claim: Safe-mode entry is a routine, recurring feature of long-duration spacecraft operations, and spacecraft failure behavior is statistically tractable at the population level, varying systematically by subsystem, mass class, and mission type; this establishes that a population of fault and failure episodes large enough to model exists and that the post-fault-survival question is a real, recurring decision problem rather than an exotic one.

source: Castet & Saleh, Satellite and satellite subsystems reliability: Statistical data analysis and modeling, Reliability Engineering and System Safety (2009)

grade: A

source: Castet & Saleh, Statistical reliability analysis of satellites by mass category: Does spacecraft size matter?, Acta Astronautica (2011)

facet: empirics

subclaim: real


claim: The autonomy spectrum in fault management is real, varied, and flight-proven: the Deep Space One Remote Agent Experiment closed the full detection-isolation-recovery chain onboard, and Cassini-class system fault protection documents the ground-dependent-to-autonomous range, so fault-management autonomy is a genuinely orderable treatment variable rather than a binary or a hypothetical.

source: Bernard et al., Spacecraft autonomy flight experience: The DS1 Remote Agent Experiment (1999)

source: Rasmussen, System fault protection design for the Cassini spacecraft, IEEE Aerospace Applications Conference (1996)

facet: mechanism


claim: The cliometric premise that grounds the study is established: a counterfactual claim of the form 'outcome could not have occurred without factor' remains unmeasured until stated quantitatively against an explicitly constructed next-best alternative and exposed to falsification (the social-saving standard), which makes a conditional population-level autonomy-survival estimate a materially improving apparatus over an untested engineering intuition.

source: Fogel, Railroads and American Economic Growth: Essays in Econometric History (1964)

grade: B

source: Leunig, Social Savings, Journal of Economic Surveys (2010)

facet: economics

subclaim: material


claim: The Cox proportional-hazards model with partial likelihood is the appropriate and validated estimator for a time-to-event question with right-censoring, and its counting-process large-sample behavior is governed by the terminal-event count, so the design's effective sample size and power are set by the number of mission-ending losses rather than the number of episodes; this both licenses the estimator choice and bounds what a thin-event population can support.

source: Cox, Regression Models and Life-Tables, Journal of the Royal Statistical Society Series B (1972)

source: Andersen & Gill, Cox's Regression Model for Counting Processes: A Large Sample Study, Annals of Statistics (1982)


claim: The social-saving Fogel demands is a COST counterfactual (the cost of performing the same task by the next-best alternative with output held fixed, related to consumer surplus and TFP), not a survival probability; a survival hazard ratio is therefore not a substitute for the missing cost leg, so the dissertation's repeated equation of the autonomy hazard ratio with a social saving is a rhetorical analogy unless an episode-level recovery-cost counterfactual is constructed.


claim: In the railway social-savings literature, time SAVED (not outcome avoided) drives most of the measured passenger benefit, so a design that models only the rare loss margin while censoring away the recovery-time-among-survivors margin risks measuring the smaller component and may have chosen the wrong estimand margin.

source: Leunig, Time is Money: A Re-Assessment of the Passenger Social Savings from Victorian British Railways, Journal of Economic History (2006)

subclaim: alternatives


claim: When terminal events differ in cause or downstream consequence (a contained single-vehicle loss versus a debris-generating or shared-asset loss), valid estimation requires cause-specific competing-risks hazards rather than a single pooled event; pooling heterogeneous terminal events into one hazard mis-aggregates the effect, and a fragmentation-generating loss imposes a propagating non-localized cost distinct from the loss of the single vehicle.

source: Lau, Cole & Gange, Competing Risk Regression Models for Epidemiologic Data, American Journal of Epidemiology (2009)

source: Lewis, Understanding long-term orbital debris population dynamics, Journal of Space Safety Engineering (2020)

facet: rival


claim: In heavy-tailed processes the historical record systematically undersamples the tail and sample means understate true exposure, so a pooled mean-based statistic such as a single hazard ratio is unreliable where extremes dominate, and the non-naive precautionary principle confines precaution to the joint case of fat tails AND systemic non-localizable ruin; treating a thin-event tail subgroup as decisive violates this.

source: Taleb, Read, Douady, Norman & Bar-Yam, The Precautionary Principle (arXiv:1410.5787, 2014)

source: Cirillo & Taleb, Tail risk of contagious diseases, Nature Physics (2020)


claim: Antifragility is a SECOND-order (convex) response to the DOSE of a stressor, formally distinct from robustness and resilience, so a single monotone Cox coefficient is a first-order mean-shift quantity that by construction cannot locate the system on the fragile-robust-antifragile continuum; an autonomy-by-dose interaction or spline is required to test whether the protective effect accelerates or decays at the tail.

source: Taleb et al., The Precautionary Principle (arXiv:1410.5787, 2014), formal fragility/convexity framework

source: Taleb, Antifragile: Things That Gain from Disorder (review record), Quantitative Finance (2013)


claim: Skin in the game is both an ethical and a statistical filter that discounts favorable assurances authored by parties carrying no exposure to the downside; because the autonomy treatment is scored largely from the implementing programs' own documentation while only the loss outcome is routed through independent GAO oversight, the favorable upper-bound hazard ratio is exactly the self-authored cheap assurance the filter is built to discard.

source: Martinetti et al., Safety-I and Safety-II, resilience and antifragility engineering: a debate (formalizing whether added automation builds or erodes antifragility)

facet: governance


claim: Potential outcomes are well-defined only under a well-posed manipulable intervention (no causation without manipulation) and under SUTVA (no interference and no hidden versions of treatment); because the autonomy score is a per-mission pre-flight design property, the only honest manipulation is program-level and conditioning on fault entry conditions on a post-treatment variable, so the episode-level treatment is not well-posed as specified.

source: Holland, Statistics and Causal Inference, Journal of the American Statistical Association (1986)

source: Imbens & Rubin, Causal Inference for Statistics, Social, and Biomedical Sciences (2015)

facet: identification


claim: Propensity-score adjustment removes bias due to observed covariates only where overlap (common support) holds; where the highest-autonomy episodes occupy a complexity-distance region with no lower-autonomy donors, the within-stratum Cox contrast is extrapolation past support rather than adjustment, which the candidate's own concentration of coverage on flagship deep-space missions makes a live threat.

source: Rosenbaum & Rubin, The central role of the propensity score in observational studies for causal effects, Biometrika (1983)


claim: Objective causal inference requires the design, including the determination of outcomes and the analysis plan, to be completed while blind to the outcome data; the dissertation seals the treatment (pre-flight autonomy scoring with second-reader weighted-kappa reliability) but leaves the outcome and censoring side outside the blinding-and-reliability apparatus, so the design's objectivity is only half-met and differential outcome measurement can contaminate the hazard ratio.

source: Rubin, For objective causal inference, design trumps analysis, Annals of Applied Statistics (2008)


claim: Onboard fault detection-isolation-recovery is implemented by materially different architectures (two-layer FDI plus layered recovery, Kalman-filter and neural-network fusion, observer-based detection), so a three-bin ordinal autonomy score collapses real within-level heterogeneity and the per-level hazard ratio averages over hidden treatment versions rather than estimating the single contrast H1 names.

source: Chen, Bettens, Xie, Wang & Wu, Kalman filter and neural network fusion for fault detection and recovery in satellite attitude estimation, Acta Astronautica (2024)

facet: measurement


claim: Conditioning on a collider (a variable that is a common effect of two causes, here recorded-fault-entry as a child of both autonomy and unobserved severity) induces an endogenous, non-causal association between its causes inside the analysis sample, and this selection bias can substantially distort observed associations even when each underlying effect is modest; no observed adjustment set closes a collider path that transits an unobserved variable.

source: Pearl, Causality: Models, Reasoning and Inference (2nd ed., 2009)

source: Elwert & Winship, Endogenous Selection Bias: The Problem of Conditioning on a Collider Variable, Annual Review of Sociology (2014)

source: Munafo et al., Collider scope: when selection bias can substantially influence observed associations, International Journal of Epidemiology (2017)


claim: Adjusting for an intermediate variable on the causal path (or a proxy of it) is overadjustment that biases the effect estimate, distinct from unnecessary adjustment which only reduces precision; because distance and complexity are partly the regimes autonomy is designed to exploit, adjusting their realized-exploitation component differences out the protective mechanism and biases the hazard ratio toward one.

source: Schisterman, Cole & Platt, On the Relative Nature of Overadjustment and Unnecessary Adjustment, Epidemiology (2009)


claim: The proportional-hazards assumption for a specified coefficient is tested by regressing its scaled Schoenfeld residuals on a function of time (Grambsch-Therneau weighted-residual test); a non-zero slope indicates a time-varying effect for that variable, and when detected the remedy is a time-varying-coefficient or time-stratified Cox specification rather than a single constant hazard ratio, so the single treatment coefficient must be tested before it is reported.

source: Grambsch & Therneau, Proportional hazards tests and diagnostics based on weighted residuals, Biometrika 81(3) (1994)

source: Zhang et al., Time-varying covariates and coefficients in Cox regression models, Annals of Translational Medicine (2018)

subclaim: mechanism


claim: A causal effect is identified under the back-door criterion only if the conditioning set blocks every back-door (common-cause) path; a risk-classification/requirements-stringency regime that drives both autonomy investment and, through a margin/redundancy/abort-disposal-policy channel, mission-ending loss leaves an open back-door path inside any fixed-autonomy stratum that {complexity, distance, age} does not block, so the autonomy hazard ratio is non-identified on regime-confounding grounds unless a proxy for that regime is measured.


claim: Formal identification rescues for an endogenous self-selected treatment are exactly back-door adjustment, a valid instrument with an exclusion restriction, and the front-door criterion; the front-door rescue requires the onboard detection-isolation-recovery mediator to be unconfounded with loss except through autonomy, which fails when a risk-class regime sets the margin that determines whether a recovery action succeeds, so neither rescue is instantiable and a sensitivity bound rather than a point hazard ratio is the correct deliverable.

source: Pearl, A general identification condition for causal effects (2002)

source: Martinussen & Vansteelandt, Instrumental Variable Estimation of the Causal Hazard Ratio, Biometrics (2022)


claim: An accurate census is the precondition for downstream collision-avoidance and governance claims, and where the catalog floor is reached capacity and risk claims become unverifiable; transferred to a fault catalog, an unreproducible event definition cannot ground a conditional survival estimate, so an inter-coder reliability statistic on the fault-entry event and end-state is owed before any hazard ratio.

source: Murtaza et al., LEO satellite security and reliability survey, IEEE Access (2020)


claim: Ceding continuous control imposes a takeover performance cost (an operator suddenly required to intervene is slow and error-prone) and intermediate levels of automation have non-uniform effects on situation awareness and workload, so the out-of-the-loop harm is concentrated at intermediate delegation; a monotone-in-level Cox coefficient is structurally incapable of registering a mid-scale hazard bump and an inverted-U test (ordered dummies or quadratic) is required.

source: Parasuraman, Sheridan & Wickens, A model for types and levels of human interaction with automation, IEEE Transactions on Systems, Man, and Cybernetics A (2000)

source: Kaber & Endsley, The effects of level of automation and adaptive automation on human performance, situation awareness and workload in a dynamic control task, Theoretical Issues in Ergonomics Science (2004)


claim: Automation applies to four distinct stages of human information processing whose automation carries different human-performance signatures (auto-isolate-but-wait-for-ground keeps a human in the decision loop; auto-recover removes them), so a single collapsed detection-isolation-recovery ordinal should be coded as three separate stage indicators to let the model attribute any survival benefit to automated diagnosis, automated recovery action, or only their bundle.

source: Parasuraman, Sheridan & Wickens, A model for types and levels of human interaction with automation, IEEE Transactions on Systems, Man, and Cybernetics A 30(3):286-297 (2000)

source: Parasuraman & Riley, Humans and automation: use, misuse, disuse, abuse, Human Factors (1997)


claim: Automation-induced error splits into omission (missed because the automation did not flag) and commission (executing an automated action against contrary evidence), both robust and dosage-dependent; a fast autonomous reconfiguration into a worse state registers in two-state recovery/loss coding as an apparently protective short time-to-recovery or a censored survivor, biasing the hazard ratio toward a spurious autonomy benefit, so a third event category for onboard-recovery-action-implicated losses is required.

source: Parasuraman & Manzey, Complacency and bias in human use of automation: an attentional integration, Human Factors 52(3):381-410 (2010)

source: Parasuraman & Riley, Humans and automation: use, misuse, disuse, abuse, Human Factors 39(2):230-253 (1997)


claim: High automation reliability predictably degrades operator monitoring of the automated function (complacency), and reliance miscalibrates two ways (misuse=over-reliance, disuse=under-reliance after nuisance trips), so the low-autonomy comparison arm (a human ground loop) is itself a non-constant-reliability automated-monitoring-plus-operator system; the estimated autonomy benefit may be the mirror image of a degrading human backstop rather than capability in the high-autonomy arm.

source: Parasuraman, Molloy & Singh, Performance consequences of automation-induced complacency, International Journal of Aviation Psychology (1993)


claim: Operator workload, vigilance, fatigue, and shift-handover state are dynamic time-varying variables, so a safe-mode entry during a concurrent critical operation or overloaded console is resolved by a different effective backstop than one during quiet cruise; operations tempo at fault entry is a distinct candidate confounder of the ground-loop-dependent outcome beyond the static complexity/distance/age controls.

source: Parasuraman, Neuroergonomics: Research and practice, Theoretical Issues in Ergonomics Science (2003)


claim: A stock changes only through its flows and behavior over time is the integral of inflow minus outflow, so two regimes whose flow balances differ (a high- and a low-autonomy recovery, where an intervention at minute two reshapes the state at minute thirty) are different dynamic systems whose baseline accumulation paths need not be proportional; the proportional-hazards single-multiplier summary must therefore be tested as a structural claim against autonomy-stratified baseline survival curves.

source: Forrester, Industrial Dynamics / Dynamic models of economic systems and industrial organizations, System Dynamics Review (reprint commentary)

source: Grambsch & Therneau, Proportional hazards tests and diagnostics based on weighted residuals, Biometrika 81(3):515-526 (1994)


claim: Material and information delays between a flow and its effect on a stock generate overshoot and instability, so the ground-intervention delay (one-way light time) is a delayed feedback loop that cannot be treated as an exogenous additive condition; the autonomy effect should be estimated with an autonomy-by-light-time interaction, and a stable hazard ratio across light-time regimes falsifies the deep-space autonomy rationale while an unstable one falsifies the single proportional-hazards coefficient.

source: Forrester, Counterintuitive Behavior of Social Systems (1971)

source: Bellera et al., Variables with time-varying effects and the Cox model, BMC Medical Research Methodology 10:20 (2010)


claim: A risk-averse program is a balancing feedback loop in which a latent regime stock drives two correlated outflows (autonomy investment and abort/margin/test stringency), so a single-equation Cox coefficient on autonomy is not a structural effect; recovering a causal hazard ratio under treatment endogeneity requires instrumental-variable or structural identification, and the highest leverage lies in loop structure not a single visible parameter, so an unidentified estimate is a within-regime association of unknown transferability, not an architecture-trade lever.

source: Meadows, Leverage Points: Places to Intervene in a System (1999)


claim: Case findings generalize analytically to theoretical propositions, not statistically to populations, and the named error is over-claiming statistical generalization from a convenient handful of cases; with a handful of mission-ending events across heterogeneous spacecraft the honest claim is that the hazard ratio tests the autonomy proposition within a narrow flagship stratum (analytic generalization), not that it estimates a population parameter.

source: Yin, Case Study Evaluations: A Decade of Progress? (analytic vs statistical generalization)


claim: A rival explanation is discharged only by being explicitly named and tested with a mutually-exclusive predicted pattern, not relabeled as a nuisance term; the program-quality/requirements-stringency regime is statable as a positive rival whose discriminating prediction (within a fixed autonomy level survival still rises with independently-coded stringency, and high-autonomy losses cluster in low-stringency programs) is the opposite of H1's within-stratum prediction, and where treated and untreated differ on a prognostic factor that drives both assignment and outcome the effect is confounded by indication.

source: Beach, It's all about mechanisms: what process-tracing case studies should be tracing

source: Sterne et al., ROBINS-I: a tool for assessing risk of bias in non-randomised studies of interventions, BMJ (2016)