Candidate ID: JPL_AUTONOMY_EDL_04
Program: COLLEGIUM 1st Battalion
NORTH STAR / JPL category: Autonomous Systems and Robotics
Date: 2026-06-15

# Fault-Management Maturity and Mission-Anomaly Survival: a Hazard Model of Safe-Mode Entries and Recovery Outcomes

## Abstract

Spacecraft fault management is the set of onboard and ground functions that detect anomalous conditions, isolate their cause, and act to preserve the vehicle and the mission. Programs differ widely in how much of this function is delegated to onboard autonomy versus a human ground loop. This dissertation asks whether higher-autonomy onboard fault management measurably lowers the hazard of a mission-ending outcome once a spacecraft has entered a fault state. The contribution is a single falsifiable proposition. The null hypothesis is that the level of fault-management autonomy has no effect on the hazard of a mission-ending anomaly conditional on entry into a fault state. The alternative is that higher autonomy is associated with a lower hazard, after accounting for mission complexity, distance from Earth, and spacecraft age. The proposed method is a Cox proportional-hazards survival model estimated on a constructed event-history dataset built from NASA Technical Reports Server and Government Accountability Office anomaly and lessons-learned reports, Jet Propulsion Laboratory mission anomaly records, and TechPort technology-readiness classifications used to score fault-management maturity. The unit of analysis is the fault episode, defined as a discrete entry into a safe mode or comparable fault state, with the time-to-event measured from fault entry to either confirmed recovery or mission-ending loss. The dissertation is presented at the design stage. It specifies the estimator, the variable construction, the identification strategy, and the threats to validity, and it states expected directions of effect that are explicitly labeled as not yet executed on the full dataset. Two methodological anchors structure the work. Fogel's cliometric discipline requires that the claim be stated quantitatively, embedded in an explicit counterfactual, and exposed to falsification. Taleb's work on tail risk requires that the analysis treat mission-ending loss as a rare, heavy-tailed event for which sample means are unreliable and for which precaution, not point optimization, is the correct decision frame. The intended outcome is a defensible, reproducible estimate of whether autonomy maturity changes post-anomaly survival, and an honest account of what would refute it.

## 1. Introduction and Contribution

### 1.1 The problem

Robotic deep-space and Earth-orbiting spacecraft routinely encounter conditions their designers did not fully anticipate. When onboard monitors detect such a condition, the standard protective response is to enter a safe mode: a reduced, stable configuration that suspends the planned activity, points solar arrays at the Sun, establishes a communications geometry, and waits. Safe mode is a success of design in the narrow sense that the vehicle survived the immediate threat. It is also a mission interruption, and in some fraction of cases the entry into a fault state precedes permanent loss of the spacecraft or of its primary objective.

The function that governs this behavior is fault management, sometimes called fault protection or systems health management. Fault management spans detection, isolation, and recovery, and it can be implemented anywhere along a spectrum from fully ground-dependent to highly autonomous. At the ground-dependent end, the spacecraft safes itself and then waits for human operators to diagnose the condition and uplink a recovery sequence. At the autonomous end, the spacecraft carries onboard models, diagnostic reasoning, and recovery logic that can isolate the fault and resume or reconfigure without waiting for a ground command cycle. The Remote Agent Experiment on Deep Space One demonstrated that closed-loop onboard planning, execution, and model-based fault diagnosis were technically feasible in flight [16, 17, 18]. The intervening decades have produced a large body of architecture and assurance work on autonomous fault management [3, 8, 19, 20], yet the operational question that programs actually face has not been answered with a population-level statistical estimate.

### 1.2 The gap in the literature

Two literatures bear on this question and do not meet. The first is spacecraft reliability statistics. Castet and Saleh and collaborators built nonparametric and Weibull-based reliability estimates from on-orbit failure data across hundreds of spacecraft and subsystems, establishing that failure behavior is statistically tractable at the population level and that it varies by subsystem, mass class, and mission type [5, 6, 7, 9, 10, 11]. This literature models time to failure of hardware. It does not model the conditional question of survival after a fault has occurred, and it does not treat the level of fault-management autonomy as an explanatory variable.

The second literature is fault-management engineering. It describes architectures, formal verification methods, diagnostic algorithms, and flight demonstrations [1, 2, 3, 4, 8, 12, 15]. This literature is largely about whether a given design is correct and assurable. It rarely asks, across many missions, whether more autonomous fault management is associated with better recovery outcomes once trouble starts, and when it makes such claims they tend to rest on individual case narratives rather than on a hazard model fit to a population of fault episodes.

The gap is therefore a specific empirical one. No published study estimates the effect of fault-management autonomy level on the hazard of mission-ending loss conditional on fault entry, while controlling for the confounders that plausibly drive both autonomy investment and anomaly outcomes. That conditional, population-level estimate is the object of this dissertation.

It is worth being precise about why the conditional framing is the right one. An unconditional comparison of mission outcomes by autonomy level answers a different and less useful question: it tells you whether autonomous missions fail less often overall, which is dominated by whether they encounter faults at all and by every other difference between autonomous and non-autonomous programs. The decision a program manager actually faces is conditional. A fault has occurred or will occur on essentially every long-duration mission; safe-mode entries are routine, not exceptional. The relevant question is what happens next, and specifically whether the spacecraft's own fault-management capability changes the probability that the episode ends in recovery rather than loss. Conditioning on fault entry isolates exactly that decision-relevant quantity and discards the noise of differing fault-arrival rates. This is also why a hazard model, rather than a simple logistic regression on episode outcome, is the natural estimator: the time the spacecraft spends in the fault state before resolving carries information, episodes are censored when missions are still operating, and recurrent episodes within a mission must be handled without double-counting.

### 1.3 The single falsifiable contribution

The contribution is one testable proposition about post-anomaly survival.

H0 (null): The level of onboard fault-management autonomy has no effect on the hazard of a mission-ending anomaly conditional on entry into a fault state. Formally, the coefficient on the autonomy variable in the hazard model is zero.

H1 (alternative): Higher onboard fault-management autonomy is associated with a lower hazard of a mission-ending anomaly conditional on fault entry, after controlling for mission complexity, distance from Earth, and spacecraft age. Formally, the coefficient on the autonomy variable is negative and the implied hazard ratio is below one.

The proposition is falsifiable in Fogel's sense [13]. It is stated quantitatively, it is embedded in an explicit counterfactual comparison between higher- and lower-autonomy designs facing comparable faults, and it can be refuted by the data: a non-negative or statistically indistinguishable-from-zero coefficient, or a coefficient whose sign reverses once confounders are included, would refute H1 and fail to reject H0.

### 1.4 Why it matters for NASA and JPL

The decision to invest in autonomous fault management is expensive and consequential. Autonomy adds onboard software, verification burden, and assurance cost, and it shifts authority from a human ground team to flight code. Deep-space missions face long one-way light times that make a ground loop slow, which is the standard engineering argument for autonomy [16, 19]. But that argument is an assertion about expected benefit; it has not been tested against the survival record of past missions. A defensible estimate of whether autonomy maturity actually changes post-anomaly survival, and by how much, would inform architecture trades for future JPL deep-space missions in the Autonomous Systems and Robotics category, and it would give program managers an evidence base rather than an intuition when they weigh autonomy investment against its cost.

## 2. Background and Literature

### 2.1 Fault management and the autonomy spectrum

Fault management has a long engineering lineage. Early work framed fault-tolerant design and onboard fault management as a route to spacecraft autonomy [1, 12]. The Cassini fault-protection system formalized a layered, monitor-and-response architecture that became a reference pattern [2]. Later programs explored simpler emergent architectures and the use of commercial-off-the-shelf components under robust fault-protection strategies [4, 15]. Model-based diagnosis and its assurance became a research focus, with explicit attention to how one gains confidence that an autonomous diagnostic system will behave correctly [8]. Formal specification and verification methods were brought to bear on autonomous robotic and spacecraft systems precisely because autonomy moves safety-critical decisions into code that must be trusted [3, 14].

The flight demonstration that anchors the autonomous end of the spectrum is the Remote Agent Experiment on Deep Space One, which integrated onboard planning, a reactive executive, and model-based fault diagnosis and recovery [16, 17, 18]. The hybrid procedural and deductive executive architecture that supported it remains a reference for how onboard autonomy can be structured [12]. More recent surveys map the past, present, and prospective state of autonomy for space robots and the broader application of artificial intelligence in space missions [19, 20], and onboard anomaly detection has matured into a distinct practice [21, 22]. The throughline is that the field has many designs and several flight demonstrations, but it lacks a population-level outcome study.

### 2.2 Spacecraft reliability statistics

The complementary literature treats spacecraft failure as a statistical phenomenon. Castet and Saleh assembled on-orbit failure data and fit nonparametric and Weibull reliability models, then extended the work to multi-state failure analysis, to comparison across mass categories, and to specific subsystems such as attitude control [5, 6, 7, 9, 10, 11]. The reliability of small satellites and CubeSats was analyzed in the same statistical tradition [10]. This body of work establishes the feasibility of population-level survival modeling for spacecraft and supplies validated baselines for failure behavior. Its limitation, for the present purpose, is that it models unconditional time to hardware failure rather than conditional survival after a fault state has been entered, and it does not include fault-management autonomy as a covariate.

Several features of this literature are directly usable in the present design. The finding that failure behavior differs by mass category and mission class [9] justifies stratification and a complexity control rather than a single pooled baseline. The documented mixture of infant-mortality and wear-out regimes [7] justifies including spacecraft age as a covariate and testing whether its effect is monotone. The multi-state framing [6], which distinguishes degraded from failed states, is conceptually the ancestor of the competing-risks specification used here, where recovery and loss are competing terminal events out of the fault state. The methodological continuity matters: this dissertation does not invent a new statistical apparatus for spacecraft, it imports a validated one and redirects it from the unconditional hardware-failure question to the conditional post-fault-survival question, adding autonomy as the explanatory variable the prior work omitted.

### 2.3 The Fogelian frame

Robert Fogel's cliometric program supplies the methodological discipline for the empirical claim [13]. Fogel insisted that a historical proposition of the form "outcome Y could not have occurred without factor X" is an unmeasured counterfactual until it is stated quantitatively and tested. His railroad study constructed an explicit world in which the supposed indispensable factor was absent and computed the difference. Translated to this dissertation, the Fogelian requirements are three. First, state the proposition quantitatively: autonomy changes the post-anomaly hazard by a specific, estimable amount. Second, build the counterfactual into the design: compare the survival of comparable fault episodes that differ in autonomy level, holding confounders fixed, which is what conditioning in a hazard model does. Third, let the data falsify the hypothesis rather than assume the engineering intuition is correct. The hazard ratio on autonomy is the social-saving analogue: a single number that either supports or refutes the claim that autonomy matters.

### 2.4 The Talebian frame

Nassim Taleb's work on tail risk supplies the discipline for the dependent variable. Mission-ending loss is a rare event, and rare events in heavy-tailed processes are dominated by a few extreme realizations, so the historical record undersamples the tail and sample means understate true exposure. Three consequences follow for this design. First, the analysis must treat mission-ending loss as the tail event it is, which favors a hazard formulation that handles censoring and small event counts over any approach that relies on the stability of a mean. Second, precaution, not point optimization, is the correct decision frame: the value of autonomy may lie disproportionately in the worst fault episodes, those with the least time and the least ground insight, so an estimate that averages over all episodes can understate autonomy's tail benefit. Third, the non-naive precautionary principle [23] cautions against treating any single point estimate, including the one this dissertation will produce, as a license to optimize fault-management economics against the most likely case while ignoring the catastrophic case. The Talebian frame is therefore built into the interpretation: the hazard ratio is reported with its uncertainty, and the discussion explicitly considers whether autonomy's benefit concentrates in the tail of hardest episodes. The runaway, feedback-driven dynamics of the orbital environment [24] are a reminder that the consequences of loss are not always localized to the lost vehicle.

## 3. Data

### 3.1 Named sources and access paths

The analysis draws on four named sources.

NASA Technical Reports Server (NTRS). NTRS provides public access to NASA technical reports, conference papers, and lessons-learned documents through a citation search API (https://ntrs.nasa.gov/api/citations/search). NTRS yields anomaly narratives, fault-management design descriptions, and post-mission assessments. It is the primary source for identifying fault episodes and for narrative coding of autonomy behavior during a fault.

Government Accountability Office (GAO) anomaly and lessons-learned reports. GAO publishes assessments of major NASA projects, including documented on-orbit and development anomalies and their consequences. These reports are accessed through the public GAO website and supply independent corroboration of mission-ending outcomes and of program-level context such as complexity and cost class.

JPL mission anomaly records. JPL maintains mission anomaly and incident records for the deep-space and Earth-science missions it operates. These records, accessed through JPL mission documentation and incident-surprise-anomaly reporting where releasable, supply the fine-grained fault-entry and recovery timing needed to define the time-to-event variable.

TechPort fault-management technology-readiness classifications. NASA TechPort catalogs technology projects with technology-readiness-level (TRL) assessments. TechPort entries for fault-management, autonomy, and systems-health-management technologies are used to construct an autonomy-maturity score for the fault-management implementation flown on each mission, anchored to a published readiness assessment rather than to a subjective rating.

### 3.2 Unit of analysis

The unit of analysis is the fault episode: a discrete entry into a safe mode or comparable fault state by a single spacecraft. A mission can contribute multiple fault episodes. Each episode has a start time (fault entry), an end state (confirmed recovery to nominal operations, or mission-ending loss of the spacecraft or its primary objective), and a duration. Recurrent episodes within a mission are handled in estimation through a robust variance estimator that clusters on the spacecraft to account for within-mission dependence.

### 3.3 Variable construction

Dependent variable. The event is mission-ending anomaly: permanent loss of the spacecraft or of its primary mission objective traceable to the fault episode. Time-to-event is measured from fault entry. Episodes that end in recovery, and missions still operating at the end of the observation window, are right-censored at the time of recovery or window close.

Primary explanatory variable. Fault-management autonomy level is an ordered score for each mission's fault-management implementation, constructed from TechPort TRL classifications and corroborated by NTRS design documentation. The score distinguishes, at minimum, ground-loop-dependent recovery, onboard detection with limited autonomous response, and onboard autonomous detection-isolation-recovery. The ordering reflects how much of the detection-isolation-recovery chain executes without a ground command cycle.

Control variables. Mission complexity is proxied by an index built from subsystem count, instrument count, and program cost class as reported in GAO and NTRS documentation. Distance is the Earth-spacecraft range regime at the time of the fault episode, which determines one-way light time and therefore the cost of a ground loop. Spacecraft age is time since launch at fault entry, capturing wear-in and wear-out effects documented in the reliability literature [5, 7].

The autonomy score deserves additional construction detail because it is the treatment variable and its measurement quality determines whether the study can answer its question. The score is built in three passes. The first pass assigns each mission's fault-management implementation to a TechPort technology-readiness anchor: the readiness level of the flown fault-management or systems-health-management technology gives an objective, externally documented floor for the autonomy claim. The second pass reads NTRS and program design documentation to place the implementation on the ordered detection-isolation-recovery scale, distinguishing whether each of the three functions executes onboard without a ground command cycle. The third pass is an independent re-coding by a second reader using the same rubric, with disagreements adjudicated against the documentation, so that the ordering is reproducible rather than a single analyst's judgment. The score is deliberately coarse and ordinal rather than cardinal, because the underlying documentation does not support finer distinctions, and because an over-precise score would create a false impression of measurement quality. Treating the variable as ordinal also disciplines the interpretation: the hazard ratio is read per level, not per unit of some continuous autonomy quantity that does not exist.

### 3.4 Coverage

The intended sample is the population of identifiable fault episodes on NASA and JPL robotic spacecraft for which fault entry, end state, and autonomy level can be coded from the named sources. Coverage is strongest for flagship and competed deep-space and Earth-science missions, which are well documented in NTRS and GAO, and for JPL-operated missions with releasable anomaly records. The target is the largest defensible set of episodes consistent with reliable coding, with the expectation of a sample in the low hundreds of episodes across several dozen spacecraft.

### 3.5 Limitations of the data

The data have four notable limitations. First, reporting is heterogeneous: well-documented flagship missions are over-represented relative to small or classified missions, which biases coverage toward complex, high-investment spacecraft. Second, the autonomy score is a coarse ordering, not a continuous measurement, and it compresses real architectural variety. Third, fault episodes that were silently handled and never escalated may be under-recorded, which truncates the low-severity end of the distribution. Fourth, mission-ending losses are rare, so the event count is small relative to the censored episodes, which is precisely the heavy-tailed, undersampled-tail condition the Talebian frame warns about and which constrains statistical power. These limitations are addressed in the design and revisited in the threats-to-validity discussion.

## 4. Research Design and Identification

### 4.1 Estimator

The estimator is the Cox proportional-hazards model [25]. The Cox model specifies the hazard of the event at time t for episode i as a product of an unspecified baseline hazard and an exponential function of covariates:

h_i(t) = h_0(t) * exp(beta_1 * autonomy_i + beta_2 * complexity_i + beta_3 * distance_i + beta_4 * age_i)

where h_0(t) is the baseline hazard, left unparameterized, and the betas are estimated by partial likelihood. The quantity of interest is the hazard ratio exp(beta_1) for the autonomy variable: the multiplicative change in the hazard of mission-ending loss associated with a one-level increase in fault-management autonomy, holding the controls fixed. H1 predicts exp(beta_1) below one; H0 predicts exp(beta_1) equal to one.

The Cox model is chosen because it handles right-censoring directly, makes no parametric assumption about the shape of the baseline hazard, and accommodates the small event count better than a parametric mean-based model. Its large-sample properties for counting-process data are well established [26], and time-dependent covariates and coefficients are well understood within the framework [27, 28], which matters because distance regime and effective autonomy can change during a long mission.

### 4.2 Identification strategy

The identification problem is confounding: programs that invest in autonomous fault management are not a random subset of missions. Deep-space missions face long light times and therefore both invest more in autonomy and operate in a harsher recovery environment. Flagship missions are more complex and also better funded for autonomy. Without conditioning, the autonomy coefficient would conflate the effect of autonomy with the effects of distance, complexity, and program richness.

The strategy is conditioning on observed confounders that drive both autonomy investment and anomaly outcomes. Distance, complexity, and age are the three confounders with the clearest theoretical link to both the treatment and the outcome, and all three are codable from the named sources. Conditioning on them isolates the within-stratum comparison: among fault episodes of comparable complexity, distance regime, and spacecraft age, do higher-autonomy spacecraft survive at a different rate. This is the counterfactual contrast Fogel's method demands, operationalized as covariate adjustment in the partial likelihood.

The identification is observational, not experimental, and the dissertation does not claim a randomized causal effect. It claims a conditional association with an explicit and defended set of controls, and it states plainly which unobserved confounders could still bias the estimate.

Two further identification choices are worth stating explicitly. First, instrumental-variable identification was considered and rejected. A valid instrument would need to shift autonomy investment without affecting post-fault survival except through autonomy, and no such variable is credibly available: every plausible candidate, such as mission era or budget, plausibly affects survival through other channels. Honest conditioning with a defended control set, and explicit reasoning about the remaining bias, is more defensible than a weak instrument that would import its own untestable exclusion restriction. Second, the direction of any residual confounding is reasoned through rather than assumed away. The most likely unobserved confounder, overall program quality, is positively associated with both autonomy investment and survival, which means an unconditioned estimate would overstate autonomy's protective effect. Conditioning on complexity and cost class absorbs part of program quality. If, after conditioning, the autonomy hazard ratio remains below one, the residual program-quality bias works in the same direction as the estimated effect, so the conditional estimate is an upper bound on autonomy's benefit, not a lower one. Stating the sign of the likely bias is itself a Fogelian move: it bounds the claim rather than asserting it.

### 4.3 Model specification

The base specification is the single Cox model above with robust standard errors clustered on the spacecraft to handle recurrent episodes. The proportional-hazards assumption is tested using scaled Schoenfeld residuals; where it is violated for a covariate, that covariate is interacted with a function of time or stratified. Distance regime is permitted to enter as a time-dependent covariate because a single mission can transit from near-Earth to deep-space regimes. Robustness specifications include: stratification by mission class; a competing-risks formulation that distinguishes mission-ending loss from recovery as competing terminal states [29]; and a frailty term to absorb unobserved mission-level heterogeneity [30].

### 4.4 Threats to validity

Internal validity. The principal threat is unobserved confounding: a mission attribute correlated with both autonomy and survival that is not in the control set, for example test rigor or operations-team experience. Conditioning reduces but cannot eliminate this. Reverse coding is a second threat: if a mission-ending loss leads documentation to retrospectively describe the fault management as inadequate, the autonomy score could be contaminated by the outcome. This is mitigated by scoring autonomy from pre-flight TechPort and design documentation rather than from post-loss narratives.

External validity. The sample over-represents complex, well-funded NASA and JPL missions, so the estimate may not generalize to small satellites, commercial constellations, or non-NASA programs. The Talebian caution applies: an estimate built on a population that undersamples the tail of catastrophic episodes may understate autonomy's benefit in exactly the conditions where it matters most.

Construct validity. Fault-management autonomy is a multidimensional engineering property compressed into an ordered score, and mission complexity is a constructed index; both risk measurement error that attenuates coefficients toward the null. The autonomy ordering is validated against independent coders and against the TRL anchor to limit this.

Statistical-conclusion validity. The event of interest is rare, so power is limited and confidence intervals will be wide. The analysis reports interval estimates, not point estimates alone, and pre-registers the primary specification to avoid specification search. Small event counts also stress the asymptotic partial-likelihood approximation, so exact or penalized methods are used as a check where event counts are very small.

## 5. Analysis Plan and Findings

This section is a design-stage analysis plan. The procedures below are specified but not yet executed on the full dataset. The figures presented are illustrative expectations used to define the decision rule, not empirical results. No fitted estimate from the assembled population is reported here.

### 5.1 Estimation procedure

The estimation proceeds in six steps. First, assemble the episode-level dataset by coding fault entries, end states, and timing from NTRS, GAO, and JPL records, and merge the TechPort-anchored autonomy score and the GAO/NTRS-derived complexity, distance, and age covariates. Second, construct the survival object with fault entry as the origin, recovery or window close as censoring, and mission-ending loss as the event. Third, fit the base Cox model by partial likelihood with spacecraft-clustered robust variance. Fourth, test the proportional-hazards assumption with scaled Schoenfeld residuals and respecify by stratification or time interaction where it fails. Fifth, fit the robustness specifications: competing risks, frailty, and mission-class stratification. Sixth, conduct the inference on H0 versus H1 using the Wald and likelihood-ratio tests on beta_1, reporting the hazard ratio with a 95 percent confidence interval.

### 5.2 Decision rule

H0 is rejected in favor of H1 if and only if the estimated hazard ratio on autonomy is below one and its 95 percent confidence interval excludes one in the pre-registered base specification, and the sign is stable across the robustness specifications. A hazard ratio whose interval includes one fails to reject H0. A hazard ratio above one with an interval excluding one would refute H1 and indicate that, conditional on a fault, higher autonomy is associated with worse survival, which would be a substantively important negative finding.

### 5.3 Illustrative expectation (not yet executed)

To make the decision rule concrete, the following illustrative numbers describe what a result consistent with H1 would look like; they are not estimates from the data. An illustrative hazard ratio of 0.6 on a one-level increase in autonomy, with an illustrative 95 percent confidence interval of 0.4 to 0.9, would reject H0 and indicate roughly a forty percent lower hazard of mission-ending loss per autonomy level, conditional on complexity, distance, and age. An illustrative hazard ratio of 0.95 with an interval of 0.7 to 1.3 would fail to reject H0. These two illustrations bound the interpretive range; the actual estimate will fall where the data place it. Consistent with the Talebian frame, a subgroup analysis restricted to the hardest episodes, those at the greatest distance and shortest reaction time, is specified in advance to test whether autonomy's benefit concentrates in the tail even if the pooled estimate is modest.

### 5.4 Power and feasibility

With an expected sample in the low hundreds of episodes and a small number of mission-ending events, the analysis is feasibility-limited rather than precision-rich. A formal power analysis is part of the plan: it computes the minimum detectable hazard ratio given the realized event count, and it determines whether the pooled model, the stratified models, or only the pooled model are adequately powered. Where power is insufficient for a stratum, the dissertation will report that limitation rather than over-interpret a wide interval.

The effective sample size for a Cox model is governed by the number of events, not the number of episodes, because the partial likelihood is built from the risk sets at event times. With a small number of mission-ending losses, a useful rule of thumb is that roughly ten events are needed per covariate to keep the maximum partial-likelihood estimates approximately unbiased; with four covariates this implies a floor on the event count below which the base model is over-parameterized. Three mitigations are planned for the realistic case where events are scarce. First, the covariate set is kept deliberately small and theoretically motivated rather than expanded in search of significance. Second, Firth-type penalized partial likelihood is used as the primary estimator when the event count is low, because it reduces the small-sample bias and the separation problems that plague ordinary partial likelihood with rare events. Third, the autonomy effect is also estimated in a reduced model containing only autonomy and the single most important confounder, distance, so that the reader can see whether the conclusion depends on fitting all four covariates against a thin event count. Reporting all three keeps the inference honest about what the data can and cannot support, which is the statistical-conclusion-validity counterpart of the Talebian warning that rare-event samples are thin in exactly the region that matters.

## 6. Discussion

### 6.1 Implications if H1 is supported

If the data reject H0 in the direction of H1, the implication is that autonomy maturity buys measurable post-anomaly survival, and the hazard ratio quantifies how much. That number would enter architecture trades directly: a program could weigh the cost of moving up one autonomy level against the estimated reduction in loss hazard, conditional on its complexity and distance regime. The estimate would be most actionable for deep-space JPL missions, where the distance term is large and the ground loop is slow.

### 6.2 Implications if H0 is not rejected

If the data fail to reject H0, the implication is more cautionary and equally useful. It would indicate that, across the documented population and conditional on the controls, autonomy maturity does not by itself change survival after a fault, and that the engineering case for autonomy must rest on other grounds, such as operational cost, cadence, or specific mission phases like entry, descent, and landing where no ground loop is possible. A null at the pooled level combined with a tail effect in the hardest-episode subgroup would be the most likely nuanced outcome and would itself be a contribution.

### 6.3 Rival explanations

Three rival explanations must be addressed. The first is that autonomy is a marker for overall program quality rather than a cause of survival; conditioning on complexity and cost class reduces but does not remove this, and the discussion will be explicit about residual confounding. The second is that better-instrumented missions both detect more faults and survive more of them, so the autonomy score and the survival outcome share a common cause in instrumentation; the competing-risks and frailty specifications probe this. The third is reverse causation in the documentation, addressed by pre-flight autonomy scoring.

### 6.4 External validity

The estimate generalizes most safely to the class of missions that dominate the sample: complex, well-documented NASA and JPL robotic spacecraft. Extension to small satellites and commercial constellations is a hypothesis for future work, not a claim of this dissertation. The Talebian point recurs: because the sample undersamples the catastrophic tail, the external validity of any pooled estimate to the worst conceivable fault episodes is limited, and precaution argues against treating a favorable average as a guarantee in the tail.

### 6.5 What would falsify the contribution

The contribution is falsified by any of the following. A hazard ratio on autonomy that is statistically indistinguishable from one in the pre-registered specification fails to reject H0 and refutes H1. A hazard ratio whose sign reverses when the controls are added shows the raw association was confounding, not effect. A hazard ratio above one with an interval excluding one refutes H1 in the strongest way, indicating worse conditional survival for higher autonomy. Demonstration that the autonomy score is contaminated by post-loss documentation, or that the complexity index is driving the result through misspecification, would also undermine the contribution. Stating these refutation conditions in advance is the Fogelian commitment to letting the data decide.

## 7. Contribution and Conclusion

This dissertation proposes the first population-level, conditional hazard estimate of the effect of fault-management autonomy on spacecraft survival after a fault. Its contribution is narrow and falsifiable: a single coefficient, the hazard ratio on autonomy in a Cox model, that either supports or refutes the claim that higher-autonomy onboard fault management lowers the hazard of mission-ending loss conditional on entering a fault state, after controlling for complexity, distance, and age. The work bridges two literatures that have not met, the reliability-statistics tradition that models hardware failure and the fault-management engineering tradition that builds and demonstrates autonomy, by asking the outcome question that neither has answered. The methodological anchors give the work its discipline: Fogel's insistence on a quantitative, counterfactual, falsifiable proposition, and Taleb's insistence that mission-ending loss is a heavy-tailed event for which precaution and tail-focused interpretation are mandatory. The analysis is presented honestly at the design stage, with the estimator, identification strategy, threats to validity, and refutation conditions fully specified, and with all numerical results labeled as illustrative rather than estimated. Executed on the assembled dataset, the plan yields a defensible answer to a question NASA and JPL program managers face whenever they decide how much of fault management to entrust to the spacecraft itself.

## References

[1] J. R. Fox and others, "Fault tolerant design and autonomous spacecraft," 3rd Computers in Aerospace Conference, 1981. doi: [10.2514/6.1981-2170](https://doi.org/10.2514/6.1981-2170)

[2] R. D. Rasmussen and others, "System fault protection design for the Cassini spacecraft," 1996 IEEE Aerospace Applications Conference Proceedings, 1996. doi: [10.1109/aero.1996.495890](https://doi.org/10.1109/aero.1996.495890)

[3] M. Luckcuck, M. Farrell, L. A. Dennis, C. Dixon, and M. Fisher, "Formal Specification and Verification of Autonomous Robotic Systems: A Survey," ACM Computing Surveys, 2019. doi: [10.1145/3342355](https://doi.org/10.1145/3342355)

[4] "SPIDER - A simple emergent system architecture for autonomous spacecraft fault protection," AIAA Space 2001 Conference and Exposition, 2001. doi: [10.2514/6.2001-4685](https://doi.org/10.2514/6.2001-4685)

[5] J.-F. Castet and J. H. Saleh, "Satellite and satellite subsystems reliability: Statistical data analysis and modeling," Reliability Engineering and System Safety, 2009. doi: [10.1016/j.ress.2009.05.004](https://doi.org/10.1016/j.ress.2009.05.004)

[6] J.-F. Castet and J. H. Saleh, "Beyond reliability, multi-state failure analysis of satellite subsystems: A statistical approach," Reliability Engineering and System Safety, 2010. doi: [10.1016/j.ress.2009.11.001](https://doi.org/10.1016/j.ress.2009.11.001)

[7] J.-F. Castet and J. H. Saleh, "Single versus mixture Weibull distributions for nonparametric satellite reliability," Reliability Engineering and System Safety, 2010. doi: [10.1016/j.ress.2009.10.001](https://doi.org/10.1016/j.ress.2009.10.001)

[8] "Assurance of model-based fault diagnosis," 2018 IEEE Aerospace Conference, 2018. doi: [10.1109/aero.2018.8396550](https://doi.org/10.1109/aero.2018.8396550)

[9] J.-F. Castet and J. H. Saleh, "Statistical reliability analysis of satellites by mass category: Does spacecraft size matter?," Acta Astronautica, 2011. doi: [10.1016/j.actaastro.2010.04.017](https://doi.org/10.1016/j.actaastro.2010.04.017)

[10] G. F. Dubos, J.-F. Castet, and J. H. Saleh, "Statistical analysis and modelling of small satellite reliability," Acta Astronautica, 2014. doi: [10.1016/j.actaastro.2014.01.018](https://doi.org/10.1016/j.actaastro.2014.01.018)

[11] J. H. Saleh and others, "Spacecraft attitude control subsystem: Reliability, multi-state analyses, and comparative failure behavior," Acta Astronautica, 2013. doi: [10.1016/j.actaastro.2012.12.003](https://doi.org/10.1016/j.actaastro.2012.12.003)

[12] B. Pell, D. E. Bernard, S. A. Chien, E. Gat, N. Muscettola, and others, "A hybrid procedural/deductive executive for autonomous spacecraft," Proceedings of the Second International Conference on Autonomous Agents, 1998. doi: [10.1145/280765.280863](https://doi.org/10.1145/280765.280863)

[13] R. W. Fogel, "Railroads and American Economic Growth: Essays in Econometric History," 1964. doi: [10.2307/2552284](https://doi.org/10.2307/2552284)

[14] M. Bozzano and others, "Spacecraft early design validation using formal methods," Reliability Engineering and System Safety, 2014. doi: [10.1016/j.ress.2014.07.003](https://doi.org/10.1016/j.ress.2014.07.003)

[15] "A Robust Fault Protection Strategy for a COTS-Based Spacecraft," 2007 IEEE Aerospace Conference, 2007. doi: [10.1109/aero.2007.352647](https://doi.org/10.1109/aero.2007.352647)

[16] D. E. Bernard, G. A. Dorais, and others, "Spacecraft autonomy flight experience: The DS1 Remote Agent Experiment," Space Technology Conference and Exposition, 1999. doi: [10.2514/6.1999-4512](https://doi.org/10.2514/6.1999-4512)

[17] N. Muscettola, P. P. Nayak, B. Pell, and B. C. Williams, "On-board planning for New Millennium Deep Space One autonomy," 1997 IEEE Aerospace Conference, 1997. doi: [10.1109/aero.1997.574421](https://doi.org/10.1109/aero.1997.574421)

[18] "On-board fault management for autonomous spacecraft," NASA Technical Reports Server, 1993. url: [https://ntrs.nasa.gov/citations/19930013066](https://ntrs.nasa.gov/citations/19930013066)

[19] A. Gao and others, "Autonomy for Space Robots: Past, Present, and Future," Current Robotics Reports, 2021. doi: [10.1007/s43154-021-00057-2](https://doi.org/10.1007/s43154-021-00057-2)

[20] "Applications and Challenges of Artificial Intelligence in Space Missions," IEEE Access, 2021. doi: [10.1109/access.2021.3132500](https://doi.org/10.1109/access.2021.3132500)

[21] "Improving Spacecraft Health Monitoring with Automatic Anomaly Detection Techniques," AIAA SPACE 2016, 2016. doi: [10.2514/6.2016-2430](https://doi.org/10.2514/6.2016-2430)

[22] L. Erhan and others, "Smart anomaly detection in sensor systems: A multi-perspective review," Information Fusion, 2021. doi: [10.1016/j.inffus.2020.10.001](https://doi.org/10.1016/j.inffus.2020.10.001)

[23] N. N. Taleb, R. Read, R. Douady, J. Norman, and Y. Bar-Yam, "The Precautionary Principle (with Application to the Genetic Modification of Organisms)," arXiv, 2014. doi: [10.48550/arxiv.1410.5787](https://doi.org/10.48550/arxiv.1410.5787)

[24] H. G. Lewis, "Understanding long-term orbital debris population dynamics," Journal of Space Safety Engineering, 2020. doi: [10.1016/j.jsse.2020.06.006](https://doi.org/10.1016/j.jsse.2020.06.006)

[25] D. R. Cox, "Regression Models and Life-Tables," Journal of the Royal Statistical Society: Series B, 1972. doi: [10.1111/j.2517-6161.1972.tb00899.x](https://doi.org/10.1111/j.2517-6161.1972.tb00899.x)

[26] P. K. Andersen and R. D. Gill, "Cox's Regression Model for Counting Processes: A Large Sample Study," Annals of Statistics, 1982. doi: [10.1214/aos/1176345976](https://doi.org/10.1214/aos/1176345976)

[27] T. M. Therneau and P. M. Grambsch, "Modeling Survival Data: Extending the Cox Model," Springer, 2000. doi: [10.1007/978-1-4757-3294-8](https://doi.org/10.1007/978-1-4757-3294-8)

[28] L. D. Fisher and D. Y. Lin, "Time-Dependent Covariates in the Cox Proportional-Hazards Regression Model," Annual Review of Public Health, 1999. doi: [10.1146/annurev.publhealth.20.1.145](https://doi.org/10.1146/annurev.publhealth.20.1.145)

[29] B. Lau, S. R. Cole, and S. J. Gange, "Competing Risk Regression Models for Epidemiologic Data," American Journal of Epidemiology, 2009. doi: [10.1093/aje/kwp107](https://doi.org/10.1093/aje/kwp107)

[30] L. Duchateau and P. Janssen, "Frailty Models in Survival Analysis," in The Frailty Model, Springer, 2008. doi: [10.1201/9781420073911](https://doi.org/10.1201/9781420073911)