reliability analysis of satellites by mass category: Does spacecraft size matter?," *Acta Astronautica*, 2011. doi: [10.1016/j.actaastro.2010.04.017](https://doi.org/10.1016/j.actaastro.2010.04.017)

<span id="ref-10"></span>[10] G. F. Dubos, J.-F. Castet, and J. H. Saleh, "Statistical analysis and modelling of small satellite reliability," *Acta Astronautica*, 2014. doi: [10.1016/j.actaastro.2014.01.018](https://doi.org/10.1016/j.actaastro.2014.01.018)

<span id="ref-11"></span>[11] J. H. Saleh et al., "Spacecraft attitude control subsystem: Reliability, multi-state analyses, and comparative failure behavior," *Acta Astronautica*, 2013. doi: [10.1016/j.actaastro.2012.12.003](https://doi.org/10.1016/j.actaastro.2012.12.003)

<span id="ref-12"></span>[12] B. Pell, D. E. Bernard, S. A. Chien, E. Gat, N. Muscettola et al., "A hybrid procedural/deductive executive for autonomous spacecraft," *Second International Conference on Autonomous Agents*, 1998. doi: [10.1145/280765.280863](https://doi.org/10.1145/280765.280863)

<span id="ref-13"></span>[13] R. W. Fogel, *Railroads and American Economic Growth: Essays in Econometric History*. Baltimore: Johns Hopkins Press, 1964. **[no DOI; pre-DOI monograph]** url: [https://openlibrary.org/works/OL3168181W](https://openlibrary.org/works/OL3168181W)

<span id="ref-14"></span>[14] M. Bozzano et al., "Spacecraft early design validation using formal methods," *Reliability Engineering and System Safety*, 2014. doi: [10.1016/j.ress.2014.07.003](https://doi.org/10.1016/j.ress.2014.07.003)

<span id="ref-15"></span>[15] "A Robust Fault Protection Strategy for a COTS-Based Spacecraft," *2007 IEEE Aerospace Conference*, 2007. doi: [10.1109/aero.2007.352647](https://doi.org/10.1109/aero.2007.352647)

<span id="ref-16"></span>[16] D. E. Bernard, G. A. Dorais et al., "Spacecraft autonomy flight experience: The DS1 Remote Agent Experiment," *Space Technology Conference and Exposition*, 1999. doi: [10.2514/6.1999-4512](https://doi.org/10.2514/6.1999-4512)

<span id="ref-17"></span>[17] N. Muscettola, P. P. Nayak, B. Pell, and B. C. Williams, "On-board planning for New Millennium Deep Space One autonomy," *1997 IEEE Aerospace Conference*, 1997. doi: [10.1109/aero.1997.574421](https://doi.org/10.1109/aero.1997.574421)

<span id="ref-18"></span>[18] NASA, "On-board fault management for autonomous spacecraft," NASA Technical Reports Server, 1993. **[NTRS technical report]** url: [https://ntrs.nasa.gov/citations/19930013066](https://ntrs.nasa.gov/citations/19930013066)

<span id="ref-19"></span>[19] A. Gao et al., "Autonomy for Space Robots: Past, Present, and Future," *Current Robotics Reports*, 2021. doi: [10.1007/s43154-021-00057-2](https://doi.org/10.1007/s43154-021-00057-2)

<span id="ref-20"></span>[20] "Applications and Challenges of Artificial Intelligence in Space Missions," *IEEE Access*, 2021. doi: [10.1109/access.2021.3132500](https://doi.org/10.1109/access.2021.3132500)

<span id="ref-21"></span>[21] "Improving Spacecraft Health Monitoring with Automatic Anomaly Detection Techniques," *AIAA SPACE 2016*, 2016. doi: [10.2514/6.2016-2430](https://doi.org/10.2514/6.2016-2430)

<span id="ref-22"></span>[22] L. Erhan et al., "Smart anomaly detection in sensor systems: A multi-perspective review," *Information Fusion*, 2021. doi: [10.1016/j.inffus.2020.10.001](https://doi.org/10.1016/j.inffus.2020.10.001)

<span id="ref-23"></span>[23] N. N. Taleb, R. Read, R. Douady, J. Norman, and Y. Bar-Yam, "The Precautionary Principle (with Application to the Genetic Modification of Organisms)," arXiv, 2014. doi: [10.48550/arxiv.1410.5787](https://doi.org/10.48550/arxiv.1410.5787)

<span id="ref-24"></span>[24] H. G. Lewis, "Understanding long-term orbital debris population dynamics," *Journal of Space Safety Engineering*, 2020. doi: [10.1016/j.jsse.2020.06.006](https://doi.org/10.1016/j.jsse.2020.06.006)

<span id="ref-25"></span>[25] D. R. Cox, "Regression Models and Life-Tables," *Journal of the Royal Statistical Society: Series B*, 1972. doi: [10.1111/j.2517-6161.1972.tb00899.x](https://doi.org/10.1111/j.2517-6161.1972.tb00899.x)

<span id="ref-26"></span>[26] P. K. Andersen and R. D. Gill, "Cox's Regression Model for Counting Processes: A Large Sample Study," *Annals of Statistics*, 1982. doi: [10.1214/aos/1176345976](https://doi.org/10.1214/aos/1176345976)

<span id="ref-27"></span>[27] T. M. Therneau and P. M. Grambsch, *Modeling Survival Data: Extending the Cox Model*. New York: Springer, 2000. doi: [10.1007/978-1-4757-3294-8](https://doi.org/10.1007/978-1-4757-3294-8)

<span id="ref-28"></span>[28] L. D. Fisher and D. Y. Lin, "Time-Dependent Covariates in the Cox Proportional-Hazards Regression Model," *Annual Review of Public Health*, 1999. doi: [10.1146/annurev.publhealth.20.1.145](https://doi.org/10.1146/annurev.publhealth.20.1.145)

<span id="ref-29"></span>[29] B. Lau, S. R. Cole, and S. J. Gange, "Competing Risk Regression Models for Epidemiologic Data," *American Journal of Epidemiology*, 2009. doi: [10.1093/aje/kwp107](https://doi.org/10.1093/aje/kwp107)

<span id="ref-30"></span>[30] L. Duchateau and P. Janssen, *The Frailty Model*. New York: Springer, 2008. doi: [10.1007/978-0-387-72835-3](https://doi.org/10.1007/978-0-387-72835-3)

<span id="ref-31"></span>[31] R. Stottler, S. Ramachandran, C. Belardi, and R. Mandayam, "On-board, Autonomous, Hybrid Spacecraft Subsystem Fault and Anomaly Detection, Diagnosis, and Recovery," *AMOS Conference*, 2020. **[grey literature: AMOS conference paper, no DOI]** url: [https://amostech.com/TechnicalPapers/2020/Machine-Learning-Applications-of-SSA/Stottler.pdf](https://amostech.com/TechnicalPapers/2020/Machine-Learning-Applications-of-SSA/Stottler.pdf)

<span id="ref-32"></span>[32] R. Stottler, S. Ramachandran, C. Healy, and A. Singhal, "Autonomous, Hybrid Space System Fault and Anomaly Detection, Diagnosis, Root Cause Determination, and Recovery," *AMOS Conference*, 2023. **[grey literature: AMOS conference paper]** doi: [10.64861/XHRO4751](https://doi.org/10.64861/XHRO4751)

<span id="ref-33"></span>[33] R. Stottler, A. Singhal, C. Healy, S. Ramachandran, K. Quinn, J. Palmieri, and S. Logan, "Autonomous, Hybrid Space System Fault and Anomaly Detection, Diagnosis, Root Cause Determination, and Recovery," *AMOS Conference*, 2024. **[grey literature: AMOS conference paper]** doi: [10.64861/FLIA6056](https://doi.org/10.64861/FLIA6056)

<span id="ref-34"></span>[34] S. Shivshankar and D. Ghose, "Time-to-Event Data (Survival Analysis) based Modelling of Maneuver Occurrence of Non-Cooperative Satellites," *AMOS Conference*, 2023. **[grey literature: AMOS conference paper]** doi: [10.64861/LPFK9568](https://doi.org/10.64861/LPFK9568)

<span id="ref-35"></span>[35] M. R. Jabbarpour, Q. B. Vo, G. El-Dalahmeh, H. Tahir, R. Kowalczyk, T. Bessell, and J. Barr, "Agent-based approaches for distributed space systems and mission management: Methodologies, current practices and challenges," *Acta Astronautica*, 2025. doi: [10.1016/j.actaastro.2025.10.018](https://doi.org/10.1016/j.actaastro.2025.10.018)

<span id="ref-36"></span>[36] A. Wander, K. Konstantinidis, R. Förstner, and P. Voigt, "Autonomy and operational concept for self-removal of spacecraft: Status detection, removal triggering and passivation," *Acta Astronautica*, 2019. doi: [10.1016/j.actaastro.2019.07.014](https://doi.org/10.1016/j.actaastro.2019.07.014)

<span id="ref-37"></span>[37] M. D. Rayman, "Lessons from the Dawn mission to Ceres and Vesta," *Acta Astronautica*, 2020. doi: [10.1016/j.actaastro.2020.06.023](https://doi.org/10.1016/j.actaastro.2020.06.023)

<span id="ref-38"></span>[38] C. Teale, J. Beeley, G. Baillet, and C. R. McInnes, "Femtosatellite mission architectures and mission assurance strategies," *Acta Astronautica*, 2024. doi: [10.1016/j.actaastro.2024.10.019](https://doi.org/10.1016/j.actaastro.2024.10.019)

<span id="ref-39"></span>[39] T. Leunig, "Social Savings," *Journal of Economic Surveys*, 2010. doi: [10.1111/j.1467-6419.2010.00636.x](https://doi.org/10.1111/j.1467-6419.2010.00636.x)

<span id="ref-40"></span>[40] N. N. Taleb, "Antifragile: Things That Gain from Disorder (review)," *Quantitative Finance*, 2013. doi: [10.1080/14697688.2013.829244](https://doi.org/10.1080/14697688.2013.829244)

<span id="ref-41"></span>[41] C. Diebolt, "Cliometrica after 10 years: definition and principles of cliometric research," *Cliometrica*, 2015. doi: [10.1007/s11698-015-0136-z](https://doi.org/10.1007/s11698-015-0136-z)

<span id="ref-42"></span>[42] J. Lerner and P. Tufano, "The Consequences of Financial Innovation: A Counterfactual Research Agenda," National Bureau of Economic Research, 2011. doi: [10.3386/w16780](https://doi.org/10.3386/w16780)

<span id="ref-43"></span>[43] M. Haupert, "The Impact of Cliometrics on Economics and History," *Revue d'économie politique*, 2018. doi: [10.3917/redp.276.1059](https://doi.org/10.3917/redp.276.1059)

<span id="ref-44"></span>[44] R. Wenzlhuemer, "Counterfactual Thinking as a Scientific Method," *Historical Social Research*, 2009. doi: [10.12759/hsr.34.2009.2.27-56](https://doi.org/10.12759/hsr.34.2009.2.27-56) [backup: [http://www.ssoar.info/ssoar/handle/document/28669](http://www.ssoar.info/ssoar/handle/document/28669)]

<span id="ref-45"></span>[45] Á. M. Rojas, "Cliometrics: A Market Account of a Scientific Community (1957-2006)," *Lecturas de Economía*, 2009. doi: [10.17533/udea.le.n66a2600](https://doi.org/10.17533/udea.le.n66a2600)

<span id="ref-46"></span>[46] *Handbook of Cliometrics*, 2024. doi: [10.1007/978-3-031-35583-7](https://doi.org/10.1007/978-3-031-35583-7)

<span id="ref-47"></span>[47] J. Mejía, "The Evolution of Economic History since 1950: From Cliometrics to Cliodynamics," *Tiempo y economía*, 2015. doi: [10.21789/24222704.1061](https://doi.org/10.21789/24222704.1061)

<span id="ref-48"></span>[48] D. Acemoğlu, A. Ozdaglar, and A. Tahbaz-Salehi, "Microeconomic Origins of Macroeconomic Tail Risks," *American Economic Review*, 2016. doi: [10.1257/aer.20151086](https://doi.org/10.1257/aer.20151086)

<span id="ref-49"></span>[49] P. Cirillo and N. N. Taleb, "Tail risk of contagious diseases," *Nature Physics*, 2020. doi: [10.1038/s41567-020-0921-x](https://doi.org/10.1038/s41567-020-0921-x)

<span id="ref-50"></span>[50] R. Gençay and F. Selçuk, "Extreme value theory and Value-at-Risk: Relative performance in emerging markets," *International Journal of Forecasting*, 2004. doi: [10.1016/j.ijforecast.2003.09.005](https://doi.org/10.1016/j.ijforecast.2003.09.005)

<span id="ref-51"></span>[51] B. T. Kelly and H. Jiang, "Tail Risk and Asset Prices," *SSRN Electronic Journal*, 2013. doi: [10.2139/ssrn.2321243](https://doi.org/10.2139/ssrn.2321243)

<span id="ref-52"></span>[52] P. Cirillo and N. N. Taleb, "On the statistical properties and tail risk of violent conflicts," *Physica A: Statistical Mechanics and its Applications*, 2016. doi: [10.1016/j.physa.2016.01.050](https://doi.org/10.1016/j.physa.2016.01.050)

<span id="ref-53"></span>[53] C. R. Sunstein, "Beyond the Precautionary Principle," *University of Pennsylvania Law Review*, 2003. doi: [10.2307/3312884](https://doi.org/10.2307/3312884)

<span id="ref-54"></span>[54] C. R. Sunstein, "Beyond the Precautionary Principle," *SSRN Electronic Journal*, 2002. doi: [10.2139/ssrn.307098](https://doi.org/10.2139/ssrn.307098)

<span id="ref-55"></span>[55] T. P. Hanna, G. A. Evans, and C. M. Booth, "Cancer, COVID-19 and the precautionary principle: prioritizing treatment during a global pandemic," *Nature Reviews Clinical Oncology*, 2020. doi: [10.1038/s41571-020-0362-6](https://doi.org/10.1038/s41571-020-0362-6)

<span id="ref-56"></span>[56] P. B. Ishai, H. Z. Baldwin, L. S. Birnbaum, T. Butler, K. Chamberlin, and D. L. Davis, "Applying the Precautionary Principle to Wireless Technology: Policy Dilemmas and Systemic Risks," *Environment: Science and Policy for Sustainable Development*, 2024. doi: [10.1080/00139157.2024.2293631](https://doi.org/10.1080/00139157.2024.2293631)

<span id="ref-57"></span>[57] M. Haupert, "History of Cliometrics," in *Handbook of Cliometrics*, 2019. doi: [10.1007/978-3-030-00181-0_2](https://doi.org/10.1007/978-3-030-00181-0_2)

<span id="ref-58"></span>[58] M. J. Haupert, "History of Cliometrics," in *Handbook of Cliometrics*, 2014. doi: [10.1007/978-3-642-40458-0_2-1](https://doi.org/10.1007/978-3-642-40458-0_2-1)

<span id="ref-59"></span>[59] G. Cancro, R. Turner, C. Monaco, D. Wilson, L. Nguyen, and M. Pekala, "Emphasizing Understandability, Flexibility, and Verifiability in a Spacecraft Fault Management Autonomy System," *AIAA Infotech@Aerospace Conference*, 2009. doi: [10.2514/6.2009-2029](https://doi.org/10.2514/6.2009-2029)

<span id="ref-60"></span>[60] D. Codetta-Raiteri and L. Portinale, "Dynamic Bayesian Networks for Fault Detection, Identification, and Recovery in Autonomous Spacecraft," *IEEE Transactions on Systems, Man, and Cybernetics: Systems*, 2014. doi: [10.1109/tsmc.2014.2323212](https://doi.org/10.1109/tsmc.2014.2323212)

<span id="ref-61"></span>[61] K. Kolcio, L. Breger, and P. Zetocha, "Model-based fault management for spacecraft autonomy," *2014 IEEE Aerospace Conference*, 2014. doi: [10.1109/aero.2014.6836174](https://doi.org/10.1109/aero.2014.6836174)

<span id="ref-62"></span>[62] S. Ayache, E. Conquet, P. Humbert, C. Rodríguez, J. Sifakis, and R. N. Gerlich, "Formal methods for the validation of fault tolerance in autonomous spacecraft," *FTCS*, 2002. doi: [10.1109/ftcs.1996.534620](https://doi.org/10.1109/ftcs.1996.534620)

<span id="ref-63"></span>[63] A. Nasir and E. Atkins, "Fault Tolerance for Spacecraft Attitude Management," *AIAA Guidance, Navigation, and Control Conference*, 2010. doi: [10.2514/6.2010-8301](https://doi.org/10.2514/6.2010-8301)

<span id="ref-64"></span>[64] J. B. Lyons, K. Sycara, M. Lewis, and A. Capiola, "Human-Autonomy Teaming: Definitions, Debates, and Directions," *Frontiers in Psychology*, 2021. doi: [10.3389/fpsyg.2021.589585](https://doi.org/10.3389/fpsyg.2021.589585)

<span id="ref-65"></span>[65] E. C. Ong, "Fault protection in a component-based spacecraft architecture," M.S. thesis, Massachusetts Institute of Technology, 2003. **[institutional repository]** url: [http://hdl.handle.net/1721.1/82804](http://hdl.handle.net/1721.1/82804)

<span id="ref-66"></span>[66] T. K. Brown and J. A. Donaldson, "Fault protection architecture for the command and data subsystem on the Cassini spacecraft," *DASC*, 2002. doi: [10.1109/dasc.1995.482823](https://doi.org/10.1109/dasc.1995.482823)

<span id="ref-67"></span>[67] B. A. Welchko, T. A. Lipo, T. M. Jahns, and S. E. Schulz, "Fault Tolerant Three-Phase AC Motor Drive Topologies: A Comparison of Features, Cost, and Limitations," *IEEE Transactions on Power Electronics*, 2004. doi: [10.1109/tpel.2004.830074](https://doi.org/10.1109/tpel.2004.830074)

<span id="ref-68"></span>[68] R. W. Butler, "A Primer on Architectural Level Fault Tolerance," NASA STI Repository, 2013. **[NASA technical report]** url: [http://hdl.handle.net/2060/20080009026](http://hdl.handle.net/2060/20080009026)

<span id="ref-69"></span>[69] G. M. Brown and S. A. Johnson, "An overview of the fault protection design for the attitude control subsystem of the Cassini spacecraft," *American Control Conference*, 1998. doi: [10.1109/acc.1998.703535](https://doi.org/10.1109/acc.1998.703535)

<span id="ref-70"></span>[70] M. Nayak, "CloudSat Anomaly Recovery and Operational Lessons Learned," *SpaceOps 2012 Conference*, 2012. doi: [10.2514/6.2012-1295798](https://doi.org/10.2514/6.2012-1295798)

<span id="ref-71"></span>[71] P. L. Jensen, K. Clausen, C. Cassi, F. Ravera, G. Janin, and C. Winkler, "The INTEGRAL spacecraft: in-orbit performance," *Astronomy and Astrophysics*, 2003. doi: [10.1051/0004-6361:20031173](https://doi.org/10.1051/0004-6361:20031173)

<span id="ref-72"></span>[72] G. Biswas, H. Khorasgani, G. Stanje, A. Dubey, S. Deb, and S. Ghoshal, "An Approach To Mode and Anomaly Detection with Spacecraft Telemetry Data," *International Journal of Prognostics and Health Management*, 2020. doi: [10.36001/ijphm.2016.v7i4.2467](https://doi.org/10.36001/ijphm.2016.v7i4.2467)

<span id="ref-73"></span>[73] F. SalarKaleji and A. Dayyani, "A survey on Fault Detection, Isolation and Recovery (FDIR) module in satellite onboard software," *RAST*, 2013. doi: [10.1109/rast.2013.6581270](https://doi.org/10.1109/rast.2013.6581270)

<span id="ref-74"></span>[74] R. R. Basilio and D. Durham, "Galileo spacecraft anomaly and safing recovery," NASA Technical Reports Server, 1993. **[NASA technical report]** url: [http://hdl.handle.net/2060/19940019391](http://hdl.handle.net/2060/19940019391)

<span id="ref-75"></span>[75] C. L. Baker, C. D. Butler, P. L. Jester, and E. Grob, "Geoscience Laser Altimetry System (GLAS) Loop Heat Pipe Anomaly and On Orbit Testing," *41st International Conference on Environmental Systems*, 2011. doi: [10.2514/6.2011-5209](https://doi.org/10.2514/6.2011-5209)

<span id="ref-76"></span>[76] P. Yue, J. An, J. Zhang, J. Ye, G. Pan, and S. Wang, "Low Earth Orbit Satellite Security and Reliability: Issues, Solutions, and the Road Ahead," *IEEE Communications Surveys and Tutorials*, 2023. doi: [10.1109/comst.2023.3296160](https://doi.org/10.1109/comst.2023.3296160)

<span id="ref-77"></span>[77] C. J. Eyles, R. A. Harrison, C. J. Davis, N. R. Waltham, B. M. Shaughnessy, and H. Mapson-Menard, "The Heliospheric Imagers Onboard the STEREO Mission," *Solar Physics*, 2008. doi: [10.1007/s11207-008-9299-0](https://doi.org/10.1007/s11207-008-9299-0)

<span id="ref-78"></span>[78] B. Häusler, M. Pätzold, G. L. Tyler, R. A. Simpson, M. K. Bird, and V. Dehant, "Radio science investigations by VeRa onboard the Venus Express spacecraft," *Planetary and Space Science*, 2006. doi: [10.1016/j.pss.2006.04.032](https://doi.org/10.1016/j.pss.2006.04.032)

<span id="ref-79"></span>[79] A. Fejjari, A. Delavault, R. Camilleri, and G. Valentino, "A Review of Anomaly Detection in Spacecraft Telemetry Data," *Applied Sciences*, 2025. doi: [10.3390/app15105653](https://doi.org/10.3390/app15105653)

<span id="ref-80"></span>[80] K. L. Wagstaff, G. Doran, A. G. Davies, S. Anwar, S. Chakraborty, and M. E. Cameron, "Enabling Onboard Detection of Events of Scientific Interest for the Europa Clipper Spacecraft," *KDD*, 2019. doi: [10.1145/3292500.3330656](https://doi.org/10.1145/3292500.3330656)

<span id="ref-81"></span>[81] Y. Lu, Q. Shao, H. Yue, and F. Yang, "A Review of the Space Environment Effects on Spacecraft in Different Orbits," *IEEE Access*, 2019. doi: [10.1109/access.2019.2927811](https://doi.org/10.1109/access.2019.2927811)

<span id="ref-82"></span>[82] A. Milillo, M. Fujimoto, G. Murakami, J. Benkhoff, J. Zender, and S. Aizawa, "Investigating Mercury's Environment with the Two-Spacecraft BepiColombo Mission," *Space Science Reviews*, 2020. doi: [10.1007/s11214-020-00712-8](https://doi.org/10.1007/s11214-020-00712-8)

<span id="ref-83"></span>[83] T. Doke, M. Fujii, M. Fujimoto, K. Fujiki, T. Fukui, and F. Gliem, "The Energetic Particle Spectrometer HEP onboard the GEOTAIL Spacecraft," *Journal of Geomagnetism and Geoelectricity*, 1994. doi: [10.5636/jgg.46.713](https://doi.org/10.5636/jgg.46.713)

<span id="ref-84"></span>[84] D. E. Bernard, G. A. Dorais, C. Fry, E. B. Gamble, B. Kanefsky, and J. Kurien, "Design of the Remote Agent experiment for spacecraft autonomy," *1998 IEEE Aerospace Conference*, 2002. doi: [10.1109/aero.1998.687914](https://doi.org/10.1109/aero.1998.687914)

<span id="ref-85"></span>[85] B. Pell, D. E. Bernard, S. Chien, E. Gat, N. Muscettola, and P. P. Nayak, "An Autonomous Spacecraft Agent Prototype," *Autonomous Robots*, 1998. doi: [10.1023/a:1008860925034](https://doi.org/10.1023/a:1008860925034)

<span id="ref-86"></span>[86] B. Pell, D. E. Bernard, S. Chien, E. Gat, N. Muscettola, and P. P. Nayak, "Remote agent prototype for spacecraft autonomy," *Proceedings of SPIE*, 1996. doi: [10.1117/12.255150](https://doi.org/10.1117/12.255150)

<span id="ref-87"></span>[87] P. Nikolaev, D. Hooper, F. Webber, R. Rao, K. Decker, and M. Krein, "Autonomy in materials research: a case study in carbon nanotube growth," *npj Computational Materials*, 2016. doi: [10.1038/npjcompumats.2016.31](https://doi.org/10.1038/npjcompumats.2016.31)

<span id="ref-88"></span>[88] S. Nakasuka, S. Ogasawara, M. Takata, and T. Yamamoto, "Model Based Autonomy: How Model without Human Expertise Can Facilitate Fault Diagnosis and Other Spacecraft Tasks," *i-SAIRAS*, 2001. **[grey literature: workshop proceedings, no DOI]** url: [http://robotics.estec.esa.int/i-SAIRAS/isairas2001/papers/Paper_AS001.pdf](http://robotics.estec.esa.int/i-SAIRAS/isairas2001/papers/Paper_AS001.pdf)

<span id="ref-89"></span>[89] A. Zolghadri, "Advanced model-based FDIR techniques for aerospace systems: Today challenges and opportunities," *Progress in Aerospace Sciences*, 2012. doi: [10.1016/j.paerosci.2012.02.004](https://doi.org/10.1016/j.paerosci.2012.02.004)

<span id="ref-90"></span>[90] K. Kolcio and L. Fesq, "Model-based off-nominal state isolation and detection system for autonomous fault management," *2016 IEEE Aerospace Conference*, 2016. doi: [10.1109/aero.2016.7500793](https://doi.org/10.1109/aero.2016.7500793)

<span id="ref-91"></span>[91] G. Labrèche, D. J. Evans, D. Marszk, T. Mladenov, V. Shiradhonkar, and T. Soto, "OPS-SAT Spacecraft Autonomy with TensorFlow Lite, Unsupervised Learning, and Online Machine Learning," *2022 IEEE Aerospace Conference*, 2022. doi: [10.1109/aero53065.2022.9843402](https://doi.org/10.1109/aero53065.2022.9843402)

<span id="ref-92"></span>[92] C. Castel, J.-F. Gabard, C. Tessier, B. Laborde, and R. Soumagne, "FDIR Strategies For Autonomous Satellite Formations: A Preliminary Report," *AAAI Workshop on Auction and Market-Based Multi-Agent Systems*, Boston, MA, 2006. **[no DOI; workshop paper not indexed in DOI registry]** url: [https://cdn.aaai.org/Workshops/2006/WS-06-13/WS06-13-contents.pdf](https://cdn.aaai.org/Workshops/2006/WS-06-13/WS06-13-contents.pdf)

<span id="ref-93"></span>[93] E. D'Amato, V. Nardi, I. Notaro, and V. Scordamaglia, "A Particle Filtering Approach for Fault Detection and Isolation of UAV IMU Sensors: Design, Implementation and Sensitivity Analysis," *Sensors*, 2021. doi: [10.3390/s21093066](https://doi.org/10.3390/s21093066)

<span id="ref-94"></span>[94] S. Jalilian, F. SalarKaleji, and T. Kazimov, "Fault detection, isolation and recovery (FDIR) in satellite onboard software," *National Conference on Software Engineering*, 2017. doi: [10.25045/ncsofteng.2017.87](https://doi.org/10.25045/ncsofteng.2017.87)

<span id="ref-95"></span>[95] N. Christofi and X. Pucel, "A novel methodology to construct digital twin models for spacecraft operations using fault and behaviour trees," *MASCOTS*, 2022. doi: [10.1145/3550356.3561550](https://doi.org/10.1145/3550356.3561550)

<span id="ref-96"></span>[96] S. Voss, "Application of Deep Learning for Spacecraft Fault Detection and Isolation," M.S. thesis, Delft University of Technology, 2019. **[institutional repository]** url: [http://resolver.tudelft.nl/uuid:7c308a4b-f97b-4a83-b739-4019ad306853](http://resolver.tudelft.nl/uuid:7c308a4b-f97b-4a83-b739-4019ad306853)

<span id="ref-97"></span>[97] A. Lánczky and B. Győrffy, "Web-Based Survival Analysis Tool Tailored for Medical Research (KMplot): Development and Implementation," *Journal of Medical Internet Research*, 2021. doi: [10.2196/27633](https://doi.org/10.2196/27633)

<span id="ref-98"></span>[98] M. Schemper, "Cox Analysis of Survival Data with Non-Proportional Hazard Functions," *Journal of the Royal Statistical Society: Series D (The Statistician)*, 1992. doi: [10.2307/2349009](https://doi.org/10.2307/2349009)

<span id="ref-99"></span>[99] M. Carpenter, "Survival Analysis: A Self-Learning Text," *Technometrics*, 1997. doi: [10.1080/00401706.1997.10485091](https://doi.org/10.1080/00401706.1997.10485091)

<span id="ref-100"></span>[100] J. Katzman, U. Shaham, A. Cloninger, J. Bates, T. Jiang, and Y. Kluger, "DeepSurv: personalized treatment recommender system using a Cox proportional hazards deep neural network," *BMC Medical Research Methodology*, 2018. doi: [10.1186/s12874-018-0482-1](https://doi.org/10.1186/s12874-018-0482-1)

<span id="ref-101"></span>[101] J. P. Fine and M. H. Ray, "A Proportional Hazards Model for the Subdistribution of a Competing Risk," *Journal of the American Statistical Association*, 1999. doi: [10.1080/01621459.1999.10474144](https://doi.org/10.1080/01621459.1999.10474144)

<span id="ref-102"></span>[102] P. C. Austin, D. S. Lee, and J. P. Fine, "Introduction to the Analysis of Survival Data in the Presence of Competing Risks," *Circulation*, 2016. doi: [10.1161/circulationaha.115.017719](https://doi.org/10.1161/circulationaha.115.017719)

<span id="ref-103"></span>[103] D. W. Hosmer, S. Lemeshow, and S. May, *Applied Survival Analysis: Regression Modeling of Time to Event Data*, 1999. doi: [10.1002/9780470258019](https://doi.org/10.1002/9780470258019)

<span id="ref-104"></span>[104] M. Lunn and D. McNeil, "Applying Cox Regression to Competing Risks," *Biometrics*, 1995. doi: [10.2307/2532940](https://doi.org/10.2307/2532940)

<span id="ref-105"></span>[105] M. A. Cleves, W. Gould, R. G. Gutierrez, and Y. Marchenko, *An Introduction to Survival Analysis Using Stata*, 2003. **[textbook]** url: [https://econpapers.repec.org/bookchap/tsjspbook/saus3.htm](https://econpapers.repec.org/bookchap/tsjspbook/saus3.htm)

<span id="ref-106"></span>[106] A. Karagrigoriou, "Frailty Models in Survival Analysis," *Journal of Applied Statistics*, 2011. doi: [10.1080/02664763.2011.559371](https://doi.org/10.1080/02664763.2011.559371)

<span id="ref-107"></span>[107] S. D. Searle, A. Mitnitski, E. A. Gahbauer, T. M. Gill, and K. Rockwood, "A standard procedure for creating a frailty index," *BMC Geriatrics*, 2008. doi: [10.1186/1471-2318-8-24](https://doi.org/10.1186/1471-2318-8-24)

<span id="ref-108"></span>[108] T. M. Therneau, P. M. Grambsch, and V. S. Pankratz, "Penalized Survival Models and Frailty," *Journal of Computational and Graphical Statistics*, 2003. doi: [10.1198/1061860031365](https://doi.org/10.1198/1061860031365)

<span id="ref-109"></span>[109] X. Xue and R. Brookmeyer, "Bivariate frailty model for the analysis of multivariate survival time," *Lifetime Data Analysis*, 1996. doi: [10.1007/bf00128978](https://doi.org/10.1007/bf00128978)

<span id="ref-110"></span>[110] Z. Zhang, J. Reinikainen, K. Adeleke, M. E. Pieterse, and K. Groothuis-Oudshoorn, "Time-varying covariates and coefficients in Cox regression models," *Annals of Translational Medicine*, 2018. doi: [10.21037/atm.2018.02.12](https://doi.org/10.21037/atm.2018.02.12)

<span id="ref-111"></span>[111] O. O. Aalen, O. Borgan, and H. K. Gjessing, *Survival and Event History Analysis: A Process Point of View*, 2008. doi: [10.1007/978-0-387-68560-1](https://doi.org/10.1007/978-0-387-68560-1)

<span id="ref-112"></span>[112] P. J. Kelly and L. Lim, "Survival analysis for recurrent event data: an application to childhood infectious diseases," *Statistics in Medicine*, 2000. doi: [10.1002/(sici)1097-0258(20000115)19:1<13::aid-sim279>3.0.co;2-5](https://doi.org/10.1002/(sici)1097-0258(20000115)19:1<13::aid-sim279>3.0.co;2-5)

<span id="ref-113"></span>[113] M. Mills, *Introducing Survival and Event History Analysis*, 2011. doi: [10.4135/9781446268360](https://doi.org/10.4135/9781446268360)

<span id="ref-114"></span>[114] G. Shenyang, "The Cox Proportional Hazards Model," in *Survival Analysis*, 2009. doi: [10.1093/acprof:oso/9780195337518.003.0004](https://doi.org/10.1093/acprof:oso/9780195337518.003.0004)

<span id="ref-115"></span>[115] D. R. Cox and D. Oakes, "Proportional hazards model," in *Analysis of Survival Data*, 2018. doi: [10.1201/9781315137438-7](https://doi.org/10.1201/9781315137438-7)

<span id="ref-116"></span>[116] P. J. Smith, "Cox Proportional Hazards," in *Analysis of Failure and Survival Data*, 2017. doi: [10.1201/9781315273150-9](https://doi.org/10.1201/9781315273150-9)

<span id="ref-117"></span>[117] R. Li and L. Peng, "Survival Analysis with Competing Risks and Semi-competing Risks Data," in *Handbook of Quantile Regression*, 2017. doi: [10.1201/9781315120256-8](https://doi.org/10.1201/9781315120256-8)

<span id="ref-118"></span>[118] "Classical Regression Models for Competing Risks," in *Handbook of Survival Analysis*, 2016. doi: [10.1201/b16248-16](https://doi.org/10.1201/b16248-16)

<span id="ref-119"></span>[119] O. Kodheli, E. Lagunas, N. Maturo, S. K. Sharma, B. Shankar, and J. F. Mendoza Montoya, "Satellite Communications in the New Space Era: A Survey and Future Challenges," *IEEE Communications Surveys and Tutorials*, 2020. doi: [10.1109/comst.2020.3028247](https://doi.org/10.1109/comst.2020.3028247)

<span id="ref-120"></span>[120] W. Benz, C. Broeg, A. Fortier, N. Rando, T. Beck, and M. Beck, "The CHEOPS mission," *Experimental Astronomy*, 2020. doi: [10.1007/s10686-020-09679-4](https://doi.org/10.1007/s10686-020-09679-4)

<span id="ref-121"></span>[121] J. B. Singer, "Contested Autonomy," *Journalism Studies*, 2007. doi: [10.1080/14616700601056866](https://doi.org/10.1080/14616700601056866)

<span id="ref-122"></span>[122] A. Lavin, C. Lee, A. Visnjic, S. Ganju, D. Newman, and S. Ganguly, "Technology readiness levels for machine learning systems," *Nature Communications*, 2022. doi: [10.1038/s41467-022-33128-9](https://doi.org/10.1038/s41467-022-33128-9)

<span id="ref-123"></span>[123] M. Schwabacher, J. Samuels, L. Brownston, and D. Clancy, "The NASA Integrated Vehicle Health Management Technology Experiment for X-37," NASA Technical Reports Server, 2002. **[NASA technical report]** url: [https://ntrs.nasa.gov/api/citations/20020063487/downloads/20020063487.pdf](https://ntrs.nasa.gov/api/citations/20020063487/downloads/20020063487.pdf)

<span id="ref-124"></span>[124] A. Lavin, C. Lee, A. Visnjic, S. Ganju, D. Newman, and S. Ganguli, "Technology Readiness Levels for Machine Learning Systems," *Research Square* (preprint), 2021. **[preprint]** doi: [10.21203/rs.3.rs-133138/v1](https://doi.org/10.21203/rs.3.rs-133138/v1)

<span id="ref-125"></span>[125] N. J. Fox, M. Velli, S. D. Bale, R. B. Decker, A. Driesman, and R. A. Howard, "The Solar Probe Plus Mission: Humanity's First Visit to Our Star," *Space Science Reviews*, 2015. doi: [10.1007/s11214-015-0211-6](https://doi.org/10.1007/s11214-015-0211-6)

<span id="ref-126"></span>[126] J. Schumann, O. J. Mengshoel, and T. Mbaya, "Integrated Software and Sensor Health Management for Small Spacecraft," *SMC-IT*, 2011. doi: [10.1109/smc-it.2011.25](https://doi.org/10.1109/smc-it.2011.25)

<span id="ref-127"></span>[127] B. Dowdeswell, R. Sinha, and S. G. MacDonell, "Finding faults: A scoping study of fault diagnostics for Industrial Cyber-Physical Systems," *Journal of Systems and Software*, 2020. doi: [10.1016/j.jss.2020.110638](https://doi.org/10.1016/j.jss.2020.110638)

<span id="ref-128"></span>[128] A. R. Hendrix, T. A. Hurford, L. M. Barge, M. T. Bland, J. S. Bowman, and W. B. Brinckerhoff, "The NASA Roadmap to Ocean Worlds," *Astrobiology*, 2018. doi: [10.1089/ast.2018.1955](https://doi.org/10.1089/ast.2018.1955)

<span id="ref-129"></span>[129] L. J. Preston and L. Dartnell, "Planetary habitability: lessons learned from terrestrial analogues," *International Journal of Astrobiology*, 2014. doi: [10.1017/s1473550413000396](https://doi.org/10.1017/s1473550413000396)

<span id="ref-130"></span>[130] K. A. LaBel, "In-Flight Anomalies and Radiation Performance of NASA Missions: Selected Lessons Learned," NASA STI Repository, 2008. **[NASA technical report]** url: [http://hdl.handle.net/2060/20090004168](http://hdl.handle.net/2060/20090004168)

<span id="ref-131"></span>[131] L. Marshall, C. Bahm, G. Corpening, and R. Sherrill, "Overview With Results and Lessons Learned of the X-43A Mach 10 Flight," *AIAA/CIRA 13th International Space Planes and Hypersonics Systems and Technologies Conference*, 2005. doi: [10.2514/6.2005-3336](https://doi.org/10.2514/6.2005-3336)

<span id="ref-132"></span>[132] C. J. Dennehy and J. R. Carpenter, "A Summary of the Rendezvous, Proximity Operations, Docking, and Undocking (RPODU) Lessons Learned from the DARPA Orbital Express (OE) Demonstration System Mission," NASA STI Repository, 2011. **[NASA technical report]** url: [http://hdl.handle.net/2060/20110011506](http://hdl.handle.net/2060/20110011506)

<span id="ref-133"></span>[133] M. W. Smith, A. Donner, M. Knapp, C. M. Pong, C. H. Smith, and J. Luu, "On-Orbit Results and Lessons Learned from the ASTERIA Space Telescope Mission," *Small Satellite Conference*, 2018. **[conference proceedings, institutional repository]** url: [https://digitalcommons.usu.edu/cgi/viewcontent.cgi?article=4067&context=smallsat](https://digitalcommons.usu.edu/cgi/viewcontent.cgi?article=4067&context=smallsat)

<span id="ref-134"></span>[134] J. M. Jenkins, J. D. Twicken, S. McCauliff, J. Campbell, D. T. Sanderfer, and D. C. Lung, "The TESS science processing operations center," *Proceedings of SPIE*, 2016. doi: [10.1117/12.2233418](https://doi.org/10.1117/12.2233418)

\newpage

# Appendices

## Appendix A. Fault-episode coding protocol and episode-inventory template

This appendix specifies, before any data are collected, the protocol by which a row of the analysis dataset is created from documentary sources, so that two analysts working from the same documents would produce the same row. The unit of analysis is the fault episode: a discrete entry into a safe mode or comparable fault state by a single spacecraft. A mission can contribute multiple episodes. The protocol governs three coding decisions whose ambiguity would otherwise contaminate the estimate: when an episode begins, when and how it ends, and how its terminal type is classified.

An episode begins at fault entry, defined as the documented transition of the spacecraft into a safe, standby, survival, or comparable protective configuration, whether commanded by onboard fault protection or by the ground in response to a detected anomaly. The entry time is recorded to the finest documented resolution (UTC timestamp where available, otherwise the documented date), and the resolution itself is recorded so that the censoring analysis can account for interval-censored entries. An episode ends in one of two states. The first is confirmed recovery: documented return to nominal or near-nominal operations with the primary objective intact, which is a censoring event. The second is mission-ending loss: permanent loss of the spacecraft or of its primary mission objective traceable to the episode, which is the event of interest. Episodes that are still open at the observation-window close, and missions that remain operating, are right-censored at the window boundary. The terminal-type classification follows a documented decision rule rather than analyst intuition: a loss is coded as mission-ending only if the documentation establishes both permanence and traceability to the fault episode, and a degraded-but-operating outcome is coded as recovery with a flag, never as a loss, because conflating degradation with loss would inflate the event count in exactly the rare-event regime where the estimate is most fragile. Each episode row also carries identifying and provenance fields: spacecraft identifier, mission identifier, episode sequence number within the mission, the supporting document identifiers (NTRS accession number, GAO report number, or JPL incident-surprise-anomaly identifier), and a free-text provenance note recording any coding judgment the analyst made. Worked examples are drawn from published mission post-mortems already in the corpus: the Galileo safing recoveries [\[74\]](#ref-74), the CloudSat battery-anomaly recovery [\[70\]](#ref-70), and the GLAS/ICESat loop-heat-pipe anomaly [\[75\]](#ref-75) illustrate, respectively, a recurrent-episode mission, a single dramatic near-loss recovery, and an instrument-level anomaly whose traceability to mission objective must be argued explicitly. The episode-inventory template is therefore a fixed-schema table whose columns are these fields, populated one row per episode, with the retained coding log (cross-referenced in Chapter 4) preserving the document-to-field mapping for audit.

## Appendix B. The three-pass autonomy-score rubric and inter-coder reliability schema

The autonomy score is the treatment variable, and its measurement quality determines whether the study can answer its question, so its construction is specified here in full. The score is ordinal with a minimum of three ordered levels: Level 1, ground-loop-dependent recovery, in which the spacecraft safes itself and waits for a ground-uplinked recovery sequence; Level 2, onboard detection with limited autonomous response, in which detection and some isolation execute onboard but recovery still requires a ground cycle; and Level 3, onboard autonomous detection-isolation-recovery, in which all three functions can execute without waiting for a ground command cycle. The ordering reflects how much of the detection-isolation-recovery chain runs light-time-independently, which is the precise mechanism the dissertation hypothesizes to matter.

The score is built in three documented passes. Pass one assigns a TechPort technology-readiness-level (TRL) anchor: the readiness level of the flown fault-management or systems-health-management technology supplies an externally documented floor for the autonomy claim, exogenous to the survival outcome. Pass two reads NTRS and program design documentation to place the implementation on the ordered detection-isolation-recovery scale, asking of each of the three functions whether it executes onboard without a ground cycle; the placement must be consistent with the pass-one TRL floor, and any contradiction (a Level 3 placement on a technology with no documented flight-proven onboard recovery) is treated as a coding error to be re-examined, not a finding. Pass three is an independent re-coding by a second reader using the same rubric, with disagreements adjudicated against the documentation. Scoring is performed from pre-flight TechPort and design documentation, never from post-loss narratives, to defeat reverse coding: a mission-ending loss must not be permitted to retroactively lower the autonomy score and manufacture the very association the study tests. The inter-coder reliability schema records the two readers' independent codes, computes a weighted agreement statistic appropriate to an ordinal scale (a weighted kappa, reported with its confidence interval), and logs every adjudicated disagreement with the document cited in its resolution. The realized agreement statistic is named in advance as evidence that would raise confidence in the measurement; a low realized agreement would lower it and would be reported rather than concealed.

## Appendix C. Complexity-index construction and distance-regime coding

The complexity control is a constructed index, and its construction is specified here so that the index is reproducible and its measurement error is bounded. The index combines three documented inputs: subsystem count, instrument count, and program cost class, each drawn from GAO assessments and NTRS documentation. The three inputs are standardized and combined with documented weights (recorded in the retained log), and the index is treated as a control whose role is to absorb the part of program richness that confounds the autonomy-survival association rather than as a quantity of independent interest. Because the index is constructed, it carries measurement error that attenuates coefficients toward the null; this is acknowledged as a conservative bias on the controls, and the mission-class-stratified robustness specification provides a non-parametric check that does not depend on the index's exact functional form.

The distance regime is the Earth-spacecraft range regime at the time of the episode, which sets one-way light time and therefore the cost of a ground loop. It is coded as an ordered regime (near-Earth, cislunar/lunar, interplanetary/deep-space) rather than as a continuous range, because the documentary precision does not support a continuous measure and because the operationally relevant quantity is the order of magnitude of the ground-loop delay. Distance is permitted to enter the model as a time-dependent covariate, because a single long-duration mission can transit from a near-Earth to a deep-space regime during its life, and the counting-process formulation of the Cox model accommodates this by splitting an episode's risk interval at the documented regime-transition time. The coding rule for the transition, and the rule for assigning the regime in force at fault entry, are recorded in the log so that the time-dependent construction is auditable.

## Appendix D. Pre-registration of specifications, decision rule, and power analysis

This appendix pre-registers the analysis so that the inference cannot be the product of a specification search. The baseline specification is the single Cox proportional-hazards model of the bible's estimating equation, fit by partial likelihood with robust standard errors clustered on the spacecraft to handle recurrent episodes. Five robustness specifications are registered in advance: a competing-risks formulation distinguishing mission-ending loss from recovery as competing terminal states [\[29\]](#ref-29), [\[101\]](#ref-101), [\[102\]](#ref-102); a shared-frailty model absorbing unobserved mission-level heterogeneity [\[30\]](#ref-30), [\[108\]](#ref-108); a mission-class-stratified model [\[9\]](#ref-9); a Firth-type penalized partial likelihood used as the primary estimator when the event count is low [\[108\]](#ref-108); and a reduced model containing only autonomy and distance, so a reader can see whether the conclusion survives against a thin event count. The proportional-hazards assumption is tested with scaled Schoenfeld residuals [\[98\]](#ref-98), [\[110\]](#ref-110), and a covariate that violates it is interacted with a function of time or stratified.

The decision rule is fixed: H0 is rejected in favor of H1 if and only if the estimated hazard ratio \(\exp(\beta_1)\) on autonomy is below one, its 95 percent confidence interval excludes one in the pre-registered baseline, and the sign is stable across the five robustness specifications. A confidence interval that includes one fails to reject H0. A hazard ratio above one with an interval excluding one refutes H1 in the strongest way and is a substantively important negative finding. The power analysis is registered as part of the plan rather than reported as a result: because the effective sample size of a Cox model is governed by the number of events and not the number of episodes, the analysis computes the minimum detectable hazard ratio given the realized event count, applies a roughly ten-events-per-covariate floor to flag over-parameterization, and determines which specifications are adequately powered. Where a stratum is underpowered, the limitation is reported rather than over-interpreted. A pre-specified tail-subgroup analysis, restricted to the hardest episodes at the greatest distance and shortest reaction time, tests the Talebian hypothesis [\[23\]](#ref-23), [\[49\]](#ref-49) that autonomy's benefit concentrates in the tail even if the pooled estimate is modest.

## Appendix E. Variable and data dictionary, derivations, instrument and query details, and extended literature

### E.1 Variable and data dictionary

| Symbol / field | Definition | Type | Source | Role |
|---|---|---|---|---|
| episode \(i\) | discrete entry into safe mode or comparable fault state by one spacecraft | unit of analysis | A | row identifier |
| \(t\) | time from fault entry to terminal state or censoring | duration | A | time-to-event |
| event | mission-ending anomaly: permanent loss of spacecraft or primary objective traceable to the episode | binary indicator | A | dependent (event) |
| censoring | confirmed recovery to nominal operations, or window close | binary indicator | A | dependent (censor) |
| \(\text{autonomy}_i\) | ordered fault-management autonomy level (1 ground-loop; 2 onboard detection, limited response; 3 onboard detection-isolation-recovery) | ordinal | TechPort + NTRS/design docs | primary explanatory |
| \(\text{complexity}_i\) | standardized index of subsystem count, instrument count, program cost class | continuous index | GAO + NTRS | control |
| \(\text{distance}_i\) | Earth-spacecraft range regime at episode time (near-Earth / cislunar / deep-space) | ordinal, time-dependent | NTRS + mission docs | control |
| \(\text{age}_i\) | time since launch at fault entry | duration | NTRS + mission docs | control |
| \(h_0(t)\) | unparameterized baseline hazard | function | estimated | nuisance |
| \(\beta_1\) | coefficient on autonomy; \(\exp(\beta_1)\) is the hazard ratio of interest | parameter | estimated | quantity of interest |

Named data sources, keyed in the dictionary: **A** denotes the composite fault-episode record assembled per Appendix A from the four named streams; the streams are NTRS (the NASA Technical Reports Server citation-search API at `https://ntrs.nasa.gov/api/citations/search`), GAO major-project assessments, JPL mission anomaly and incident-surprise-anomaly records where releasable, and the NASA TechPort technology-readiness catalog.

### E.2 Derivation of the hazard ratio and its interpretation

The Cox model specifies the hazard for episode \(i\) as

\[ h_i(t) = h_0(t)\,\exp\!\left(\beta_1\,\text{autonomy}_i + \beta_2\,\text{complexity}_i + \beta_3\,\text{distance}_i + \beta_4\,\text{age}_i\right) \qquad\qquad (1) \]

For two episodes that differ by one autonomy level and share all controls, the ratio of their hazards is \(\exp(\beta_1)\), because the baseline hazard \(h_0(t)\) and the control terms cancel. This identity is why the hazard ratio is read per level and why conditioning on the controls operationalizes Fogel's counterfactual contrast [\[13\]](#ref-13), [\[39\]](#ref-39): the ratio compares the loss hazard of higher- versus lower-autonomy episodes that are otherwise comparable in complexity, distance, and age. The parameters are estimated by maximizing the partial likelihood, whose construction from the risk sets at event times is the reason the effective sample size depends on the event count rather than the episode count [\[25\]](#ref-25), [\[26\]](#ref-26), and which is the mechanical source of the power constraint registered in Appendix D.

### E.3 Instrument and query details

The four sources are queried through their public interfaces, documented here for reproducibility. NTRS is queried through its citation-search API, returning accession-numbered records whose full-text PDFs supply anomaly narratives and design documentation; the accession number is the join key into the episode inventory. GAO assessments are retrieved by report number from the GAO website and supply independent corroboration of mission-ending outcomes and program-level complexity and cost class. JPL anomaly and incident-surprise-anomaly records are accessed through JPL mission documentation where releasable, and any episode whose timing rests on a non-public record is flagged so a reproducibility reviewer can assess the conclusion with and without it. TechPort entries for fault-management, autonomy, and systems-health-management technologies supply the TRL anchor of the autonomy score's first pass. No keyed bibliographic API and no internal or working-note material is part of the data substrate; the substrate is public documentation and releasable JPL records only.

### E.4 Extended literature table

The literature-review chapter triages the strongest sources into its main text and relegates the remainder here so the body argument is not diluted. The relegated spine includes the Cassini-lineage attitude-control and command-and-data fault-protection descriptions [\[66\]](#ref-66), [\[69\]](#ref-69), the component-based and motor-drive fault-tolerance treatments [\[65\]](#ref-65), [\[67\]](#ref-67), the architectural-level fault-tolerance primer [\[68\]](#ref-68), the FDIR survey and onboard-software treatments [\[73\]](#ref-73), [\[94\]](#ref-94), the model-based diagnosis and digital-twin and deep-learning detection studies [\[60\]](#ref-60), [\[61\]](#ref-61), [\[90\]](#ref-90), [\[91\]](#ref-91), [\[93\]](#ref-93), [\[95\]](#ref-95), [\[96\]](#ref-96), the formation-FDIR and model-without-expertise studies [\[88\]](#ref-88), [\[92\]](#ref-92), the mission-context and in-orbit-performance references that establish the population of well-documented spacecraft [\[71\]](#ref-71), [\[76\]](#ref-76), [\[77\]](#ref-77), [\[78\]](#ref-78), [\[81\]](#ref-81), [\[82\]](#ref-82), [\[83\]](#ref-83), [\[119\]](#ref-119), [\[120\]](#ref-120), [\[125\]](#ref-125), [\[128\]](#ref-128), [\[129\]](#ref-129), and the autonomy-in-other-domains and human-autonomy-teaming references [\[64\]](#ref-64), [\[87\]](#ref-87), [\[121\]](#ref-121) that bound the autonomy construct. These works support the literature chapter's branch structure without each requiring main-text exposition, and they are retained here in full so the reduction is transparent and reversible.