# Does Flight Heritage Buy Reliability? A Cross-Mission Regression of Realized On-Orbit Failure Rates Against Heritage and Parts-Class

**Candidate:** JPL_MGMT_SMA_TECH_04

**Program:** COLLEGIUM 1st Battalion

**North Star / JPL category:** Safety, Mission Assurance and Health

**Hall-of-Shoulders anchors:** Angrist and Pischke (design-based econometrics); Rubin (potential outcomes, design-before-analysis); the Castet and Saleh satellite-reliability program (domain-empirical anchor)

**Date:** 2026-06-15

## Abstract

Few judgments in spacecraft mission assurance carry as much quiet weight, or as little scrutiny, as the appeal to flight heritage at a design review. A subsystem or component that has flown before is widely assumed to carry lower delivered risk, and heritage claims routinely shape architecture decisions, parts selection, and the scope of the qualification and acceptance test program. The empirical basis for that assumption is weaker than the rhetorical weight placed on it. Published statistical reliability work shows that infant mortality and subsystem-level anomalies persist across populations that include heritage-rich designs, and that reliability varies by orbit, mass class, and subsystem in ways heritage alone does not explain. This dissertation specifies a cross-mission regression of realized on-orbit subsystem failure outcomes against three competing drivers, claimed flight-heritage depth, EEE parts-class, and integration-and-test program fidelity, with controls for mission environment, mission prominence, mass class, launch epoch, and survivorship.

The falsifiable contribution is a head-to-head test. The null hypothesis (H0) holds that prior-flight heritage is the primary driver of delivered reliability for JPL-class spacecraft. The alternative (H1) holds that realized failure rate is predicted more strongly by parts-class and test-program fidelity than by claimed heritage once confounders are controlled. The design uses a mixed-effects survival specification with subsystem random effects and a discrete-time complementary-log-log companion for an infant-mortality outcome, estimated on NASA anomaly and lessons-learned records, NTRS reliability and parts-stress reports, and JPL mission archives that document heritage and parts-class per subsystem. The methodological frame follows the design-based econometrics of Angrist and Pischke and the potential-outcomes and observational-design discipline of Rubin, with explicit attention to selection on observables, bad controls, overlap, and survivorship correction. This is a design-stage analysis plan: results are presented as expected directions and illustrative magnitudes, clearly labeled as not yet executed on the full assembled dataset. The contribution is the pre-registered specification and the falsification conditions, not estimated coefficients. The value to the Safety, Mission Assurance and Health portfolio does not depend on which hypothesis the data support, because either outcome tells the portfolio where its next assurance dollar buys the most reliability and which of its two characteristic errors it is more often making.

## Table of Contents

- Abstract
- Chapter 1: Introduction
- Chapter 2: Theoretical Framework
- Chapter 3: Literature Review
- Chapter 4: Data and Measurement
- Chapter 5: Research Design and Identification
- Chapter 6: Analysis Plan and Expected Results
- Chapter 7: Discussion
- Chapter 8: Conclusion
- References
- Appendix A: Variable and Data Dictionary
- Appendix B: Derivation of the Estimators
- Appendix C: Documentation-Probability (Inverse-Probability-Weighting) Model
- Appendix D: Pre-Registration Block (Frozen Specification)
- Appendix E: Minimum-Detectable-Difference Power Tables
- Appendix F: Source-Provenance Log for the Corpus


## List of Tables and Figures

- Table 3.1. What each literature theme delivers and withholds (Chapter 3)
- Table 3.2. The three predictors and their evidentiary status before estimation (Chapter 3)
- Table 4.1. Measurement table: constructs, operational definitions, sources, scales (Chapter 4, Section 4.3.1)
- Table E.1. Illustrative minimum detectable standardized coefficient difference (Appendix E)

No figures are included; the dissertation is design-stage and presents no estimated results to plot.

# Chapter 1: Introduction

## 1.0 The chapter's answer, stated first

This dissertation contributes a pre-registered, falsifiable cross-mission survival specification that puts claimed flight heritage in direct competition with electrical, electronic, and electromechanical (EEE) parts-class and integration-test fidelity as predictors of realized JPL-class subsystem reliability. The deliverable is the design and the falsification conditions, not estimated coefficients. The chapter that follows develops that answer, but the answer comes first by intent, because the discipline this work owes to the missions and the people who fly them is to lead with the claim and then earn it, rather than to accumulate background and hope a thesis emerges.

The claim being earned is narrow and decidable. Spacecraft review boards routinely treat the word "heritage" as a reason to reduce the scope of qualification and acceptance testing and, on occasion, to relax the parts-class standard applied to a subsystem. The justification is that prior on-orbit operation has already retired the risk. This dissertation asks whether that justification survives contact with the data, and it frames the question so that the data can answer in either direction. The contribution is the apparatus that makes the answer falsifiable: a mission-by-subsystem hazard model, a control set that absorbs the program forces which jointly produce provenance and rigor, an overlap restriction that refuses to extrapolate, a survivorship correction built into the sampling frame rather than appended as a caveat, and a decision rule fixed in advance so that the result cannot be talked into agreement with the researcher's prior.

What this chapter does, beyond stating the thesis, is establish that the problem is real, that it is material, and that no existing study answers it on the population that matters for the Jet Propulsion Laboratory and for NASA's Safety, Mission Assurance and Health portfolio. It then states the single falsifiable contribution as a head-to-head hypothesis test, disambiguates the slippery term at the center of the dispute, sets out the cost and decision stakes, fixes the scope and the delimitations, defines the operative terms, and lays out the road the rest of the dissertation travels. The register throughout is design-stage. No empirical result has been executed on the full assembled dataset; where this chapter gestures at expected patterns, it labels them as expectations that define the test, never as findings.

## 1.1 The problem in full: heritage as a substitute for rigor

The current state of spacecraft mission assurance is one in which a claim about a subsystem's ancestry is permitted to stand in for measurement of the delivered article. Mission assurance allocates three scarce and expensive resources under schedule and cost pressure: review attention, qualification and acceptance test budget, and high-reliability parts-procurement money. When a subsystem, box, or component is described as heritage, the implicit argument made to the review board is that prior on-orbit operation has already retired the risk that fresh design would carry, and that the qualification and acceptance program can therefore be reduced in scope. Heritage is treated, in working practice, as a substitute for test fidelity and sometimes for parts-class rigor. This is not a marginal rhetorical habit. It is one of the most frequently invoked justifications in the design-review process, and heritage claims routinely shape architecture decisions, parts selection, and the scope of the qualification and acceptance test campaign.

The difficulty, stated plainly, is that heritage is a claim about provenance, not a measured property of the delivered article. A heritage label can attach to a design that was rebuilt with different parts lots, modified for a new thermal or radiation environment, integrated by a different team, or subjected to a thinner test campaign than the original. The phrase "same as before" can be true at the level of a block diagram and simultaneously false at the level of the parts list and the test matrix. The two levels are not the same risk object. A functional architecture that has flown carries information about whether the design concept works; it carries far less information about whether this physical instance of that concept, fabricated from these parts, integrated by this team, and exercised through this test program, will survive the orbit it is about to enter.

The claim that motivates this dissertation can be stated plainly and defended on evidence: current practice permits a weak heritage argument to license real reductions in delivered-article rigor. The descriptive reliability literature documents persistent infant mortality and persistent subsystem-level anomalies across satellite populations that include heritage-rich designs. Castet and Saleh, building nonparametric and parametric reliability functions from databases of on-orbit failures, established that satellite reliability is not well described by a constant hazard and that a non-negligible fraction of failures occurs early in life, consistent with latent-defect infant mortality rather than wear-out [\[19\]](#ref-19). Tafazoli's review of on-orbit failures located a large share of anomalies in a small number of subsystems and traced a meaningful fraction to design and parts issues rather than to random external causes [\[100\]](#ref-100). The platform health scorecard work cataloged anomalies and failures by subsystem and confirmed the uneven distribution [\[95\]](#ref-95). If heritage actually retired risk in proportion to how often it is invoked, the early-failure regime in heritage-rich populations would be smaller than it is; the persistence of infant mortality in populations where heritage is common is therefore evidence that the heritage label and the delivered reliability are imperfectly coupled. The maturity literature reinforces the logic, showing that lower-maturity technology carries measurable, documented program risk, and that the maturity which matters is the maturity of the delivered article in its actual environment, not the maturity of the design concept [\[33\]](#ref-33). The boundary of the argument is stated honestly: it establishes that heritage and delivered reliability are imperfectly coupled, not the strength of the coupling, and certainly not that heritage is worthless. One objection must be granted, that the persistence of early failure could reflect the novelty-dominated subsystems, such as instruments, where heritage is least available, rather than a failure of heritage where it is claimed; the design answers it by coding heritage at the subsystem level and by running the analysis with and without the payload instrument, so that the heritage signal is not contaminated by the subsystems for which heritage was never on offer.

The decision-relevant failure mode, the one that gives this problem its bite, is the substitution of a weaker heritage claim for a stronger one. A design-heritage box flown to a new environment is treated as if it carried same-environment flight heritage, and its qualification and acceptance program is reduced accordingly. If realized reliability is in fact governed by what is inside the box, namely the parts-class, and by how thoroughly the box was exercised before launch, namely the test fidelity, then heritage labeling may be capturing those things only loosely, and may in some cases license the very reductions in parts rigor and test scope that drive failures. The desired state, against which the current state is measured, is an assurance posture in which the heritage discount is granted only when the delivered article matches the heritage article in parts-class and meets a test-fidelity floor in the new environment, and in which that discount is justified by an explicit empirical test rather than by the reflex of the phrase. The gap between current and desired states is the absence of any specification that separates heritage from the rigor it is assumed to proxy. The consequence of leaving the gap unfilled is that assurance dollars keep flowing on faith: a wrong heritage discount that produces an on-orbit subsystem failure can cost a mission, while an overcautious denial of a justified discount wastes test budget that could have bought margin elsewhere, and the portfolio cannot tell which of the two errors it is more often making.

## 1.2 The gap in the literature
The published statistical reliability literature on satellites is mature on description and thin on causal attribution, and the precise shape of that thinness is what this dissertation exploits. The empirical anchor for the field is the satellite reliability program of Castet and Saleh. Their nonparametric reliability estimates demonstrate the early-failure regime [\[19\]](#ref-19); their comparison of single-Weibull and mixture-Weibull fits shows that a mixture, capturing an early-failure subpopulation and a longer-lived subpopulation, fits the on-orbit data better than a single distribution [\[21\]](#ref-21); their multi-state extension moves beyond binary working-or-failed accounting to graded degradation [\[20\]](#ref-20); and the reliability-by-mass analysis shows that the failure distribution shifts with platform class, which means spacecraft size carries reliability information that aggregate curves obscure [\[32\]](#ref-32). Tafazoli's failure review and the Saleh and Castet health scorecard establish that failures concentrate in a handful of subsystems and that the concentration is stable enough to model [\[100\]](#ref-100)[\[95\]](#ref-95). Subsystem-specific extensions deepen this base: the electrical power subsystem has been characterized with its own failure-behavior and multi-state reliability analysis [\[54\]](#ref-54), and the attitude control subsystem has been characterized with a comparative LEO-versus-GEO failure analysis that makes the environment dependence concrete [\[108\]](#ref-108).

This body of work does a great deal, and the dissertation depends on it. It establishes that the outcome, subsystem-level early and total failure, has enough variation to be modeled and is not so rare that estimation is hopeless. It establishes the dominant confounder structure, because subsystem identity, orbit, and mass class all shift the failure hazard, and any test of heritage must condition on them or absorb them with random effects. What it does not do is isolate the contribution of claimed heritage from the contribution of parts-class and test-program fidelity, holding mission environment and prominence fixed, on a population that includes JPL-class deep-space and science missions. The descriptive reliability curves tell a project what the failure distribution looks like; they do not tell a project whether the next heritage claim on the table is buying delivered reliability or merely buying a justification to cut test scope.

That this gap is real, and not an artifact of incomplete search, deserves a careful statement. No prior study isolates heritage from parts-class and test-fidelity on a JPL-class population with design-based identification. The case rests on two observations. The descriptive reliability literature, surveyed above, treats heritage at most as an unmodeled background condition rather than as a coded regressor competing against parts and test. The parts-reliability literature, surveyed in Chapter 3, treats parts-class and screening as device-level determinants without placing them in competition with a heritage variable on a common population. A question framed as a head-to-head coefficient comparison can only be answered by a study that constructs all three regressors at the same unit of analysis and estimates them jointly, and no such study exists for this population. The corpus assembled for this dissertation confirms the point: it is strong on descriptive satellite reliability and on the causal-inference toolkit yet contains few sources that quantify a heritage variable against realized failure directly, since heritage is overwhelmingly invoked qualitatively in the literature. The absence of a direct heritage-quantification study is partly a function of data access, because the heritage construct lives in project archives that are not open literature, which is exactly why this dissertation must lean on the JPL mission archives as a primary source rather than on a citable secondary study. An unindexed or proprietary study could of course exist; the design answers that possibility not by claiming exhaustive certainty but by stating the gap plainly and by making its own specification reproducible, so that if such a study surfaces the two can be compared on method.

## 1.3 The research questions, broken out explicitly

The dissertation is organized around one primary question and a small set of subordinate questions that the design must answer in order to answer the primary one.

The primary research question is this. Does claimed flight heritage actually buy delivered on-orbit reliability for JPL-class spacecraft, or is realized subsystem failure rate governed instead by EEE parts-class and integration-test fidelity once mission environment, prominence, and survivorship are controlled?

This primary question decomposes into five subordinate questions, each of which corresponds to a design decision the dissertation must defend.

The first subordinate question is one of measurement: can heritage depth, parts-class, and test-program fidelity each be constructed as auditable, outcome-blind variables at the mission-by-subsystem level from the available archival and reporting sources, with reported inter-coder reliability for the coding-intensive constructs? Without an affirmative answer here, the head-to-head test has no regressors to compare, and Chapter 4 is devoted to establishing it.

The second subordinate question is one of identification: under what conditioning set is the assignment of heritage, parts-class, and test fidelity to a subsystem plausibly as good as unconfounded with the residual determinants of failure, and does that conditioning set avoid the bad-control trap of absorbing the effect under test? Chapter 5 answers this by specifying the control set, the overlap restriction, and the rule that no post-design, pre-outcome test verdict enters the model.

The third subordinate question is one of overlap and answerability: within strata of environment, prominence, mass class, epoch, and subsystem type, does the population contain both heritage-rich and heritage-poor subsystems at comparable parts-class and test-fidelity, so that a within-stratum comparison exists at all? This question can return a negative answer, and the dissertation treats that negative as a first-class result rather than a failure, because a finding that heritage and rigor are too tightly bundled to separate is itself decision-relevant for the portfolio.

The fourth subordinate question is one of survivorship: how much does the under-representation of early-failed and short-lived missions in the documentation bias the heritage-versus-rigor comparison, and how far can the comparison be corrected by sampling from launch manifests, weighting by the inverse probability of documentation, and bounding the behavior of the undocumented cells? Chapter 5 builds this correction into the design.

The fifth subordinate question is one of power and honest reporting: given the modest number of well-documented JPL-class missions and the within-mission clustering, what is the minimum detectable difference between the standardized heritage coefficient and the standardized parts-class or test-fidelity coefficient, and at what point must a non-result be reported as underpowered rather than as confirmation of the null? Chapter 6 computes this quantity and ties the interpretation of any non-result to it.

These subordinate questions are not decoration. Each one is a place where the primary question could fail to be answerable, and stating them explicitly is the design discipline that keeps the dissertation from claiming an answer the data cannot support.

## 1.4 The single falsifiable contribution stated as H0 and H1

The contribution is one head-to-head comparison of predictors, stated so that it can be falsified. The two hypotheses are reproduced here verbatim, because the whole apparatus of the dissertation exists to decide between them and any drift in their wording would unmoor the falsification rule from the design.

**H0 (null):** Prior-flight heritage depth is the primary driver of delivered on-orbit reliability for JPL-class spacecraft. After conditioning on observed confounders, heritage depth carries the largest and most robust association with reduced subsystem failure hazard, and parts-class and test-program fidelity add little once heritage is included.

**H1 (alternative):** Realized subsystem failure rate is predicted more strongly by EEE parts-class and integration-test fidelity than by claimed heritage depth. After conditioning on the same confounders, the parts-class and test-fidelity coefficients dominate the heritage coefficient in magnitude and robustness, and heritage adds little incremental predictive power once parts-class and test-fidelity are included.

The test is decided by the relative strength and stability of the heritage coefficient against the parts-class and test-fidelity coefficients in a specification that controls for mission environment, mission prominence, and survivorship, with subsystem random effects. The contribution is falsified in the direction of H0 if heritage depth retains the dominant, stable association after parts-class and test-fidelity enter the model. The contribution is supported in the direction of H1 if the heritage coefficient attenuates toward negligible effect once parts-class and test-fidelity enter, while those two carry the larger and more stable associations.

The formal object of the test is fixed and carried verbatim from the design bible into the chapters that estimate it. The log hazard of first failure for subsystem cell i in mission m at on-orbit time t is written as a proportional-hazards form, the sum of a baseline log hazard that depends on time, a linear index in the three regressors of interest, a linear index in the controls, and a subsystem random intercept:

\[ \log h(t) = \log h_0(t) + \beta_1 \text{Heritage}_i + \beta_2 \text{PartsClass}_i + \beta_3 \text{TestFidelity}_i + \gamma \text{Controls}_{im} + u_s \qquad\qquad (1) \]

Here Heritage, PartsClass, and TestFidelity are the ordinal or index regressors defined in Section 1.6 and constructed in Chapter 4; Controls are environment, prominence, mass class, and launch epoch; \( u_s \) is the Gaussian random intercept for subsystem type s, which absorbs the documented subsystem-specific baseline hazard; and \( h_0(t) \) is the flexible, piecewise-constant or Weibull-mixture, baseline consistent with the documented early and late failure regimes [\[21\]](#ref-21). Because the regressors are placed on a common standardized scale before estimation, the coefficients \( \beta_1 \), \( \beta_2 \), and \( \beta_3 \) are directly comparable in magnitude, which is precisely what the falsification rule requires. The nested comparison estimates the index first without parts-class and test-fidelity, which is Model A, namely heritage plus controls, and then with them, which is Model B. H0 predicts that \( |\beta_1| \) is the largest standardized magnitude and remains stable and bounded away from zero when \( \beta_2 \) and \( \beta_3 \) are added. H1 predicts that \( |\beta_2| \) and \( |\beta_3| \) exceed \( |\beta_1| \) and that \( \beta_1 \) collapses toward an interval covering negligible effect once \( \beta_2 \) and \( \beta_3 \) enter. The contribution of this dissertation is this pre-registered specification and its falsification conditions, not estimated coefficients; no coefficient is reported here or anywhere in the design-stage document as a finding.

## 1.5 What "heritage" actually denotes

Heritage is not one thing, and the imprecision is part of the problem this dissertation isolates rather than an incidental nuisance. At least four distinct claims travel under the single word, and a review board that hears "heritage" without disambiguation cannot tell which claim is being made.

The weakest is design heritage: the block diagram, the functional architecture, or the algorithm has flown before, but the physical article is newly fabricated. Design heritage carries information that the concept is sound and essentially nothing about the delivered instance.

Next is build heritage: the article was manufactured to the same drawings, by a comparable process, often by the same supplier, so the workmanship is presumed equivalent. Build heritage adds information about manufacturing consistency but still says nothing definitive about the parts populating the build or the environment it will face.
Stronger still is parts heritage: the same EEE parts, drawn from the same qualified lots or at least the same class, populate the new build, so the intrinsic defect rate is presumed equivalent. Parts heritage begins to constrain the property that the rival hypothesis says actually matters, the intrinsic defect and degradation rate of the article.

The strongest claim, and the only one that retires environmental risk, is same-environment flight heritage: the article, or an article identical to it in design, build, and parts, has already operated successfully in the orbit and radiation environment the new mission will impose. Only this fourth claim retires the environmental risk that a new mission imposes.

These four claims are not interchangeable, and the decision-relevant failure mode is the substitution of a weaker claim for a stronger one. A design-heritage box flown to a new environment is treated as if it carried same-environment flight heritage, and its qualification and acceptance program is reduced accordingly. The variable construction in Chapter 4 therefore codes heritage as an ordinal depth, with the ordered levels none, design-only, design-plus-build, and design-plus-build-plus-same-environment flight, and codes same-environment against the orbit and radiation environment of the prior flight rather than against the mere fact of a prior flight. Coding heritage as an ordinal depth lets the regression distinguish these claims rather than collapsing them, and the falsification test turns on whether the depth that matters for delivered reliability is heritage depth or, instead, the parts-class and test-fidelity of the delivered article. The disambiguation is not a definitional preliminary that the analysis then sets aside. It is load-bearing, because a robustness check in Chapter 6 deliberately re-codes the top heritage category to require same-environment flight, testing whether any apparent heritage association is driven entirely by the same-environment cases. If it is, that finding itself supports the rival reading, because it would mean environment-matched verification, not provenance, carries the signal.

## 1.6 Definitions of key terms

The dissertation uses a fixed vocabulary, and the operative terms are defined here so that the chapters that build and estimate the variables inherit a single meaning for each.

The unit of analysis is the mission-by-subsystem cell. For each spacecraft in the assembled population, each functional subsystem, for example attitude control, command and data handling, electrical power, propulsion, thermal, telecommunications, and payload instrument, is one record, and the outcome variables are measured at this cell. This unit is chosen because the descriptive literature shows that failure behavior is subsystem-specific and that aggregating to the spacecraft level discards the variation that distinguishes the hypotheses [\[95\]](#ref-95)[\[54\]](#ref-54).

Two outcomes are defined. The first is time-to-first-failure, measured in days from on-orbit commissioning to the first recorded anomaly that meets a failure-severity threshold, right-censored at end of mission or end of observation window. The second is an infant-mortality indicator, equal to one if a failure-severity anomaly occurred within a fixed early window after commissioning, where the early window is set from the inflection of the mixture-Weibull early subpopulation reported in the reliability literature rather than chosen ad hoc [\[21\]](#ref-21).

Heritage depth is the ordinal measure described in Section 1.5: none, design-only, design-plus-build, and design-plus-build-plus-same-environment flight, with same-environment coded against the prior-flight orbit and radiation environment.

EEE parts-class is an ordinal measure mapping the dominant class of the subsystem's EEE parts to the standard space parts hierarchy, for example class S or equivalent high-reliability, class B, and commercial or COTS, with a screening-level subindicator.

Test-program fidelity is an index built from the integration and test plan and the as-run records, capturing the presence and duration of thermal-vacuum cycling, vibration and acoustic qualification, parts-level screening and burn-in, and system-level functional-test coverage. The index is constructed before outcomes are examined.

The controls are mission environment, meaning orbit class and radiation environment; mission prominence, a proxy for review intensity and budget, for example flagship versus competed-line versus smaller class; spacecraft mass class; and launch epoch, included to absorb secular technology change.

Two further terms recur and are fixed here. Model A is the specification regressing the outcome on heritage depth plus controls. Model B is the specification that adds parts-class and test-fidelity to Model A. The nested comparison from Model A to Model B is the operation that decides the test.

## 1.7 Significance for NASA, JPL, and the named stakeholders

Mission assurance decisions about test scope and parts class are made under the heritage banner on most JPL-class programs, and that fact alone makes the question significant. The significance can be stated with more precision than mere ubiquity, and it should be, because the value of the contribution does not depend on which hypothesis wins.

The significance under H1 is a concrete reallocation of assurance effort. If realized failure rate is predicted more strongly by parts-class and test-fidelity than by claimed heritage, the policy implication is that heritage claims should be discounted unless accompanied by evidence of equivalent parts-class and equivalent or greater test fidelity in the delivered configuration, and that review boards should weight delta-qualification of the as-built article over provenance of the design lineage. This moves assurance attention from provenance review toward verification of the delivered article. The significance under H0 is the symmetric and equally useful result. If heritage depth retains the dominant, stable association after parts-class and test-fidelity enter, the current reliance on heritage is vindicated and the burden shifts back to demonstrating that test and parts rigor add value beyond what heritage already secures. Either outcome is decision-relevant for the Safety, Mission Assurance and Health portfolio, because either outcome changes where assurance dollars should go.

The causal account that makes this significance concrete is worth tracing as a chain rather than asserting as a correlation. The driver is a weak-heritage claim substituted for a strong-heritage claim at design review. The mechanism is that qualification and acceptance scope and parts-class rigor are reduced on provenance grounds, leaving latent defects and environment-mismatch unverified on the delivered article. The observable effect is elevated early, infant-mortality, and total subsystem failure hazard on that delivered article. The operational consequence is an on-orbit subsystem anomaly or loss on a JPL-class mission. The strategic implication is that assurance resources are misallocated toward provenance review and away from delivered-article verification. This is a mechanism, not a bare association, and the dissertation's design is built to test whether the mechanism operates by separating the provenance regressor from the delivered-article regressors. Where the design can only establish association under unconfoundedness rather than identified causation, it says so and downgrades its confidence accordingly.

The cost stakes give the mechanism its weight, and they are not marginal. Qualification and acceptance test campaigns and high-reliability parts procurement are among the larger discretionary lines in a spacecraft budget, and a heritage argument that justifies cutting them reallocates real money. A wrong heritage discount that produces an on-orbit subsystem failure can cost a mission; a heritage discount that is in fact justified but is denied by an overcautious board wastes test budget that could have funded margin elsewhere. The portfolio needs to know which error it is more often making, and at present it has no instrument that tells it. The confidence attached to this significance claim is moderate at the design stage and is explicitly contingent on the data: it would be raised by an executed estimation that meets the overlap and power conditions, and it would be lowered by an overlap diagnostic showing that heritage and rigor are too bundled in JPL practice to separate, in which case the honest contribution shifts from a heritage discount rule to a recommendation that the rigor be required regardless of the heritage claim.

The named stakeholders for whom this matters are concrete. The Safety, Mission Assurance and Health portfolio, the North Star and JPL category under which this work sits, is the primary consumer, because the result rewrites where its assurance budget should concentrate. JPL mission assurance managers and chief engineers, who must decide test scope at each design review, are the operational stakeholders, because the result tells them whether a heritage claim on the table licenses a reduction or demands a delta-qualification. NASA's broader program-assurance function is a stakeholder because the question of whether provenance substitutes for verification recurs across the agency's class-A and class-B missions, not only at JPL. The design community that authors heritage claims is also a stakeholder, because a result that disciplines the heritage discount disciplines the incentive to make the weakest claim that will clear a board.

## 1.8 Scope and delimitations

The scope of this dissertation is deliberately bounded, and the bounds are stated as delimitations rather than discovered later as limitations.

The population is JPL-class missions: deep-space and science spacecraft for which the project archives document heritage assessments, parts-control records, and integration-and-test plans at the subsystem level. The study does not claim to characterize commercial constellations or the smallest CubeSat class, where the parts and test regimes differ in kind and where the heritage construct itself often does not apply [\[59\]](#ref-59)[\[12\]](#ref-12). The small-satellite and NewSpace evidence is used in this dissertation to bound external validity and to motivate replication hypotheses, not to extend the estimand.

The contribution is a specification and its falsification conditions, not an executed empirical result. This is a delimitation of claim, not only of progress. The dissertation reports expected directions and illustrative magnitudes that define the falsification thresholds, and it labels them as expectations, because the full mission-by-subsystem dataset is still being assembled from the JPL archives and the NASA anomaly records. No estimated coefficient is presented as a finding anywhere in the document.

The estimand is a comparison of conditional associations, not a single average treatment effect. Because heritage, parts-class, and test-fidelity are not randomly assigned across spacecraft, the strongest defensible claim from the observational design is a conditional association under stated unconfoundedness assumptions, and the dissertation frames the test as a nested-model coefficient comparison rather than as the estimation of one causal contrast.

The architecture-traceability layer is explicitly out of scope. This is an empirical-econometric reliability study, not an enterprise or systems-architecture deliverable. No real capability, system, data or service exchange, or enterprise outcome is in scope; the unit of analysis is the mission-by-subsystem statistical cell. The dissertation therefore does not construct a strategic-objective-to-capability-to-activity-to-function-to-exchange-to-measure traceability chain, and it does not force systems-architecture vocabulary onto a statistical contribution. The decision-relevance that such a chain would carry is instead carried by the mission-assurance policy implications developed in the discussion, which is the appropriate substitute for an architecture-traceability chain in a study whose object is a hazard coefficient.

Finally, the dissertation delimits its causal language. It does not assert identified causation. It asserts conditional association under unconfoundedness, defends that conditioning with a control set, an overlap restriction, and a bad-controls discipline, and states the residual confounding it cannot remove as a limit on the causal reading rather than papering over it.
## 1.9 Roadmap of the dissertation

The dissertation proceeds in eight chapters, and the logic that links them follows a single line of argument carried from this introduction: the problem is real, the problem is material, the design addresses the causal mechanism, the design beats the alternatives, and the residual risk is acceptable.

Chapter 1, this chapter, has stated the problem in full, located the gap, broken out the research questions, fixed the single falsifiable contribution as H0 and H1, disambiguated the heritage construct into its four levels, set out the significance and stakes, and bounded the scope. It establishes the first two links of the argument: the problem is real and the problem is material.

Chapter 2 builds the theoretical framework. It develops the conceptual split between reliability-as-delivered and reliability-as-provenance, recasts heritage as an informal maturity claim tied to the technology-readiness literature, sets parts-class and test as the rival predictors with their mechanism stated, and installs the potential-outcomes and design-based frame of Angrist and Pischke and of Rubin that lets the two theories be tested head-to-head, translating the econometric apparatus into spacecraft terms.

Chapter 3, the largest chapter, reviews the literature. It funnels from broad satellite-reliability statistics through subsystem and environment differentiation, into the heritage and maturity literature, then into the parts, radiation, and COTS rival literature and the small-satellite evidence, and arrives at the causal-attribution gap that the descriptive literature leaves open. Every cited result is interpreted for what its convergence means for the argument, not merely listed.

Chapter 4 specifies the data and measurement. It names the three source classes, the NASA anomaly and lessons-learned records, the NTRS reliability and parts-stress reports, and the JPL mission archives; fixes the mission-by-subsystem unit; operationalizes each variable defined in Section 1.6; confronts survivorship as a first-order data threat; and details the record linkage and the inter-coder reliability that make the coding auditable.

Chapter 5 sets out the research design and identification. It specifies the mixed-effects survival estimator and its discrete-time companion with the fixed notation, defends the selection-on-observables identification through the control set, the overlap restriction, and the bad-controls discipline, builds the survivorship correction into the sampling frame and the weighting, and catalogs the threats to internal, external, construct, and statistical-conclusion validity. This chapter establishes the third and fourth links of the argument: the design addresses the causal mechanism and beats the alternatives.

Chapter 6 lays out the analysis plan. It states the eight-step estimation procedure, the expected and explicitly illustrative findings that define the test, the pre-registered falsification rule, the fixed diagnostics and robustness re-codings, and the power analysis that ties any non-result to the minimum detectable coefficient difference. This chapter establishes the fifth link: the residual risk is acceptable, because the design reports its own limits honestly.

Chapter 7 discusses the implications under each hypothesis, the three rival readings of heritage-rigor bundling, mediation rather than confounding, and program-competence confounding, and the external-validity boundary, and it locates the decision-relevance of the work in mission-assurance policy.

Chapter 8 concludes by restating the contribution as a specification rather than a coefficient, affirming the value to the Safety, Mission Assurance and Health portfolio regardless of which hypothesis wins, and naming the execution path: complete the assembly of the JPL heritage and parts records and the NASA anomaly outcomes into the mission-by-subsystem frame, and execute the pre-registered specification, reporting the falsification decision exactly as defined.

The backmatter supplies the full bibliography with hyperlinked citations and a set of appendices: the variable coding manual, the subsystem-taxonomy crosswalk, the documentation-probability model specification, the frozen pre-registration block, the minimum-detectable-difference power tables, and the source-provenance log for the corpus.

The thread that runs through all eight chapters is the one stated in Section 1.0 and never abandoned. The dissertation does not claim to have measured whether heritage buys reliability. It claims to have built the instrument that can measure it, fixed in advance so that the answer, in either direction, will be the data's and not the researcher's.

# Chapter 2: Theoretical Framework

## 2.0 The chapter thesis

The reliability that a spacecraft subsystem actually delivers on orbit is a property of the article that flew, not of the lineage from which its design descended. That distinction is the theoretical hinge of this dissertation, and making it operational and testable is the work of this chapter. Heritage, parts-class, and test-program fidelity are routinely treated as if they were three names for the same underlying quality, maturity, with heritage taken as the most economical signal of it. They are not interchangeable. They refer to logically distinct objects, and their conflation is what lets a review board grant a heritage discount that the delivered article has not earned.

The framework that follows builds two competing theories of where delivered reliability comes from: a provenance theory and a delivered-article theory. It then installs the causal-inference scaffold, the potential-outcomes formalism of Rubin and the design-based discipline of Angrist and Pischke, that allows those theories to stand in direct, falsifiable competition rather than being asserted past one another. The conceptual model the empirical chapters will test is stated here as a nested coefficient comparison: whether the standardized association of claimed heritage depth with the subsystem failure hazard survives the entry of parts-class and test-fidelity, or collapses toward negligible effect when those delivered-article properties are conditioned on.

Mission assurance currently operates on an untested theory. The word "heritage" functions as an informal maturity certificate that licenses reductions in qualification scope and parts rigor, but no specification separates the provenance claim from the article properties it is assumed to proxy. What that certificate actually buys, in terms of reduced failure hazard on the delivered article, has never been measured against the alternative explanations on this population. The gap is not a gap in the descriptive reliability literature, which is mature, but a gap in its conceptual apparatus: nothing in it distinguishes provenance from delivered-article properties, and nothing supplies an identification strategy that could adjudicate between them on observational data. Leaving the gap open has a consequence. Assurance attention and budget flow on faith, and the field cannot tell whether its standing practice is buying reliability or merely buying a justification to stop paying for it.

This chapter does not present empirical results. It is a design-stage theoretical development. Where it states what the framework predicts, those predictions are expected directions that define the test, not estimated quantities, and they are labeled as such. The contribution is the conceptual model and the argument that the model is identifiable in principle.

## 2.1 Reliability as delivered versus reliability as provenance

The framework begins with a single conceptual split that the rest of the dissertation depends on: the distinction between reliability as a property of the delivered article and reliability as a claim about the article's provenance. This split is the theoretical hinge of the entire study, and stating it precisely is the work of this section.

Reliability, in the sense that matters to a mission, is a forward-looking statement about the delivered article: given the particular box that was built, with the particular parts that populate it, integrated by the particular team that integrated it, and exercised by the particular test campaign it actually received, what is the probability that it operates without a failure-severity anomaly through the mission in the environment it will actually fly. This is a property of the physical object and of the verification it underwent. It is, in the potential-outcomes language developed in Section 2.4, the object whose distribution we want to predict and compare across configurations. Provenance, by contrast, is a backward-looking statement about lineage: the design, or the build process, or the parts family, or in the strongest case an identical article, has operated before. Provenance is a fact about history. Delivered reliability is a fact about the present article's future. The two coincide only under a strong and usually unstated assumption, namely that the historical success transfers intact to the present article because nothing reliability-relevant changed between them.

That transfer assumption is where the practice is most fragile, and the descriptive reliability literature is what tells us so. Castet and Saleh's nonparametric estimates of satellite and subsystem reliability, built from databases of on-orbit failures, establish that satellite reliability is not well described by a constant hazard and that a non-negligible fraction of failures occur early in life, consistent with latent-defect infant mortality rather than wear-out [\[19\]](#ref-19). The interpretive weight of that result for the present framework is this: if a meaningful share of failures are early and defect-driven, then they are failures of the delivered article's intrinsic quality and of the verification that should have caught the defect, not failures that any amount of design provenance could have foreclosed. A design that has flown successfully a hundred times confers nothing on a freshly fabricated copy that carries a bad parts lot the original did not, and the early-failure regime is the regime in which such intrinsic defects express themselves. Tafazoli's review of on-orbit failures reinforces the same reading from the opposite direction: failures concentrate in a small number of subsystems and a meaningful share trace to design and parts issues rather than to random external causes [\[100\]](#ref-100). A failure that traces to a parts issue is, by construction, a delivered-article failure, and provenance is silent about it unless the provenance claim includes the parts.

The central proposition of this section is that delivered reliability and provenance are distinct constructs that coincide only under a transfer assumption the data show is frequently violated. The documented early-failure and parts-driven failure regimes in the satellite population establish the point [\[19\]](#ref-19)[\[100\]](#ref-100): early and parts-driven failures are, by their causal origin, properties of the as-built article and its verification, which provenance does not determine unless it explicitly carries the parts and the environment forward. The mechanistic reliability-physics account developed in Section 2.3 explains why, since intrinsic defect rate is set by parts-class and latent-defect detection is set by test fidelity, both of which are article properties. The distinction bites only to the extent that articles bearing the same provenance actually differ in their delivered properties; where a heritage claim does carry identical parts and identical environmental qualification, provenance and delivered reliability converge and the distinction is harmless. One objection deserves a direct answer, that provenance is a sufficient summary statistic for the article properties, so that conditioning on it captures them; Section 2.3 and the identification argument in Section 2.5 answer it by showing that provenance and article properties can be made to vary independently in principle and that the empirical design is built to detect whether they do so in fact. Confidence in the distinction itself is high, because it is a definitional and mechanistic point rather than an empirical one; confidence that the distinction is decision-relevant in practice is moderate at the design stage and is what the empirical test is constructed to raise or lower.

The mechanism by which the conflation produces harm can be named explicitly, in the driver-to-implication chain the framework uses throughout. The driver is the substitution of a weaker provenance claim for the delivered-article properties it is assumed to summarize. The mechanism is that a review board, accepting provenance as a maturity certificate, reduces the qualification and acceptance scope and relaxes parts-class requirements for the new build, leaving intrinsic defects and environment-mismatch unverified on the actual article. The observable effect is an elevated early and total subsystem failure hazard on the delivered article relative to what full verification would have produced. The operational consequence is an on-orbit subsystem anomaly or loss on a mission that believed itself protected by heritage. The strategic implication is that assurance resources are misallocated toward reviewing lineage and away from verifying the article, which is the policy stake the dissertation exists to inform. This is a mechanism, not a bare correlation: each link names a specific actor, decision, and physical pathway, and the empirical design in later chapters is built to test the links that are testable on observational data while acknowledging that the design-review decision step is reconstructed from documentation rather than observed directly.

The desired theoretical state, then, is a framework in which heritage is understood as a noisy and possibly biased signal of the delivered-article properties that actually govern failure, rather than as a property in its own right. The next three sections build that framework: Section 2.2 locates heritage within the maturity literature to explain why the signal is attractive and where it goes wrong; Section 2.3 specifies the two delivered-article properties, parts-class and test-fidelity, and the mechanisms by which they set the failure hazard; and Section 2.4 installs the causal apparatus that lets the signal and the properties be separated empirically.
## 2.2 Heritage as an informal maturity claim

Heritage is best understood theoretically as an informal, subsystem-level assertion of maturity. Reading it through the technology-maturity literature explains its appeal and exposes the specific way it misleads. This section develops that reading and connects it to the established maturity-and-risk findings in the corpus.

The technology readiness level (TRL) construct is the formal version of the intuition heritage trades on. Dubos, Saleh, and Braun connected TRL to schedule risk and slippage in spacecraft design, demonstrating empirically that lower-maturity technology carries measurable program risk and that the maturity of a technology at program start predicts downstream schedule behavior [\[33\]](#ref-33). The earlier conference treatment of the same data analysis and modeling effort establishes the methodological basis for that maturity-to-risk linkage [\[31\]](#ref-31). The interpretive significance for this framework is that there is genuine, documented signal in maturity: more mature technology does, on average, behave better programmatically, so the instinct to reward maturity is not irrational. Heritage attempts to claim that signal at the level of a box or subsystem, asserting that this article is mature because something like it has flown.

The trouble is that the maturity literature itself shows the construct to be slippery, and the slipperiness is exactly the failure mode heritage inherits. Olechowski, Eppinger, and Joglekar, surveying the state of TRL use four decades after its introduction, document that the readiness-level construct is applied inconsistently, that the boundary between levels is interpreted differently across organizations, and that the single-number summary obscures heterogeneity in what has actually been demonstrated [\[70\]](#ref-70). The NASA Technology Readiness Assessment study team reached a compatible conclusion from inside the agency, recommending tightened definitions and explicit assessment procedures because the bare level number was being read to mean more than it demonstrated [\[44\]](#ref-44). Independent corroboration that maturity-level assessment influences program schedule appears in the schedule-influence analysis of Yilin [\[114\]](#ref-114), grade C and used only as supporting corroboration rather than as a primary warrant. The reading the framework takes from this cluster is that even the formal maturity construct, with its defined ladder and its assessment guidance, suffers from ambiguity about what a given level actually certifies; heritage, which has no ladder and no assessment guidance, suffers the same ambiguity in a more acute form.

The decisive theoretical point is that maturity is a property of a technology in an environment, and heritage routinely detaches the environment from the maturity claim. The TRL definitions themselves distinguish demonstration in a relevant environment from demonstration in an operational environment, and the highest readiness levels require operational-environment demonstration [\[44\]](#ref-44). A heritage claim that asserts a box is mature because it flew in low Earth orbit, applied to a new mission flying that box into a high-radiation deep-space environment, is making a relevant-environment claim and presenting it as an operational-environment claim for the new mission's environment. The maturity that was actually demonstrated is maturity for the old environment. The maturity the new mission needs is maturity for the new environment, which the heritage claim does not establish. This is the same gap the reliability-by-environment literature makes concrete by showing that the failure distribution shifts with orbit and platform class, so a maturity or heritage claim silent about environment change is an incomplete predictor.

There is a countervailing case in the corpus that the framework must engage honestly rather than dismiss, because it is the strongest evidence that heritage sometimes works exactly as advertised. Kirschenbaum and colleagues describe a family of commercial spacecraft avionics units with extensive reliable flight heritage and argue that this heritage offers an efficient path to a tailored spacecraft bus without redesign, redevelopment, or requalification of the avionics [\[55\]](#ref-55). Murphy's long-term performance analysis of the ASTRO APS star tracker, drawing on on-orbit data across many flights, is presented explicitly as proof in heritage [\[1\]](#ref-1). These are real cases where deep, environment-matched, parts-stable heritage is doing genuine reliability work. The framework does not deny them; it absorbs them. In the heritage-depth construction the dissertation uses, these are the strongest category, design-plus-build-plus-same-environment flight heritage, the only category that actually retires environmental risk. The interpretive claim is not that heritage never buys reliability but that the reliability it buys is a function of how deep the heritage actually is, and that the decision-relevant error is the substitution of a shallow heritage claim for a deep one. The avionics-family and star-tracker cases are evidence for the deep end of the ordinal scale, not evidence that the label "heritage" without qualification is sufficient.

This section argues that heritage is an informal maturity signal whose reliability content depends entirely on the depth of the heritage and on environmental match, and that the construct as ordinarily invoked does not carry that depth information. The evidence comes from two directions: the documented maturity-to-risk signal on one side [\[33\]](#ref-33)[\[31\]](#ref-31), and the documented ambiguity of even formal maturity assessment on the other [\[70\]](#ref-70)[\[44\]](#ref-44), together with the deep-heritage success cases [\[55\]](#ref-55)[\[1\]](#ref-1). A single-label maturity claim that does not specify the environment and the article properties it covers cannot be read off to a delivered-reliability prediction, because the same label spans cases from genuine same-environment proof to bare design lineage; the TRL framework's own insistence on environment-specific demonstration makes the same point [\[44\]](#ref-44). Where heritage is deep and environment-matched, the signal is strong and the construct works. The natural objection is that experienced reviewers implicitly account for depth even when the label does not encode it; the dissertation answers it by making depth explicit and ordinal so the empirical test can determine whether it is the depth or the bare label that carries the association. Confidence that heritage is a maturity signal is high; confidence about how much of the signal survives once depth and environment are disentangled is exactly what the design is built to measure, and at the design stage that confidence is deliberately held at moderate.

This framing also disciplines the variable construction the later chapters inherit. Because heritage is theorized as an ordinal depth claim rather than a binary, the empirical model codes it as none, design-only, design-plus-build, and design-plus-build-plus-same-environment flight. That ordinal coding is the operational expression of this section's theory: it lets the regression distinguish the shallow claims that the maturity literature warns are ambiguous from the deep claims that the avionics-family and star-tracker cases show can be genuinely load-bearing.

## 2.3 Parts-class and test-program fidelity as the rival predictors

The rival to the provenance theory is a delivered-article theory with two named mechanisms, and this section specifies both precisely enough that the empirical model can place them in competition with heritage. The theory holds that delivered reliability is governed by what is inside the box, captured by EEE parts-class, and by how thoroughly the box was exercised before launch, captured by test-program fidelity. Each is a property of the article, each acts through a specific mechanism, and together they constitute the alternative hypothesis H1.

The first mechanism is intrinsic defect and degradation rate, set by parts-class. The EEE parts-reliability literature establishes that parts-class, specifically the screening level and the radiation tolerance of the devices, is a first-order determinant of device-level reliability, and that the move toward commercial parts trades cost against this margin. Brandhoff and colleagues' risk assessment for COTS devices in space systems under radiation effects makes the determinant explicit: device-level survival in the space radiation environment is set by the device's intrinsic radiation response and by the screening that culls weak devices, and the COTS substitution that lowers cost also lowers the screened-in margin unless compensated [\[12\]](#ref-12). The mechanism this supports is direct and physical: parts-class sets the rate at which the article carries latent manufacturing defects and the rate at which it degrades under the dose and single-event environment it will encounter. A higher parts-class means a lower intrinsic defect rate and greater environmental margin; a lower parts-class means the opposite, regardless of the design's lineage. Because this is a property of the procured devices, it is logically independent of heritage: a heritage design rebuilt with a lower parts-class is a heritage design with a higher intrinsic defect rate, and provenance does nothing to lower it.

The second mechanism is latent-defect detection, set by test-program fidelity. The theory holds that integration and test fidelity sets the probability that latent defects, parts escapes, and integration errors are caught on the ground rather than discovered on orbit. The mechanism is screening and exercise: thermal-vacuum cycling, vibration and acoustic qualification, parts-level burn-in, and system-level functional test each create opportunities for a latent defect to express itself under controlled conditions where it can be found and corrected, rather than under flight conditions where it becomes an anomaly. The reliability literature's documented early-failure regime is the observable signature of this mechanism's failures: infant mortality is, mechanistically, the population of latent defects that the test campaign did not catch [\[19\]](#ref-19). The framework's prediction, stated as an expected direction and not a measured value, is therefore specific: the infant-mortality outcome should load on test-fidelity in particular, because the causal pathway for early failure is an uncaught latent defect, and screening and system test are exactly the activities designed to catch it. This is the interpretive bridge from the descriptive early-failure finding to the rival hypothesis: the early-failure regime is not an act of nature, it is a verification outcome, and verification fidelity is an article property that competes with heritage.

The two mechanisms are distinct but coupled, and the framework keeps them separate because the policy implications differ. Parts-class acts before test, setting the population of defects the article carries; test-fidelity acts after, setting the fraction of that population removed before launch. A high-parts-class article with a thin test campaign and a low-parts-class article with a thorough one can in principle reach similar delivered reliability by different routes, and the empirical model includes both regressors so that their separate contributions can be read rather than collapsed. The subsystem-level reliability studies in the corpus support treating these as subsystem-specific: Kim, Castet, and Saleh's analysis of the electrical power subsystem and Wayer, Castet, and Saleh's analysis of the attitude control subsystem each show subsystem-specific failure behavior and multi-state degradation, which the framework reads as evidence that the parts-and-test mechanisms operate with subsystem-specific intensity and must be modeled with subsystem-specific baseline hazards rather than a single pooled hazard [\[54\]](#ref-54)[\[108\]](#ref-108).

The rival theory holds that delivered subsystem reliability is governed by parts-class and test-fidelity, two article properties, and that these compete with and may dominate claimed heritage. It rests on the device-level radiation-and-screening determinant documented for COTS-versus-screened parts [\[12\]](#ref-12) and the early-failure regime that signals incomplete latent-defect detection [\[19\]](#ref-19), together with the subsystem-specificity of failure behavior [\[54\]](#ref-54)[\[108\]](#ref-108). Intrinsic defect rate and latent-defect detection are the proximate causes of, respectively, total and early subsystem failure, and both are properties of the delivered article rather than of its lineage, a conclusion the reliability-physics account supports: radiation response and screening set device survival, and environmental and functional test exercise latent defects into detectability. Parts-class and test-fidelity are themselves measured with error and may be correlated with heritage in practice, which is the identification problem Section 2.4 addresses. A further objection is mediation, the possibility that heritage causes good parts-class and good test-fidelity, so that controlling for them understates a real heritage effect; Section 2.5 and the analysis plan distinguish mediation from confounding explicitly rather than assuming one. Confidence in the existence of the two mechanisms is high, because they rest on established reliability physics; confidence in their dominance over heritage is the H1 claim under test, held at moderate at the design stage by construction.

The rival theory is what makes the dissertation a head-to-head test rather than a one-sided argument. H0, the null, is the provenance theory of Section 2.1 and 2.2: heritage depth is the primary driver, and parts-class and test-fidelity add little once heritage is included. H1, the alternative, is the delivered-article theory of this section: parts-class and test-fidelity dominate, and heritage adds little incremental predictive power once they enter. The two theories make opposite predictions about the same nested coefficient comparison, which is what allows the design to falsify one in favor of the other rather than merely illustrating either.

## 2.4 The potential-outcomes and design-based frame

To put the provenance theory and the delivered-article theory into competition on observational data, the framework adopts the potential-outcomes formalism of Rubin and the design-based econometric discipline of Angrist and Pischke. This section develops both as the methodological anchors of the dissertation and explains what each contributes to the head-to-head test; Section 2.5 then translates them into spacecraft-specific terms.

### 2.4.1 Why an observational-causal frame is required

The estimation problem is observational, and that fact dictates the choice of frame. No agency randomizes heritage, parts-class, or test fidelity across spacecraft; each is chosen by programs under budget, schedule, and environment constraints. The threat this creates is that the same program characteristics that generate a heritage claim may also generate, or fail to generate, parts rigor and test rigor, so that a naive regression of failure on heritage will absorb the effect of the omitted rigor variables and attribute it to heritage. A frame that simply regressed failure on heritage and read the coefficient causally would be committing exactly the error the descriptive literature cannot itself correct, because descriptive reliability curves estimate marginal failure distributions and do not attempt to attribute them to competing, possibly confounded, causes. The potential-outcomes frame is adopted because it makes the assignment problem explicit and forces the analyst to state and defend the assumptions under which a comparison is interpretable, rather than leaving them implicit.

### 2.4.2 Rubin's potential-outcomes formalism

Rubin's framework defines a causal effect as a comparison of potential outcomes for the same unit under different treatment assignments, and it locates the central difficulty in the fact that only one potential outcome is ever observed per unit [\[88\]](#ref-88). The interpretive contribution to this dissertation is that it reframes the heritage question from "is heritage associated with reliability" to "what would this subsystem's failure behavior have been under a different heritage, parts-class, or test-fidelity assignment," which is the question a review board implicitly asks when it considers discounting test scope. Rubin's foundational treatment establishes that, absent randomization, the assignment mechanism, the process that determines which units receive which treatment, must be reconstructed and defended from observed covariates before any causal reading is licensed [\[88\]](#ref-88). Rosenbaum and Rubin's propensity-score result supplies the practical apparatus: under unconfoundedness, conditioning on the probability of treatment given covariates suffices to remove confounding from the comparison, which reduces a high-dimensional balancing problem to a one-dimensional one [\[85\]](#ref-85). The interpretive weight for this study is that it provides a tractable route to checking whether heritage-rich and heritage-poor subsystems can be compared at all, by examining whether they overlap in covariate space, which Section 2.5 develops as a first-class diagnostic.

Rubin's later methodological synthesis sharpens the discipline into a single directive that the dissertation adopts as its organizing principle: for objective causal inference, design trumps analysis, meaning the entire specification, the variable construction, the control set, and the analysis plan, must be fixed before the outcome data are examined [\[93\]](#ref-93). The interpretive significance is that this is what makes the dissertation's pre-registration not a formality but the core of the contribution: the deliverable is an outcome-blind design, and the credibility of any future estimate rests on the design having been frozen before estimation. Imbens and Rubin's comprehensive treatment supplies the formal apparatus for the assumptions, unconfoundedness and overlap, that the design must satisfy, and the demonstration that overlap is a precondition rather than a robustness check: where the treated and control groups do not overlap in covariate space, no comparison exists and the effect is not identified on that region [\[49\]](#ref-49). The dissertation takes this directly: the overlap diagnostic is reported as a result in its own right, because a finding that heritage-rich and heritage-poor subsystems never coexist at comparable parts-class and test-fidelity would mean the question is unidentified on the population, which is itself informative.

The Rubin anchor transfers to this setting because the potential-outcomes formalism is the appropriate frame for the heritage question: that question is a causal comparison on non-randomized data. Rubin's definition of causal effects as potential-outcome comparisons and the requirement to reconstruct the assignment mechanism [\[88\]](#ref-88), the propensity-score reduction of the balancing problem [\[85\]](#ref-85), the design-before-analysis directive [\[93\]](#ref-93), and the unconfoundedness-and-overlap apparatus [\[49\]](#ref-49) together supply the apparatus. A frame that makes the assignment mechanism and the overlap requirement explicit is the only frame in which an observational heritage-versus-rigor comparison can be honestly defended or honestly declared unidentified. Half a century of methodological development established potential outcomes as the standard apparatus for observational causal inference, corroborated within the corpus by Pearl's overview placing potential outcomes among the principal frameworks for causal inference in statistics [\[72\]](#ref-72). One limit the dissertation never relaxes is that selection-on-observables identification yields a conditional association under a stated unconfoundedness assumption, not an experimentally identified causal effect; the strongest defensible reading is that, conditional on the control set, the data favor one theory over the other. The threat to guard against is hidden confounding by unobserved program competence, which Section 2.5 and the later threat analysis address by proxy and by acknowledged limitation rather than by overclaim. Confidence in the appropriateness of the frame is very high; confidence that its identifying assumptions hold on this particular population is moderate and is defended, not assumed.

### 2.4.3 The Angrist-Pischke design-based discipline
Where Rubin supplies the formalism, Angrist and Pischke supply the operating discipline for using it on real, messy data. Their design-based program in Mostly Harmless Econometrics insists that every regression be read as a specific comparison: identify what variation in the regressor is being exploited, identify the units being compared, and ask whether that variation is plausibly unrelated to the omitted determinants of the outcome after conditioning [\[5\]](#ref-5). The interpretive contribution is that it converts the abstract unconfoundedness assumption into a concrete question the analyst must answer for the heritage coefficient: which subsystems' heritage variation is the coefficient built from, and is that variation contaminated by parts-and-test choices the program made alongside the heritage choice. This is the question the nested Model A to Model B comparison operationalizes.

The single most consequential element Angrist and Pischke contribute is the bad-controls warning, and the framework treats it as a binding constraint rather than as advice. A bad control is a variable that is itself an outcome of the treatment; conditioning on it reintroduces bias by absorbing part of the treatment's effect [\[5\]](#ref-5). The spacecraft-specific application, developed fully in Section 2.5, is that the result of the qualification and acceptance test campaign, for example whether the article passed thermal-vacuum without anomaly, is a bad control: test outcomes are downstream of heritage, parts, and test-fidelity choices, so conditioning on them would absorb the very effect under test. The framework therefore restricts the specification to pre-launch, pre-outcome inputs and never conditions on the test's pass-or-fail verdict. This specification decision follows directly from the bad-controls treatment and is, in the dissertation's judgment, the most important design choice in the study.

The companion instrumental-variables work of Angrist, Imbens, and Rubin completes the design-based anchor by clarifying what is and is not identified when an instrument is available, and by tying the instrumental-variables estimand to the potential-outcomes framework through the local-average-treatment-effect interpretation [\[4\]](#ref-4). The interpretive use in this dissertation is mostly negative, and the framework states it honestly: no credible instrument for heritage assignment is available, because the program-level forces that drive heritage also drive the rigor variables and the outcome, so the study does not claim instrumental identification and rests instead on selection-on-observables. Citing the instrumental-variables result marks the boundary of what the design claims. It identifies the alternative that was considered and set aside, and it names the local-average interpretation that would have been required had an instrument existed, which strengthens rather than weakens the selection-on-observables choice by showing it was made deliberately.

The Angrist-Pischke transfer establishes that the design-based discipline, and the bad-controls constraint in particular, is necessary to keep the heritage-versus-rigor comparison honest. The design-based reading of regressions as specific comparisons and the bad-controls warning [\[5\]](#ref-5), together with the instrumental-variables boundary-marking result [\[4\]](#ref-4), supply the basis. An observational comparison that conditions on post-treatment variables, or that fails to identify the variation it exploits, will misattribute the rigor effect to heritage or the reverse, which is the established econometric treatment of post-treatment conditioning as a source of bias. The discipline reduces but cannot eliminate omitted-variable bias, so the conclusion remains conditional. The temptation it forecloses is to add a seemingly natural test-result control to improve fit; the framework rules it out by construction. Confidence in the necessity of the discipline is very high, because it is a logical consequence of the estimand rather than an empirical claim.

## 2.5 Translating the econometric frame to the spacecraft problem

The potential-outcomes and design-based anchors were developed for labor economics and program evaluation, and transferring them to spacecraft reliability requires care on three specific points: the meaning of the stable-unit-treatment-value assumption in a spacecraft population, the physical meaning of overlap, and the spacecraft-specific statement of bad controls. This section makes each translation explicit, because the credibility of the head-to-head test depends on the transfer being defended rather than assumed.

### 2.5.1 The estimand and SUTVA in spacecraft terms

The first translation concerns what is being estimated. The estimand of interest is not a single average treatment effect but a comparison of the conditional associations of three regressors, heritage depth, parts-class, and test-fidelity, with the subsystem failure hazard. The dissertation therefore frames the test as a nested-model coefficient comparison rather than as the estimation of one causal contrast: the question is which of three competing predictors carries the dominant, stable association, not what the magnitude of a single intervention's effect is. The potential outcome for a unit is a subsystem's on-orbit failure behavior under a counterfactual heritage, parts-class, or test-fidelity assignment, and the comparison of conditional associations is the object the nested specification reads.

The stable-unit-treatment-value assumption requires, in this setting, that one subsystem's heritage or parts choice does not change another subsystem's failure behavior. This is mostly defensible at the subsystem level, because subsystems fail through largely independent mechanisms, but common-cause structure can violate it: a shared power bus, a shared parts lot procured across subsystems, or a shared integration error can couple failures that the unit-of-analysis treats as independent. The framework's response is not to assume the assumption away but to record lot-level and bus-level commonality so that violations can be flagged and the affected cells examined separately, which is the design's way of respecting the assumption's limits rather than pretending they do not exist. SUTVA in spacecraft terms is thus a statement about failure independence across subsystems, and the corpus's documentation of subsystem-specific failure behavior [\[54\]](#ref-54)[\[108\]](#ref-108) supports treating the subsystems as largely separate units while the commonality recording guards the cases where they are not.

### 2.5.2 Overlap as a physical condition

The second translation gives overlap a concrete physical meaning, and it is the translation that determines whether the question can be answered on this population at all. Overlap requires that, within a region defined by environment, prominence, mass class, epoch, and subsystem type, the data contain both heritage-rich and heritage-poor subsystems at comparable parts-class and test-fidelity. Where the field always pairs deep heritage with high parts-class and full test, no within-stratum comparison exists, and the heritage effect is not identified separately from the rigor effect. Imbens and Rubin's insistence that overlap be demonstrated before outcomes are analyzed is therefore not a formality here but the gate that decides whether the comparison is feasible [\[49\]](#ref-49).

The interpretive consequence is one the framework states plainly and treats as a possible primary finding: if heritage and rigor are so bundled in practice that no overlap region exists, then the honest conclusion is not that heritage is confirmed but that the heritage discount cannot be evaluated separately on this population, and the defensible assurance posture is to require the rigor regardless of the heritage claim. The dissertation therefore reports the overlap diagnostic as a result in its own right. A finding of no overlap is informative: it means the field's own practice has made the question unidentifiable, which is itself a statement about how tightly heritage and rigor travel together. Confidence that overlap is the correct gate is very high, because it is a logical precondition for identification; confidence that adequate overlap exists on the assembled population is unknown at the design stage and is precisely what the diagnostic will establish.

### 2.5.3 Bad controls in spacecraft terms

The third translation states the bad-controls constraint in spacecraft-specific language, because the temptation to violate it is strong and the violation would silently destroy the test. A natural-seeming control is the result of the qualification and acceptance test campaign, for instance whether the article passed thermal-vacuum without anomaly. Conditioning on that result would be a bad control in the exact Angrist-Pischke sense: test outcomes are downstream of both heritage and parts choices and partly downstream of test fidelity itself, so conditioning on them would absorb the very effect under test and bias the heritage and parts coefficients toward zero or worse [\[5\]](#ref-5). The specification therefore uses only pre-launch, pre-outcome inputs, heritage as claimed at design review, parts-class as procured, and test-fidelity as planned and as-run in scope, and never conditions on the test's pass-or-fail verdict.

This single decision is what keeps the head-to-head test interpretable. The point is to measure whether heritage, parts-class, and test-fidelity predict failure; conditioning on a test verdict that those three inputs jointly produce would mean regressing failure on a downstream summary of the very regressors of interest, which would attenuate all three toward zero and render the comparison meaningless. The framework treats the pre-outcome-input rule as inviolable for this reason.

### 2.5.4 Mediation versus confounding

A final translation concerns the interpretation of attenuation in the nested comparison, because the framework must distinguish two readings of the same statistical pattern. If the heritage coefficient attenuates when parts-class and test-fidelity enter Model B, that attenuation admits two interpretations. Under the confounding reading, heritage was spuriously associated with low failure because heritage-rich programs also tended to choose high parts-class and full test, and conditioning on the rigor removes the spurious part; this is the H1 reading. Under the mediation reading, heritage causes good parts-class and good test-fidelity, so the rigor variables are mechanisms through which a real heritage effect operates, and conditioning on them is conditioning on a mediator, which understates the total heritage effect.

The framework distinguishes these rather than assuming one. The distinguishing evidence is whether heritage predicts parts-class and test-fidelity in the first place, which the design examines directly, and whether the total heritage association (Model A) and the conditional heritage association (Model B) tell a consistent mediation story or a confounding story. The honest position at the design stage is that both readings are live and that the design is built to tell them apart, reporting both the total and the conditional heritage associations so the reader can see which pattern the data show. This is itself an application of the design-before-analysis discipline [\[93\]](#ref-93): the mediation-versus-confounding question is posed and its diagnostic fixed before outcomes are examined, so that the answer is read from a pre-specified comparison rather than rationalized after the fact.

The translation argument holds that the econometric anchors transfer to the spacecraft reliability problem under three explicit conditions: SUTVA as subsystem-failure independence with commonality recording, overlap as a physical coexistence condition reported as a first-class result, and bad-controls as a binding pre-outcome-input rule. The formal requirements of the potential-outcomes and design-based frameworks [\[88\]](#ref-88)[\[49\]](#ref-49)[\[5\]](#ref-5) and the subsystem-specificity evidence that licenses the unit of analysis [\[54\]](#ref-54)[\[108\]](#ref-108) together justify it. A frame's assumptions must be restated in the substantive terms of the application and either defended or reported as binding diagnostics, or the transfer is illegitimate, a requirement that follows from the design-trumps-analysis principle, which demands that the assumptions be confronted before estimation [\[93\]](#ref-93). The transfer succeeds only to the degree that the population supplies overlap and the commonality recording captures the SUTVA violations; where it does not, the design reports an unidentified question rather than a false answer. One objection is that the spacecraft setting is too different from the labor-economics setting for the apparatus to apply; the answer is that the apparatus is general to observational causal comparison and that the three translations are exactly the work of making it specific. Confidence in the transfer's logical validity is high; confidence in its empirical feasibility on the assembled population is moderate and is gated by the overlap diagnostic.


## 2.6 The conceptual model the empirical work will test

The framework's two competing theories and the causal apparatus that adjudicates them converge on a single conceptual model, stated here in the notation the empirical chapters carry forward verbatim. The model specifies the failure hazard of a subsystem as a function of the three competing predictors plus controls and a subsystem random effect, and the test is a nested comparison of how the heritage coefficient behaves when the rival predictors enter.

The hazard of first failure for subsystem cell i in mission m at on-orbit time t is written in proportional-hazards form as

\[ \log h(t) = \log h_0(t) + \beta_1 \text{Heritage}_i + \beta_2 \text{PartsClass}_i + \beta_3 \text{TestFidelity}_i + \gamma \text{Controls}_{im} + u_s \qquad\qquad (2) \]

where \( h_0(t) \) is a flexible baseline hazard (piecewise-constant or Weibull-mixture, consistent with the documented early and late failure regimes [\[19\]](#ref-19)); Heritage, PartsClass, and TestFidelity are the ordinal or index regressors theorized in Sections 2.2 and 2.3; Controls are mission environment, prominence, mass class, and launch epoch; and \( u_s \) is a Gaussian random intercept for subsystem type s, which absorbs the subsystem-specific baseline hazard the corpus documents [\[54\]](#ref-54)[\[108\]](#ref-108). The regressors are standardized before estimation so that \( \beta_1 \), \( \beta_2 \), and \( \beta_3 \) are directly comparable in magnitude, which is what the falsification rule requires.

The conceptual model maps the two theories onto the coefficients exactly. The provenance theory (H0) predicts that the standardized magnitude of \( \beta_1 \) is the largest of the three and remains stable and bounded away from zero when \( \beta_2 \) and \( \beta_3 \) are added. The delivered-article theory (H1) predicts that the standardized magnitudes of \( \beta_2 \) and \( \beta_3 \) exceed that of \( \beta_1 \) and that \( \beta_1 \) collapses toward negligible effect once \( \beta_2 \) and \( \beta_3 \) enter. The test is implemented as a nested comparison: Model A estimates the index with heritage and controls only; Model B adds parts-class and test-fidelity; the change in \( \beta_1 \) together with the magnitudes of \( \beta_2 \) and \( \beta_3 \) decides the test. This is the operational form of the entire chapter's argument. Section 2.1's provenance-versus-delivered split is the reason the three regressors are conceptually distinct; Section 2.2's maturity reading is why heritage is ordinal depth rather than binary; Section 2.3's two mechanisms are why parts-class and test-fidelity are separate regressors with the specific prediction that the infant-mortality outcome loads on test-fidelity; and Sections 2.4 and 2.5 are why the nested comparison, with its overlap gate and its bad-controls rule, can be read as evidence rather than as spurious association.
The line of argument the dissertation carries across its chapters is visible in this model. The problem is real because the early-failure and parts-driven regimes that the model's baseline and regressors target are documented in the population [\[19\]](#ref-19)[\[100\]](#ref-100)[\[95\]](#ref-95). The problem is material because failure concentrates in subsystems whose baseline hazards the random effect absorbs, and because the parts-and-test campaigns the regressors measure are large discretionary budget lines. The design addresses the causal mechanism because the nested specification, with overlap and bad-controls discipline, separates provenance from delivered-article properties [\[5\]](#ref-5)[\[85\]](#ref-85)[\[93\]](#ref-93). It beats the alternatives because descriptive reliability curves and naive heritage-only regressions cannot decide the test, whereas the design-based nested comparison can [\[49\]](#ref-49). The residual risk is acceptable because the conclusion is stated as conditional association under unconfoundedness, the overlap diagnostic guards against extrapolation, and an underpowered or unidentified result is reported honestly rather than resolved by assumption. This chapter's contribution to that argument is the conceptual model and the demonstration that the model is identifiable in principle under stated, defended assumptions.

What this chapter does not claim bears restating, because the guardrail is part of the framework. The model above is a specification, not a result. The directional predictions attached to H0 and H1 are expected directions that define the falsification rule, not estimated coefficients, and the dataset on which the model will be estimated is still being assembled from the JPL heritage and parts archives and the NASA anomaly records. The theoretical contribution is the model and the argument that it places provenance and delivered-article properties in a genuine, falsifiable competition. The empirical contribution, the estimated behavior of \( \beta_1 \) against \( \beta_2 \) and \( \beta_3 \), is the work of the chapters that follow and is deliberately left unmeasured here. The framework's value is that it specifies, in advance and outcome-blind, exactly what would count as evidence for each theory, so that whichever way the coefficients fall, the field learns where its assurance dollars should go.



# Chapter 3: Literature Review

## 3.0 The chapter's answer, stated first

Four decades of statistical work have produced, with convergent evidence from independent datasets, a mature and detailed description of how spacecraft fail: failure is non-constant in time, concentrated in a small number of subsystems, modulated by orbit and mass class, and shaped in part by an early infant-mortality regime that wear-out models cannot explain. A parallel body of work has established that the intrinsic properties of the delivered article, specifically EEE parts class and the radiation hardness assurance applied to it, are first-order determinants of device-level reliability, and that the trade between commercial and high-reliability parts is real and measurable. What no study in this corpus does is place these two bodies of evidence in direct competition with a third candidate, claimed flight heritage, on a single population, with a design that can decide which predictor governs realized failure once the others are held fixed.

That is the gap. This chapter establishes it by reading the literature thematically, interpreting each major source for what its method delivers and what its limitation withholds. The descriptive curves, the maturity models, and the parts-reliability assessments each supply a necessary piece of the present design; none of them, alone or together as currently assembled, answers the question the dissertation poses. The propositions that close the chapter follow from that reading: the outcome is modelable because failure varies enough to be modeled; the confounder structure is known because the descriptive literature has already mapped it; the rival predictor is credible because the parts literature has already measured its channel; the causal comparison is unbuilt because no one has yet held the design-based discipline against the heritage claim on a JPL-class population.

Mission assurance currently makes an unjustified inferential leap. The literature supplies a rich descriptive map of how satellites fail, and a rich methodological toolkit for causal inference under observational data, but the two have never been joined on the heritage question. The desired state is a body of evidence that tells a review board whether a heritage claim, net of parts-class and test fidelity, buys delivered reliability. The gap is that the descriptive literature treats heritage qualitatively or not at all, the maturity literature stops at the design concept rather than the delivered article, and the parts literature measures the rival channel without ever pitting it against provenance. As long as this gap persists, mission assurance continues to grant heritage discounts on faith, reallocating real qualification and parts budget on the strength of a label whose empirical warrant has never been isolated.

## 3.1 The descriptive reliability base: the Castet-Saleh program

The empirical anchor for the entire field, and for this dissertation, is the satellite reliability program built by Castet and Saleh and their collaborators across a sequence of papers between 2008 and 2013. The foundational result is established in their statistical data analysis and modeling of satellite and satellite-subsystem reliability [\[19\]](#ref-19). The method is nonparametric survival estimation, principally the Kaplan-Meier estimator applied to a database of on-orbit failures, followed by parametric Weibull fits to the resulting reliability functions. The finding that matters most for the present work is that satellite reliability is not well described by a constant hazard. A constant hazard would imply that failures arrive at a steady rate independent of time on orbit, the memoryless exponential model that underlies much naive reliability accounting. The data refuse this. A non-negligible fraction of failures occur early in life, in the first months after commissioning, in a pattern consistent with infant mortality from latent manufacturing or design defects rather than with random external insult or end-of-life wear-out. The interpretation this dissertation draws is direct. If failures cluster early and arise from latent defects, then the pre-launch activities that catch latent defects, namely parts screening and system-level test, are mechanistically positioned to move the outcome, and a heritage label that licenses cutting those activities is positioned to make the outcome worse. The descriptive base does not test that claim, but it establishes the hazard shape that makes the claim plausible and that any serious model of the outcome must respect.

The companion paper sharpens the point by asking whether a single Weibull distribution suffices or whether a mixture of two is required [\[21\]](#ref-21). The method is a head-to-head goodness-of-fit comparison between a single-Weibull model and a mixture-Weibull model on the same nonparametric reliability data. The result is that the mixture fits better. A single Weibull, however its shape parameter is chosen, cannot simultaneously capture the steep early drop and the long flat tail of the empirical reliability curve. A mixture, which superposes an early-failure subpopulation with a short characteristic life onto a long-lived subpopulation, captures both regimes. The interpretation is consequential for the design in Chapter 5 and the measurement in Chapter 4. The mixture model identifies, quantitatively, the inflection that separates the infant-mortality regime from the steady-state regime, and that inflection is exactly what the present dissertation uses to set the early window for the infant-mortality outcome rather than choosing it arbitrarily. The limitation of the Castet-Saleh mixture work, read against the dissertation's question, is that the mixture is descriptive. It tells us that an early-failure subpopulation exists and roughly where it ends; it does not tell us what distinguishes the members of that subpopulation from the survivors, which is precisely the heritage-versus-parts-versus-test question. The mixture is the outcome's anatomy, not its etiology.

The third paper in the core sequence moves beyond binary reliability to multi-state failure analysis of satellite subsystems [\[20\]](#ref-20). The method generalizes the survival framework to a multi-state model in which a subsystem can occupy fully operational, partially degraded, and failed states, with transition intensities estimated from the data. The finding is that aggregating to a binary working-or-failed outcome discards real information, because many subsystems spend meaningful time in degraded states that carry their own risk and their own diagnostic signal. For the present dissertation the multi-state result is methodologically load-bearing in a specific way: it confirms that the subsystem, not the spacecraft, is the correct unit of analysis, because failure behavior is subsystem-specific and the aggregate spacecraft curve is a mixture of heterogeneous subsystem curves that masks the variation the hypotheses depend on. The dissertation does not adopt the full multi-state machinery, because the head-to-head coefficient comparison is cleaner in a first-failure survival and infant-mortality framework, but it inherits the multi-state program's central lesson that the analysis must live at the subsystem level. The book-length consolidation of the program restates the subsystem-reliability result in its mature form [\[17\]](#ref-17), and the encyclopedic treatment of satellite reliability [\[18\]](#ref-18) and the standalone subsystem-reliability chapter [\[98\]](#ref-98) make the same point in reference form: the subsystem is where the reliability signal lives.

A confirming and partly independent line is Tafazoli's review of on-orbit spacecraft failures [\[100\]](#ref-100). The method is a structured review of documented on-orbit failures rather than a parametric reliability fit, and the value of the independence is that it does not share the Castet-Saleh dataset or estimator. The finding converges with the parametric work on two points. First, failures concentrate in a small number of subsystems rather than spreading uniformly across the spacecraft. Second, a meaningful share of failures trace to design and parts issues rather than to random external causes such as debris or unmodeled environment. The convergence matters because it means the subsystem-concentration and parts-relevance facts are not artifacts of one team's database or one estimator's assumptions; two methods on two evidence bases reach the same place. The interpretation for the dissertation is that the rival hypothesis, that delivered-article properties such as parts class drive failure, is not a contrarian guess but a reading already supported by the descriptive review literature. The limitation is the same as before: Tafazoli documents that parts and design issues cause failures; he does not isolate the marginal contribution of a heritage claim against those issues.

The platform health scorecard work completes the descriptive base [\[95\]](#ref-95). The method is a systematic cataloguing of anomalies and failures by subsystem across a satellite population, producing what the authors frame as a scorecard of platform health. The finding is the uneven distribution again, now rendered as a ranked accounting of which subsystems contribute disproportionately to anomalies. The scorecard's contribution to the present design is the dominant-confounder map. If certain subsystems are intrinsically more failure-prone, then any test of heritage that does not condition on subsystem identity will confound the heritage effect with the subsystem mix of the heritage-rich versus heritage-poor cells. The dissertation responds to this exactly, by absorbing subsystem-specific baseline hazard into a Gaussian random intercept for subsystem type in the notation \[ \log h(t) = \log h_0(t) + \beta_1 \text{Heritage}_i + \beta_2 \text{PartsClass}_i + \beta_3 \text{TestFidelity}_i + \gamma \text{Controls}_{im} + u_s \]. The scorecard is, in effect, the empirical justification for the \( u_s \) term. The limitation is that a scorecard ranks subsystems; it does not explain within a subsystem why one instance of an attitude control system fails early and another does not, which is the within-subsystem variation the head-to-head test exploits.

Two subsystem-specific deep dives extend the scorecard into the two subsystems most central to the dissertation's mechanism. The electrical power subsystem analysis examines failure behavior, reliability, and multi-state transitions for spacecraft power specifically [\[54\]](#ref-54). The method mirrors the multi-state program applied to a single subsystem, and the finding is that the power subsystem carries a substantial and time-structured failure load with identifiable degraded states. This matters because the power subsystem is a common-cause node: a shared power bus can propagate a single fault across multiple subsystems, which is exactly the stable-unit-treatment-value violation the dissertation flags and records lot-level and bus-level commonality to detect. The attitude control subsystem analysis performs the parallel decomposition and adds a comparative LEO-versus-GEO failure-behavior result [\[108\]](#ref-108). The finding that attitude control failure behavior differs by orbit is direct evidence for the environment control in the dissertation's specification: the same subsystem in a different environment is a different reliability object, which is the precise reason a heritage claim that does not account for environment change is an incomplete predictor. These two papers convert the scorecard's ranking into mechanism-relevant detail for the two subsystems where the heritage-versus-rigor contest is most consequential.

The synthesis of Section 3.1 is that the descriptive base delivers four things the dissertation requires and withholds the one thing it must build. It delivers the hazard shape (non-constant, infant-mortality-bearing) [\[19\]](#ref-19)[\[21\]](#ref-21), the correct unit (subsystem) [\[20\]](#ref-20)[\[54\]](#ref-54)[\[108\]](#ref-108), the dominant confounder (subsystem identity and its anomaly load) [\[95\]](#ref-95), and an independent confirmation that parts and design issues are real failure causes [\[100\]](#ref-100). It withholds any isolation of the heritage claim from the parts and test rigor it is assumed to proxy. Confidence in this synthesis is high, because the convergence across nonparametric estimation, parametric mixture fitting, multi-state modeling, and independent structured review is strong and mutually reinforcing; what would lower it is evidence that the failure databases underlying these studies are themselves biased by survivorship in a way that distorts the hazard shape, a threat the dissertation treats in Chapter 5 rather than dismissing here.

## 3.2 Reliability by mass, orbit, and platform class: the environment differentiators

If the first theme establishes that satellites fail in a structured way, the second establishes that the structure shifts with the platform and its environment, which is what makes the environment controls in the dissertation's specification mandatory rather than decorative. The mass-category analysis asks directly whether spacecraft size matters for reliability [\[32\]](#ref-32). The method partitions the satellite population by mass class and estimates separate reliability functions per class. The finding is that the reliability functions differ across mass categories, so that a small satellite and a large one are not draws from the same failure distribution. The interpretation for the dissertation is that mass class is a confounder of the heritage test, because heritage practices and parts regimes co-vary with mass class: flagship-scale missions document heritage and procure high-reliability parts differently than smaller classes do. Conditioning on mass class, as the specification does, is therefore not optional. The limitation of the mass-category work is that it shows the distributions differ without decomposing why, leaving open whether the difference is parts, test, environment, or program-resource driven, which is again the very decomposition the dissertation attempts.

The deep-space reliability literature is the most directly relevant environment slice because the dissertation's population is JPL-class, which is disproportionately deep-space and high-radiation. The bulk-population and subsystem analysis of deep-space satellites launched between 1991 and 2020 estimates reliability for the deep-space population specifically [\[25\]](#ref-25). The method follows the nonparametric-then-parametric template on a deep-space-restricted sample, and the finding is that deep-space satellites carry their own characteristic reliability profile, distinct from the LEO and GEO populations that dominate the broader databases. The companion deep-space and launch-vehicle reliability estimation extending the window to 1958 through 2022 broadens the temporal base for the same population [\[40\]](#ref-40). The interpretation is twofold. First, these papers establish that a deep-space-specific population is large enough and varied enough to model, which is a precondition for the dissertation's empirical feasibility. Second, they establish that the high-radiation deep-space environment is a distinct reliability regime, which is the regime in which a heritage box flown previously to LEO has unproven environmental qualification, the exact case the rival hypothesis predicts will fail. The limitation is that the deep-space studies, like the rest of the descriptive base, characterize the population without separating provenance from rigor within it.

The two-Weibull segmented modeling work generalizes the mixture insight into a formal segmented model and applies it across a satellite population [\[102\]](#ref-102). The method fits a two-segment Weibull in which an early segment and a later segment have distinct shape and scale parameters, with a changepoint between them. The finding is that the segmented model captures the early and late regimes more faithfully than an unsegmented fit, which is the same infant-mortality-versus-wear-out distinction reached by mixture modeling but expressed as an explicit changepoint. For the dissertation this reinforces the decision to model the infant-mortality window separately, and it supplies an alternative estimation route for locating the early-window boundary if the mixture inflection proves unstable. The single-versus-mixture and payload-focused reliability estimation for satellites operating 1991 through 2020 adds a payload-subsystem-specific reading [\[39\]](#ref-39), which matters because the payload instrument is the most novel and least heritage-eligible subsystem and is therefore a candidate to dominate any heritage signal; the dissertation pre-specifies a robustness check that excludes the payload subsystem precisely because of this. The large-satellite bus reliability assessment from the NASA technical literature [\[43\]](#ref-43) confirms that bus-level reliability for large platforms is its own object with its own track record, separable from payload reliability, which supports treating bus subsystems and the payload instrument as distinct cells.

Two structural-statistical observations close this theme. A geosynchronous communication satellite reliability analysis applies the same data-analysis-and-modeling template to the GEO commercial population [\[16\]](#ref-16), and the finding that GEO commercial reliability has its own profile, distinct from the science and deep-space populations, reinforces both the orbit control and the external-validity boundary the dissertation draws around JPL-class missions. The high-orbit electrostatic-discharge anomaly warning work [\[115\]](#ref-115) supplies the mechanism behind some of the orbit dependence: in high orbit, space-weather-driven electrostatic discharge is a major anomaly cause, an environment-specific failure channel that a same-environment heritage claim would have retired and a different-environment heritage claim would not. The synthesis of Section 3.2 is that environment is not a nuisance to be averaged away but a first-order modulator of the hazard, so the dissertation's controls for orbit class, radiation environment, and mass class are doing identification work, not cosmetic adjustment. Confidence is high for the existence of environment dependence, which is replicated across mass, orbit, and platform slices [\[32\]](#ref-32)[\[25\]](#ref-25)[\[40\]](#ref-40)[\[16\]](#ref-16); it is moderate for the specific magnitude of any one environment's effect, because the slices use different databases and windows, which is why the dissertation conditions on environment rather than importing a fixed effect size from any single study.

## 3.3 Heritage, maturity, and the novelty tradeoff

The third theme is the conceptual bridge between provenance and reliability, and it is where the literature is thinnest on exactly the construct the dissertation tests. Heritage is, at bottom, an informal maturity claim asserted at the box or subsystem level, so the maturity literature is the closest formal treatment available. The foundational result connects technology readiness level (TRL) to schedule risk and slippage in spacecraft design [\[33\]](#ref-33), with the underlying data analysis and modeling presented in the companion conference paper [\[31\]](#ref-31). The method regresses program schedule outcomes on the maturity of the technologies involved, and the finding is that lower-maturity technology carries measurable program risk in the form of schedule slippage. The interpretation for the dissertation is that maturity demonstrably matters for program outcomes, which makes the heritage-as-maturity-claim framing credible, but the maturity that the TRL literature measures is the maturity of the technology concept, not the maturity of the delivered article in its actual flight environment. This is the precise gap the dissertation isolates: a heritage box flown to a new and harsher environment has a mature design concept and an immature environmental qualification, and the TRL framework, which scores the concept, does not capture the distinction. The schedule-slippage finding also speaks to why heritage is invoked under cost pressure: heritage is the lever that promises to retire maturity risk without the schedule cost of fresh qualification.

The broader assessment of TRL practice at its fortieth anniversary catalogues the state of the art, the challenges, and the opportunities in TRL use across engineering domains [\[70\]](#ref-70). The method is a review and synthesis of TRL practice, and the finding most relevant here is that TRL is widely used but inconsistently applied and frequently misread, particularly when a high TRL earned in one context is transferred to a different context as if the readiness traveled with the technology. This is the maturity-literature analogue of the heritage-substitution failure mode the dissertation targets: a readiness or heritage credential earned in one environment is spent in another. The supporting Chinese-language study of TRL influence on spacecraft development schedule [\[114\]](#ref-114) and the NASA technology readiness assessment study team's final report [\[44\]](#ref-44) confirm the institutional weight placed on readiness assessment and the recurring difficulty of pinning readiness to a specific as-built, as-flown configuration rather than to a design lineage. The interpretation is that the maturity literature has already identified, in its own vocabulary, the context-transfer problem that the heritage literature has not formalized, and the dissertation imports that insight to motivate coding heritage as an ordinal depth that explicitly distinguishes same-environment flight from design-only provenance.

The single source in the corpus that directly examines a heritage claim against on-orbit data is the long-term performance analysis of a star tracker, framed as the proof in heritage and built on on-orbit data with lessons learned [\[1\]](#ref-1). The method is a longitudinal analysis of a specific heritage component's on-orbit performance, and the finding is that the component's accumulated flight record supports its heritage status for the environments in which it has flown. This is valuable as an existence proof that heritage can be evidenced rather than merely asserted, and it models the kind of delta-qualification reasoning the dissertation's policy implication recommends. But it is a single-component case study, not a cross-mission comparison, and it cannot separate the component's heritage from its parts class or its test history because there is no contrast population. Read against the dissertation, it illustrates both the promise and the limit of the existing heritage literature: heritage can be examined empirically one component at a time, but no study scales that examination into a population-level head-to-head against the rival predictors. The commercial-avionics building-blocks work that argues for reusable, flight-heritage-rich avionics units [\[55\]](#ref-55) makes the practitioner case for heritage as a cost-and-reliability lever explicitly, asserting that a family of commercial avionics with extensive reliable flight heritage avoids costly requalification. That assertion is exactly the proposition the dissertation puts to test rather than accepts: the building-blocks argument states the H0 position in practitioner form, that heritage retires the need for requalification, and the dissertation's contribution is to ask whether the delivered-article properties or the provenance is what the avoided requalification was actually buying.
The synthesis of Section 3.3 is that the maturity literature supplies a rigorous framework for thinking about heritage as a readiness claim and independently identifies the context-transfer failure mode, while the direct heritage literature consists of single-component proof points and practitioner assertions rather than population-level tests. Confidence that heritage is invoked as a rigor and requalification substitute is high, because it is stated explicitly in the practitioner literature [\[55\]](#ref-55) and structurally in the TRL work [\[33\]](#ref-33)[\[70\]](#ref-70). Confidence that the substitution is empirically warranted is, by the state of this literature, unestablished, because no source in the corpus measures the heritage claim against the rival predictors on a contrast population. That absence is the dissertation's opening.

## 3.4 Parts-class, radiation, and COTS as the rival predictors

The fourth theme assembles the rival hypothesis's evidence base, and here the literature is rich, recent, and quantitative, which is what gives H1 its credibility. The rival claim is that the intrinsic properties of the delivered article, principally EEE parts class and the radiation hardness assurance applied to it, set the failure hazard, and that heritage is at best a loose proxy for these properties. The risk assessment for the use of COTS devices in space systems under consideration of radiation effects [\[12\]](#ref-12) is the anchor. The method is a structured risk assessment that maps commercial-off-the-shelf device characteristics to radiation-induced failure modes and quantifies the resulting risk relative to high-reliability parts. The finding is that parts class, specifically radiation tolerance and screening level, is a first-order determinant of device-level reliability, and that the move toward commercial parts trades cost against this margin in a way that is measurable rather than notional. The interpretation for the dissertation is foundational. The rival predictor is not speculative, because the channel from parts class to failure has been characterized directly, which means the \( \beta_2 \) coefficient in the specification has a mechanism behind it before any estimation occurs. The systematic review of engineering and testing approaches for radiation hardness assurance in commercial space avionics [\[2\]](#ref-2) generalizes this into a review-level synthesis, finding that radiation hardness assurance is the organizing discipline by which parts-class risk is managed and that its rigor varies systematically across programs, which is exactly the variation the test-fidelity index in Chapter 4 is built to capture.

A cluster of device-level radiation studies supplies the mechanism in physical detail. The from-COTS-to-space-grade analysis traces how technology scaling has unintentionally improved radiation hardness in some commercial parts while leaving single-event-effect vulnerability [\[10\]](#ref-10), and the finding that scaling produces natural but uneven hardening warns against treating COTS as a single class: the screening-level subindicator in the dissertation's parts-class variable exists to capture this within-class heterogeneity. The radiation hardness assurance for a NewSpace DC-DC converter [\[111\]](#ref-111) and the single-event-effects and total-ionizing-dose testing of a commercial system-on-module [\[97\]](#ref-97) are concrete qualification campaigns showing that a commercial part's space suitability is established by test, not by pedigree, and that the test reveals failure modes the pedigree did not predict. The use and benefits of COTS board-level testing for radiation hardness assurance [\[86\]](#ref-86) makes the same point at the board level, finding that board-level testing catches integration-level radiation vulnerabilities that part-level data miss, which directly supports the dissertation's decision to index test fidelity at the system level and not only at the parts level. The total-dose radiation hardness assurance work for space electronics [\[110\]](#ref-110) establishes the historical baseline method for total-ionizing-dose assurance, and the NASA radiation hardness assurance guideline [\[82\]](#ref-82) supplies the institutional standard against which a program's assurance rigor can be scored.

The radiation-environment characterization literature grounds why the assurance is necessary. The assessment of the true radiation environment in low Earth orbit for COTS device use [\[87\]](#ref-87) and the broader treatment of COTS devices for space missions in LEO [\[37\]](#ref-37) find that the LEO radiation environment, while milder than deep space, is still severe enough that COTS reliability depends sensitively on the assurance applied, which reinforces the environment-by-parts interaction the dissertation's controls are meant to absorb. The evaluation of algorithm-based fault tolerance under neutron radiation [\[84\]](#ref-84) and the analysis of COTS FPGA single-event-upset sensitivity under combined conducted electromagnetic interference and total ionizing dose [\[106\]](#ref-106) show that parts-class effects compound with operating conditions, a caution the dissertation heeds by recording environment alongside parts class rather than treating them as independent. The why-space-is-unique treatment of basic environment challenges for EEE parts [\[109\]](#ref-109) and the NASA electronic parts and packaging program's account of EEE parts resources [\[68\]](#ref-68) supply the institutional and physical justification for the parts-class hierarchy the dissertation reads from parts control records.

The hybrid-architecture and parts-mixing literature is especially pointed for the dissertation's mechanism because it shows engineers deliberately trading parts class within a single article. The benefits of hybrid electronic architecture mixing COTS and radiation-tolerant components in payload-computer and hyperspectral-camera projects [\[50\]](#ref-50) and the irradiation testing of electronic space components within a shared infrastructure [\[80\]](#ref-80) document that real subsystems contain mixtures of parts classes, which is why the dissertation's dominant-class rule is accompanied by worst-case-class and weighted-class alternatives so the conclusion can be checked against the coding choice. The modular and highly reliable COTS-based power conditioning and distribution unit for small satellites [\[15\]](#ref-15) and the herccules balloon-borne characterization of the thermal environment using COTS [\[3\]](#ref-3) illustrate that COTS-based designs can be engineered to high reliability when the assurance and test are rigorous, which is the H1-consistent reading that delivered-article rigor, not pedigree, carries the reliability.

The synthesis of Section 3.4 is that the rival predictor has a measured mechanism and a deep evidentiary base. Parts class drives device reliability [\[12\]](#ref-12)[\[2\]](#ref-2); the channel is physical and characterized [\[111\]](#ref-111)[\[97\]](#ref-97)[\[10\]](#ref-10)[\[86\]](#ref-86)[\[110\]](#ref-110); the environment modulates it [\[87\]](#ref-87)[\[84\]](#ref-84)[\[106\]](#ref-106)[\[37\]](#ref-37); and engineers manage it through assurance and test rigor that varies across programs [\[15\]](#ref-15)[\[2\]](#ref-2)[\[68\]](#ref-68)[\[109\]](#ref-109)[\[3\]](#ref-3). This is the strongest-evidenced theme in the chapter, and confidence that parts class and assurance rigor are real, first-order reliability drivers is very high. The critical gap, even here, is that this literature measures the parts-class channel in isolation or against cost, never against a heritage claim on the same population, so it establishes that \( \beta_2 \) and \( \beta_3 \) have mechanisms without ever estimating them alongside \( \beta_1 \).

## 3.5 Small-satellite and NewSpace reliability evidence

The fifth theme draws on the small-satellite and NewSpace populations, which are not the dissertation's target population but which provide the clearest natural experiment in reduced parts and test rigor, because these populations deliberately relax the rigor that flagship missions impose. The statistical analysis and modeling of small-satellite reliability [\[41\]](#ref-41) estimates reliability functions for the small-satellite population and finds systematically different, and generally worse, early-life reliability than the larger-platform populations, with the difference plausibly attributable to reduced screening and test. The reading is that when rigor is relaxed, the infant-mortality regime worsens, which is the H1 mechanism observed at population scale even though the study does not frame it causally. The statistical analyses of small-satellite reliability for 1990 through 2019 [\[76\]](#ref-76) and the small-data statistical modeling of small-satellite reliability [\[113\]](#ref-113) replicate this finding on overlapping but distinct windows, and the convergence across these small-satellite studies strengthens the reading that the parts-and-test channel is visible in the aggregate failure record.

The CubeSat reliability literature is the most explicit on the rigor question because the CubeSat community has examined its own beliefs against its own data. The CubeSat reliability work on statistical data, developers' beliefs, and the way forward [\[59\]](#ref-59) is pivotal: its method juxtaposes the empirical CubeSat failure record against a survey of developers' beliefs about why CubeSats fail, and its finding is that developers systematically misattribute failure causes, underestimating the contribution of inadequate test and parts rigor relative to what the data show. This is, in miniature, the misattribution the dissertation argues afflicts heritage reasoning at the flagship scale: a community grants itself a rigor discount on belief, and the failure record contradicts the belief. The reliability estimation tool for reducing infant mortality in CubeSat missions [\[58\]](#ref-58) operationalizes the response, building a tool that targets the infant-mortality regime specifically through pre-flight rigor, which is direct evidence that the early-failure regime is addressable by test and screening, the mechanism the dissertation's test-fidelity coefficient is meant to capture.

The mission-experience literature adds case-level texture. The lessons-learned analysis from the IDEASSat CubeSat covering design, testing, on-orbit operations, and anomaly analysis [\[23\]](#ref-23) documents a first-university-CubeSat anomaly trail in which inadequate pre-flight test is implicated, and the on-orbit no-contact anomaly debug procedure for the CuPID CubeSat [\[7\]](#ref-7) documents a total communications failure traced to a radio subsystem, a single-point failure of the kind that thorough system test is designed to catch. The improving-mission-success analysis for CubeSats [\[105\]](#ref-105) and the CubeSat-mission-from-design-to-operation review [\[75\]](#ref-75) synthesize the accumulated mission experience into the recurring conclusion that test and integration rigor separate the successful small missions from the failed ones. For the dissertation, the small-satellite and CubeSat evidence is the closest thing the literature offers to a manipulation of rigor, and the manipulation moves the outcome in the H1 direction, which raises prior credence in H1 without proving it for the JPL-class population. The limitation, stated plainly, is external validity in reverse: this evidence comes from populations with deliberately reduced rigor and different parts regimes, so its transfer to JPL-class missions is a hypothesis, not a result, which is why the dissertation bounds its population to JPL-class missions and treats NewSpace transfer as a replication question in Chapter 7.

The synthesis of Section 3.5 is that the NewSpace and CubeSat literature supplies the field's nearest approach to an experiment in rigor, and the experiment's outcome is consistent with H1: relaxed parts and test rigor coincides with worse early-life reliability, and communities that discount rigor on belief are contradicted by their own failure data [\[59\]](#ref-59)[\[58\]](#ref-58)[\[41\]](#ref-41)[\[113\]](#ref-113)[\[76\]](#ref-76). Confidence that reduced rigor worsens the infant-mortality regime is moderate to high within these populations; confidence that the same relationship holds at the JPL-class scale, where parts and test floors are higher and heritage is the operative discount lever, is low and is the dissertation's to establish.

## 3.6 The statistical and reliability-modeling toolkit

A sixth, methodological theme runs underneath the substantive ones and deserves explicit treatment, because the dissertation's outcome model inherits its form from this literature. The mixture-Weibull modeling literature beyond the satellite-specific work establishes the general validity of mixture reliability models. The treatments of Weibull and inverse-Weibull mixture models with negative weights [\[51\]](#ref-51), reliability approximation using finite Weibull mixtures [\[6\]](#ref-6), generalized renewal processes based on finite Weibull mixtures [\[104\]](#ref-104), and Bayesian estimation of Weibull mixtures in heavily censored settings [\[34\]](#ref-34) collectively establish that mixture-Weibull models are a mature and well-understood tool for representing populations with distinct failure subpopulations, and that they can be estimated even when censoring is heavy, which is the dissertation's situation. The general Weibull-mixture reliability-analysis treatment [\[11\]](#ref-11) and the small-data Weibull-mixture approach [\[45\]](#ref-45) confirm estimability under the small-sample conditions the dissertation faces. The reading is that the flexible Weibull-mixture baseline \( h_0(t) \) in the dissertation's hazard specification is not an exotic choice but the field-standard representation of the documented infant-mortality-plus-wear-out structure, and that its estimation under censoring is a solved problem.

The infant-mortality modeling literature specifically supports the second outcome. The general limited failure population modeling via the EM algorithm [\[101\]](#ref-101) formalizes a population in which defective units fail early from one mechanism while sound units fail late from another, which is the exact two-mechanism structure the infant-mortality indicator targets, and it supplies an estimation route. The alternative to exponential and Weibull reliability models that explicitly represents the infant-mortality period [\[77\]](#ref-77) and the additive-Weibull reliability prediction work [\[56\]](#ref-56) confirm that the infant-mortality regime is a recognized modeling target with dedicated tools, and the modified-Weibull-extension satellite reliability model [\[74\]](#ref-74) and the combining-modified-Weibull power-system reliability forecast [\[30\]](#ref-30) show the same family applied to satellite and to analogous engineered populations. The phase-type encoding of Weibull failure models for satellite reliability verification [\[112\]](#ref-112) demonstrates that these nonexponential satellite failure distributions can be carried into formal verification frameworks, which is beyond the dissertation's scope but confirms the centrality of the Weibull-mixture representation for satellites. The cross-domain reliability work on wind-turbine critical-component failure modeling [\[94\]](#ref-94) and the GLFP reliability inference application [\[101\]](#ref-101) show that the same survival-and-mixture toolkit transfers across engineered systems, which supports borrowing estimation technique from outside the spacecraft literature where the spacecraft literature is thin.

The synthesis of Section 3.6 is that the dissertation's outcome model is built from field-standard parts: a flexible Weibull-mixture or piecewise-constant baseline for the non-constant hazard [\[56\]](#ref-56)[\[77\]](#ref-77)[\[11\]](#ref-11)[\[51\]](#ref-51)[\[6\]](#ref-6)[\[34\]](#ref-34)[\[104\]](#ref-104), a limited-failure-population logic for the infant-mortality regime [\[101\]](#ref-101), and established estimation under heavy censoring [\[34\]](#ref-34). Confidence in the adequacy of these modeling tools is high; they are mature, cross-validated, and matched to the documented hazard structure. The gap this theme exposes is not in the tools but in their application: the toolkit has been used to describe satellite reliability exhaustively and has never been pointed at the heritage-versus-parts-versus-test comparison, because that comparison requires not better survival modeling but the causal-inference scaffold that Section 3.7 addresses.

## 3.7 The causal-attribution gap and the design-based response

The seventh theme is the chapter's hinge: it explains why the descriptive and modeling literatures, however mature, cannot decide the dissertation's question, and what kind of literature can. The descriptive reliability literature is observational and associational by construction. It reports how reliability varies with subsystem, mass, orbit, and epoch, but it does not, and given its methods cannot, separate the contribution of a heritage claim from the contribution of the parts and test rigor that co-vary with it. The reason is structural and is named precisely in the causal-inference literature. No agency randomizes heritage, parts class, or test fidelity across spacecraft; the same program forces that produce a heritage claim also produce or withhold parts and test rigor, so a naive regression of failure on heritage absorbs the omitted rigor effect. This is the confounding-and-collapsibility problem in causal inference [\[38\]](#ref-38), whose method clarifies when conditioning on a covariate removes versus introduces bias and whose relevance here is that the heritage-failure association is collapsible only under conditions the descriptive literature never checks.

The design-based econometric program supplies the discipline the descriptive literature lacks. The mostly-harmless-econometrics treatment of credible comparison [\[5\]](#ref-5) sets the method: identify the comparison being made, ask what variation in the regressor is being exploited, and ask whether that variation is plausibly unrelated to omitted outcome determinants after conditioning. Its warning about bad controls is decisive for the dissertation and explains a specific specification choice. Conditioning on a post-design test result, such as whether the article passed thermal-vacuum without anomaly, would be a bad control, because the test result is downstream of heritage and parts choices and partly of test fidelity itself, so conditioning on it would absorb the very effect under test. The dissertation therefore uses only pre-launch, pre-outcome inputs and never conditions on the test verdict, a decision that follows directly from this source. The instrumental-variables identification framework [\[4\]](#ref-4) supplies the complementary logic for when an exclusion restriction can substitute for unconfoundedness, which the dissertation invokes as a fallback rather than a primary strategy because credible instruments for heritage are scarce.

The potential-outcomes program of Rubin supplies the design-before-analysis discipline that makes the dissertation a pre-registration rather than a fishing expedition. The central-role-of-the-propensity-score result [\[85\]](#ref-85) establishes that conditioning on a scalar function of observed covariates can balance treatment and comparison groups under unconfoundedness, which is the method the dissertation uses to defend its selection-on-observables identification. The design-trumps-analysis argument [\[93\]](#ref-93) supplies the governing principle that the design, the variable construction, the control set, and the analysis plan should be fixed before the outcomes are examined, which is the posture this dissertation adopts and which distinguishes it from the post-hoc associational reading the descriptive literature would otherwise invite. The comprehensive treatment of causal inference for statistics and the biomedical and social sciences [\[49\]](#ref-49) supplies the overlap requirement in operational form: the comparison is identified only within regions of covariate space where heritage-rich and heritage-poor cells coexist at comparable parts class and test fidelity, and outside that region any estimate is extrapolation. The randomization-role and potential-outcomes foundations [\[88\]](#ref-88) and the related potential-outcomes treatments [\[78\]](#ref-78)[\[91\]](#ref-91)[\[14\]](#ref-14)[\[29\]](#ref-29)[\[90\]](#ref-90) establish the conceptual apparatus that licenses framing a subsystem's failure behavior as a potential outcome under a counterfactual heritage, parts, or test assignment. The design-versus-analysis parallel with randomized trials [\[92\]](#ref-92) and the estimating-causal-effects-from-large-datasets-using-propensity-scores treatment [\[89\]](#ref-89) round out the methodological warrant for an outcome-blind observational design.

The matching, weighting, and selection-on-observables literature supplies the concrete tools for implementing the design on the dissertation's data. The selection-on-observables review covering propensity-score matching, Heckit, and instrumental-variable estimation [\[96\]](#ref-96) surveys the options and their assumptions; the matching-methods review and look-forward [\[99\]](#ref-99) and the balance-diagnostics treatment [\[8\]](#ref-8) supply the matching and balance-checking machinery; the coarsened-exact-matching approach [\[47\]](#ref-47) offers a balance-by-design alternative suited to the dissertation's discrete strata; the entropy-balancing reweighting method [\[42\]](#ref-42) and the genetic-matching method [\[28\]](#ref-28) offer reweighting and automated-balance routes; and the variable-selection-for-propensity-score-models guidance [\[13\]](#ref-13) and the generalized-boosted-model tutorial for multiple-treatment propensity estimation [\[64\]](#ref-64) address the multivalued nature of the dissertation's ordinal regressors. The matching and synthetic-control review in operations-management research under selection on observables [\[62\]](#ref-62) is a particularly apt methodological transfer because it shows the same design-based discipline applied to engineered-system and program-adoption settings analogous to the dissertation's. The when-to-use-unit-fixed-effects guidance [\[48\]](#ref-48) clarifies the trade the dissertation makes in choosing subsystem random effects over fixed effects, and the dissertation reports the comparison under both per Chapter 5. The reporting-of-observational-studies framework [\[103\]](#ref-103) supplies the transparency template the dissertation follows.

Three further methodological sources address the threats that the design cannot fully eliminate and must instead bound. The relative-bias treatment under imperfect identification [\[46\]](#ref-46) supplies the framework for reasoning about how violations of the selection-on-observables assumption propagate into the estimate, which the dissertation uses to state its conclusion as conditional association rather than established causation. The stable-probability-weighting method for heterogeneous effects under limited overlap [\[53\]](#ref-53) is directly relevant because the dissertation's central feasibility risk is exactly limited overlap, where heritage-rich cells are nearly always high-parts-class and fully tested, and this source offers an estimation route and a diagnostic for that case. The sensitivity-analysis framework for selection bias and unmeasured confounding [\[83\]](#ref-83) supplies the formal apparatus for the bounded sensitivity analysis the dissertation runs over the undocumented, disproportionately early-failed cells. The discrete-time survival design literature with random effects [\[116\]](#ref-116), the multilevel survival analysis tutorial [\[9\]](#ref-9), the survival-analysis state-of-the-art treatment [\[79\]](#ref-79), the discrete-time complementary-log-log hazard application with random effects [\[69\]](#ref-69), the Bayesian multilevel discrete-time-to-event analysis [\[63\]](#ref-63), and the repeatability-and-intraclass-correlation treatment for time-to-event data [\[65\]](#ref-65) collectively supply the survival-estimator machinery, including the clustered and random-effects structure, that the dissertation's mixed-effects survival and discrete-time models require. The optimal-design treatment for discrete-time survival models with random effects [\[116\]](#ref-116) additionally informs how the dissertation reasons about its power and minimum-detectable-difference reporting.

The synthesis of Section 3.7 is the chapter's central interpretive move. The descriptive reliability literature establishes the outcome, its structure, its confounders, and its environment dependence, but it is associational and cannot separate provenance from rigor. The parts-and-test literature establishes the rival predictor's mechanism but never estimates it against heritage on a shared population. The maturity literature frames heritage as a readiness claim and identifies the context-transfer failure mode but never tests it. The causal-inference literature supplies the missing instrument: a design-based, outcome-blind, selection-on-observables framework with explicit overlap, bad-controls, and sensitivity discipline that can put the three predictors into a nested head-to-head comparison and decide which dominates. The gap is therefore not a gap in any one literature but a gap between them, and the dissertation's contribution is to bridge the spacecraft-reliability and causal-inference literatures on the heritage question, which neither has done. Confidence that the causal-inference toolkit is adequate to the task is high, because it is mature and has been transferred to analogous engineered-system settings [\[96\]](#ref-96)[\[62\]](#ref-62); confidence that the bridge can be built on the available JPL-class data is moderate and conditional on the overlap diagnostic, which the dissertation reports as a first-class result precisely because a finding that the comparison is unidentified would itself be informative.

## 3.8 Synthesis tables

The following tables consolidate the thematic reading into a form that makes the gap and the propositions legible at a glance. They are interpretive summaries of the sources discussed above, not new evidence.
### Table 3.1 What each literature theme delivers and withholds

| Theme | Principal sources | What it establishes | What it withholds (relative to the dissertation's question) |
|-------|-------------------|---------------------|-------------------------------------------------------------|
| Descriptive reliability base | [\[19\]](#ref-19)[\[21\]](#ref-21)[\[20\]](#ref-20)[\[100\]](#ref-100)[\[95\]](#ref-95)[\[54\]](#ref-54)[\[108\]](#ref-108)[\[17\]](#ref-17)[\[18\]](#ref-18)[\[98\]](#ref-98) | Non-constant hazard; infant-mortality regime; subsystem concentration; subsystem as correct unit; dominant confounder map | Any isolation of heritage from parts/test; etiology of within-subsystem variation |
| Mass/orbit/platform differentiation | [\[32\]](#ref-32)[\[25\]](#ref-25)[\[102\]](#ref-102)[\[39\]](#ref-39)[\[40\]](#ref-40)[\[43\]](#ref-43)[\[16\]](#ref-16)[\[115\]](#ref-115) | Environment and mass shift the hazard; deep-space and GEO are distinct regimes; environment-specific failure channels | Decomposition of why distributions differ; provenance-versus-rigor split within a regime |
| Heritage and maturity | [\[33\]](#ref-33)[\[70\]](#ref-70)[\[1\]](#ref-1)[\[31\]](#ref-31)[\[114\]](#ref-114)[\[44\]](#ref-44)[\[55\]](#ref-55) | Maturity matters for program risk; context-transfer failure mode named; heritage assertable but only as case proof or practitioner claim | Population-level test of heritage against rival predictors |
| Parts-class, radiation, COTS | [\[12\]](#ref-12)[\[111\]](#ref-111)[\[97\]](#ref-97)[\[10\]](#ref-10)[\[86\]](#ref-86)[\[87\]](#ref-87)[\[110\]](#ref-110)[\[84\]](#ref-84)[\[15\]](#ref-15)[\[2\]](#ref-2)[\[68\]](#ref-68)[\[50\]](#ref-50)[\[80\]](#ref-80)[\[109\]](#ref-109)[\[106\]](#ref-106)[\[37\]](#ref-37)[\[3\]](#ref-3) | Parts class is a first-order, mechanism-backed reliability driver; assurance rigor varies and is measurable | Estimation of the parts channel alongside a heritage claim on one population |
| Small-sat / NewSpace | [\[59\]](#ref-59)[\[58\]](#ref-58)[\[23\]](#ref-23)[\[41\]](#ref-41)[\[7\]](#ref-7)[\[75\]](#ref-75)[\[105\]](#ref-105)[\[113\]](#ref-113)[\[76\]](#ref-76) | Relaxed rigor coincides with worse early-life reliability; communities misattribute failure on belief | Transfer to JPL-class population; heritage as the operative discount lever |
| Statistical/reliability toolkit | [\[112\]](#ref-112)[\[74\]](#ref-74)[\[56\]](#ref-56)[\[77\]](#ref-77)[\[30\]](#ref-30)[\[45\]](#ref-45)[\[11\]](#ref-11)[\[94\]](#ref-94)[\[51\]](#ref-51)[\[6\]](#ref-6)[\[34\]](#ref-34)[\[104\]](#ref-104)[\[101\]](#ref-101) | Mixture-Weibull and limited-failure-population models are mature and estimable under censoring | Application to the heritage-versus-rigor comparison |
| Causal-inference scaffold | [\[5\]](#ref-5)[\[4\]](#ref-4)[\[85\]](#ref-85)[\[93\]](#ref-93)[\[49\]](#ref-49)[\[88\]](#ref-88)[\[65\]](#ref-65)[\[96\]](#ref-96)[\[69\]](#ref-69)[\[53\]](#ref-53)[\[78\]](#ref-78)[\[91\]](#ref-91)[\[14\]](#ref-14)[\[29\]](#ref-29)[\[90\]](#ref-90)[\[116\]](#ref-116)[\[62\]](#ref-62)[\[46\]](#ref-46)[\[42\]](#ref-42)[\[48\]](#ref-48)[\[103\]](#ref-103)[\[38\]](#ref-38)[\[28\]](#ref-28)[\[9\]](#ref-9)[\[79\]](#ref-79)[\[89\]](#ref-89)[\[99\]](#ref-99)[\[8\]](#ref-8)[\[47\]](#ref-47)[\[13\]](#ref-13)[\[64\]](#ref-64)[\[92\]](#ref-92)[\[63\]](#ref-63)[\[83\]](#ref-83) | Design-based, outcome-blind, selection-on-observables framework with overlap, bad-controls, and sensitivity discipline | Has never been pointed at the spacecraft heritage question |

### Table 3.2 The three predictors and their evidentiary status before estimation

| Predictor | Notation | Mechanism in the literature | Evidentiary status in this corpus | Confidence its channel is real |
|-----------|----------|------------------------------|------------------------------------|--------------------------------|
| Claimed heritage depth | \( \beta_1 \text{Heritage}_i \) | Informal maturity/readiness claim; presumed to retire requalification | Case proofs [\[1\]](#ref-1) and practitioner assertion [\[55\]](#ref-55); no population-level test | Moderate (asserted, not measured against rivals) |
| EEE parts class | \( \beta_2 \text{PartsClass}_i \) | Sets intrinsic defect and radiation-degradation rate of the article | Direct, quantified mechanism [\[12\]](#ref-12)[\[10\]](#ref-10)[\[2\]](#ref-2) | Very high |
| Test-program fidelity | \( \beta_3 \text{TestFidelity}_i \) | Sets probability latent defects/integration errors are caught pre-launch | Direct evidence early-failure regime is test-addressable [\[86\]](#ref-86)[\[58\]](#ref-58) | High |

## 3.9 The gap, stated explicitly

The gap that this chapter's reading establishes is precise and can be stated without hedging. No study in the assembled literature isolates the contribution of claimed flight heritage from the contribution of EEE parts class and integration-test fidelity, holding mission environment, mission prominence, mass class, and epoch fixed, on a JPL-class population, using a design that can decide the comparison. The descriptive reliability literature, mature and convergent, characterizes the outcome and its confounders but is associational and silent on heritage as a measured variable [\[19\]](#ref-19)[\[21\]](#ref-21)[\[20\]](#ref-20)[\[100\]](#ref-100)[\[95\]](#ref-95). The maturity literature frames heritage as a readiness claim and names the context-transfer failure mode but never tests it at population scale [\[33\]](#ref-33)[\[70\]](#ref-70). The parts-and-radiation literature measures the rival channel directly and deeply but never against a heritage claim on a shared population [\[12\]](#ref-12)[\[2\]](#ref-2). The small-satellite literature offers the field's nearest approach to a rigor manipulation, and its outcome is consistent with the rival hypothesis, but it draws from a population whose parts and test regimes do not transfer to JPL-class missions [\[59\]](#ref-59)[\[41\]](#ref-41). The causal-inference literature supplies exactly the design that could decide the comparison and has been transferred to analogous engineered-system settings, yet it has never been applied to the spacecraft heritage question [\[5\]](#ref-5)[\[93\]](#ref-93)[\[49\]](#ref-49)[\[62\]](#ref-62). The gap is therefore inter-literature: each body of work supplies a necessary component, and no one has assembled the components into the head-to-head test. This is the gap the dissertation fills, and the reason its contribution is the specification and the falsification conditions rather than a set of estimated coefficients.

A second-order gap reinforces the first. Even within the descriptive reliability literature, heritage is almost never operationalized as a variable; it is invoked qualitatively or folded into unmeasured program characteristics. The single corpus source that examines heritage against on-orbit data does so for one component without a contrast population [\[1\]](#ref-1), and the practitioner literature that most strongly asserts the heritage-reliability link offers the assertion as a design rationale rather than as a tested finding [\[55\]](#ref-55). The dissertation's coding of heritage as an ordinal depth that distinguishes design-only, design-plus-build, and design-plus-build-plus-same-environment-flight provenance is itself a contribution to this measurement gap, because it converts a rhetorical label into a variable that the descriptive literature has never constructed.

## 3.10 Propositions that follow from the literature

The thematic reading licenses a set of propositions that carry directly into the dissertation's design. Each is stated with the evidence that supports it, the bound that limits it, and the findings that would raise or lower confidence in it.

Proposition 1. The outcome is modelable. On-orbit subsystem failure exhibits enough structured variation, with a documented infant-mortality regime and a long-lived regime, to support survival and discrete-time modeling [\[19\]](#ref-19)[\[21\]](#ref-21)[\[102\]](#ref-102), and a non-constant, mixture-structured hazard is what survival and limited-failure-population models are built to represent [\[77\]](#ref-77)[\[11\]](#ref-11)[\[101\]](#ref-101). Modelability depends on the assembled sample retaining enough well-documented mission-by-subsystem cells, which the power analysis in Chapter 6 reports rather than assumes. Confidence is high; it would fall if the documented population proved too thin or too survivorship-distorted to recover the hazard shape.

Proposition 2. The confounder structure is known and conditionable. Subsystem identity, orbit, radiation environment, and mass class are documented modulators of the hazard [\[95\]](#ref-95)[\[32\]](#ref-32)[\[25\]](#ref-25)[\[108\]](#ref-108)[\[16\]](#ref-16), and a known confounder that is observable can be conditioned on or absorbed by a random effect, which the specification does through the controls and the subsystem random intercept \( u_s \). Conditioning addresses observed confounders only, so the conclusion remains a conditional association under unconfoundedness, not established causation [\[46\]](#ref-46)[\[38\]](#ref-38). Confidence is high for the observed confounders and moderate overall; it would rise with evidence that program-competence confounding is well proxied by mission prominence and would fall if a strong unobserved confounder were identified.

Proposition 3. The rival predictor is mechanism-backed and therefore a serious competitor to heritage. The parts-class-to-failure channel and its assurance-rigor modulation are directly and quantitatively characterized [\[12\]](#ref-12)[\[10\]](#ref-10)[\[86\]](#ref-86)[\[2\]](#ref-2), and a predictor with a measured mechanism enters the comparison with a non-trivial prior, so \( \beta_2 \) and \( \beta_3 \) are not nuisance terms but candidate dominators of \( \beta_1 \). Mechanism in isolation does not establish dominance against heritage, which only the estimation can decide. Confidence that the rival channel is real is very high; confidence that it dominates heritage is, by design, undetermined until estimation.

Proposition 4. The heritage claim is empirically underdetermined and worth testing. Heritage is asserted as a rigor and requalification substitute in the practitioner literature [\[55\]](#ref-55) and framed as a readiness claim in the maturity literature [\[33\]](#ref-33)[\[70\]](#ref-70), yet examined against on-orbit data only at the single-component case level [\[1\]](#ref-1), and a near-universal design-review assumption with thin empirical isolation is precisely the kind of claim that a pre-registered head-to-head test can adjudicate. The test is identified only within the overlap region, and the overlap diagnostic may reveal that heritage and rigor are too bundled to separate on this population, in which case the honest conclusion is non-identification rather than a verdict for either hypothesis [\[49\]](#ref-49)[\[53\]](#ref-53). Confidence that the claim is underdetermined is high; confidence that it is separable on the available data is moderate and contingent on overlap.

Proposition 5. The deciding instrument is design-based causal inference, not better description. The descriptive and modeling literatures, however mature, cannot separate provenance from rigor, while the causal-inference literature supplies an outcome-blind, selection-on-observables design with overlap, bad-controls, and sensitivity discipline [\[5\]](#ref-5)[\[93\]](#ref-93)[\[49\]](#ref-49). The head-to-head comparison is a causal-attribution problem, and causal attribution under observational data is what the design-based program was built for and has been transferred to analogous engineered-system settings [\[96\]](#ref-96)[\[62\]](#ref-62). The design yields conditional association under stated assumptions, with residual confounding bounded rather than eliminated [\[46\]](#ref-46)[\[83\]](#ref-83). Confidence that the design-based approach is the right instrument is high; what would raise it further is a successful overlap diagnostic, and what would lower it is a finding that no credible control set can break the heritage-rigor bundling.

These five propositions are the bridge from the literature to the design. They establish that the outcome can be modeled, that its confounders are known, that the rival predictor is a credible competitor, that the heritage claim is worth and capable of being tested, and that the deciding instrument is the design-based causal-inference framework rather than additional description. Chapter 4 operationalizes the variables these propositions reference, and Chapter 5 installs the design-based identification strategy that Proposition 5 names. The literature, read thematically and interpreted source by source, has shown that every component of the test exists and that no one has yet assembled them; that assembly is the dissertation's contribution.



# Chapter 4: Data and Measurement

## 4.0 The chapter thesis

Three constructs that are usually invoked as slogans must be turned into auditable, pre-specified variables built from documented inputs and locked before any outcome is examined. That is the chapter's argument, and it is the condition on which the falsification rule is meaningful. Claimed flight heritage, EEE parts-class, and integration-test fidelity are not naturally given quantities waiting to be read off a spacecraft; they are claims, designations, and program scopes that live in different record systems, in different vocabularies, recorded for different purposes. Unless they are operationalized with the same discipline that the identification strategy demands, the head-to-head test in the analysis chapters collapses into a comparison of measurement artifacts rather than a comparison of predictors.

This chapter does four things, and doing all four is what earns the right to run the falsification rule. It names each data source in depth: its provenance, access path, coverage, unit, and known biases. It fixes the unit of analysis as the mission-by-subsystem cell. It operationalizes every variable into a measurement table that maps each construct to an operational definition, a source, and a scale. And it confronts data quality, validation against known values, and the ethics and access constraints of working with NASA and JPL records, treating survivorship not as a closing caveat but as a measurement problem that the source-selection and coding rules must address from the start.

Measurement discipline and econometric identification are inseparable in this design. The selection-on-observables strategy, developed from the Angrist-Pischke design-based program and the Rubin potential-outcomes discipline [\[5\]](#ref-5)[\[85\]](#ref-85)[\[93\]](#ref-93), assumes that the regressors and controls are measured before the outcomes and measured the same way for heritage-rich and heritage-poor cells alike. A measurement process contaminated by knowledge of the outcome, or that codes heritage more generously for missions that happened to succeed, would manufacture exactly the bias the design exists to exclude. The governing principle is carried verbatim from the prospectus: for objective causal inference, design trumps analysis, and the design must be completed, including every variable construction, before the outcome data are examined [\[93\]](#ref-93). The data are observational and archival; the resulting variables carry measurement error and coverage limits that the chapter states rather than conceals. Where the constructs prove too entangled in the records to separate, the chapter concedes it.

## 4.1 Named data sources

Three classes of records supply the variables. They are different in kind, and the differences matter for what each can and cannot measure. The current state of the field is that each source has been used in isolation: reliability statisticians use anomaly databases, radiation engineers use parts and test reports, and program offices use their own heritage and parts-control archives, but no published study has linked all three at the subsystem level to put heritage in competition with parts-class and test-fidelity. The desired state is a single linked frame in which each mission-by-subsystem cell carries its outcome, its heritage claim as made at design review, its as-procured parts-class, and its as-planned and as-run test scope. The gap is the linkage and the disciplined coding that the rest of the chapter specifies. The consequence of leaving the sources unlinked is that the question cannot be asked: heritage cannot be separated from rigor when each lives in a record system that the others never touch.

### 4.1.1 NASA anomaly and lessons-learned records (the outcome source)

The first source supplies the outcomes. The NASA Lessons Learned Information System (LLIS) and the agency's problem reporting and corrective action (PRACA) records together provide narrative and coded anomaly entries at the subsystem and component level. The decision-relevant fields are the time of occurrence relative to launch, where it is recorded; the affected subsystem; and a description rich enough to classify the root cause as a parts, design, integration, environment, or operations failure. LLIS is publicly accessible through the NASA Engineering Network, which is its provenance and its access path; PRACA data, which is more granular and project-specific, is accessed at the project-archive level under JPL records access and is not a public open dataset.
The provenance of these records shapes their bias structure, and that bias structure must be stated because it propagates directly into the outcome variable. Anomaly and lessons-learned systems are populated by a reporting process, not by a census. An anomaly enters the record when someone files it, and the filing threshold is not uniform. Severe anomalies that threatened mission success are reliably reported, while minor anomalies that were worked around without formal action are undercounted. This is a well-documented feature of on-orbit anomaly data, and it explains why the descriptive reliability literature this dissertation builds on works with failure-severity events rather than with every logged off-nominal reading. Castet and Saleh assembled their nonparametric and parametric satellite reliability functions from databases of on-orbit failures at the failure-severity level, and they showed that even at that level the data carry enough variation to distinguish an early infant-mortality regime from a later wear-out regime [\[19\]](#ref-19)[\[21\]](#ref-21). Tafazoli's review of on-orbit spacecraft failures reached a compatible conclusion from the same kind of severity-thresholded record, locating a disproportionate share of failures in a small number of subsystems [\[100\]](#ref-100). Saleh and Castet's platform health scorecard catalogued anomalies and failures by subsystem from this class of source and confirmed the uneven distribution across subsystems [\[95\]](#ref-95). The convergence of these three independent uses of anomaly data means that the undercounting of minor events is not a fatal flaw here. The hypotheses concern reliability-relevant failures, and the severity threshold the literature already applies is the same threshold the outcome variable adopts. The bias runs toward the more severe events, and that is the bias the question wants.

The mechanism by which this source can nonetheless contaminate the design is reverse documentation, and it deserves a named warning rather than a footnote. A subsystem that failed on orbit attracts a failure investigation, and a failure investigation generates records that a quietly successful subsystem never generates. If the act of failing causes a subsystem to be documented more thoroughly, then richer documentation correlates with worse outcomes, which is the opposite of survivorship but equally distorting. The driver is the failure event itself; the mechanism is the investigation it triggers; the observable effect is asymmetric documentation density between failed and successful cells; the operational consequence for the design is that any variable read from post-failure investigation text is suspect. The response, developed in Section 4.5 and carried into the design chapter, is to code heritage and the other regressors only from pre-launch, design-review-era documents, never from the post-failure investigation, so that the regressors cannot be infected by the outcome they are meant to predict.

### 4.1.2 NTRS reliability, parts-stress, and radiation-hardness reports (the rigor source)

The second source supplies the rigor variables and cross-checks the outcomes. The NASA Technical Reports Server (NTRS) hosts reliability analyses, parts-stress and derating reports, radiation hardness assurance (RHA) reports, and qualification and acceptance test summaries. NTRS is publicly accessible through its citations API and its document store, which is its provenance and access path. For missions whose projects documented parts-class and test scope in reports that reached NTRS, these documents are the primary source for the EEE parts-class and test-program-fidelity variables, and they independently corroborate anomaly classifications drawn from the first source.

This source matters because it grounds the rival hypothesis in measurable engineering practice rather than in assertion. The parts-class and radiation literature establishes that what is inside the box and how it was screened is a first-order determinant of device-level reliability. The NASA Radiation Hardness Assurance guideline and the agency's broader treatment of why the space environment is uniquely hostile to EEE parts set out the formal framework within which a part is assigned a class and a screening level [\[82\]](#ref-82)[\[109\]](#ref-109). Winokur and Fleetwood's foundational treatment of total-dose radiation hardness assurance for space electronics established the discipline by which total ionizing dose tolerance is demonstrated and bounded, which is the engineering substance behind a parts-class designation [\[110\]](#ref-110). The NASA Electronic Parts and Packaging program documents the agency's institutional machinery for qualifying parts and tracking their class designations over time, which is the provenance of the class labels the parts-class variable reads [\[68\]](#ref-68). Baumann's account of the path from commercial to space-grade electronics makes the reliability stakes of the class distinction explicit, showing that the move from screened space-grade to unscreened commercial parts trades cost against an intrinsic defect and degradation margin [\[10\]](#ref-10). The interpretation this convergence supports is decisive for the measurement design: parts-class is not a vague quality label but a documented, hierarchical engineering designation with a defined screening regime behind each level, which is exactly what an ordinal variable needs to be measurable and auditable.

The test-fidelity side of this source is grounded in the qualification and acceptance literature in the same way. The presence, type, and duration of environmental test campaigns are recorded in qualification and acceptance summaries, and the engineering content of those campaigns, thermal-vacuum cycling, vibration and acoustic qualification, parts-level screening and burn-in, and system-level functional test, is the substance of the test-fidelity index. The radiation-hardness-assurance reports in particular document the board-level and device-level radiation testing that distinguishes a thoroughly verified article from a lightly verified one, and the literature on the use and benefits of commercial-off-the-shelf board-level testing for radiation hardness assurance shows that this testing is a discretionary scope decision with measurable reliability consequences, not a fixed requirement [\[86\]](#ref-86). The systematic review of engineering and testing approaches for radiation hardness assurance in commercial space avionics confirms that test approaches vary widely across programs and that the variation is documentable, which is the precondition for treating test-fidelity as a constructed index rather than a constant [\[2\]](#ref-2). Witcher and colleagues' radiation-hardness-assurance campaign for a NewSpace DC-DC converter is a concrete instance of the documented test scope the index reads, showing the specific test articles and dose levels that populate a fidelity record [\[111\]](#ref-111).

A coverage bias of this source must be stated. NTRS documentation is densest for missions and parts campaigns that produced formal, releasable reports, which skews toward larger and more prominent programs and toward the parts and test questions that were considered worth a formal report. Smaller missions and routine parts decisions are documented more thinly. This coverage gradient correlates with mission prominence, which is itself a control in the design, so the gradient is partly absorbed by the prominence control. The residual is a real limit on how completely the rigor variables can be measured for the least prominent missions, and Section 4.4 treats it as such.

### 4.1.3 JPL mission archives documenting heritage and parts-class (the heritage source)

The third source is the only one that records the construct at the center of the dissertation. Heritage as claimed at design review does not appear in the anomaly system and only partially in NTRS reports; it lives in project documentation. The JPL mission archives, including heritage assessment matrices, parts control board records, EEE parts lists with class designations, and integration and test plans, supply the heritage-depth variable and corroborate the parts-class variable at the subsystem level. These archives are accessed under JPL records access and are not open literature, a provenance and access fact with consequences for both reproducibility and ethics, addressed in Section 4.6.

This source is indispensable because heritage is a claim about provenance asserted at a particular moment, and only the design-review-era archive captures the claim as it was made. The prospectus draws the distinction between four heritage claims that travel under one word: design heritage, where only the block diagram or algorithm has flown; build heritage, where the article was manufactured to the same drawings by a comparable process; parts heritage, where the same EEE parts from the same class populate the new build; and same-environment flight heritage, where an article identical in design, build, and parts has already operated in the orbit and radiation environment the new mission imposes. The heritage assessment matrices are the documents in which a project states which of these claims it is making for each subsystem, and they are therefore the only valid source for an ordinal heritage-depth variable that distinguishes the four. A heritage label reconstructed after the fact, from a success narrative or a failure investigation, would not preserve the claim as made and would be vulnerable to exactly the reverse-documentation contamination described above. The measurement rule that follows, fixed here and carried into the coding manual, is that heritage depth is coded from the design-review-era assessment, not from any later document.

The known bias of this source is documentation completeness as a function of program class. Heritage claims and parts-class are best documented for JPL flagship and competed science missions, which carry formal heritage assessment matrices and parts control board records as a matter of process, and they are documented more thinly for the smallest mission classes, where the process is lighter. This is the same coverage gradient that affects NTRS, and it interacts with survivorship: a mission that failed early may never have completed or archived a full heritage assessment, so its heritage claims are both thin and disproportionately associated with the worst outcomes. This interaction is the first-order data-quality threat of the dissertation and is the subject of Section 4.4.

## 4.2 Unit of analysis

The unit of analysis is the mission-by-subsystem cell, fixed verbatim from the prospectus and the shared bible. For each spacecraft in the assembled population, each functional subsystem is a record: attitude control (ACS), command and data handling (C&DH), electrical power (EPS), propulsion, thermal, telecommunications, and payload instrument, with the taxonomy reconciled across sources as described in Section 4.5. The outcome variables, the three regressors, and the controls are all measured at this cell.

This choice is not a convenience; it is forced by the structure of the phenomenon and by the descriptive literature, which repeatedly finds that failure behavior is subsystem-specific. Castet and Saleh's extension of satellite reliability analysis to the subsystem level showed that the aggregate spacecraft reliability curve hides large differences across subsystems, with some subsystems contributing disproportionately to early failures [\[20\]](#ref-20). Saleh and Castet's platform health scorecard confirmed the uneven distribution of anomalies and failures across subsystems [\[95\]](#ref-95). Tafazoli's review located failures in a handful of subsystems [\[100\]](#ref-100). Aggregating to the spacecraft level would discard precisely the variation that distinguishes the hypotheses, because heritage, parts-class, and test-fidelity are themselves subsystem-level properties: a spacecraft does not have a single heritage depth, it has a heritage depth for its attitude-control subsystem that may differ from the heritage depth of its instrument. Subsystem cells within a mission are not independent, because they share a bus, a project team, a budget, and an epoch; this dependence is real and is handled in the design chapter by clustering inference at the mission level and absorbing subsystem-type baseline hazard with random intercepts, consistent with the notation carried in the bible, \( \log h(t) = \log h_0(t) + \beta_1 \text{Heritage}_i + \beta_2 \text{PartsClass}_i + \beta_3 \text{TestFidelity}_i + \gamma \text{Controls}_{im} + u_s \), where \( u_s \) is the Gaussian random intercept for subsystem type s. The objection that common-cause failures across subsystems violate the stable-unit-treatment-value assumption is conceded in part and managed by recording lot-level commonality so that shared-parts-lot and shared-bus violations can be flagged and the affected cells examined separately, as the prospectus specifies.

A measurement consequence of the unit choice must be made explicit. Because the cell is mission-by-subsystem, every variable must be definable at that granularity, and a variable that is only available at the spacecraft level must be either disaggregated by a documented rule or relegated to the controls. Mission prominence, mass class, orbit environment, and launch epoch are spacecraft-level and enter as controls at that level. Heritage depth, parts-class, and test-fidelity are subsystem-level and are coded per cell. Where a subsystem-level value is genuinely unavailable and only a spacecraft-level value exists, the cell is flagged as imputed-from-spacecraft and a sensitivity analysis excludes the imputed cells, so the conclusion can be checked against the imputation.

## 4.3 Variable construction and the measurement table

Every variable named in the prospectus is carried forward here verbatim in definition and elaborated into an operational measurement specification. The construction principle, stated once and binding on all variables, is outcome-blindness: each variable is built from documented, auditable fields and fixed before the outcomes are examined, which is the Rubin discipline applied to measurement [\[93\]](#ref-93)[\[49\]](#ref-49). The table below is the spine of the chapter; the subsections that follow it give the operational substance for each row.

### 4.3.1 Measurement table

| Construct | Operational definition | Source | Scale |
|-----------|------------------------|--------|-------|
| Time-to-first-failure (Outcome 1) | Days from on-orbit commissioning to the first recorded anomaly meeting the failure-severity threshold; right-censored at end of mission or end of observation window | NASA LLIS / PRACA anomaly records, linked to commissioning date from mission archives | Continuous (days), right-censored |
| Infant-mortality indicator (Outcome 2) | 1 if a failure-severity anomaly occurs within a fixed early window after commissioning; 0 otherwise | NASA LLIS / PRACA anomaly records; window set from the mixture-Weibull early-subpopulation inflection | Binary {0,1} |
| Heritage depth | Ordinal claim made at design review: none < design-only < design+build < design+build+same-environment flight; same-environment coded against prior-flight orbit and radiation environment | JPL heritage assessment matrices (design-review-era) | Ordinal (4 levels) |
| EEE parts-class | Dominant class of the subsystem's EEE parts on the standard space hierarchy (class S / high-reliability, class B, commercial/COTS), with a screening-level subindicator | JPL parts control board records, EEE parts lists; cross-checked against NTRS parts-stress / NEPP records | Ordinal (3 levels) + binary screening subindicator |
| Test-program fidelity | Index over presence and duration of thermal-vacuum cycling, vibration/acoustic qualification, parts-level screening/burn-in, and system-level functional-test coverage; constructed before outcomes are examined | JPL integration and test plans and as-run records; NTRS qualification/acceptance and RHA summaries | Composite index (standardized continuous) |
| Mission environment (control) | Orbit class and radiation environment of the mission | Mission archives; orbit and radiation references | Categorical (orbit class) + ordinal/continuous (radiation severity) |
| Mission prominence (control) | Review intensity and budget proxy: flagship / competed-line / smaller class | Mission archives, program records | Ordinal (3 levels) |
| Spacecraft mass class (control) | Standard mass category of the spacecraft | Mission archives | Ordinal/categorical |
| Launch epoch (control) | Year or epoch band of launch, to absorb secular technology change | Launch manifests | Continuous (year) or epoch dummies |

### 4.3.2 The two outcomes

The two outcomes are constructed exactly as the bible specifies, and their operational substance is the threshold and the window. Time-to-first-failure is measured in days from on-orbit commissioning to the first recorded anomaly that meets a failure-severity threshold, right-censored at end of mission or end of the observation window. The censoring is informative to handle correctly: a subsystem that operated to end of mission without a failure-severity anomaly is a right-censored observation, not a missing one, and the survival estimator in the design chapter treats it as such. The failure-severity threshold is the same severity level the descriptive reliability literature uses, which is why the outcome is comparable to the published reliability functions and why the undercounting of minor anomalies is acceptable [\[19\]](#ref-19)[\[100\]](#ref-100).

The infant-mortality indicator equals one if a failure-severity anomaly occurred within a fixed early window after commissioning, and the operational decision that makes it principled rather than arbitrary is the source of the window. The window is set from the inflection of the mixture-Weibull early subpopulation reported in the satellite reliability literature, not chosen ad hoc. Castet and Saleh demonstrated that a single Weibull distribution fits satellite on-orbit failure data poorly and that a mixture of an early-failure subpopulation and a longer-lived subpopulation fits better, and the boundary between those subpopulations is an estimated quantity rather than a guess [\[21\]](#ref-21). The mechanism behind the early subpopulation is the latent-defect mechanism: a defect introduced in parts or integration that escapes detection before launch manifests early in operation, which is precisely the failure mode that screening and system test are designed to catch. Setting the window at the empirical inflection means the infant-mortality outcome is anchored to the documented physical regime, and the analysis chapter's expectation that this outcome loads on test-fidelity follows from that mechanism, not from the variable's construction.

### 4.3.3 Heritage depth

Heritage depth is the ordinal measure the entire dissertation turns on, and its operational definition is the four-level claim made at design review: no heritage, design heritage only, design plus build heritage, and design plus build plus same-environment flight heritage. The operational rule that governs it is the coding of same-environment, which is coded against the orbit and radiation environment of the prior flight. Same-environment sits at the top of the ordinal scale, and it is coded against environment, because of the rival hypothesis itself: a heritage claim to a different environment is the case H1 predicts will fail to deliver reliability, because the maturity that retires environmental risk is the maturity of the delivered article in the actual mission environment, not the maturity of the design concept [\[33\]](#ref-33)[\[32\]](#ref-32). The reliability-by-mass and reliability-by-orbit findings make this concrete: the failure distribution shifts with environment and platform class, so a heritage box flown to a benign orbit and now flown to a high-radiation deep-space orbit has a heritage design but an unproven environmental qualification [\[32\]](#ref-32)[\[25\]](#ref-25).

The construction must guard against the substitution failure that the prospectus identifies as the decision-relevant mode: a weaker heritage claim treated as if it were a stronger one. The ordinal coding exists so the regression can distinguish the four claims rather than collapsing them into a binary heritage flag, and the coding rule reads the level from the design-review heritage assessment matrix, which states what the project actually claimed. Because heritage depth is one of the two coding-intensive variables, it is coded independently by two analysts on a common subset and inter-coder agreement is reported as a chance-corrected statistic before full coding proceeds, with disagreements reconciled against the source document under a recorded rule, as Section 4.5 specifies. A robustness re-coding, carried in the analysis plan, requires same-environment flight for the top category under a stricter definition, to test whether any heritage association is driven entirely by the same-environment cases, which would itself be evidence for the rival hypothesis that environment-matched verification rather than provenance is what matters.
### 4.3.4 EEE parts-class

EEE parts-class is the first of the two rival predictors and the most objective of the three coded variables, since it is read directly from parts control records. Its operational definition maps the dominant class of the subsystem's EEE parts to the standard space parts hierarchy, with levels for class S or equivalent high-reliability, class B, and commercial or COTS, accompanied by a screening-level subindicator. The case for treating parts-class as a first-order reliability driver is dense in the corpus. Risk-assessment work on COTS devices in space shows that radiation tolerance and screening level are first-order determinants of device-level reliability, and that the NewSpace move toward commercial parts trades cost against this margin [\[12\]](#ref-12)[\[36\]](#ref-36). The radiation-effects literature for COTS parts in small satellites documents the device-level consequences of reduced screening directly [\[81\]](#ref-81)[\[57\]](#ref-57). Work on the path from COTS to space-grade electronics makes the class distinction's reliability stakes explicit [\[10\]](#ref-10), and the assessment of the true radiation environment in low Earth orbit shows that the margin a class buys is environment-dependent, which ties parts-class measurement to the environment control [\[87\]](#ref-87).

The operational subtlety is the dominant-class rule. A subsystem rarely uses a single parts class throughout. It mixes classes, and the variable must resolve the mix to a single ordinal value. The primary rule assigns the dominant class, but because that choice can affect the conclusion, two alternatives are also constructed: a worst-case-class rule that assigns the lowest class present, and a weighted-class rule that weights by part count or by criticality. All three are built so the conclusion can be checked against the coding choice, the auditability the outcome-blind design requires [\[93\]](#ref-93). The screening-level subindicator captures whether the parts received space-level screening and burn-in independent of their nominal class, because a commercial part that has been upscreened and a commercial part that has not are different reliability objects, and work on the use and benefits of board-level testing for radiation hardness assurance shows that this screening is a documentable, consequential, discretionary step [\[86\]](#ref-86)[\[111\]](#ref-111). Recent device-level studies of specific COTS components under radiation, including system-on-module and FPGA testing, confirm that screening and characterization data are recorded at a granularity that supports the subindicator [\[97\]](#ref-97)[\[106\]](#ref-106)[\[37\]](#ref-37).

### 4.3.5 Test-program fidelity

Test-program fidelity is the second rival predictor and the second coding-intensive variable. It is an index, not a single field, built from the integration and test plan and the as-run records, and its components are the presence and duration of thermal-vacuum cycling, vibration and acoustic qualification, parts-level screening and burn-in, and system-level functional-test coverage. The index is constructed before outcomes are examined, the binding constraint, and it is constructed from the planned and as-run scope, never from the test's verdict, the bad-control prohibition carried from the prospectus and the design-based econometrics it rests on [\[5\]](#ref-5).

The mechanism that makes test-fidelity a candidate predictor of reliability, and specifically of the infant-mortality outcome, is defect detection. Parts-level screening and burn-in catch latent defects in the parts before integration, and system-level functional test and environmental qualification catch integration errors and environment-sensitivity before launch, so a more complete test campaign converts a higher fraction of latent defects from on-orbit failures into pre-launch findings. The literature supports each component of the index as a real and variable engineering practice. The systematic review of radiation-hardness-assurance engineering and testing approaches in commercial space avionics shows that test approaches vary across programs and that the variation is the documentable kind an index needs [\[2\]](#ref-2). The radiation-hardness-assurance reports document the specific dose and environmental test campaigns that the index reads [\[111\]](#ref-111)[\[86\]](#ref-86)[\[82\]](#ref-82). The lessons-learned record from a first university CubeSat, which documents design, testing, on-orbit operations, and anomaly analysis together, is an instructive instance of how thinner test campaigns associate with on-orbit anomalies and of how the test scope is recorded in a form the index can use [\[23\]](#ref-23). The CubeSat reliability statistics literature, which connects developer beliefs and reduced test regimes to outcomes, motivates treating test scope as a measured rather than assumed quantity [\[59\]](#ref-59).

The construct-validity threat for this index is real and is stated. A poorly constructed index could understate one component or double-count another, flattering or penalizing the predictor relative to heritage. The mitigation is threefold: the index is built from documented, auditable fields; its components are pre-specified and weighted by a rule fixed before estimation; and inter-coder reliability is reported for the fidelity coding exactly as for heritage. Where the as-run scope diverged from the planned scope, both are recorded, and the analysis uses the as-run scope as the primary measure because it reflects what the article actually received, with the planned scope retained for a sensitivity check.

### 4.3.6 Controls

The controls operationalize the program-level forces that jointly drive provenance and rigor and that must be conditioned on for the selection-on-observables identification to be credible. Mission environment is operationalized as orbit class and radiation environment, drawing on the assessment of the true radiation environment in orbit to ground the radiation-severity coding rather than treating orbit class as a sufficient proxy for radiation [\[87\]](#ref-87)[\[109\]](#ref-109). Mission prominence is an ordinal flagship / competed-line / smaller-class proxy for review intensity and budget, the variable that captures the documentation-density gradient discussed in Section 4.1 and that does double duty in the survivorship correction. Spacecraft mass class is the standard mass category, included because the reliability-by-mass literature shows the failure distribution shifts with platform size [\[32\]](#ref-32). Launch epoch, as a year or as epoch dummies, absorbs secular technology change, because both parts-class norms and heritage practices have shifted across decades and a heritage-versus-parts comparison must not be a technology trend in disguise [\[36\]](#ref-36)[\[2\]](#ref-2). The controls are chosen for their role in the identification argument and not for predictive power, and the design chapter's bad-controls discipline ensures none of them is a post-treatment outcome.

## 4.4 Coverage, limitations, and survivorship as a measurement problem

Coverage is bounded by what the archives recorded, and the honest statement of that bound belongs to the measurement design rather than an apology appended to it. Heritage claims and parts-class are best documented for JPL flagship and competed science missions and thinner for the smallest classes, which means the heritage-depth and parts-class variables are measured most completely for exactly the missions where mission prominence is highest. Anomaly records undercount minor anomalies that did not trigger formal reporting, which biases the outcome toward more severe events; this is acceptable because the hypotheses concern reliability-relevant failures and the severity threshold is the same one the descriptive literature applies [\[19\]](#ref-19)[\[95\]](#ref-95). These two coverage facts are limits on precision and external reach, not on the validity of the comparison within the well-documented population.

The most serious data limitation is survivorship, and the chapter's position is that survivorship is a measurement problem to be built into the source-selection and weighting rules, not a caveat to be noted at the end. The current-state failure is the convenient one: build the sample from surviving-mission documentation, because that is where the records are complete, and thereby silently drop the missions and subsystems that failed before producing complete documentation. The consequence is a sample in which the worst outcomes are underrepresented and in which heritage claims that were quietly dropped after an early failure never appear as heritage at all, which would bias the heritage-versus-parts comparison in an unknown direction. The driver is the correlation between failure and incomplete documentation; the mechanism is the loss of early-failed cells from a documentation-built frame; the observable effect is a sample whose failure rate is too low and whose heritage-failure association is distorted; the operational consequence is a contaminated test.

The mitigation, carried from the prospectus and treated here as a measurement specification, has three parts, and they are the reason survivorship is a first-order design feature. First, the sampling frame is built from launch manifests, not from surviving-mission documentation, so that early-failed and short-lived missions enter the frame even when their internal records are thin; the frame is the set of cells the question is asked about, and building it from manifests fixes the denominator before documentation completeness can corrupt it. Second, inverse-probability-of-documentation weighting is applied: a model for the probability that a subsystem cell has complete heritage and parts documentation is estimated from observed mission characteristics, and cells are weighted by the inverse of that probability so that under-documented and disproportionately early-failed cells are not silently dropped, the reweighting logic that entropy-balancing and propensity methods formalize in the causal-inference literature [\[42\]](#ref-42)[\[85\]](#ref-85). Third, a sensitivity analysis varies the assumed failure behavior of the undocumented cells across plausible bounds and reports how the heritage-versus-parts comparison moves, so the reader sees the range of conclusions consistent with the missing data rather than a single point estimate that pretends the missing cells do not exist. The qualifier on all three is that they correct for documentation probability as a function of observables; unobserved drivers of joint failure-and-non-documentation remain a residual threat, acknowledged and not waved away.

There is a deeper coverage question that the design must confront before estimation and that belongs in the measurement chapter because it is decided by the data rather than by the estimator: whether enough independent variation exists to separate heritage from rigor at all. If the field always pairs deep heritage with high parts-class and full test, then within any region of environment, prominence, mass class, epoch, and subsystem type there are no heritage-rich and heritage-poor cells at comparable parts-class and test-fidelity to compare, and the heritage effect is not identified separately from the rigor effect. This overlap question is a property of the measured data, and the chapter's commitment, carried into the design and analysis chapters, is to report the overlap diagnostic as a first-class result, because a finding that the comparison is unidentified is itself informative: it would mean heritage and rigor are so bundled in practice that the honest assurance posture is to require the rigor regardless of the heritage claim. Confidence in the design's ability to answer the question is therefore conditional on an overlap finding that cannot be known until the data are assembled, and the chapter states that confidence as moderate and contingent rather than high.

## 4.5 Record linkage and inter-coder measurement reliability

The three source classes are linked at the mission-by-subsystem cell, and the linkage is a measurement operation with its own error structure that must be specified rather than assumed away. Linkage proceeds in three documented stages, each a place where measurement error can enter and each with a stated rule for containing it.

The first stage is mission matching. The same mission appears under different names in the anomaly system, the NTRS reports, and the project archives, so missions are matched across sources by a canonical mission identifier reconciled from launch designation, project name, and launch date. The error mode here is a false match or a missed match, and the containment rule is to require agreement on at least two of the three identifying fields and to adjudicate residual ambiguity against the launch manifest, the authoritative record of what flew and when.

The second stage is subsystem mapping. The anomaly system, the parts records, and the test plans use different subsystem nomenclatures, so a fixed crosswalk assigns each source's subsystem label to one of the common functional subsystems, and ambiguous cases are adjudicated by two coders. The crosswalk is built once, before the outcomes are examined, and is frozen, so that no subsystem assignment can be revised in light of an outcome; the crosswalk and its adjudication log form Appendix B of the dissertation. The error mode is a misassigned subsystem, which would contaminate the subsystem random effects and the subsystem-specific baseline hazard, and the containment is the two-coder adjudication with a recorded rule.

The third stage is anomaly assignment. Each anomaly is assigned a time relative to commissioning and a root-cause class, parts, design, integration, environment, or operations, from the narrative and coded fields. Operations-caused and environment-caused anomalies are retained as outcomes but flagged, so that sensitivity to their inclusion can be tested, since the hypotheses concern article-intrinsic reliability rather than operator error. This flagging is itself a measurement decision with a defensible rationale: an operations-caused anomaly is not a property of the delivered article and including it indiscriminately would add noise to the outcome, but excluding it entirely would discard information and risk misclassification, so the principled course is to retain it, flag it, and report the comparison with and without it.

Measurement reliability is reported, not assumed, and this commitment distinguishes a defensible coding from an arbitrary one. The two coding-intensive variables, heritage depth and test-fidelity, are coded independently by two analysts on a common subset, and inter-coder agreement is reported as a chance-corrected statistic before the full coding proceeds; disagreements are reconciled against the source document and the reconciliation rule is recorded. The choice of a chance-corrected agreement statistic rather than raw percent agreement matters because the ordinal heritage scale and the index components have unequal marginal frequencies, and raw agreement would overstate reliability where one level dominates. Parts-class is the most objective of the three because it is read directly from parts control records, but where a subsystem mixes classes the dominant-class rule and its alternatives, worst-case class and weighted class, are all constructed so the conclusion can be checked against the coding choice. This auditability is required by the outcome-blind design discipline: every construction decision is fixed and documented before the outcomes enter the estimation, the operational meaning of design trumping analysis in a measurement context [\[93\]](#ref-93)[\[49\]](#ref-49).

The reasoning that ties the linkage and reliability machinery back to the chapter thesis is direct. The head-to-head test compares three standardized coefficients, and a comparison of coefficients is only as good as the comparability of the variables behind them. If heritage were coded more loosely than parts-class, or if subsystem labels were assigned inconsistently across sources, the comparison would reflect coding asymmetry rather than predictive difference, and the falsification rule would be deciding between measurement artifacts. The linkage rules and the reported inter-coder reliability are what license reading the coefficient comparison as a comparison of predictors, the claim the chapter opened with.

## 4.6 Ethics, data access, and reproducibility

The data-access and ethics posture of the dissertation is shaped by the fact that two of the three source classes are not open literature. LLIS is publicly accessible through the NASA Engineering Network, and NTRS is publicly accessible through its citations API and document store, so the outcome cross-checks and a meaningful share of the rigor variables can be assembled from open sources whose provenance is citable. The PRACA project-level records and the JPL mission archives, including the heritage assessment matrices and parts control board records, are accessed under JPL records access and are not open datasets, which has three consequences that the chapter states plainly.

The first consequence is for citation and provenance. The JPL-internal sources cannot be cited by a DOI because they are not published literature, and the dissertation therefore describes their access path and records their provenance rather than pretending they are citable in the same way as the reliability and radiation literature. This is a known limitation flagged in the expansion plan as a data-access dependency rather than a literature gap, and it is the reason the heritage construct, which is the dissertation's contribution, rests on a primary archival source outside the open corpus. The convergent open literature on parts-class and test practice [\[12\]](#ref-12)[\[10\]](#ref-10)[\[2\]](#ref-2)[\[86\]](#ref-86) grounds the rigor variables in citable engineering practice, but the heritage-as-claimed-at-design-review variable is unavoidably archival.

The second consequence is for reproducibility, and the response is the pre-registration and coding-manual machinery already specified. Because an external researcher cannot necessarily obtain the same JPL-internal records, reproducibility is supported by fixing and publishing the variable-coding manual, the subsystem crosswalk, the documentation-probability model, the pre-registration block, and the power tables as appendices, so that the construction rules are fully transparent even where the underlying records are access-controlled. A reader can audit every coding decision and every modeling choice against the documented rule, the achievable form of reproducibility for a study built on controlled archival data, and the form the outcome-blind design demands [\[93\]](#ref-93).
The third consequence is ethical and concerns the use of failure records. Anomaly and failure investigations document mistakes, and the dissertation uses them to study reliability drivers, not to attribute blame to teams or individuals. The unit of analysis is the mission-by-subsystem cell, and the regressors are article and program properties, not personnel; the analysis reports associations between heritage, parts-class, test-fidelity, and failure hazard, and it does not identify or evaluate the people who made the decisions. Flagging operations-caused anomalies and treating them separately reinforces this stance by keeping operator error analytically distinct from article-intrinsic reliability. Access to JPL records is conducted under the applicable records-access terms, and the deliverable is a statistical specification and its findings, not a re-litigation of any individual mission's anomaly board. This framing is both an ethical commitment and a measurement discipline, because a blame-oriented use of the records would create incentives that distort the very documentation the study depends on.

## 4.7 Validation against known values

A measurement design that cannot be checked against anything asks to be trusted. The alternative this chapter adopts is to validate the constructed variables against known values wherever the published literature supplies a benchmark. The claim is that the assembled data, before any heritage analysis is run, should reproduce the established descriptive facts about satellite reliability; if it does not, the measurement is suspect, and the discrepancy must be explained before the head-to-head test is credible.

Three validation checks are specified. The first is the reproduction of the subsystem failure-concentration pattern. The descriptive literature establishes that on-orbit failures concentrate in a small number of subsystems and that the distribution across subsystems is uneven [\[100\]](#ref-100)[\[95\]](#ref-95)[\[20\]](#ref-20). The assembled outcome data, summarized by subsystem before any regression, should show the same concentration; a flat distribution across subsystems would signal that the anomaly-to-subsystem crosswalk is misassigning events, and the validation check therefore tests the crosswalk as much as the data. The second is the reproduction of the early-failure regime. The mixture-Weibull finding establishes that a non-negligible fraction of failures occur early in life, consistent with infant mortality rather than wear-out [\[19\]](#ref-19)[\[21\]](#ref-21). A nonparametric hazard estimate on the assembled time-to-first-failure data should show an elevated early hazard, and the inflection that locates the infant-mortality window should fall in the region the published mixture models identify; a flat or monotone-increasing hazard would signal a censoring or commissioning-date error. The third is the reproduction of the environment and mass gradients. The reliability-by-mass and deep-space reliability analyses establish that the failure distribution shifts with platform size and with environment [\[32\]](#ref-32)[\[25\]](#ref-25). The assembled data, summarized by mass class and orbit environment, should show the documented gradients, which validates the environment and mass-class controls as measured rather than nominal.

The interpretation of these checks is calibrated to the design stage. They validate the measurement, not the hypotheses, and passing them does not support H1 or H0; it supports only the claim that the assembled variables are measuring what the literature has already characterized. The confidence this chapter places in the measurement design is moderate and conditional on these checks passing. The evidence that would raise it is the successful reproduction of all three documented patterns on the assembled frame; the evidence that would lower it is a failure to reproduce any of them, which would send the analysis back to the linkage and coding rules before any heritage coefficient is estimated. Stating the validation checks in advance, with their pass and fail interpretations fixed, applies to measurement the same outcome-blind discipline the design chapter applies to estimation [\[93\]](#ref-93)[\[49\]](#ref-49).

## 4.8 How the measurement design advances the argument

A data chapter that does not connect to the dissertation's argument is a catalogue, not a contribution. Five claims organize the argument, and the measurement design advances each.

The problem is real: heritage is invoked as a rigor substitute while infant mortality and subsystem anomalies persist across heritage-rich populations, and the outcome source measures exactly those anomalies at the severity level the literature validates [\[19\]](#ref-19)[\[100\]](#ref-100)[\[95\]](#ref-95). The problem is material: failure concentrates in a few subsystems, and the parts and test campaigns that heritage arguments target are large, documentable, discretionary scopes, which the rigor source measures through parts-class designations and test-campaign records grounded in the radiation-assurance and COTS literature [\[10\]](#ref-10)[\[12\]](#ref-12)[\[2\]](#ref-2)[\[86\]](#ref-86). The design addresses the causal mechanism: the variable construction codes heritage as claimed at design review and codes parts-class and test-fidelity as properties of the delivered article, never conditioning on post-launch verdicts, so the comparison separates provenance from the delivered-article properties that the mechanism implicates [\[5\]](#ref-5)[\[93\]](#ref-93). It beats the alternatives: a study that read variables from surviving-mission documentation or from post-failure investigations could not separate heritage from rigor, while the launch-manifest frame, the inverse-probability weighting, and the outcome-blind coding can [\[85\]](#ref-85)[\[42\]](#ref-42)[\[49\]](#ref-49). The residual risk is acceptable and stated: the conclusion will be a conditional association under unconfoundedness, the survivorship correction handles documentation probability as a function of observables and leaves an acknowledged residual, and the overlap diagnostic is reported as a first-class result that can declare the question unidentified rather than forcing a false answer [\[93\]](#ref-93)[\[38\]](#ref-38). Each chapter advances this argument in its own register; this one contributes the measurement decisions on which the rest depends.

The architecture-traceability layer is deliberately out of scope here, as the bible directs, because this is an empirical reliability study and not an enterprise or systems-architecture deliverable; the unit of analysis is a statistical cell, and no real capability, system, or data exchange is in scope, so no DoDAF or BEA vocabulary is forced onto the measurement. The decision-relevance that an architecture chain would otherwise carry is carried instead by the mission-assurance policy implications developed in the discussion chapter, where the measured comparison turns into guidance about where assurance dollars should go. What this chapter guarantees for that downstream argument is that the variables it will rest on are real, documented, pre-specified, outcome-blind, linked with a stated error structure, reported with inter-coder reliability, corrected for survivorship at the frame and the weight, and validated against the known descriptive facts of satellite reliability before a single heritage coefficient is estimated. That guarantee is the chapter's contribution to the whole.


# Chapter 5: Research Design and Identification

## 5.0 The answer this chapter defends

Whether claimed flight heritage actually buys delivered on-orbit reliability for JPL-class spacecraft is answerable on observational mission data only if the research design earns the right to read the heritage coefficient as something more than a raw correlation. This chapter earns that right through a single, defensible chain: a mixed-effects survival estimator that respects the documented two-regime hazard structure of satellite subsystems; a selection-on-observables identification argument that names its assignment mechanism and its overlap requirement explicitly; a survivorship correction built into the sampling frame and the weighting rather than appended as a caveat; and a threat catalogue that downgrades the contribution's claimed strength from causation to conditional association wherever the evidence cannot support more. The deliverable is not an estimate. It is a specification rigid enough to be falsified and honest enough to report when it cannot be.

The chain matters because the alternative is the failure mode the whole dissertation is written against. A naive regression of subsystem failure on a heritage label, run on whatever missions happen to have complete archives, would absorb into the heritage coefficient every program characteristic that travels with heritage in practice: the budget that buys high-reliability parts, the schedule that buys a full qualification campaign, the review intensity that catches latent defects. Such a regression would confirm that heritage predicts reliability while telling a review board nothing about whether the next heritage claim, stripped of the rigor it usually rides alongside, will deliver. The design is constructed to break that bundling where the data permit and to report it honestly where they do not.

The notation, the hypotheses, the variable definitions, and the falsification rule introduced here are carried verbatim from the shared specification that governs every chapter of this dissertation. Chapter 4 has already named the three source classes, the mission-by-subsystem unit of analysis, and the construction of the two outcomes and three regressors of interest. This chapter takes those measured quantities as given and specifies what is done with them: the estimator (Section 5.1), the identification strategy (Section 5.2), the survivorship correction (Section 5.3), the full threat-to-validity catalogue (Section 5.4), the robustness battery and power analysis (Section 5.5), and the pre-registration and computational commitments that hold the design accountable (Section 5.6).

### 5.0.1 Problem frame for the chapter

Mission-assurance analytics are descriptive. The mature satellite-reliability literature, built principally by Castet and Saleh and their collaborators, fits nonparametric and parametric reliability functions to populations of on-orbit failures and establishes, across independent datasets, that the satellite hazard is not constant, that an early infant-mortality regime coexists with a later wear-out regime, and that subsystem identity, mass, and orbit shift the failure distribution [\[19\]](#ref-19), [\[21\]](#ref-21), [\[20\]](#ref-20), [\[32\]](#ref-32). These curves describe how satellites fail. They do not isolate why a particular delivered article failed, and they do not separate the contribution of an article's provenance from the contribution of its parts-class and its test campaign.

The desired state is a design that performs that separation under a stated and defended identifying assumption, on a JPL-class population, with the inferential discipline that observational causal work requires. The gap is a research-design gap, not merely a data gap: even with the assembled mission-by-subsystem frame, a comparison of heritage against parts-class and test-fidelity is uninformative unless the estimator matches the hazard structure, the identification argument confronts confounding directly, and the survivorship distortion that quietly drops early-failed missions is corrected rather than ignored. Assurance dollars are currently flowing on a correlation that no one has decomposed, and the portfolio cannot tell whether its heritage discounts are buying reliability or merely buying a justification to cut the test scope and parts rigor that actually buy it.

This chapter closes the design gap. Confidence in doing so is moderate to high on the estimator and the threat catalogue, where the methodological literature is directly applicable, and deliberately moderate on the identification claim, where the strongest defensible reading of an observational design is a conditional association under unconfoundedness. That calibration is stated at the outset and maintained throughout; overclaiming the identification would itself violate the design-before-analysis discipline that governs the whole dissertation [\[93\]](#ref-93).


## 5.1 The Estimator

### 5.1.1 The estimator must match the documented hazard structure

The primary estimator is a mixed-effects (frailty) survival model for time-to-first-failure with a flexible baseline hazard and Gaussian subsystem random intercepts, complemented by a discrete-time complementary-log-log hazard model for the infant-mortality indicator. This pairing is chosen because it is the smallest model class that simultaneously respects the two-regime hazard, the subsystem-specific baseline, and the clustered, right-censored structure that the data and the prior literature establish.

Three measured features of the outcome force this choice rather than a simpler one. First, the satellite hazard is not constant: Castet and Saleh show that single-Weibull fits are frequently inadequate and that a mixture distribution, capturing an early-failure subpopulation and a longer-lived subpopulation, fits on-orbit failure data better than a single distribution [\[21\]](#ref-21). A constant-hazard exponential model, or any proportional-hazards model with a rigid baseline, would misrepresent the early window that is central to the infant-mortality outcome. Second, the aggregate satellite curve conceals large between-subsystem differences in baseline hazard: the multi-state subsystem analyses and the subsystem-specific reliability studies for the electrical power and attitude control subsystems demonstrate that each functional subsystem carries its own failure signature [\[20\]](#ref-20), [\[32\]](#ref-32). An estimator that ignored subsystem identity would let those baseline differences leak into the regressors of interest. Third, the unit of analysis is the mission-by-subsystem cell, and cells are clustered within missions, so the outcomes are neither independent nor singly censored.

A frailty survival model with subsystem random intercepts is the canonical tool when failure-time data are clustered and the baseline hazard varies by group; the multilevel survival-analysis literature establishes that random-effect (frailty) terms absorb unobserved group-level heterogeneity in the baseline hazard while leaving the covariate coefficients interpretable as within-and-between effects under stated assumptions [\[9\]](#ref-9). The discrete-time complementary-log-log companion is the standard discrete-time analogue of a continuous proportional-hazards model and is the appropriate estimator when the outcome is an indicator of failure within a fixed period and the period structure is coarse, as the infant-mortality window is [\[69\]](#ref-69), [\[63\]](#ref-63), [\[116\]](#ref-116). The discrete-time cloglog hazard model with random effects has an established applied track record on exactly this kind of right-censored, clustered duration outcome: it has been used to model export survival with random effects and Kaplan-Meier companions [\[69\]](#ref-69) and to model time-to-event with Bayesian multilevel structure on heavily clustered data [\[63\]](#ref-63). The optimal-design literature for discrete-time survival models with random effects confirms that the estimator is well-posed and that its information structure is understood, which matters for the power analysis in Section 5.5 [\[116\]](#ref-116). Repeatability and intraclass-correlation methods for time-to-event data, recently standardized, give the procedure for reading the subsystem random-effect variance as a meaningful quantity rather than a nuisance [\[65\]](#ref-65).

This estimator choice is held with high confidence as the appropriate model class. The specific baseline form (piecewise-constant versus a parametric Weibull-mixture baseline) is held with moderate confidence and is itself a tested object: the design fits both and reports the heritage-versus-rigor conclusion under each, so that the substantive finding is not an artifact of the baseline parameterization. One could object that a fully nonparametric Cox model with a frailty term would avoid committing to any baseline shape and would therefore be safer. The design declines this as the primary estimator for the infant-mortality outcome specifically, because the Cox partial likelihood discards the baseline and with it the early-window shape that the infant-mortality hypothesis is about; the early regime is where the mixture literature shows the hazard is most sharply non-constant [\[21\]](#ref-21). The Cox frailty model is retained as a robustness check for the time-to-first-failure outcome (Section 5.5), where the proportional-hazards form is the object of interest and the baseline shape is a nuisance, but it is not the vehicle for the early-window test.
### 5.1.2 The formal specification

The hazard of first failure for subsystem cell *i* in mission *m* at on-orbit time *t* takes a proportional-hazards form. The log hazard is the sum of a baseline log hazard that depends on time, a linear index in the three regressors of interest, a linear index in the controls, and a subsystem random intercept. Carrying the fixed notation of the dissertation verbatim:

\[ \log h(t) = \log h_0(t) + \beta_1 \text{Heritage}_i + \beta_2 \text{PartsClass}_i + \beta_3 \text{TestFidelity}_i + \gamma \text{Controls}_{im} + u_s \qquad\qquad (3) \]

Here Heritage, PartsClass, and TestFidelity are the ordinal or index regressors defined in Chapter 4 and in the shared specification. Heritage is the ordinal heritage-depth measure (none < design-only < design+build < design+build+same-environment flight). PartsClass is the ordinal EEE parts-class measure on the standard space hierarchy (class S or high-reliability, class B, commercial or COTS) with its screening-level subindicator. TestFidelity is the index built from thermal-vacuum cycling, vibration and acoustic qualification, parts-level screening and burn-in, and system-level functional-test coverage. Controls are mission environment (orbit class and radiation environment), mission prominence (flagship, competed-line, or smaller class), spacecraft mass class, and launch epoch. The term \( u_s \) is the Gaussian random intercept for subsystem type *s*, distributed \( \mathcal{N}(0, \sigma_s^2) \), which absorbs the documented subsystem-specific baseline hazard [\[20\]](#ref-20), [\[32\]](#ref-32), [\[54\]](#ref-54), [\[108\]](#ref-108). The function \( h_0(t) \) is the flexible baseline, specified as piecewise-constant over a small number of pre-set intervals or, in the alternative specification, as a Weibull-mixture baseline consistent with the documented early and late failure regimes [\[21\]](#ref-21).

All three regressors of interest sit on a common standardized scale before estimation, so that the coefficients \( \beta_1 \), \( \beta_2 \), and \( \beta_3 \) are directly comparable in magnitude. This standardization is not cosmetic. The falsification rule is a statement about the relative magnitudes of the standardized coefficients, and it would be meaningless if the regressors remained on their native and incommensurable scales (an ordinal heritage level, an ordinal parts class, and a continuous test index). The standardization is fixed in the pre-registration block (Section 5.6) before any outcome is examined.

The discrete-time companion replaces the continuous baseline with a set of period indicators and estimates the same linear index by a complementary-log-log link on subsystem-period records:

\[ \operatorname{cloglog}\!\left( \Pr(\text{fail in period } k \mid \text{survived to } k) \right) = \alpha_k + \beta_1 \text{Heritage}_i + \beta_2 \text{PartsClass}_i + \beta_3 \text{TestFidelity}_i + \gamma \text{Controls}_{im} + u_s \qquad\qquad (4) \]

where \( \alpha_k \) is the period-specific baseline (the discrete analogue of \( \log h_0 \)) and the linear index is identical to the continuous model. The complementary-log-log link is chosen over the logit link here because it renders the discrete-time coefficients interpretable as the same proportional-hazards coefficients estimated by the continuous model, so that the two outcomes are estimated within one coherent framework rather than two unrelated ones [\[69\]](#ref-69), [\[63\]](#ref-63). This companion produces an early-window hazard that maps cleanly onto the infant-mortality outcome whose window is set, not ad hoc, from the inflection of the mixture-Weibull early subpopulation reported in the reliability literature [\[21\]](#ref-21).

### 5.1.3 The hypotheses as statements about the coefficients

The hypotheses of the dissertation are statements about the coefficients, and the estimator is built so those statements are testable. Restating the fixed hypotheses in coefficient terms:

- **H0 (null):** prior-flight heritage depth is the primary driver. In coefficient terms, the standardized magnitude \( |\beta_1| \) is the largest of the three and remains stable and bounded away from zero when \( \beta_2 \) and \( \beta_3 \) are added to the model. Parts-class and test-fidelity add little once heritage is included.
- **H1 (alternative):** realized failure rate is predicted more strongly by parts-class and test-fidelity. In coefficient terms, \( |\beta_2| \) and \( |\beta_3| \) exceed \( |\beta_1| \), and \( \beta_1 \) collapses toward zero, with a confidence interval covering negligible effect, once \( \beta_2 \) and \( \beta_3 \) enter.

The test is implemented as a nested model comparison. Model A estimates the linear index with heritage and the controls only:

\[ \log h(t) = \log h_0(t) + \beta_1 \text{Heritage}_i + \gamma \text{Controls}_{im} + u_s \qquad\qquad (5) \]

Model B adds parts-class and test-fidelity:

\[ \log h(t) = \log h_0(t) + \beta_1 \text{Heritage}_i + \beta_2 \text{PartsClass}_i + \beta_3 \text{TestFidelity}_i + \gamma \text{Controls}_{im} + u_s \qquad\qquad (6) \]

The test reads the change in \( \beta_1 \) from Model A to Model B together with the magnitudes of \( \beta_2 \) and \( \beta_3 \) in Model B. H1 predicts that \( \beta_1 \) attenuates substantially toward zero and loses stability when \( \beta_2 \) and \( \beta_3 \) enter, while \( \beta_2 \) and \( \beta_3 \) are large and stable. H0 predicts that \( \beta_1 \) survives the addition with its magnitude and its exclusion of negligible effect largely intact. This A-to-B comparison is the engine of the falsification, and the identification argument of Section 5.2 is what licenses reading the comparison as evidence about the rival drivers rather than as an artifact of confounding.

Confidence in the estimator design is high: the model class is standard, well-understood, and matched feature-by-feature to the documented data structure. Evidence that would lower this confidence includes a finding, at the diagnostic stage, that the proportional-hazards assumption fails badly across the early window for the heritage regressor specifically, in which case the design moves that coefficient to a time-varying form (Section 5.5) rather than forcing it into a constant. Evidence that would raise it includes convergence of the continuous and discrete-time estimates on the same A-to-B pattern, which would show the conclusion is not an artifact of either link.


## 5.2 The Identification Strategy

### 5.2.1 Identification is selection-on-observables, defended on three fronts

The design identifies the conditional associations of heritage, parts-class, and test-fidelity with the failure hazard under a selection-on-observables (unconfoundedness) assumption: conditional on mission environment, mission prominence, mass class, launch epoch, and subsystem type, the assignment of heritage depth, parts-class, and test-fidelity to a subsystem is treated as as-good-as-unconfounded with the residual determinants of failure. The credibility of this assumption is defended on three fronts (a control set chosen to capture the common drivers, an overlap restriction, and a bad-controls discipline), and the strongest claim the design will make is a conditional association under stated unconfoundedness, not an established causal effect.

The estimation problem is observational by necessity. No agency randomizes heritage, parts-class, or test fidelity across spacecraft, and none could. The threat this creates is specific and nameable: the same program characteristics that produce a heritage claim (a generous budget, a flagship designation, a mature institutional pipeline) also tend to produce parts rigor and test rigor, so a regression of failure on heritage that omits the rigor variables will absorb their effect into the heritage coefficient. This is the textbook omitted-variable structure, and it is exactly what the A-to-B comparison is built to expose: if heritage and rigor are confounded, \( \beta_1 \) will fall when the rigor variables enter Model B.

The Angrist-Pischke design-based program supplies the discipline for reading a regression coefficient causally: identify the comparison being made, ask what variation in the regressor is being exploited, and ask whether that variation is plausibly unrelated to omitted determinants of the outcome after conditioning [\[5\]](#ref-5). Their treatment of "bad controls," variables that are themselves outcomes of the treatment, is the basis for the specification choice in Section 5.2.3. Rubin's potential-outcomes framework supplies the complementary discipline: the assignment mechanism for an observational treatment is unknown and must be reconstructed and defended from observed covariates, and the credibility of any causal reading rests on unconfoundedness and on overlap between the compared groups [\[4\]](#ref-4), [\[85\]](#ref-85), [\[49\]](#ref-49). The selection-on-observables apparatus is not a niche tool; it is the mainstream of observational causal inference, and its application to settings without randomization is documented across operations management [\[62\]](#ref-62), program evaluation [\[96\]](#ref-96), and the broad methodological reviews [\[85\]](#ref-85), [\[49\]](#ref-49). Rubin's central and repeatedly stated methodological point, that the design of an observational study should be completed (treatment groups defined, covariates fixed, overlap demonstrated) before the outcome data are examined, is the foundation of the pre-registration commitment in Section 5.6 [\[93\]](#ref-93).

Confidence in the identification claim is deliberately moderate, and the chapter says so plainly. Selection-on-observables is an assumption, not a fact, and it cannot be fully verified from the data it is invoked to analyze. The design strengthens the assumption's plausibility through the control set and the overlap restriction, and it bounds the consequences of the assumption's failure through the sensitivity analyses in Sections 5.3 and 5.5, but it does not claim to have eliminated unobserved confounding. The honest statement of the result is therefore a conditional association under unconfoundedness, with the residual-confounding risk reported rather than assumed away.

A reader committed to a stricter standard might argue that without an instrument or a natural experiment, no causal reading is warranted at all and the study should retreat to pure description. The reply is twofold. First, the head-to-head framing partially insulates the contribution from this objection: even read as a purely predictive comparison, a finding that parts-class and test-fidelity dominate heritage in a conditional model is decision-relevant for where assurance attention should go, because it identifies which observable property of the delivered article carries the predictive weight. Second, the recent literature on relative bias under imperfect identification shows how to quantify how far the selection-on-observables estimate could be from the truth under bounded violations, which is the form in which the design reports its causal claim [\[46\]](#ref-46). The contribution does not rest on a clean causal point estimate; it rests on a coefficient comparison whose sensitivity to the identifying assumption is itself reported.
### 5.2.2 The control set and the overlap restriction

The control set captures the program-level forces that jointly drive provenance and rigor. Mission environment (orbit class and radiation environment) enters because the failure distribution shifts with environment, and a heritage box flown to a harsher environment than its prior flight carries an unproven environmental qualification [\[32\]](#ref-32). Mission prominence (flagship versus competed-line versus smaller class) proxies the budget and review intensity that drive both heritage retention and rigor. Mass class absorbs the platform-size effect documented in the reliability-by-mass analysis [\[32\]](#ref-32). Launch epoch absorbs secular technology change, because both parts-class norms and heritage practices have shifted across decades. The control set is fixed in advance, justified by the requirement, drawn from the variable-selection literature for observational designs, that controls capture the common causes of treatment and outcome without including the treatment's own consequences [\[5\]](#ref-5), [\[38\]](#ref-38).

Overlap is the second front, and the design treats it as a first-class result rather than a precondition assumed to hold. Identification under selection-on-observables requires that, within a region of environment, prominence, mass class, epoch, and subsystem type, the data contain both heritage-rich and heritage-poor subsystems at comparable parts-class and test-fidelity. Where the field always pairs deep heritage with high parts-class and a full test campaign, no within-stratum comparison exists, and the heritage effect is not separately identified from the rigor effect [\[85\]](#ref-85), [\[49\]](#ref-49). The design therefore reports an overlap diagnostic, a propensity-style balance table within strata showing how many heritage-rich and heritage-poor cells coexist at comparable rigor, and it restricts estimation to the overlap region; comparisons outside that region are extrapolation, not evidence. Rubin's insistence on demonstrating overlap before analyzing outcomes is not a formality here but the gate that decides whether the question can be answered on this population at all [\[93\]](#ref-93). A finding that the overlap region is too thin to support the comparison is itself informative: it would mean heritage and rigor are so bundled in JPL practice that the heritage discount cannot be evaluated separately, and that the honest assurance posture is to require the rigor regardless of the heritage claim.

The multivalued and ordinal nature of the treatments sharpens the overlap concern rather than relaxing it. Heritage depth and parts-class are ordinal multi-level treatments, and the overlap requirement must hold at each level transition, not only between extremes. The limited-overlap literature for multivalued treatments shows that standard inverse-probability weighting becomes unstable precisely when overlap is thin at some levels, and it offers more stable weighting alternatives for exactly that case [\[53\]](#ref-53). The design adopts a stable-weighting approach where the documentation-probability model (Section 5.3) exhibits extreme weights, and it reports the trimmed and untrimmed estimates side by side so the reader can see the influence of the thin strata.

### 5.2.3 The bad-controls discipline

The single most important specification decision in the design is the refusal to condition on post-treatment outcomes, and it deserves a spacecraft-specific statement because the temptation to commit the error is strong. A natural-seeming control is the result of the qualification and acceptance test campaign, for example whether the article passed thermal-vacuum without anomaly. Conditioning on that result would be a bad control in the precise Angrist-Pischke sense: a test outcome is downstream of both heritage and parts choices and partly downstream of test fidelity itself, so conditioning on it would absorb the very effect under test and bias the heritage and parts coefficients toward zero or worse [\[5\]](#ref-5). The thermal-vacuum and qualification-test literature makes concrete what a "test result" is and why it sits downstream: a thermal-vacuum campaign exercises the integrated article against its mission thermal environment and surfaces workmanship and design defects [\[35\]](#ref-35), [\[60\]](#ref-60); a functional-qualification campaign verifies that the article meets its requirements after environmental exposure [\[107\]](#ref-107); a flight-component qualification program documents the pass/fail verdicts and the lessons that follow from them [\[71\]](#ref-71). Each of these produces a verdict that is a consequence of the inputs the design is testing, and each must therefore stay out of the conditioning set.

The specification consequently uses only pre-launch, pre-outcome inputs: heritage as claimed at design review, parts-class as procured, and test-fidelity as planned and as-run in scope (the presence, duration, and coverage of the campaign, not its pass or fail verdict). The distinction between test-fidelity-as-scope and test-result-as-verdict is the hinge of the bad-controls discipline. Test-fidelity is an input chosen before the outcome; the test verdict is an output realized alongside it. The design measures and uses the former and never conditions on the latter. This decision follows directly from the Angrist-Pischke treatment of post-treatment variables and is fixed in the pre-registration block so it cannot be relaxed after seeing results [\[5\]](#ref-5), [\[93\]](#ref-93).

A subtler bad-control risk concerns mediation. If heritage operates on reliability through parts-class and test-fidelity (a heritage article is reliable because it inherits high-class parts and a thorough test campaign), then parts-class and test-fidelity are mediators of the heritage effect, not confounders of it, and conditioning on them in Model B estimates the direct heritage effect net of those channels rather than the total heritage effect. The design does not treat this as a flaw to be corrected but as a substantive distinction to be reported: it estimates and reports both the total heritage association (Model A, heritage and controls only) and the conditional heritage association (Model B, heritage net of parts-class and test-fidelity), and it separately examines whether heritage predicts parts-class and test-fidelity. If \( \beta_1 \) attenuates in Model B because heritage works through the rigor channels, that is itself the answer the dissertation seeks: it means the rigor, not the provenance, is the operative property, and that a heritage claim unaccompanied by the matching rigor should not earn the discount. The collapsibility and confounding-versus-mediation distinction is handled with the standard causal-inference machinery for separating the two [\[38\]](#ref-38).


## 5.3 Survivorship Correction

### 5.3.1 Survivorship is corrected by design, not noted as a caveat

Survivorship bias, the systematic under-representation of missions and subsystems that failed before producing complete documentation, is the most serious data threat to this study, and it is addressed through three design steps (a launch-manifest sampling frame, inverse-probability-of-documentation weighting, and a bounded sensitivity analysis) rather than acknowledged as a limitation and left to corrupt the estimates.

The mechanism of the bias is concrete and directional. Heritage claims and parts-class are best documented for JPL flagship and competed science missions and thinner for the smallest classes; anomaly records undercount minor anomalies that did not trigger formal reporting; and missions and subsystems that failed early may have produced thin documentation, while heritage claims that were quietly dropped after an early failure may not be archived as heritage at all. Each of these channels removes failures, or removes the heritage labels attached to failures, from the analyzable sample. The direction of the resulting bias is predictable: it flatters heritage, because the heritage-labeled cells that survive into the documented sample are disproportionately the ones that did not fail early.

When the probability that a unit appears in the analyzable sample depends on observed characteristics, inverse-probability weighting restores the target population by up-weighting the kinds of units that are under-represented; this is the standard missing-data and selection correction, and it is the same machinery used for propensity weighting in observational causal inference [\[89\]](#ref-89), [\[85\]](#ref-85). When the selection also depends on unobservables, a bounded sensitivity analysis that varies the assumed behavior of the missing units across plausible limits reports the range of conclusions consistent with the missing data, which is the appropriate response when the missingness cannot be fully modeled [\[83\]](#ref-83). The three-step structure has direct precedent. Building a sampling frame from a complete enumeration (here, launch manifests) rather than from surviving records is the standard defense against survivorship in reliability studies, and it is implicit in the population-complete reliability analyses that begin from launch-year cohorts rather than from documented-survivor sets [\[25\]](#ref-25), [\[40\]](#ref-40). Inverse-probability weighting for selection on observed characteristics is foundational [\[89\]](#ref-89). Sensitivity analysis for selection bias and unmeasured confounding in missing-data and causal models, varying the missing units' behavior across bounds, is a developed methodology with a clear reporting format [\[83\]](#ref-83), and the relative-bias framework gives a way to express how far the corrected estimate could still be from the truth [\[46\]](#ref-46).

Confidence in the survivorship correction is moderate to high for the observed-characteristics channel, where IPW directly applies, and moderate for the unobservables channel, where only the bounded sensitivity analysis can speak. The correction reduces and bounds the bias; it does not prove the bias is gone. The honest report, consistent with the dissertation's guardrail, is the corrected estimate accompanied by the sensitivity range, not a single number presented as bias-free. One could object that IPW with extreme weights can be more harmful than the bias it corrects, inflating variance and amplifying model misspecification in the documentation-probability model. The design takes the objection seriously. Where the documentation-probability model produces extreme weights (the thin-overlap case of Section 5.2.2), the design substitutes a stable-weighting estimator designed for limited overlap rather than letting a handful of enormous weights dominate the estimate [\[53\]](#ref-53), and it reports the estimate with and without weight trimming so the influence of the correction is visible. The weighting is a tool to be monitored, not a black box to be trusted.

### 5.3.2 The three steps in detail

The first step builds the sampling frame from launch manifests for the chosen population and epoch window, not from surviving-mission documentation. This is the structural defense: an early-failed or short-lived mission enters the frame even when its internal records are thin, so that its absence from the analyzable cells is recorded as missingness to be corrected rather than as a unit that silently never existed. The population-complete reliability studies that begin from launch cohorts demonstrate that a manifest-based frame is constructable and that it captures the early-failed tail that a survivor-based frame would lose [\[25\]](#ref-25), [\[40\]](#ref-40), [\[43\]](#ref-43).

The second step estimates a documentation-probability model and forms inverse-probability-of-documentation weights. A model for the probability that a subsystem cell has complete heritage and parts documentation is estimated from observed mission characteristics (prominence, mass class, epoch, environment, agency, and subsystem type), and cells are weighted by the inverse of that probability so that under-documented and disproportionately early-failed cells are not silently dropped. The model specification, including its functional form and its covariate set, is fixed in the pre-registration appendix before the outcomes are examined, so that the weights cannot be tuned to produce a desired heritage result [\[93\]](#ref-93). The propensity-weighting literature supplies the estimation and the diagnostic checks (weight distributions, effective sample size after weighting) that accompany the procedure [\[89\]](#ref-89), [\[64\]](#ref-64).

The third step is the bounded sensitivity analysis. Because the second step corrects only for selection on observed characteristics, the design varies the assumed failure behavior of the undocumented cells across plausible bounds, from an optimistic bound in which undocumented cells failed at the documented rate to a pessimistic bound in which they failed at an elevated rate consistent with their being disproportionately early-failed, and it reports how the heritage-versus-rigor comparison moves across that range [\[83\]](#ref-83). The reader sees not a single corrected coefficient comparison but the interval of comparisons consistent with the missing data. The falsification rule (Section 5.5) is then required to hold within these survivorship bounds, not merely at the point estimate: H1 is supported only if parts-class and test-fidelity dominate heritage across the sensitivity range, and a comparison that flips sign or order within the range is reported as inconclusive rather than as support for either hypothesis.


## 5.4 Threats to Validity

The design's claims are only as strong as its treatment of the things that could make them wrong. This section catalogues the threats along the four standard axes, internal, external, construct, and statistical-conclusion validity, and states the mitigation and the residual risk for each. The catalogue is exhaustive by design, because the argument of the dissertation depends on the residual risk being shown to be acceptable, and acceptability cannot be claimed for risks that were not named.

### 5.4.1 Internal validity

The central internal-validity threat is omitted-variable confounding between heritage and unobserved rigor or unobserved program competence. This is the threat the entire identification strategy of Section 5.2 is built to address, and it cannot be fully eliminated on observational data. The control set, the overlap restriction, and the bad-controls discipline mitigate it; the A-to-B comparison is designed to expose it (a heritage coefficient that collapses when rigor enters is the signature of exactly this confounding); and the relative-bias and sensitivity machinery bounds the residual [\[46\]](#ref-46), [\[83\]](#ref-83). The mitigation is strong but partial, and the design therefore states its conclusion as a conditional association under unconfoundedness, with a named residual risk: unobserved program competence (a capable institution that both retains heritage and builds reliable hardware for reasons not captured by prominence) could drive both heritage and low failure, and mission prominence plus the documentation-probability model are the only available proxies for it.

A secondary internal-validity threat is reverse documentation: a subsystem that failed could be retrospectively recoded as less heritage-rich, so that failures appear concentrated among low-heritage cells by construction. The mitigation is the provenance-at-design-review coding rule, fixed in Chapter 4, which codes heritage as claimed before launch rather than as reconstructed after the outcome is known, combined with the launch-manifest frame that prevents the quiet disappearance of failed cells [\[93\]](#ref-93). The residual risk here is low, because the coding rule attaches to a document (the design-review heritage assessment) that predates the outcome.

A third internal-validity threat is unit interference, a violation of the stable-unit-treatment-value assumption. One subsystem's heritage or parts choice should not change another subsystem's failure behavior, which is mostly defensible at the subsystem level but can be violated by common-cause failures (a shared power bus, a shared parts lot across subsystems). The mitigation is to record lot-level and bus-level commonality so that violations can be flagged and the affected cells examined separately rather than treated as independent [\[49\]](#ref-49). The residual risk is moderate and is reported transparently for the cells where commonality is detected.
### 5.4.2 External validity

The population is JPL-class missions with documented heritage and parts records, and the results, in either direction, are statements about that population. Transfer to commercial NewSpace constellations or to the smallest CubeSat class is not assumed, because the parts and test regimes differ markedly in those populations: CubeSat reliability data show systematically different outcomes for designs built with reduced screening and reduced test [\[59\]](#ref-59), and the COTS and small-satellite literature suggests the parts-class channel is, if anything, stronger there [\[12\]](#ref-12), [\[81\]](#ref-81). The mitigation is the mass-class and orbit controls, which bound the within-study heterogeneity, together with a planned subgroup analysis that reports the comparison separately by mass class so the reader can see whether the heritage-versus-rigor pattern is stable across the size range the study does cover. The residual external-validity risk is acknowledged rather than mitigated away. The dissertation's claim is bounded to JPL-class missions, and transfer to NewSpace or CubeSat populations is offered as a replication hypothesis, not as a result.

### 5.4.3 Construct validity

Heritage depth, parts-class, and test-fidelity are constructed indices, and a poor construction could understate one predictor and flatter another, producing a spurious head-to-head result. Three mitigations apply. First, each index is built from documented, auditable fields before the outcomes are examined, so the construction cannot be tuned to the result [\[93\]](#ref-93). Second, inter-coder reliability is reported as a chance-corrected agreement statistic for the two coding-intensive variables (heritage depth and test-fidelity), with disagreements reconciled against the source document under a recorded rule, the measurement-reliability procedure fixed in Chapter 4; the standardized treatment of intraclass correlation for time-to-event-adjacent measurement gives the procedure for reporting this agreement meaningfully [\[65\]](#ref-65). Third, the test-fidelity index is grounded in a concrete and externally validated notion of what a test campaign contains: the thermal-vacuum, vibration, and functional-qualification literature establishes the components a fidelity index should weight (campaign presence, duration, environmental coverage, and functional-test breadth), so the index is not an arbitrary analyst construction but a documented operationalization of a known engineering practice [\[35\]](#ref-35), [\[60\]](#ref-60), [\[71\]](#ref-71), [\[107\]](#ref-107). The residual construct-validity risk is reported as the dependence of the conclusion on the coding choices, which Section 5.5 probes directly through the re-coding robustness checks.

### 5.4.4 Statistical-conclusion validity

The mission-by-subsystem cells are clustered within missions, so naive standard errors that assume independence would be too small and would overstate significance. The mitigation is twofold: standard errors are clustered at the mission level, and the subsystem random effects absorb within-subsystem correlation, so the inference accounts for both the mission-level clustering and the subsystem-level dependence [\[9\]](#ref-9). A second statistical-conclusion threat is low power. The number of well-documented JPL-class missions is modest, and a study can fail to distinguish coefficient magnitudes simply because the sample is small. The mitigation is the explicit minimum-detectable-difference analysis of Section 5.5, which states in advance how large a difference between the standardized coefficients the design can detect at the achieved sample size, so that a non-result is interpreted as underpowered rather than misread as confirmation of H0 [\[116\]](#ref-116). A third threat, multiple comparisons across the two outcomes, the survivorship bounds, and the robustness re-codings, is handled by fixing the primary test (the A-to-B comparison on both outcomes within the survivorship bounds) in advance and labeling everything else as secondary and exploratory, so the primary falsification decision is not the product of a search over specifications [\[93\]](#ref-93).

The line of argument that runs through this catalogue is the one the dissertation carries throughout: the problem is real (heritage is invoked as a rigor substitute while infant mortality persists [\[19\]](#ref-19), [\[100\]](#ref-100)); the problem is material (failure concentrates in a few subsystems, and test and parts campaigns are large discretionary budget lines [\[95\]](#ref-95), [\[32\]](#ref-32)); the design addresses the causal mechanism (the A-to-B survival comparison with overlap and bad-controls discipline separates provenance from delivered-article properties [\[5\]](#ref-5), [\[85\]](#ref-85), [\[93\]](#ref-93)); it beats the alternatives (descriptive curves and naive heritage-only regressions cannot decide the test, design-based identification can [\[20\]](#ref-20), [\[49\]](#ref-49)); and the residual risk is acceptable because it is stated as conditional association, survivorship-corrected, and bounded by sensitivity analysis [\[93\]](#ref-93), [\[83\]](#ref-83), [\[46\]](#ref-46). This section supplies the threat-by-threat evidence on which the residual-risk claim rests.


## 5.5 Robustness Battery, Power, and the Honest Sample Limit

### 5.5.1 Diagnostics fixed in advance

The estimation is accompanied by a fixed set of diagnostics, specified here so they cannot be chosen after the results are seen. The proportional-hazards assumption is checked with scaled-residual tests, and where it fails for a covariate, that covariate is allowed a time-varying coefficient rather than being forced into a constant-hazard form. This matters most for the early window, where the mixture literature shows the hazard is far from constant [\[21\]](#ref-21). The random-effects structure is checked by comparing the mixed-effects (frailty) fit against a fixed-effects-by-subsystem alternative, and the heritage-versus-rigor conclusion is reported under both, so the reader can see it is not an artifact of the random-effects assumption; the choice between unit fixed effects and a selection-on-observables random-effects approach is itself a substantive modeling decision with known tradeoffs, and reporting both is the disciplined response [\[48\]](#ref-48), [\[9\]](#ref-9). The overlap diagnostic is reported as a propensity-style balance table within strata, showing how many heritage-rich and heritage-poor cells coexist at comparable parts-class and test-fidelity; thin cells are flagged, and the estimate is reported on both the full overlap region and a trimmed region that drops the thinnest strata [\[85\]](#ref-85), [\[53\]](#ref-53). Coefficient stability is examined by adding the control blocks one at a time, so a heritage coefficient that moves sharply when a single control enters is identified as fragile rather than reported as a finding.

### 5.5.2 Three pre-specified robustness re-codings

Three robustness checks on the substantive constructs are fixed in advance. First, the heritage measure is re-coded under a stricter definition that requires same-environment flight for the top category, to test whether any heritage association is driven entirely by the same-environment cases; if it is, that is itself evidence for the rival hypothesis, because it would mean that environment-matched verification, not provenance per se, is what carries the predictive weight. Second, the analysis is re-run excluding the payload-instrument subsystem, because instruments are the most novel and least heritage-eligible subsystem and could dominate the heritage signal in either direction; the payload-reliability literature shows the instrument subsystem behaves distinctively and warrants separate treatment [\[39\]](#ref-39). Third, the launch-epoch control is replaced with a finer set of epoch dummies to confirm that the heritage-versus-rigor comparison is not a secular technology trend in disguise, since both parts-class norms and heritage practices have shifted across decades [\[12\]](#ref-12), [\[81\]](#ref-81). Each re-coding is run on both outcomes and reported alongside the primary specification, so the reader sees the comparison's stability to the construction choices that Section 5.4.3 flagged as a construct-validity risk.

A fourth robustness axis concerns the estimator family itself. The primary frailty survival model is checked against a Cox proportional-hazards model with a subsystem frailty term for the time-to-first-failure outcome, where the proportional-hazards coefficient is the object of interest and the baseline shape is a nuisance [\[9\]](#ref-9), and against a coarsened-exact-matching pre-processing step that balances the heritage-rich and heritage-poor cells on the controls before the survival model is fit, which guards against the conclusion being driven by functional-form assumptions in the control index [\[47\]](#ref-47). Convergence of the A-to-B pattern across the frailty model, the Cox frailty model, the matched-then-modeled estimate, and the discrete-time cloglog companion would raise confidence in the conclusion from moderate to high; divergence across them would be reported as a limitation on the robustness of the finding rather than suppressed.

### 5.5.3 Power and the minimum detectable difference

Power is bounded by the number of well-documented JPL-class missions, which is modest, and the design reports this limit rather than assuming it away. The relevant quantity is not the power to detect a single coefficient but the minimum detectable difference between the standardized heritage coefficient and the standardized parts-class or test-fidelity coefficient, given the assembled number of mission-by-subsystem cells, the within-mission clustering, the censoring rate, and the subsystem random-effect variance. The design computes this minimum detectable difference using the information structure of the discrete-time survival model with random effects, for which the optimal-design literature provides the variance expressions [\[116\]](#ref-116), and it states the result alongside the falsification rule.

The numbers used to illustrate the procedure are expected and illustrative, not executed on the assembled dataset, consistent with the dissertation's design-stage guardrail. As an illustration of the form the analysis will take, and not as a measured result, if the assembled frame yields on the order of a few hundred well-documented mission-by-subsystem cells with the censoring and clustering typical of the reliability literature, the design would expect to detect a standardized coefficient difference of moderate size with adequate power, while a small difference between \( \beta_1 \) and \( \beta_2 \) or \( \beta_3 \) would fall below the minimum detectable difference and would correctly be reported as a difference the study cannot resolve. The precise minimum detectable difference will be reported as a table in the appendix once the frame is assembled. The interpretive rule attached to it is fixed now: if the data cannot distinguish the coefficient magnitudes at the achieved sample size, the honest report is that the test is underpowered on this population, not that H0 is confirmed. This is the Rubin discipline of fixing the analysis and its interpretation before the outcomes are examined, applied to the awkward but common case where the available population is small [\[93\]](#ref-93).

### 5.5.4 The falsification rule, restated and bound to the robustness battery

The falsification rule is fixed in advance and is the same rule that governs the dissertation: H1 is supported if, across both outcomes and within the survivorship sensitivity bounds, the standardized parts-class and test-fidelity coefficients (\( |\beta_2| \) and \( |\beta_3| \)) exceed the standardized heritage coefficient (\( |\beta_1| \)) in magnitude and the heritage coefficient's confidence interval includes negligible effect in Model B. The contribution is falsified toward H0 if the heritage coefficient remains the largest standardized coefficient and retains a confidence interval excluding negligible effect after parts-class and test-fidelity are added. The robustness battery is bound to this rule by a conjunction requirement: the rule must hold not only in the primary specification but across the diagnostics-driven respecifications (time-varying coefficients where PH fails, fixed-effects as well as random-effects), the three construct re-codings, and the estimator-family checks. A conclusion that holds in the primary specification but flips under a single pre-specified robustness check is reported as fragile, not as a finding. This conjunction is what converts a single coefficient comparison into a defensible falsification, and it is the reason the robustness checks are specified before estimation rather than assembled afterward to defend a result.


## 5.6 Pre-Registration and the Computational Plan

### 5.6.1 The pre-registration commitment

The design commits to pre-registration, and the commitment is the operational form of the design-before-analysis principle that runs through the whole dissertation. Before any outcome is examined on the assembled dataset, a frozen specification document fixes: the variable constructions and their standardization (Chapter 4 and Section 5.1.2); the control set (Section 5.2.2); the documentation-probability model for the inverse-probability weights (Section 5.3.2); the overlap restriction and the trimming rule (Section 5.2.2); the bad-controls exclusion list, naming the test verdict explicitly as excluded (Section 5.2.3); the primary estimator and its baseline alternatives (Section 5.1); the diagnostics, the three construct re-codings, and the estimator-family robustness checks (Section 5.5); the minimum-detectable-difference computation and its interpretive rule (Section 5.5.3); and the falsification rule with its conjunction requirement across the robustness battery (Section 5.5.4). The pre-registration is the mechanism that makes the contribution a test rather than a narrative: because the analysis is fixed before the outcomes are seen, the result, in either direction, is interpretable as evidence rather than as the product of a search over specifications [\[93\]](#ref-93), [\[88\]](#ref-88).

This pre-registration discipline is what distinguishes the design-based observational approach adopted here from the descriptive reliability tradition it builds on. The descriptive literature reports the failure curves it finds [\[19\]](#ref-19), [\[21\]](#ref-21), [\[20\]](#ref-20); this design reports the falsification decision it pre-committed to. The commitment is recorded as Appendix D of the dissertation (the frozen specification, control set, and falsification rule), and the reporting follows the structured observational-study reporting guidance so that every construction and analysis decision is auditable against the pre-registered plan [\[103\]](#ref-103).

### 5.6.2 The computational and software plan

The estimation is implemented in a documented, reproducible computational environment so that the pre-registered specification can be executed exactly as written and re-run by others. The mixed-effects (frailty) survival model and the Cox frailty robustness model are estimated in established survival-analysis software with frailty support; the discrete-time complementary-log-log companion is estimated as a generalized linear mixed model on the expanded subsystem-period records [\[69\]](#ref-69), [\[9\]](#ref-9), [\[63\]](#ref-63). The documentation-probability model and the inverse-probability weights, the coarsened-exact-matching pre-processing, the overlap and balance diagnostics, and the stable-weighting alternative for limited overlap are implemented with standard, citable causal-inference tooling whose methods are documented in the matching and weighting literature [\[89\]](#ref-89), [\[47\]](#ref-47), [\[64\]](#ref-64), [\[53\]](#ref-53). The minimum-detectable-difference computation uses the variance expressions from the discrete-time survival design literature [\[116\]](#ref-116).
The computational plan commits to three reproducibility practices. First, the analysis code is version-controlled and released with the dissertation, with a fixed random seed for any stochastic step (the boosted documentation-probability model, any bootstrap for the clustered standard errors), so the reported numbers are exactly reproducible. Second, the data-construction pipeline, from the launch-manifest frame through the subsystem crosswalk and the root-cause coding to the analyzable cells, is scripted and logged rather than performed by hand, so the path from source records to estimation is auditable; the JPL-internal archival sources (LLIS/PRACA records, heritage assessment matrices, parts control records) are not open literature and cannot be released, but the transformation code and the de-identified analyzable cells can be, and the provenance of each source is logged. Third, the analysis is run blind to the heritage-versus-rigor comparison until the pre-registered specification is locked: the outcomes are merged onto the regressors only after the construction, the weights, the overlap restriction, and the falsification rule are frozen, which is the computational enforcement of the outcome-blind design discipline [\[93\]](#ref-93).

The residual computational risk is the dependence of the estimates on a small number of software defaults (the frailty-variance estimation method, the tie-handling in the survival model, the convergence tolerance of the generalized linear mixed model). The mitigation is to report the estimates under the documented defaults and to confirm, as a final robustness pass, that the A-to-B pattern is stable to reasonable variation in these settings. With that confirmation, the computational plan closes the chain this chapter opened: a specification rigid enough to be falsified, identified under a stated and bounded assumption, corrected for the survivorship that would otherwise flatter heritage, examined for the threats that could make it wrong, and implemented reproducibly so that the falsification decision, when the assembled dataset is run, belongs to the design and not to the analyst.



# Chapter 6: Analysis Plan and Expected Results

## 6.0 Chapter thesis

This chapter freezes the analysis before any outcome is seen. The head-to-head test between claimed flight heritage and the delivered-article predictors of parts-class and integration-test fidelity can be decided by a small, fully pre-specified sequence of operations whose decision rule, expected signs, diagnostics, and power floor are all fixed in advance, so that the result, in either direction, reads as evidence rather than as the product of analyst discretion. The chapter does not report estimates. It reports the procedure that will generate them, the directions those estimates are expected to take if the alternative hypothesis is true, the rule that converts estimates into a verdict, and the diagnostics that protect that verdict from the most likely failure modes. Every number below is labeled expected or illustrative; none is an executed coefficient. The mission-by-subsystem dataset is still being assembled from the JPL heritage and parts archives and the NASA anomaly records described in Chapter 4, and the design discipline this dissertation adopts forbids examining outcomes before the specification is locked [\[93\]](#ref-93)[\[49\]](#ref-49).

A chapter of this kind earns its length because the credibility of an observational study is decided here, not in the regression output. Rubin's central methodological position, that for objective causal inference design trumps analysis, means that the work of making the comparison believable happens entirely in the choice of estimator, control set, overlap restriction, and decision rule, all settled while the analyst is still blind to which configuration of heritage and rigor produced which failures [\[93\]](#ref-93). A reader who accepts this design should be willing to accept whatever verdict the frozen procedure later returns, including a verdict that falsifies the dissertation's own preferred hypothesis. That is the standard this chapter is written to meet.

## 6.1 The problem this chapter addresses

A heritage claim is evaluated qualitatively at a design review and then used, informally but consequentially, to discount the qualification and acceptance program for the article carrying the claim. The descriptive reliability literature has documented that this practice coexists with a persistent early-failure regime: satellite reliability is not well described by a constant hazard, a non-negligible share of failures occur early in life, and those early failures concentrate in a small number of subsystems [\[19\]](#ref-19)[\[21\]](#ref-21)[\[95\]](#ref-95)[\[25\]](#ref-25). What the literature has never produced is a procedure that takes a population of missions, measures heritage, parts-class, and test-fidelity on each subsystem, and returns a defensible statement about which of the three predicts realized failure once the others and the confounders are held fixed.

The desired state is a procedure that does exactly that, with every step fixed before the data speak, so that the answer cannot be an artifact of specification search. No such pre-registered procedure exists for this question on a JPL-class population. Assurance dollars continue to flow on the strength of a label whose predictive content has never been isolated from the rigor it is assumed to proxy. This chapter closes the procedural half of that gap. The empirical half, executing the procedure on the assembled data, remains open by design; but it becomes mechanical once the dataset is complete. The steps below run without further design decisions.

The chapter proceeds in five movements. Section 6.2 states the eight-step estimation procedure and explains the dependency order that makes it outcome-blind. Section 6.3 states the expected, illustrative findings under the alternative hypothesis, with the mechanism reasoning that licenses each expected sign and the explicit caveat that the estimates may contradict those expectations. Section 6.4 fixes the falsification rule in advance. Section 6.5 specifies the diagnostics and the three pre-registered robustness re-codings. Section 6.6 derives the power floor and states how an underpowered non-result is to be reported.

## 6.2 The estimation procedure

### 6.2.1 The eight steps

The analysis executes the following eight steps in order. The order is not cosmetic; it enforces the outcome-blind discipline by ensuring that every construction and modeling decision that could be tuned to a result is completed before the result is visible.

1. Build the mission-by-subsystem frame from launch manifests for the chosen population and epoch window.
2. Code heritage depth, parts-class, and test-fidelity from the JPL archives and NTRS reports, with two independent coders on the heritage and test-fidelity indices, and record inter-coder agreement.
3. Construct the two outcomes and the censoring structure from the anomaly and lessons-learned records.
4. Estimate the documentation-probability model and form inverse-probability weights.
5. Restrict to the overlap region in covariate space.
6. Estimate Model A (heritage plus controls) and Model B (heritage, parts-class, test-fidelity, controls) for both the survival and the discrete-time outcomes, with mission-clustered standard errors and subsystem random effects.
7. Run the survivorship sensitivity analysis across the bounded assumptions for undocumented cells.
8. Report the nested comparison and the falsification decision.

### 6.2.2 Why the order is the design

The dependency structure of these eight steps is the substance of the outcome-blind claim, and it deserves to be made explicit rather than left implicit in the numbering. Steps 1 through 5 are entirely a function of the regressors, the controls, and the sampling frame. None of them touches the relationship between predictors and outcomes. The frame in Step 1 is drawn from launch manifests precisely so that the population is defined by what was launched, not by what survived to be documented, which is the survivorship guard developed in Chapter 5 carried into the procedure here. The coding in Step 2 is performed by analysts who, by construction, are reading heritage matrices, parts control records, and integration-and-test plans, none of which reveals the on-orbit failure history; the two-coder protocol and the chance-corrected agreement statistic make the measurement reliability auditable before the outcome enters [\[100\]](#ref-100). The outcome construction in Step 3 reads the anomaly records, but it reads them only to build the dependent variable and the censoring indicator, not to choose a specification. The documentation-probability model in Step 4 and the overlap restriction in Step 5 are functions of observed covariates and the missingness pattern, again with no contact with the predictor-outcome relationship.

Only Step 6 joins predictors to outcomes, and by the time it runs, every decision that an analyst could otherwise have tuned to manufacture a result has already been fixed and recorded. This is the operational meaning of design before analysis [\[93\]](#ref-93)[\[49\]](#ref-49). The procedure is not immune to error; what it removes is the specific class of error, specification search conditioned on the outcome, that most threatens observational findings. The Rubin design-trumps-analysis position supports the point, holding that the credibility of a causal reading is established by the assignment-mechanism reconstruction and the overlap demonstration, both completed blind, rather than by the regression that follows [\[93\]](#ref-93)[\[85\]](#ref-85), and the broader potential-outcomes literature formalizes why outcome-blind design is the correct response to the fundamental problem of causal inference, namely that the two potential outcomes for a unit are never both observed and so the comparison must be defended by the design rather than recovered from the data [\[90\]](#ref-90)[\[29\]](#ref-29)[\[14\]](#ref-14)[\[78\]](#ref-78). Outcome-blindness disciplines specification search but does not by itself establish unconfoundedness, which remains an assumption defended separately in Chapter 5 and revisited in Section 6.5 here. A critic would press that an analyst can still tune the frozen specification to a prior belief about the answer; the protection against that is that this document, written before estimation, is the pre-registration, and any deviation from it at execution time must be reported as a deviation. Confidence in the outcome-blind property is high, because it follows from the procedure's dependency structure rather than from an empirical conjecture; what would lower it is evidence that the coders were not in fact blind to outcomes, which the two-coder protocol and the documented coding order are designed to prevent and to surface if it occurs.

### 6.2.3 The estimators invoked at Step 6

Step 6 estimates two models that share the linear index but differ in their treatment of time. The continuous-time model is the mixed-effects proportional-hazards specification carried verbatim from the bible:

\[ \log h(t) = \log h_0(t) + \beta_1 \text{Heritage}_i + \beta_2 \text{PartsClass}_i + \beta_3 \text{TestFidelity}_i + \gamma \text{Controls}_{im} + u_s \qquad\qquad (7) \]

where \( h_0(t) \) is a flexible (piecewise-constant or Weibull-mixture) baseline, \( u_s \) is a Gaussian random intercept for subsystem type s, and the regressors are standardized so that \( \beta_1 \), \( \beta_2 \), and \( \beta_3 \) are magnitude-comparable. The discrete-time companion replaces the continuous baseline with period dummies and estimates the same linear index by a complementary-log-log link on subsystem-period records, which produces the early-window hazard that maps onto the infant-mortality outcome. The choice of a discrete-time complementary-log-log hazard with a random-effects estimator for the binary, clustered, right-censored outcome is not idiosyncratic to this dissertation; it is the standard tool for exactly this data shape in applied survival work outside the spacecraft domain, where the same combination of time-to-event outcomes, censoring, and grouped data recurs [\[65\]](#ref-65)[\[69\]](#ref-69). The convergence of that external methodological practice on the present design carries a plain reading: the discrete-time random-effects hazard is a mature, well-understood estimator whose properties are known, so importing it removes one source of uncertainty about whether the model can in principle recover the contrast of interest, leaving the substantive uncertainty where it belongs, in the identification assumptions rather than in the estimator's mechanics.

The flexible baseline is mandatory rather than optional, and the reason is the documented shape of the satellite hazard. The mixture-Weibull evidence shows that a single-Weibull fit is inadequate and that the data require an early-failure subpopulation layered over a longer-lived subpopulation [\[21\]](#ref-21)[\[95\]](#ref-95). Forcing a constant or single-Weibull baseline onto a hazard that the literature has shown to be a mixture would misattribute the early-failure mass and could load it onto whichever covariate happens to correlate with early failure in the sample, contaminating the very coefficient comparison the test depends on. The piecewise-constant or Weibull-mixture baseline absorbs that structure into \( h_0(t) \) so that \( \beta_1 \), \( \beta_2 \), and \( \beta_3 \) carry the covariate signal net of the baseline shape. The recent deep-space and two-Weibull-segmented reliability analyses reinforce that the early-versus-late segmentation is a real and recurring feature of these populations, not an artifact of one dataset, which is why the design treats the flexible baseline as a fixed requirement rather than a robustness option [\[25\]](#ref-25)[\[102\]](#ref-102).

### 6.2.4 The documentation-probability model and the weights it produces

Step 4 estimates the documentation-probability model and forms the inverse-probability weights that carry the survivorship correction into the estimation, and the logic of that step is worth stating in full because it is where the most serious data threat is converted from a caveat into a modeled quantity. The threat, established in the design chapters, is that the cells with complete heritage and parts documentation are not a random sample of the launched population. Missions and subsystems that failed early, or that were small and lightly reviewed, produced thinner archives, so a complete-case analysis that silently drops under-documented cells would over-represent the surviving, well-documented, and disproportionately successful cells and would bias the heritage-versus-rigor comparison in an unknown direction. The documentation-probability model attacks this directly. It models the probability that a mission-by-subsystem cell carries complete heritage and parts documentation as a function of the observed mission characteristics that are available for every launched cell from the manifest frame, regardless of whether the internal records survived: mission prominence, mass class, orbit class, launch epoch, and subsystem type. Each cell is then weighted by the inverse of its estimated documentation probability, so that a well-documented cell drawn from a stratum where documentation is rare stands in for the under-documented cells in that stratum that would otherwise be lost.
Inverse-probability-of-documentation weighting recovers, under a stated missingness assumption, the population the complete-case analysis cannot reach. The standard result is that inverse-probability weighting reweights a selected sample back toward the target population when selection is a function of observed covariates, the same reweighting logic that underlies propensity-score and entropy-balancing adjustment in observational designs [\[96\]](#ref-96)[\[42\]](#ref-42). That result applies here because documentation completeness is plausibly a function of the same observed program characteristics that the weights condition on: prominence and class drive both review intensity and archival thoroughness, and the operations and observational-inference literature has used exactly this family of reweighting estimators to repair selection on observables in non-experimental data [\[62\]](#ref-62). One condition is load-bearing. The weights repair selection only to the extent that documentation completeness is missing-at-random given the modeled covariates. If documentation completeness depends on the outcome itself in a way the covariates do not capture, for example if a catastrophic early failure caused records to be sealed or never written, then the weights are insufficient and the residual bias is carried into the bounded sensitivity analysis of Section 6.3.4 rather than assumed away. A critic presses that the documentation-probability model is itself a model that could be misspecified. The response is that the design reports the estimate under more than one specification of the documentation model and treats a conclusion that moves with the documentation-model specification as fragile, exactly as it treats a conclusion that moves with a single control. Confidence that the weights remove the documentation-driven component of survivorship is moderate, conditional on the missing-at-random assumption. What would raise it is external evidence on why specific archives are incomplete; what would lower it is evidence that incompleteness tracks unrecorded early failure, which is precisely the case the bounded sensitivity analysis is built to absorb.

## 6.3 Expected and illustrative findings

This section states what the procedure is expected to return if H1 is true. Every direction below is an expectation that defines the test, not an estimated value, and the actual estimates may contradict every one of them, in which case the contribution is falsified toward H0. The guardrail is absolute: no number in this section is a result.

### 6.3.1 The expected Model A to Model B pattern

Under H1, the expected pattern is as follows. In Model A, which regresses the outcome on heritage depth plus controls, heritage depth would show a moderate negative association with failure hazard, consistent with the raw correlation that motivates current practice. In Model B, which adds parts-class and test-fidelity, the heritage coefficient would attenuate substantially and lose stability, while parts-class (with high-reliability classes associated with lower hazard) and test-fidelity (with more complete qualification associated with lower hazard, especially for the infant-mortality outcome) would carry the larger and more stable coefficients. The infant-mortality outcome in particular would be expected to load on test-fidelity, because the mechanism for early failure is an uncaught latent defect, which is precisely what screening and system test are designed to catch.

The expectation here is that the heritage signal visible in Model A is, under H1, largely a reflection of the parts-class and test-fidelity that travel with deep heritage in practice, so that controlling for the delivered-article properties dissolves it. The rival-predictor mechanism established in the theoretical and literature chapters supports the expectation: parts-class sets the intrinsic defect and degradation rate of the article, and integration-test fidelity sets the probability that latent defects and integration errors are caught before launch rather than discovered on orbit [\[12\]](#ref-12). The logic of confounding and collapsibility connects that mechanism to the expected attenuation. If heritage's Model-A association runs through parts-class and test-fidelity, then adding those variables to the index should collapse the heritage coefficient, and the size of the collapse is informative about how much of the heritage signal was delivered-article rigor in disguise [\[38\]](#ref-38). The broader observational-causal literature on selection on observables reinforces this, establishing that the change in a coefficient across nested models conditioning on a richer covariate set is the diagnostic quantity for whether the first coefficient was carrying omitted rigor [\[96\]](#ref-96)[\[62\]](#ref-62). One point matters and is developed in the next subsection: an attenuation in Model B is consistent with two distinct stories, confounding and mediation, and the design must distinguish them. A careful critic raises that the expected attenuation could be an artifact of multicollinearity between heritage and the rigor variables rather than evidence of confounding. The overlap diagnostic in Section 6.5 is the direct test of whether enough independent variation exists to separate them, and if it does not, the honest report is non-identification rather than attenuation. Confidence in this expected pattern is moderate, appropriate to a design-stage prior. It is the direction the mechanism predicts, but the dissertation's entire point is that the direction has never been measured on this population, so the prior is held loosely and is explicitly falsifiable.

### 6.3.2 Distinguishing mediation from confounding

The expected attenuation of the heritage coefficient in Model B admits two readings, and keeping them distinct is the difference between an honest analysis plan and an overclaiming one. The first reading is confounding: heritage and rigor are jointly driven by program-level forces (budget, environment, review intensity), so heritage's Model-A association is spurious and dissolves when the rigor variables enter. The second reading is mediation: heritage genuinely causes rigor, deep heritage leads programs to procure better parts and run fuller test campaigns, so the Model-B attenuation reflects the heritage effect operating through the rigor variables rather than a spurious original association. These two stories produce the same coefficient movement but carry opposite policy implications. Under confounding, heritage is not buying reliability and the discount is unjustified. Under mediation, heritage is buying reliability precisely by buying rigor, and the discount is justified so long as the rigor actually follows.

The design distinguishes the two by examining whether heritage predicts parts-class and test-fidelity directly and by reporting both the total heritage association (Model A) and the conditional heritage association (Model B). If heritage strongly predicts the rigor variables, the mediation reading gains weight; if it does not, the confounding reading does. This is not a perfect separation, because partial mediation and partial confounding can coexist, and the chapter does not claim to resolve the decomposition cleanly. What it claims is that the two readings are named in advance, that the diagnostic distinguishing them is specified in advance, and that the policy implication is conditioned on which reading the data support. The reason to treat this as a first-class design concern rather than a footnote is the causal-inference literature's insistence that conditioning on a variable that lies on the causal path between treatment and outcome is a categorically different operation from conditioning on a confounder, and conflating them is a standard route to wrong conclusions [\[29\]](#ref-29)[\[73\]](#ref-73). Confidence that the design can at least partially separate mediation from confounding is moderate. What would raise it is a richer measurement of the program-level decision process that produced both the heritage claim and the rigor, which the JPL archives may or may not support and which Chapter 4 flags as a data-access dependency.

### 6.3.3 Why infant mortality is the sharper test

The two outcomes are not redundant, and the design expects them to behave differently in a way that is itself diagnostic. The infant-mortality indicator is the sharper test of the test-fidelity channel, and the reasoning is mechanistic. Early failure, by the mixture-Weibull account, is driven by latent defects present at launch that manifest under early operational stress [\[21\]](#ref-21)[\[95\]](#ref-95). The function of parts-level screening, burn-in, and system-level functional test is to surface exactly those latent defects on the ground, before launch, so that they are caught and corrected rather than discovered on orbit. A test campaign that is thinner in screening and system test therefore leaves a larger residual population of latent defects to fail early. This is a named causal chain, not a correlation: the driver is reduced test scope, the mechanism is fewer latent defects intercepted on the ground, the observable effect is elevated early-window hazard, the operational consequence is an infant-mortality anomaly on the delivered article, and the strategic implication is that test-fidelity should load most heavily on the infant-mortality outcome.

The time-to-first-failure outcome, by contrast, integrates over the whole mission and mixes the early-defect regime with the later wear-out and environment-exposure regime, so it is expected to carry a broader signal in which parts-class (which governs degradation rate over the full life) is more visible relative to test-fidelity. The expectation, therefore, is a pattern across outcomes: test-fidelity dominant on infant mortality, parts-class more prominent on time-to-first-failure, heritage attenuated on both. If the data show test-fidelity loading on the infant-mortality outcome and parts-class loading on the time-to-first-failure outcome, that joint pattern is stronger evidence for H1 than either coefficient alone, because it matches the mechanism's prediction about which channel should dominate which outcome. One caveat is that the early window itself is set from the mixture-Weibull early-subpopulation inflection rather than chosen ad hoc, so the infant-mortality outcome is defined by the same literature that motivates the mechanism, which avoids the circularity of tuning the window to flatter the test-fidelity coefficient [\[21\]](#ref-21). Confidence in the differential expectation is moderate. It is a mechanism-derived prediction that the design is built to detect but has not yet observed.

### 6.3.4 The survivorship sensitivity bounds

Step 7 runs the survivorship sensitivity analysis, and because the falsification rule in Section 6.4 requires the H1 pattern to hold within the survivorship bounds rather than only at the weighted point estimate, the construction of those bounds is part of the test, not an afterthought. The inverse-probability weights of Section 6.2.4 repair the component of survivorship that is missing-at-random given observed covariates, but they cannot repair the component that depends on the outcome through an unrecorded channel. The sensitivity analysis bounds that residual. It does so by varying the assumed failure behavior of the undocumented cells across a plausible range and re-estimating the coefficient comparison at each setting, so the reader sees not a single number but the interval of conclusions consistent with the missing data. At one extreme, the undocumented cells are assumed to behave like the documented cells in their stratum, which is the benign assumption that the weights already encode. At the other extreme, the undocumented cells are assumed to carry systematically higher early-failure hazard, which is the adversarial assumption that documentation went missing precisely because the article failed early, the worst case for any heritage discount because it concentrates the unobserved failures wherever the design most needs to see them.

Reporting the coefficient ordering across this bounded range, rather than at a single point, is what makes a survivorship-robust verdict possible. The direction of survivorship bias is not knowable a priori but is bounded by the two extreme assumptions, so the conclusion that survives both extremes is the conclusion that does not depend on the unknowable missingness mechanism. This follows the design-stage principle that an observational conclusion should be reported with its sensitivity to the assumptions it cannot test, the same logic that governs bias analysis under imperfect identification in observational causal inference, where the estimate is presented as a function of the unverifiable assumption rather than as a point that pretends the assumption away [\[46\]](#ref-46). It reflects the broader practice of bounding rather than point-identifying when a key assumption is untestable, a practice the matching and weighting literature adopts whenever overlap or selection cannot be fully verified [\[53\]](#ref-53). The bounds are only as wide as the adversarial assumption is severe, so the design states the adversarial assumption explicitly and justifies its severity from the documented concentration of early failures in a few subsystems, which is the empirical reason to fear that missing documentation tracks early failure [\[95\]](#ref-95)[\[100\]](#ref-100). A critic raises that a sufficiently adversarial assumption can overturn any finding, rendering the bounds vacuous. The response is that the adversarial bound is pinned to a documented failure-concentration magnitude rather than set arbitrarily, so it represents a severe-but-real worst case rather than a contrived one, and a verdict that survives even that bound is correspondingly strong. Confidence that the bounded analysis correctly brackets the survivorship-driven uncertainty is moderate to high, because bracketing requires only that the truth lie between the benign and adversarial assumptions, which is a weak requirement. Confidence about whether the H1 ordering will survive the adversarial bound is low by design, and is exactly what Step 7 is built to discover.

## 6.4 The falsification rule

The falsification rule is fixed here, in advance, and is reproduced verbatim from the dissertation's locked specification so that no element of it can be adjusted after the estimates are seen. H1 is supported if, across both outcomes and within the survivorship sensitivity bounds, the standardized parts-class and test-fidelity coefficients exceed the standardized heritage coefficient in magnitude and the heritage coefficient's confidence interval includes negligible effect in Model B. The contribution is falsified toward H0 if the heritage coefficient remains the largest standardized coefficient and retains a confidence interval excluding negligible effect after parts-class and test-fidelity are added.

Three features of this rule deserve explicit defense because they are what make it a genuine pre-registration rather than a flexible target. First, the rule is stated on standardized coefficients, which is why Section 6.2.3 places the three regressors on a common scale before estimation. Without standardization, a magnitude comparison between an ordinal heritage measure, an ordinal parts-class measure, and an index test-fidelity measure would be meaningless, because the units would differ. Standardization makes \( \beta_1 \), \( \beta_2 \), and \( \beta_3 \) directly comparable in the only sense the hypothesis cares about, namely how much each moves the hazard per standard-deviation shift in the predictor. Second, the rule requires the pattern to hold across both outcomes, not just one, which guards against a result that is an artifact of a single outcome construction; a finding that holds for time-to-first-failure but reverses for infant mortality is not a clean H1 verdict and the rule does not let it be read as one. Third, the rule requires the pattern to survive the survivorship sensitivity bounds, which ties the verdict to the robustness machinery rather than to a single point estimate computed on the documented cells alone.

This rule is decidable, symmetric, and fixed. It is decidable because each of its conditions is a comparison of standardized magnitudes and confidence-interval positions that the estimation directly produces. It is symmetric because it specifies, with equal precision, what supports H1 and what falsifies the contribution toward H0, so the dissertation cannot quietly reinterpret a null as a win. The case for a symmetric, pre-stated rule rests on the design-before-analysis principle, which holds that the interpretation of every possible outcome must be fixed before the outcome is known, on pain of post hoc rationalization [\[93\]](#ref-93)[\[85\]](#ref-85): a rule fixed in advance converts the estimation from an exploratory exercise into a confirmatory test, which is the only mode in which an observational study can make a falsifiable claim. The rule, as developed fully in Section 6.6, presupposes that the sample can distinguish the coefficient magnitudes at all; if it cannot, the correct report is underpowered, not H0 confirmed, and the rule is explicitly subordinated to the power floor so that a no-difference finding at an inadequate sample size is never miscoded as a falsification. A critic might raise that any threshold rule embeds an arbitrary cut. The response is that the rule avoids a single arbitrary numeric threshold by stating the verdict as an ordering of standardized magnitudes plus a confidence-interval condition, which is the weakest commitment that still yields a decision, rather than as an arbitrary effect-size cutoff. Confidence that the rule is well-formed is very high, because it is a logical construction rather than an empirical conjecture. What it cannot guarantee, and does not claim to, is that the data will be informative enough to trigger either branch cleanly, which is the power question.

## 6.5 Diagnostics and robustness

The estimation is accompanied by a fixed set of diagnostics, specified here so that they cannot be chosen after seeing results. Specifying diagnostics in advance is the same discipline as specifying the decision rule in advance: a diagnostic selected after the fact can be used to rescue or discredit a result, whereas a diagnostic fixed before estimation simply reports what it reports.

### 6.5.1 Proportional-hazards and random-effects checks

The proportional-hazards assumption is checked with scaled-residual tests, and where it fails for a covariate, that covariate is allowed a time-varying coefficient rather than being forced into a constant-hazard form. This matters most for the early window, where the mixture literature shows the hazard is far from constant, so a covariate whose effect differs between the early-defect regime and the later regime would violate proportional hazards in a way that is substantively expected rather than anomalous [\[21\]](#ref-21)[\[95\]](#ref-95). The design therefore treats a proportional-hazards failure as information about regime-dependent effects to be modeled, not as a nuisance to be ignored. The random-effects structure is checked by comparing the mixed-effects fit against a fixed-effects-by-subsystem alternative, and the heritage-versus-parts conclusion is reported under both, so the reader can see it is not an artifact of the random-effects assumption. The choice between random and fixed effects for subsystem type is not innocuous, because the two estimators answer subtly different questions and can diverge when the subsystem-specific intercepts correlate with the regressors. The applied causal literature on unit fixed effects shows precisely that fixed-effects specifications buy adjustment for time-invariant confounders at the cost of restricting the variation the model uses, so reporting both is the conservative course rather than committing to one [\[48\]](#ref-48). The intraclass-correlation machinery for time-to-event data with random effects is well developed outside this domain, which is why importing the mixed-effects survival estimator and its diagnostics carries low methodological risk [\[65\]](#ref-65).

### 6.5.2 The overlap diagnostic as a first-class result

The overlap diagnostic is reported as a propensity-style balance table within strata, showing how many heritage-rich and heritage-poor cells coexist at comparable parts-class and test-fidelity. Thin cells are flagged, and the estimate is reported both on the full overlap region and on a trimmed region that drops the thinnest strata. The reason overlap is elevated to a first-class result rather than a footnote is that, on this question, the absence of overlap is itself the most consequential possible finding. If the field always pairs deep heritage with high parts-class and full test, then within every stratum of environment, prominence, mass class, epoch, and subsystem type there is no variation in heritage at fixed rigor, and the heritage coefficient is not identified separately from the rigor coefficients. Rubin's insistence on demonstrating overlap before analyzing outcomes is therefore the gate that decides whether the question can be answered on this population at all [\[85\]](#ref-85)[\[72\]](#ref-72). The propensity score is the natural summary for whether that gate is open, because it reduces the multivariate covariate balance to a single dimension along which overlap can be inspected, which is the original and still the central use of the score in observational studies [\[96\]](#ref-96).
The interpretation rule for the overlap diagnostic is stated in advance and is two-sided. If overlap is adequate, the nested comparison proceeds and the falsification rule applies. If overlap is inadequate, the honest conclusion is that heritage and rigor are so bundled in practice that the heritage discount cannot be evaluated separately on this data, and the assurance posture that follows is to require the rigor regardless of the heritage claim, because the data cannot license discounting it. This is not a failure of the study; it is a substantive finding about the structure of the field, and it is reported as such. The matching and weighting literature offers several routes to extract identification from limited overlap, including coarsened exact matching, entropy balancing, propensity-score matching, and stable probability weighting under limited overlap, and the design records which route, if any, is used and reports the estimate's sensitivity to that choice [\[47\]](#ref-47)[\[42\]](#ref-42)[\[26\]](#ref-26)[\[53\]](#ref-53). These belong in the role of robustness tools rather than as the primary estimator because each makes its own assumptions about the form of the selection, and stacking them lets the reader see whether the heritage-versus-rigor ordering is stable across plausible identification strategies or fragile to the choice among them [\[46\]](#ref-46)[\[116\]](#ref-116). Confidence that the overlap diagnostic will be informative is high, because it is a description of the data that requires no outcome information. Confidence about which way it will come out is low by design, because whether heritage and rigor are separable in JPL practice is an open empirical question and is, in a real sense, half of what the dissertation is asking.

### 6.5.3 Coefficient stability and the three pre-specified re-codings

Coefficient stability is examined by adding controls one block at a time, so that a heritage coefficient that moves sharply when a single control enters is identified as fragile rather than reported as a finding. Three robustness checks are pre-specified beyond this, each targeting a specific alternative explanation for an apparent result.

First, the heritage measure is re-coded under a stricter definition that requires same-environment flight for the top category, to test whether any heritage association is driven entirely by the same-environment cases. If the heritage signal survives only when the top category is restricted to same-environment flight, that is itself evidence for the rival hypothesis, because it would mean that what predicts reliability is environment-matched verification of the delivered article rather than provenance of the design lineage. This re-coding turns a potential weakness of the heritage construct into a discriminating test between the two hypotheses. Second, the analysis is re-run excluding the payload instrument subsystem, because instruments are the most novel and least heritage-eligible subsystem and could dominate the heritage signal in either direction; if the conclusion depends on instruments, the design wants that visible. Third, the launch-epoch control is replaced with a finer set of epoch dummies to confirm that the heritage-versus-parts comparison is not a secular technology trend in disguise, since both parts-class norms and heritage practices have shifted across decades and a coarse epoch control could leave a residual time trend that masquerades as a heritage or parts effect [\[12\]](#ref-12)[\[20\]](#ref-20).

These three re-codings, and no others chosen later, are fixed because each maps to a named confounding or construct-validity threat identified in the design chapters, so the robustness menu is derived from the threat catalogue rather than assembled opportunistically. The reporting-standards literature for observational studies supports the choice, holding that pre-specifying the sensitivity analyses is part of what makes an observational result interpretable, because it removes the suspicion that the reported robustness checks are the ones that happened to confirm the headline [\[103\]](#ref-103). No finite set of re-codings can exhaust the space of alternative explanations, so the three are a floor, not a ceiling, and any additional analysis run at execution time is reported as exploratory and labeled as such. Confidence that these three re-codings address the most likely artifacts is moderate to high, because they are derived directly from the dominant threats the literature documents for this kind of data. What would lower it is discovery of a confounder structure not anticipated in the design, which the coefficient-stability blocks are intended to surface.

## 6.6 Power and the honest sample limit

Power is bounded by the number of well-documented JPL-class missions, which is modest, and the design reports this limit rather than assuming it away. The relevant quantity is not the conventional power to reject a null of zero effect for a single coefficient; it is the minimum detectable difference between the standardized heritage coefficient and the standardized parts-class or test-fidelity coefficient, given the assembled number of mission-by-subsystem cells, the within-mission clustering, and the censoring rate. This is the quantity the falsification rule actually depends on, because the rule is a statement about the ordering of standardized magnitudes, so the design computes the minimum detectable difference in those magnitudes and states it alongside the rule.

An underpowered non-result must be reported as underpowered, never as a confirmation of H0. The reason is arithmetic: with a small number of clustered, censored cells, the confidence intervals on \( \beta_1 \), \( \beta_2 \), and \( \beta_3 \) may be wide enough that the ordering condition in the falsification rule cannot be evaluated, in which case the data are silent on the ordering rather than supportive of either hypothesis. This follows the design-before-analysis principle, applied to the awkward but common case where the available population is small: the interpretation of a no-difference finding must be fixed in advance, and the correct fixed interpretation of a no-difference finding at an inadequate sample size is that the test is underpowered on this population [\[93\]](#ref-93)[\[85\]](#ref-85). The standard structure of clustered survival inference supports the point, since standard errors are clustered at the mission level and the subsystem random effects absorb within-subsystem correlation, both of which reduce effective sample size relative to a naive cell count and so must be built into the power calculation rather than ignored [\[65\]](#ref-65)[\[69\]](#ref-69). The minimum detectable difference is itself a function of the assembled sample, which is not yet final, so the power floor reported here is a procedure for computing the floor rather than a numeric floor; the numeric value is produced once the frame is complete, and the design commits to reporting it whatever it turns out to be. A critic might press that a study which may turn out underpowered should not be run. The response is that the value of the contribution is the pre-registered specification and the overlap finding, both of which are informative independent of whether the coefficient comparison reaches significance, so an underpowered coefficient comparison is a known and accepted risk rather than a fatal flaw, and reporting it honestly is preferable to either suppressing the study or overclaiming its result. Confidence that the honest-reporting commitment is the correct posture is very high, because it follows directly from the design discipline the whole dissertation adopts. Confidence about whether the achieved sample will clear the floor is low, and is flagged as the principal risk to the empirical phase.

## 6.7 The result tables are specified but, by design, unpopulated

Consistent with the design-stage status of this dissertation, the result tables are specified here in structure but left unpopulated, because populating them would require executing the procedure on the assembled data, which has not been done. The principal table is the nested comparison: rows for the standardized heritage, parts-class, and test-fidelity coefficients, columns for Model A and Model B under each of the two outcomes, with mission-clustered confidence intervals and the survivorship-bounded range, and a final row recording whether the falsification rule's branch evaluated to H1-supported, H0-falsified, or underpowered. The accompanying overlap balance table is specified with rows for each stratum of the control space and columns counting heritage-rich and heritage-poor cells at comparable rigor, with thin strata flagged. The diagnostic panel is specified with the proportional-hazards residual tests, the random-versus-fixed-effects comparison, and the three robustness re-codings each reported against the same falsification branches. None of these tables carries a number in this document, and that absence is a design choice, not an omission: the contribution is the specification of what the tables will contain and the rule for reading them, and presenting fabricated or illustrative cell values as though they were estimates would violate the design-stage honesty the dissertation is built on [\[93\]](#ref-93)[\[49\]](#ref-49).

## 6.8 Chapter synthesis

This chapter has frozen the analysis. It stated the eight-step procedure and showed that its dependency order enforces outcome-blindness, so that every tunable decision is fixed before predictors meet outcomes. It stated the expected, illustrative findings under H1, with the mechanism reasoning that licenses each expected sign and the explicit warning that the estimates may contradict them. It fixed the falsification rule in advance, on standardized coefficients, across both outcomes, within the survivorship bounds, and subordinated that rule to the power floor so a no-difference result at an inadequate sample is never miscoded as a confirmation. It specified the diagnostics, elevated the overlap check to a first-class result whose negative outcome is itself a substantive finding, and pre-registered three robustness re-codings each tied to a named threat. It derived the power floor as the minimum detectable difference in standardized magnitudes and committed to reporting an underpowered comparison as underpowered.

The line of argument is intact. The problem is real and material, established in the design chapters and carried here as the early-failure regime the procedure is built to interrogate. The design addresses the causal mechanism, because the nested A-to-B comparison with overlap and bad-controls discipline is exactly the operation that separates provenance from delivered-article properties. It beats the alternatives: a naive heritage-only regression or a purely descriptive reliability curve cannot decide the ordering of the three standardized coefficients, whereas the pre-registered nested comparison can [\[19\]](#ref-19)[\[95\]](#ref-95)[\[72\]](#ref-72). The residual risk is acceptable and named: the conclusion is stated as conditional association under unconfoundedness, survivorship is corrected rather than caveated, and the dominant remaining risk, an underpowered or unidentified comparison on a small JPL-class population, is reported honestly rather than papered over.

The chapter's contribution is not a result but a result-generating procedure. When the data are assembled, the verdict will be mechanical. Its honesty is guaranteed by the fact that the rule for reading it was written before the data were seen.



# Chapter 7: Discussion

## 7.0 The chapter thesis

The decision this dissertation exists to inform is where a mission-assurance organization should spend its next marginal assurance dollar. The design delivers the same answer whether the data come back supporting H1 or supporting H0: the heritage discount must be earned by the delivered article, not granted to its lineage. Under H1, the marginal dollar moves from provenance review toward verification of the as-built configuration, because the article properties the design isolates, EEE parts-class and integration-test fidelity, carry the reliability that the heritage label was being credited with. Under H0, the marginal dollar stays roughly where it is, but stays there on a demonstrated empirical warrant rather than on faith, and the field acquires for the first time a defended estimate of how much reliability heritage actually buys and under what conditions it stops buying it. Neither outcome is a wasted study. The portfolio learns which error it is more often making, denying a justified heritage discount and wasting test budget, or granting an unjustified one and shipping an unverified article, and that is a decision-relevant deliverable regardless of which way the coefficients fall.

The preceding chapters have produced a pre-registered specification, a falsification rule, and a set of expected directions. A specification does not by itself tell a review board what to do; it produces a coefficient comparison whose meaning for practice must be reasoned out under each possible outcome, against the rival explanations that could undermine a naive reading, and within the population to which it actually applies. The desired state is a complete interpretive map: for each outcome, a concrete reallocation rule; for each rival reading, an explicit statement of how the design distinguishes it; and for the external boundary, an honest declaration of where the JPL-class result stops and where it becomes a replication hypothesis. Design-stage dissertations frequently stop at the specification and leave the interpretation implicit, inviting the two characteristic abuses of an observational result: over-claiming causation where only conditional association is licensed, and over-generalizing a bounded population to the whole field. Even a clean estimate can be misread into a policy it does not support. The interpretive work in this chapter is not ornamental; it is the bridge from the number to the decision, and it is built before the number exists precisely so that it cannot be bent to flatter whatever the number turns out to be [\[93\]](#ref-93).

This chapter presents no empirical results. Every magnitude discussed is an expected direction that defines the test or an illustrative figure used to make a policy consequence concrete, and each is labeled as such. The contribution is the interpretive architecture, the mapping from outcomes to decisions and the catalogue of rival readings and external limits. Consistent with the scope decision recorded in the dissertation bible, this chapter carries the study's decision relevance through mission-assurance policy rather than an architecture-traceability chain, because the unit of analysis is a statistical cell, not a system or data exchange; the policy implications below are the appropriate form for an empirical-econometric contribution.


## 7.1 Implications under both outcomes

The central interpretive claim of this section is that the study is decision-useful under either hypothesis, but that the two outcomes route the next marginal assurance dollar to different places, and stating both routings concretely is what makes the design worth executing. The two outcomes are not symmetric in their consequences for practice, and the value of the study lies precisely in resolving which world the portfolio is living in.

### 7.1.1 If H1 is supported: from provenance review to article verification

Under H1, the standardized parts-class and test-fidelity coefficients exceed the standardized heritage coefficient in magnitude across both outcomes and within the survivorship sensitivity bounds, and the heritage coefficient's confidence interval includes negligible effect once parts-class and test-fidelity enter Model B. The interpretive reading of that pattern is that the reliability a review board has been crediting to the heritage label is in fact being carried by what is inside the box and by how thoroughly the box was exercised, and that the label was a noisy proxy for those article properties rather than a property in its own right. The actionable rule that follows is concrete and was stated in advance so it could not be reverse-engineered from a result: heritage may reduce required qualification and acceptance scope only when the delivered article matches the heritage article in parts-class and meets a test-fidelity floor in the new environment, and delta-qualification of the as-built configuration should be weighted above the provenance of the design lineage.

The mechanism that licenses this rule, named rather than asserted, runs as follows. The driver is the substitution at design review of a shallow heritage claim, design lineage or build lineage, for the deep, same-environment, parts-stable heritage that would actually retire environmental risk. The mechanism is that a board accepting the shallow claim as a maturity certificate reduces qualification scope and relaxes parts-class requirements, leaving intrinsic defects and environment-mismatch unverified on the article that flies. The observable effect, under H1, is that the failure hazard tracks parts-class and test-fidelity rather than heritage depth, because those are the properties the reduction actually degraded. The operational consequence is an elevated early and total subsystem failure hazard on missions that believed themselves protected by provenance. The strategic implication is that assurance resources spent reviewing lineage are buying less reliability per dollar than the same resources spent verifying the delivered article, which is exactly the reallocation the rule encodes. This is a mechanism with named links, not a bare correlation; the empirical design tests the links that observational data can test, the hazard-to-article-property associations, while acknowledging that the design-review decision step is reconstructed from documentation rather than observed in the act.
The infant-mortality outcome carries a sharper version of this implication, and reading it is where the policy gets its edge. The framework predicts, as an expected direction and not a measured value, that the early-failure outcome should load on test-fidelity, because the causal pathway for early failure is an uncaught latent defect, and screening and system test are the activities that exist to catch it [\[19\]](#ref-19). If the executed estimate confirms that direction, the operational reading is that the test floor, not the parts floor and certainly not the heritage claim, is the binding constraint for early survival, and an assurance organization that wants to buy down infant mortality should protect thermal-vacuum cycling, parts-level burn-in, and system-level functional coverage before it protects anything else. The small-satellite and CubeSat evidence is consistent with this reading and is interpreted here as corroborating, not confirming. Langer and colleagues' reliability-estimation tool, built explicitly to reduce CubeSat infant mortality, treats reduced screening and reduced test as the levers on early failure, the same causal claim the H1 reading would vindicate on the JPL-class population [\[58\]](#ref-58), and the CubeSat reliability statistics and developer-belief survey of Langer and Bouwmeester document that the populations built with the thinnest test and screening regimes carry the heaviest early-failure burden [\[59\]](#ref-59). The convergence is that across very different platform classes the early-failure regime behaves like a verification outcome rather than an act of nature, which is the load-bearing premise of the H1 policy.

### 7.1.2 If H0 is supported: a defended warrant for current practice

Under H0, the heritage coefficient remains the largest standardized coefficient with a confidence interval excluding negligible effect after parts-class and test-fidelity are added, and the contribution is falsified in the sense the design fixed in advance. The reading is not that the study failed but that the field's standing practice is vindicated on evidence rather than on assertion, a result the literature does not currently possess. The actionable consequence is that the burden of proof shifts. A board would be entitled to grant a heritage discount on provenance grounds, but the research community would owe the field an account of the conditions under which heritage nonetheless fails, because even a dominant average heritage effect coexists with the documented infant-mortality regime that no amount of provenance forecloses [\[19\]](#ref-19)[\[95\]](#ref-95).

The deep-heritage success cases in the corpus are the substantive content of an H0 world and are interpreted here as the mechanism by which heritage could legitimately dominate. Where heritage is deep, same-environment, and parts-stable, the transfer assumption that links historical success to present-article reliability actually holds, and provenance becomes a sufficient summary of the article properties rather than a noisy proxy for them. An H0 result would mean that in the JPL-class population, heritage claims as actually made are predominantly of this deep, environment-matched kind, so that the label and the article properties travel together tightly enough that conditioning on the label captures the reliability. The honest reading of H0 is therefore conditional and bounded in the same way the H1 reading is: it would say that on this population, with these documentation practices, heritage as practiced is a good proxy, not that heritage is intrinsically protective independent of its depth. The policy that follows is to keep the discount but to make the depth explicit, so that the shallow claims the framework warns about are not silently swept into the same category as the deep ones that earned the H0 result.

### 7.1.3 The asymmetry of errors and why the portfolio needs the answer

The two outcomes map onto two errors an assurance organization can make, and the deeper implication of the study is that it tells the portfolio which error it is more often committing. Granting an unjustified heritage discount, the error H1 would expose, ships an unverified article and risks an on-orbit subsystem failure whose cost is the mission or a degraded mission. Denying a justified heritage discount, the error H0 would expose if current practice were in fact overcautious, spends qualification and acceptance budget that could have funded margin elsewhere. These are not equivalent. The cost of a wrong heritage discount is borne on orbit where it cannot be recovered; the cost of an unnecessary test is borne on the ground where it is merely inefficient. The study does not assume which error dominates. It estimates the coefficient comparison that reveals which error the data are consistent with, and reports the minimum detectable difference so that an underpowered non-result is read as inability to distinguish the errors rather than as confirmation of either [\[93\]](#ref-93). One caveat is essential here: the design delivers a conditional association under stated unconfoundedness, not an established causal contrast, so the reallocation rule is offered as the decision a rational board would make given the conditional association and the asymmetry of costs, not as a proof that reallocation will deliver a guaranteed reliability gain. Confidence in the decision relevance of the study is high because it holds under both outcomes; confidence in any specific reallocation magnitude is moderate at the design stage and rises only when the specification is executed on the assembled frame.


## 7.2 Theoretical contribution back to the anchor frameworks

A study that only applied existing theory would be a competent exercise. This design gives something back to each of its three anchor frameworks, and naming what it returns is part of the contribution. The extensions to the Castet-Saleh reliability program, the Angrist-Pischke design-based program, and the Rubin potential-outcomes program are each specific and statable, and they are worth making explicit because they are where the dissertation earns its place in more than one literature.

### 7.2.1 Back to the Castet-Saleh reliability program

The Castet-Saleh program established the descriptive backbone the field now relies on: nonparametric and parametric reliability functions for satellites and subsystems, the inadequacy of a single-Weibull fit and the superiority of a mixture capturing an early infant-mortality regime followed by a longer-lived regime, the concentration of failure in a small number of subsystems, and the dependence of the failure distribution on mass and orbit [\[19\]](#ref-19)[\[95\]](#ref-95)[\[32\]](#ref-32). What this program does not do, and what the present design returns to it, is an attribution layer. The descriptive curves tell a project the shape of the hazard but not which of the design-time levers, provenance, parts-class, or test-fidelity, moves it. The contribution back to the program is to take the program's own dominant findings, the early-failure regime and the subsystem concentration, and treat them not as the end of the analysis but as the dependent structure that a design-based attribution model must explain. The mixture-Weibull early regime becomes, in this design, the infant-mortality outcome whose loading on test-fidelity is the sharpest test of the rival hypothesis, and the subsystem concentration becomes the justification for subsystem random effects rather than a pooled hazard. The move is to convert a descriptive finding into an identified comparison: the program said where the failures are; this design asks which design-time decision put them there, holding the program's documented confounders fixed. The multi-state failure work is extended in the same spirit, since reading degradation as well as outright failure as the dependent structure is what lets the design separate parts-driven degradation from verification-driven early failure [\[20\]](#ref-20).

This is a genuine extension and not a re-description, and one limit matters. The program's reliability curves are estimated on populations that include heritage-rich and heritage-poor designs without separating them, so the curves are averages over the very heritage variation this design tries to exploit. The return contribution is therefore conditional on overlap actually existing in the data; if heritage and rigor prove inseparable in practice, the design cannot give the program its attribution layer, and the honest report is that the descriptive program's curves are the most that the JPL-class population can support. Confidence that the attribution question is the right next question for the program is high; confidence that this population can answer it is exactly what the overlap diagnostic in the analysis plan is built to establish.

### 7.2.2 Back to the Angrist-Pischke design-based program

The Angrist-Pischke program supplies the discipline of asking what comparison a regression is making, what variation in the regressor is being exploited, and whether that variation is plausibly unrelated to omitted determinants of the outcome after conditioning, together with the warning against bad controls that condition on outcomes of the treatment [\[5\]](#ref-5). The dissertation returns to this program a worked instance in a domain it was not built for, spacecraft reliability, and the worked instance sharpens one of the program's standing lessons in a way the original labor-economics setting does not. The bad-controls warning becomes physically vivid in this domain. The natural-seeming control is the result of the qualification campaign, whether the article passed thermal-vacuum without anomaly, and conditioning on it would absorb the very test-fidelity effect under test because the pass-or-fail verdict is downstream of heritage, parts, and test-fidelity alike. The contribution back to the program is to show that the bad-controls principle is not a technicality but the single most consequential specification decision in a reliability study, because the most informative-looking variable in the dataset, the test verdict, is exactly the one the principle forbids. Stating that in spacecraft terms gives the program a teaching case in which the cost of violating the principle is a biased verdict on a real engineering practice rather than an abstract attenuation.

The translation also stresses the program's overlap requirement in a domain-specific way that returns something to the methodology. In the spacecraft setting, overlap has a concrete physical meaning: within a region of environment, prominence, mass class, epoch, and subsystem type, the data must contain both heritage-rich and heritage-poor subsystems at comparable parts-class and test-fidelity, and the field's tendency to pair deep heritage with high parts-class and full test is a structural threat to overlap that the program's general statement does not anticipate. The contribution is to identify a domain in which the treatment and the rival regressors are bundled by engineering practice rather than by individual choice, a cleaner and more total form of the overlap problem than the partial bundling the program usually confronts, and to report the overlap diagnostic as a first-class result precisely because the bundling could be complete. Confidence that the design-based discipline transfers to this domain is high, with one condition: the transfer succeeds only if the overlap region is non-empty, and the design treats a finding of no overlap as informative rather than as failure.

### 7.2.3 Back to the Rubin potential-outcomes program

The Rubin program supplies the potential-outcomes formalism, the insistence that the assignment mechanism be reconstructed and defended from observed covariates, the unconfoundedness and overlap conditions, and the discipline that design should be completed before outcomes are examined [\[93\]](#ref-93)[\[49\]](#ref-49). The dissertation returns two things to this program. The first is a non-standard estimand that the program's machinery accommodates but rarely features: the object of interest here is not a single average treatment effect but a comparison of the conditional associations of three regressors with a failure hazard, which is why the test is framed as a nested-model coefficient comparison rather than the estimation of one causal contrast. Showing that the potential-outcomes design discipline, outcome-blind variable construction, defended assignment mechanism, demonstrated overlap, applies cleanly to a coefficient-dominance question is a small but real extension of how the program's design logic is deployed. The second return is a survivorship treatment built into the assignment-mechanism reasoning rather than appended as a caveat. The censoring-due-to-attrition problem that Rubin's principal-stratification work addresses in the mortality setting has a spacecraft analogue: subsystems that failed before producing complete documentation are differentially missing, so the documentation-probability model and the inverse-probability weighting are an application of the program's missing-data-as-assignment-mechanism logic to a reliability frame [\[93\]](#ref-93). The contribution is to demonstrate that survivorship in reliability data is not a data-cleaning nuisance but an assignment-mechanism question that the potential-outcomes program is already equipped to handle, if the analyst treats documentation completeness as itself an outcome to be modeled.

The honest limit on all three return contributions is the same and follows from the program's own logic. Because heritage, parts-class, and test-fidelity are not randomly assigned, the strongest defensible claim is a conditional association under stated unconfoundedness, and the theoretical contributions back to the three programs are contributions to how one designs and interprets such a study, not claims to have escaped its observational nature. The dissertation extends the frameworks; it does not transcend the conditions they impose. Confidence in the methodological extensions is high because they are statements about design rather than about estimated quantities; confidence in any causal reading of the eventual estimates is deliberately held lower, which is itself the Rubin discipline applied reflexively to the dissertation's own claims.


## 7.3 Policy and mission implications for NASA, JPL, and stakeholders

Under either outcome, the study changes where a mission-assurance organization should look first. That change is actionable at the level of the review board, the parts control board, and the test-program plan, not only at the level of agency policy. The levers the study isolates, the heritage discount, the parts-class floor, and the test-fidelity floor, are levers that named boards actually pull on named programs.

### 7.3.1 The review board and the heritage discount

The most direct implication is for the design-review decision that grants or withholds a heritage discount. The study supplies a board with a decision rule whose form is fixed by the outcome but whose existence is guaranteed by either outcome. If H1 holds, the rule is that a heritage claim is insufficient on its own and must be accompanied by evidence that the delivered article matches the heritage article in parts-class and meets a test-fidelity floor in the new environment before any reduction in qualification scope is granted. If H0 holds, the rule is that a heritage claim may stand on provenance grounds, but the board must record the depth of the claim, none, design-only, design-plus-build, or design-plus-build-plus-same-environment flight, so that the shallow claims the framework warns about are not granted the discount the deep claims earned. In both cases the operational change is the same: the board stops treating heritage as an undifferentiated label and starts treating it as an ordinal depth claim whose decision weight depends on which depth is actually present. That single change, making depth explicit at the review, is the policy contribution that survives regardless of the coefficient outcome, because the framework's theory of heritage as a depth claim is logically prior to the empirical test of whether depth or article-properties carries the reliability.

### 7.3.2 The parts control board and the test-program plan

The implication for the parts control board and the integration-and-test plan is conditional on H1 but sharp if H1 holds. The reading would be that the parts-class floor and the test-fidelity floor are doing the reliability work the heritage discount was being credited with, and the organizational consequence is that the authority to relax those floors on heritage grounds should be constrained. Concretely, a heritage argument that licenses procuring a lower parts-class or cutting thermal-vacuum cycling, parts-level burn-in, or system-level functional coverage would be exactly the substitution the H1 mechanism identifies as the driver of elevated hazard, and the policy would be to require that the heritage claim carry the parts and the environmental qualification forward before it can license the cut. The radiation-hardness-assurance and COTS-reliability literature is interpreted here as the engineering substrate for that policy: the move toward commercial parts trades cost against radiation and screening margin, and an assurance regime that lets a heritage label license that trade without re-establishing the margin is spending the very margin the parts-class floor exists to protect [\[12\]](#ref-12)[\[111\]](#ref-111)[\[36\]](#ref-36). The same literature also shows the policy is not a blanket prohibition on commercial parts but a requirement that the margin be re-established in the new environment, since hybrid architectures mixing screened and commercial parts can reach acceptable reliability when the screening and qualification are done rather than assumed [\[57\]](#ref-57). The mission implication is that the assurance dollar buys more reliability when it is spent re-qualifying the as-built parts-and-test configuration than when it is spent reviewing the lineage that the configuration may not actually inherit.

### 7.3.3 Stakeholders beyond the program
The implication for stakeholders beyond the individual program, the agency portfolio manager, the independent review board, and the cost estimator, is that the study supplies a defensible basis for a portfolio-level allocation rule. Qualification and acceptance test campaigns and high-reliability parts procurement are among the larger discretionary lines in a spacecraft budget, and a heritage argument that justifies cutting them reallocates real money across the portfolio. The study's value to the portfolio manager is that it converts a faith-based allocation into an evidence-based one: under H1, the portfolio should systematically weight verification of the delivered article over provenance review, and under H0, it should keep its current weighting but require depth recording so that the allocation is at least applied to the right heritage claims. The cost estimator gains a principled basis for pricing the assurance reduction a heritage claim purports to justify, because the study locates the conditions under which the reduction is and is not warranted. The independent review board gains a checklist item that is currently missing, the explicit depth of every heritage claim and the parts-and-test evidence accompanying it, which is the operational residue of the entire study regardless of outcome. The lessons-learned literature corroborates that the absence of this discipline is a recurring source of anomaly, since post-flight anomaly analyses repeatedly trace failures to test and integration gaps that a heritage assumption was allowed to paper over [\[23\]](#ref-23). The interpretive reading of that corroboration is cautious: the lessons-learned cases are individual narratives, not a controlled comparison, so they motivate the policy and illustrate the mechanism but cannot by themselves establish the coefficient dominance the policy ultimately rests on. That is the work the executed specification does, and the policy is offered here as the decision a rational stakeholder would make given the conditional association the design will deliver, with confidence calibrated to the design-stage grade of the evidence.


## 7.4 Rival explanations and how the design distinguishes them

Three rival readings could defeat a naive interpretation of the result. The design anticipates each and builds in the specific diagnostic that distinguishes it, so that the eventual estimate can be defended against the obvious objections rather than merely asserted past them. Engaging the rivals before the data exist is what keeps the interpretation honest: a rival named only after a result is seen is a rival chosen to protect the result [\[93\]](#ref-93).

### 7.4.1 Rival one: heritage and rigor are inseparably bundled

The first rival reading holds that heritage and rigor are so tightly bundled in engineering practice that no within-stratum comparison of heritage at fixed parts-class and test-fidelity exists, so that any coefficient comparison the model reports is extrapolation rather than evidence. This is the most serious rival because it would render the question unidentified on this population rather than answered in either direction. The design distinguishes it with the overlap diagnostic, reported as a first-class result rather than a footnote: within each region of environment, prominence, mass class, epoch, and subsystem type, the analysis counts the heritage-rich and heritage-poor cells that coexist at comparable parts-class and test-fidelity, and where the count is thin the cell is flagged and the estimate is reported both on the full overlap region and on a trimmed region that drops the thinnest strata. The interpretive rule fixed in advance is that a finding of no overlap is itself informative: it would mean heritage and rigor are bundled so completely that the heritage discount cannot be evaluated separately, and the honest assurance posture in that world is to require the rigor regardless of the heritage claim, because the field has never actually run the experiment of deep heritage with thin rigor or shallow heritage with full rigor. This rival does not have a benign resolution. Either overlap exists and the comparison is identified, or it does not and the policy default becomes to require rigor unconditionally. Confidence that the design can detect this rival is high because the overlap diagnostic is mechanical; confidence that overlap exists is exactly what the diagnostic measures and is not assumed.

### 7.4.2 Rival two: mediation, not confounding

The second rival reading holds that heritage genuinely improves reliability but operates through parts-class and test-fidelity as mediators rather than competing with them as confounders, so that the attenuation of the heritage coefficient in Model B reflects mediation, not spuriousness, and the H1 reading would then be a misinterpretation that discards a real heritage effect. This rival is consequential because it inverts the policy: if heritage causes good parts-class and good test-fidelity, then rewarding heritage is rewarding the thing that produces the rigor, and stripping the heritage discount could remove the incentive that delivers the rigor. The design distinguishes mediation from confounding by examining whether heritage predicts parts-class and test-fidelity and by reporting both the total and the conditional heritage associations, so that a board can see whether the heritage-to-rigor pathway is present and how much of the total heritage association runs through it. The interpretive reading is deliberately careful: a finding that heritage predicts rigor is consistent with mediation but does not establish it, because the same correlation arises if a common cause, program competence, drives both heritage retention and rigor, which is the third rival. The design therefore does not claim to resolve mediation versus confounding from the coefficient pattern alone; it reports the total-and-conditional decomposition and flags the mediation possibility as a limit on the causal reading, which is the honest treatment given observational data [\[5\]](#ref-5). Confidence in detecting the heritage-to-rigor pathway is moderate-to-high because it is a measurable association; confidence in attributing it to mediation rather than to a common cause is low, and the design says so.

### 7.4.3 Rival three: program competence as an unobserved common cause

The third rival reading holds that an unobserved program characteristic, broadly program competence or organizational maturity, drives both heritage retention and low failure, so that the heritage association is a marker for competence rather than a causal path of its own, and equally the parts-and-test associations could be markers for the same competence. This is the omitted-variable rival that selection-on-observables identification cannot eliminate, only bound. The design confronts it with the available proxies, mission prominence as a stand-in for review intensity and budget and the documentation-probability model as a stand-in for organizational record-keeping discipline, and it acknowledges explicitly that residual competence confounding remains after these proxies are included. The interpretive consequence is the qualifier that governs the entire study: the conclusion is stated as a conditional association under unconfoundedness, not as an established causal effect, and the policy is offered as the decision a rational board would make given that conditional association and the asymmetric cost of errors, not as a proof of a causal mechanism. The relative-bias literature on imperfect identification is the methodological warrant for treating this rival as a bounding problem rather than a resolvable one: under plausible violations of the selection-on-observables assumption, the bias in the estimated associations can be characterized and bounded, and the honest report states the bound rather than ignoring the violation [\[93\]](#ref-93). Confidence that competence confounding is fully removed is low by construction; confidence that the design bounds it and reports the bound is high, and the difference between those two confidences is the difference between an overclaim and an honest observational result.

### 7.4.4 A fourth reading: secular technology trend

A fourth reading, short of a full rival, holds that the heritage-versus-rigor comparison is a secular technology trend in disguise, because both parts-class norms and heritage practices have shifted across decades, so that what looks like a heritage or parts effect is the calendar. The design pre-specifies the diagnostic: the launch-epoch control is replaced with a finer set of epoch dummies, and the heritage measure is re-coded under a stricter same-environment-flight definition for its top category to test whether any heritage association is driven entirely by the same-environment cases, which would itself be evidence for the rival hypothesis that environment-matched verification, not provenance, is what matters. The small-satellite reliability literature spanning multiple decades is interpreted here as motivating the concern, since reliability statistics shift across launch epochs as parts and practices change [\[41\]](#ref-41)[\[76\]](#ref-76)[\[113\]](#ref-113), and the design's epoch dummies are the response. Confidence that the epoch diagnostic separates a secular trend from a heritage effect is moderate, bounded by the number of well-documented missions per epoch, and the power section reports that bound rather than assuming it away.


## 7.5 External validity

The result, in either direction, is a statement about JPL-class missions with documented heritage and parts records. Transfer to other populations is a replication hypothesis the study can frame but not establish. Stating that boundary precisely is part of the contribution: an observational result generalized past its population is the second characteristic abuse of this kind of study, and the design forecloses it by declaring the boundary in advance.

The population to which the result applies is defined by the data the study can assemble: JPL-class deep-space and science missions for which the archives record heritage claims as made at design review, EEE parts-class as procured, and test-program fidelity as planned and as run. That population is bounded on at least three dimensions, and each bound is a limit on transfer. It is bounded in mass and platform class, because heritage claims and parts-class are best documented for flagship and competed science missions and thinner for the smallest classes; the mass-class control and the planned subgroup analysis bound this internally, but they cannot manufacture transfer to a class the data barely contain. It is bounded in environment, because the JPL-class population skews toward deep-space and high-radiation environments where the same-environment heritage distinction bites hardest, and a result driven by that distinction may not transfer to a benign-environment population where shallow heritage is closer to deep heritage in its reliability content. It is bounded in institutional regime, because the parts and test practices the study measures are JPL practices, and a population built under a different assurance culture is a different assignment mechanism.

The transfer to commercial NewSpace and to CubeSat populations is the most important external boundary, and the corpus lets the study state it as a directional hypothesis rather than leave it open. The COTS and small-satellite literature suggests that the parts-class channel is, if anything, stronger in those populations, because they make the COTS substitution the study treats as a parts-class reduction the central design choice, and they carry the early-failure burden that the test-fidelity channel predicts [\[59\]](#ref-59)[\[36\]](#ref-36)[\[57\]](#ref-57). The interpretive reading is that if H1 holds on the JPL-class population, the prior for H1 holding even more strongly on the NewSpace and CubeSat populations should rise, because those populations have moved further toward the low-parts-class, thin-test regime the H1 mechanism identifies as the driver of hazard. But that is a replication hypothesis, not a finding of this study, and the distinction is enforced rather than blurred: the small-satellite reliability statistics, the CubeSat mission-success analyses, and the lessons-learned anomaly narratives are evidence about those populations, not about the JPL-class population this design estimates on, and importing them as confirmation would be the error the boundary statement exists to prevent [\[41\]](#ref-41)[\[75\]](#ref-75)[\[105\]](#ref-105)[\[23\]](#ref-23)[\[7\]](#ref-7). The honest claim is that the study's mechanism makes a testable prediction for those populations and that the prediction should be tested on their own data, not that the JPL-class result transfers.

There is a converse boundary worth stating, because it disciplines the H0 reading symmetrically. If H0 holds on the JPL-class population, it does not follow that heritage dominates on the NewSpace and CubeSat populations, because the deep, same-environment, parts-stable heritage that would explain an H0 result on JPL-class missions is precisely the heritage those populations least often have. A small-satellite program reusing a design but rebuilding it with commercial parts for a new orbit is making the shallow heritage claim the framework warns about, so an H0 result on the deep-heritage JPL-class population would, if anything, lower rather than raise the prior for H0 on the shallow-heritage small-satellite population. The science-mission and platform literature for small satellites is interpreted here as marking the breadth of the population to which neither result automatically transfers, since these are missions built under assurance regimes ranging from near-flagship to minimal [\[66\]](#ref-66)[\[67\]](#ref-67)[\[27\]](#ref-27)[\[61\]](#ref-61)[\[22\]](#ref-22)[\[24\]](#ref-24). The interpretive discipline is the same in both directions: the study estimates on one population, states the mechanism that would or would not transfer, and hands the transfer question to a replication on the target population's own data.

The strongest external-validity statement the study can make is therefore a layered one. The internal claim is a conditional association on the JPL-class population under stated unconfoundedness, with the overlap diagnostic deciding whether even that claim is identified. The external claim is a directional prediction for the NewSpace and CubeSat populations, grounded in the shared mechanism but explicitly labeled a replication hypothesis rather than a finding. And the meta-claim, which holds regardless of outcome, is that the depth of a heritage claim and the parts-and-test evidence accompanying it are decision-relevant variables that any population's assurance process should record, because the framework's theory of heritage as a depth claim is prior to the empirical test and transfers as a conceptual contribution even where the coefficient estimate does not. Confidence in the internal conditional association is design-stage moderate and rises with execution; confidence in the external directional prediction is lower and is offered as a hypothesis; confidence in the meta-claim, that depth and article-evidence should be recorded, is high, because it follows from the conceptual framework rather than from any estimate and costs nothing to adopt while protecting against the substitution error the whole study is built around.


## 7.6 Chapter synthesis

Pulling the discussion together against the line of argument the dissertation carries, the five claims that organize it hold under the interpretation developed here, and stating their status is the appropriate close for a discussion chapter. The problem is real: heritage is invoked as a rigor substitute while infant mortality and subsystem anomalies persist across heritage-rich populations, a pattern the descriptive reliability program documents and this chapter reads as the standing motivation regardless of outcome [\[19\]](#ref-19)[\[95\]](#ref-95)[\[100\]](#ref-100). The problem is material: failure concentrates in a few subsystems, test and parts campaigns are large discretionary budget lines, and environment shifts the hazard, so the heritage discount reallocates real money against a real hazard [\[95\]](#ref-95)[\[32\]](#ref-32). The design addresses the causal mechanism: the nested Model A to Model B comparison with overlap and bad-controls discipline separates provenance from delivered-article properties, and this chapter has shown how each rival reading is distinguished rather than assumed away [\[5\]](#ref-5)[\[93\]](#ref-93). The design beats the alternatives: pure descriptive reliability curves and naive heritage-only regressions cannot decide the test, and the design-based identification can, conditional on overlap, which is the extension this chapter returns to the Castet-Saleh program [\[20\]](#ref-20)[\[49\]](#ref-49). And the residual risk is acceptable in the specific sense the discipline requires: the conclusion is stated as conditional association under unconfoundedness, survivorship is corrected by inverse-probability weighting and bounded sensitivity rather than waved away, and an underpowered non-result is reported as inability to distinguish rather than as confirmation [\[93\]](#ref-93).

The single sentence that the whole discussion serves is the one the dissertation opened with and the one this chapter has interpreted under every contingency: the deliverable is a pre-registered, falsifiable specification that puts claimed flight heritage in direct competition with EEE parts-class and integration-test fidelity as predictors of realized JPL-class subsystem reliability, and the value to the Safety, Mission Assurance and Health portfolio does not depend on which hypothesis wins, because either outcome tells the portfolio where its next assurance dollar buys the most reliability and which of its two errors it is more often making. That is the decision relevance, carried through policy rather than architecture, and it is the appropriate substitute in a statistical dissertation for the architecture-traceability chain that this contribution, being an empirical-econometric study of a statistical cell rather than a system, correctly does not force.


# Chapter 8: Conclusion

## 8.0 The answer this dissertation delivers

The deliverable of this dissertation is a decision procedure, not a coefficient. The contribution is a pre-registered, falsifiable cross-mission survival specification that places claimed flight heritage in direct competition with electrical, electronic, and electromechanical (EEE) parts-class and integration-test fidelity as predictors of realized JPL-class subsystem reliability, on a population, with controls, and under a falsification rule fixed before the outcome data are examined. What stands at the close of the design phase is the apparatus that can decide the question, together with the conditions under which each answer would be earned. What does not yet stand, and is not claimed to, is any estimated value of the competing coefficients. This distinction is the whole point. A field that has argued about flight heritage for decades has done so without an instrument that could settle the argument; the instrument is now built, specified to the level of the variable codebook, the estimator, the overlap gate, and the survivorship correction, and it is ready to be run on the full assembled data.
That framing carries a deliberate epistemic consequence. Because the specification is design-complete but not yet executed, every claim in this chapter is a claim about the design, the conditional logic of the test, and the value of the apparatus independent of its eventual reading. Where the chapter states that the contribution survives even if the alternative hypothesis is not confirmed, it makes a structural argument about what a pre-registered falsification test buys the portfolio, not a prediction about which way the coefficients will fall. The confidence attached to the structural argument is high, because it follows from the design discipline itself. The confidence attached to any directional expectation about the coefficients remains, as it has throughout, deliberately withheld, because the design-stage evidence grade does not license it.

This chapter restates the contribution and what stands regardless of the eventual finding (Section 8.1), states the value to the Safety, Mission Assurance and Health portfolio under either hypothesis (Section 8.2), gives an honest account of the limitations that bound the design (Section 8.3), lays out a concrete future-research program including the path to executing the specification on the full data (Section 8.4), and closes (Section 8.5).

## 8.1 The contribution restated, and what stands even if H1 is not confirmed

### 8.1.1 The current state, the desired state, the gap, and the consequence

The problem this dissertation addresses can be stated as a gap between two states of mission-assurance practice. In the current state, a review board hears the word "heritage" attached to a subsystem and treats that label as a substitute for parts rigor and test scope, discounting the qualification and acceptance program on the strength of provenance. In the desired state, the heritage discount is granted only when the delivered article matches the heritage article in parts-class and meets a test-fidelity floor in the new environment, and that conditional grant is justified by an explicit empirical test rather than by custom. The gap between these states is that the published reliability literature, mature as it is on description, has never isolated heritage from the parts-class and test-fidelity it is assumed to proxy, and has never done so on a JPL-class population with design-based identification. Leaving the gap open carries a consequence: assurance dollars keep flowing on faith. A wrong heritage discount that produces an on-orbit subsystem failure can cost a mission, while an unjustified denial wastes test budget that could have bought margin elsewhere, and the portfolio cannot tell which of those two errors it is more often making.

### 8.1.2 The contribution and the case for it

The central claim of the dissertation is that the heritage-versus-rigor question is answerable with the apparatus assembled here. Three lines of evidence developed across the preceding chapters establish it: the descriptive reliability base shows that the outcome varies enough to be modeled and that its dominant confounders are known and codable [\[19\]](#ref-19)[\[95\]](#ref-95); the design-based causal-inference frame supplies an identification strategy that separates a provenance label from delivered-article properties under stated assumptions [\[5\]](#ref-5)[\[93\]](#ref-93)[\[85\]](#ref-85); and the variable codebook operationalizes heritage, parts-class, and test-fidelity at the mission-by-subsystem cell so that the three can enter a common regression on a standardized scale. The logic that ties this evidence to the claim is the principle that a head-to-head comparison of conditional associations, conducted under selection-on-observables with an overlap gate and a bad-controls discipline, is the appropriate instrument for adjudicating which of several bundled predictors carries delivered reliability when none of them is randomized, a principle drawn from the body of design-based observational practice that established outcome-blind design and overlap demonstration as the gates of credible observational inference [\[93\]](#ref-93)[\[49\]](#ref-49).

One limit on the claim is essential and is protected here exactly as it was protected in the design chapters: the apparatus answers the question conditionally, under the unconfoundedness assumption, and yields a defended conditional association rather than an identified causal contrast. One finding would defeat the claim: the discovery, at execution, that the overlap region is too thin to support any within-stratum heritage-versus-rigor comparison, in which case the apparatus would return not an answer but the finding that the question is unidentified on this population. That outcome is not a failure of the design. It is one of the design's anticipated outputs, and Section 8.1.4 explains why it is itself a contribution.

### 8.1.3 What the contribution is not

The contribution is not an estimate of the heritage effect. No coefficient in the specification

\[ \log h(t) = \log h_0(t) + \beta_1 \text{Heritage}_i + \beta_2 \text{PartsClass}_i + \beta_3 \text{TestFidelity}_i + \gamma \text{Controls}_{im} + u_s \qquad\qquad (8) \]

has been estimated on the full assembled dataset, where \( h_0(t) \) is the flexible piecewise-constant or Weibull-mixture baseline, \( u_s \) is the Gaussian random intercept for subsystem type s, and the regressors are standardized so that \( \beta_1 \), \( \beta_2 \), and \( \beta_3 \) are magnitude-comparable. The expected directions discussed in the analysis-plan chapter, that heritage would show a moderate raw association in Model A and attenuate when parts-class and test-fidelity enter in Model B, were stated as illustrative expectations that fix the falsification thresholds, never as results. The contribution is the pre-registered specification of Model A and Model B, the nested A-to-B comparison that decides the test, and the falsification rule that interprets the comparison. Withholding the estimate until the design is frozen is the source of the design's credibility, not a deferral of its substance.

### 8.1.4 What stands even if H1 is not confirmed

The hypothesis pair is fixed and head-to-head. H0 holds that prior-flight heritage depth is the primary driver of delivered on-orbit reliability for JPL-class spacecraft, carrying the largest and most robust association with reduced subsystem failure hazard after conditioning, with parts-class and test-program fidelity adding little once heritage is included. H1 holds that realized subsystem failure rate is predicted more strongly by EEE parts-class and integration-test fidelity than by claimed heritage depth, with the parts-class and test-fidelity coefficients dominating the heritage coefficient in magnitude and robustness after conditioning, and heritage adding little incremental predictive power once the two delivered-article properties enter. The falsification rule is symmetric and was fixed in advance: H1 is supported if, across both outcomes and within the survivorship sensitivity bounds, the standardized magnitudes of \( \beta_2 \) and \( \beta_3 \) exceed the standardized magnitude of \( \beta_1 \) and \( \beta_1 \)'s interval includes negligible effect in Model B; the contribution is falsified toward H0 if \( \beta_1 \) remains the largest standardized coefficient with an interval excluding negligible effect after \( \beta_2 \) and \( \beta_3 \) enter.

The decisive point for this conclusion is that the contribution stands whether the test confirms H1 or falsifies it toward H0. This is a claim about the value of a symmetric pre-registered test, and its warrant is that a falsification rule fixed before estimation makes both outcomes informative rather than only the one the author hoped for. If the data falsify the contribution toward H0, the field does not lose; it gains a defended empirical warrant for a practice it currently holds on faith, itself a result of value to a portfolio that has never had one. A vindicated heritage discount, demonstrated rather than assumed, would let review boards grant it with documented confidence and would redirect the research effort toward characterizing the conditions under which heritage nonetheless fails, since even a strong average heritage effect coexists with the documented infant-mortality regime that the mixture-Weibull reliability work made unmistakable [\[21\]](#ref-21). If the data support H1, the field gains the warrant to discount heritage claims absent matched parts-class and test-fidelity. And if the overlap diagnostic returns the unidentified verdict, the field learns that heritage and rigor are so tightly bundled in JPL practice that no separate heritage discount can be evaluated at all, which carries the immediate operational implication that the honest assurance posture is to require the rigor regardless of the heritage claim. Three distinct outcomes, each decision-relevant; that is what a symmetric design buys, and it is what stands independent of which way the estimate eventually falls. Confidence in this structural argument is high, because it is entailed by the design rather than contingent on the data.

## 8.2 Value to the Safety, Mission Assurance and Health portfolio under either hypothesis

### 8.2.1 The argument, carried to the close

The argument of this dissertation has followed a single line, and the conclusion is the place to confirm that each link holds at the design stage. The problem is real: heritage is invoked as a rigor substitute, yet infant mortality and subsystem anomalies persist across heritage-rich populations, a pattern the reliability program documented across multiple databases and platform classes [\[19\]](#ref-19)[\[100\]](#ref-100)[\[95\]](#ref-95). The problem is material: failure concentrates in a small number of subsystems, qualification and acceptance test campaigns and high-reliability parts procurement are among the larger discretionary lines in a spacecraft budget, and the failure hazard shifts with environment and platform class, so a heritage argument that licenses cutting those lines reallocates real money against a moving target [\[95\]](#ref-95)[\[32\]](#ref-32). The design addresses the causal mechanism: a nested Model A to Model B survival specification with an overlap gate and a bad-controls discipline separates a provenance label from delivered-article properties [\[5\]](#ref-5)[\[85\]](#ref-85)[\[93\]](#ref-93). The design beats the alternatives: a pure descriptive reliability curve and a naive heritage-only regression cannot decide the test, because the first never models the competing predictors and the second confounds heritage with the rigor it travels with, whereas the design-based comparison can adjudicate them [\[19\]](#ref-19)[\[49\]](#ref-49). The residual risk is acceptable: the conclusion is stated as a conditional association under unconfoundedness, survivorship is corrected by inverse-probability-of-documentation weighting and bounded sensitivity rather than waved away, and an underpowered non-result is reported honestly as underpowered rather than dressed as confirmation [\[93\]](#ref-93)[\[49\]](#ref-49). Confirmed link by link, the argument is intact at design completion.

### 8.2.2 The named mechanism that makes the portfolio value concrete

The portfolio value rests on a single causal mechanism, named here in full so that the reallocation it implies is not a bare correlation. The driver is the substitution, at design review, of a weaker heritage claim for a stronger one: a design-heritage box flown to a new environment is treated as if it carried same-environment flight heritage. The mechanism is that, on the strength of that substitution, qualification and acceptance scope and parts-class rigor are reduced on provenance grounds, leaving latent defects and environment-mismatch unverified on the delivered article. The observable effect is an elevated early, infant-mortality, and total subsystem failure hazard on that article. The operational consequence is an on-orbit subsystem anomaly or loss on a JPL-class mission. The strategic implication is that assurance resources are misallocated toward provenance review and away from delivered-article verification. The portfolio value of the dissertation is that its test measures whether this mechanism is operating strongly enough to warrant moving assurance dollars along the chain from provenance to verification. Where the design can establish only association rather than the full mechanism, the dissertation says so and downgrades the confidence accordingly; the mechanism is named as the hypothesis under test, not asserted as established fact.

### 8.2.3 Why the value does not depend on the verdict

The reallocation implied by each verdict is concrete, and that concreteness is the portfolio value. Under H1, the actionable rule is that a heritage claim is insufficient on its own: heritage may reduce required test scope only when the delivered article matches the heritage article in parts-class and meets a test-fidelity floor in the new environment, and delta-qualification of the as-built configuration should be weighted above design-lineage provenance. That rule moves review attention and test money from lineage documentation toward verification of the article that will actually fly. Under H0, the rule is the inverse and is no less useful: the heritage discount is empirically warranted, review boards may grant it with documented confidence rather than nervous custom, and the research burden shifts to identifying the residual conditions under which heritage fails despite a strong average effect. Under the unidentified verdict, the rule is the most conservative of the three: because heritage and rigor cannot be separated on this population, the rigor is required regardless of the heritage claim, and the assurance posture defaults to verification. In every case the portfolio learns where its assurance dollars should go, which is precisely the knowledge it lacks today. The value is in the decision the apparatus enables, and that decision is well-defined under all three readings. The unit of analysis here is the mission-by-subsystem statistical cell rather than a capability or a system, so the contribution's decision-relevance is carried by the mission-assurance policy implication itself rather than by any architectural mapping.

## 8.3 Limitations, stated honestly

The credibility of the contribution depends on stating its limits as plainly as its strengths, and the design-stage status makes that statement a matter of design integrity rather than modesty.

### 8.3.1 The estimand is a conditional association, not an identified causal effect
The most consequential limitation is that no one randomizes heritage, parts-class, or test fidelity across spacecraft, so the strongest defensible reading of the eventual estimates is a conditional association under selection-on-observables, not an identified causal contrast. The same program characteristics that produce a heritage claim may also produce, or fail to produce, parts rigor and test rigor, and the control set for mission environment, prominence, mass class, launch epoch, and subsystem type mitigates that confounding without eliminating it. The dissertation states its conclusion accordingly and does not promote the conditional association to a causal claim, keeping faith with the design discipline that distinguishes what an observational comparison can and cannot license [\[5\]](#ref-5)[\[93\]](#ref-93). The evidence that would raise confidence toward a causal reading would be a natural experiment in heritage assignment: a parts-lot disruption or a supplier change that severed heritage from rigor for reasons unrelated to the failure outcome. The design notes this as a target for future identification rather than a property it currently possesses.

### 8.3.2 Overlap may be thin, and the question may be unidentified on this population

The second limitation is the physical possibility that JPL practice always pairs deep heritage with high parts-class and full test, so that no within-stratum comparison of heritage against rigor exists. The overlap diagnostic is reported as a first-class result precisely because this outcome is possible, and a finding that the comparison is unidentified would mean the heritage discount cannot be evaluated separately on this data at all. This is a genuine limit on the population, not a defect of the apparatus, and reporting it honestly is required by the outcome-blind design discipline [\[93\]](#ref-93)[\[49\]](#ref-49). The evidence that would lift this limitation is a broader population, discussed in Section 8.4, that imports independent heritage-versus-rigor variation from mission classes where the two are less tightly bundled.

### 8.3.3 The population is JPL-class, and transfer is not assumed

The third limitation is external validity. The population is JPL-class deep-space and science missions with documented heritage and parts records, and the result in either direction is a statement about that population. Transfer to commercial constellations or to the smallest CubeSat class, where parts and test regimes differ, is not assumed; it is bounded by the mass-class and orbit controls and by a planned subgroup analysis. The small-satellite and COTS reliability evidence suggests the parts-class channel may be stronger in those populations, but that is a replication hypothesis rather than a claim of this study.

### 8.3.4 Data limits: survivorship, undercount, and unciteable archives

The fourth cluster of limitations concerns the data. Survivorship is the first-order threat: missions and subsystems that failed before producing complete documentation are underrepresented, and heritage claims quietly dropped after an early failure may not be archived as heritage. The design builds the sampling frame from launch manifests rather than from surviving-mission documentation, applies inverse-probability-of-documentation weighting, and runs a bounded sensitivity analysis across the assumed failure behavior of undocumented cells, but no correction fully recovers records that were never written. Anomaly records also undercount minor anomalies that did not trigger formal reporting, which biases the outcome toward more severe events. This is acceptable because the hypotheses concern reliability-relevant failures, but it is a bias to declare rather than hide. The primary heritage and parts-class construct draws on JPL-internal archives, the Lessons Learned Information System, problem-reporting records, and project heritage matrices, none of them citable open literature, so the dissertation describes their access and provenance rather than referencing a DOI, and the coding decisions made against them are documented in the coding manual so the construction is auditable even though the source is not public.

### 8.3.5 Construct and power limits

The fifth and sixth limitations are construct validity and power. Heritage depth, parts-class, and test-fidelity are constructed indices, and a poor construction could understate one predictor and flatter another. Each index is built from documented, auditable fields before outcomes are examined, and inter-coder reliability is reported for the two coding-intensive indices, but the indices remain measurements with error rather than ground truth. Power is bounded by the modest number of well-documented JPL-class missions, and the design reports the minimum detectable difference between the standardized heritage coefficient and the standardized parts-class or test-fidelity coefficient rather than assuming adequate power. If the data cannot distinguish the coefficient magnitudes at the achieved sample size, the honest report is that the test is underpowered on this population, not that H0 is confirmed. Stating the power limit in advance is what keeps a non-result from being misread as a vindication of the null.

## 8.4 A concrete future-research program

The future-research program has two parts: the path to executing the present design on the full data, and the extensions that the executed design makes possible.

### 8.4.1 The path to executing the pre-registered specification on the full data

The immediate next step is execution, and the path is the eight-step procedure fixed in the analysis plan, restated here as a work program. First, build the mission-by-subsystem frame from launch manifests for the chosen JPL-class population and epoch window, so that early-failed and short-lived missions enter the frame even when their internal records are thin. Second, code heritage depth, parts-class, and test-fidelity from the JPL archives and the NASA Technical Reports Server reports, with two independent coders on the heritage and test-fidelity indices and the chance-corrected inter-coder agreement recorded before full coding proceeds. Third, construct the two outcomes, time-to-first-failure and the infant-mortality indicator, and the censoring structure from the anomaly and lessons-learned records, with the early window set from the mixture-Weibull early-subpopulation inflection rather than chosen ad hoc [\[21\]](#ref-21). Fourth, estimate the documentation-probability model and form the inverse-probability weights. Fifth, restrict to the overlap region in covariate space and report the overlap balance table as a first-class result. Sixth, estimate Model A and Model B for both the survival and the discrete-time outcomes, with mission-clustered standard errors and subsystem random effects. Seventh, run the survivorship sensitivity analysis across the bounded assumptions for the undocumented cells. Eighth, report the nested comparison and the falsification decision exactly as the pre-registered rule defines it.

The principal dependency on this path is data assembly. The heritage and parts records live in JPL project archives whose access is governed by records-access procedures rather than by open download, and the linkage across the anomaly system, the NTRS reports, and the project archives requires reconciling a canonical mission identifier and a common subsystem taxonomy across three nomenclatures. The realistic sequencing therefore front-loads the records-access agreements and the crosswalk construction, because the coding cannot begin until the linkage is fixed, and the outcome-blind discipline requires that the entire codebook be frozen before any outcome is examined [\[93\]](#ref-93). A staged release is advisable: assemble and freeze the codebook, complete the inter-coder reliability subset, and only then unlock the outcomes for the Model A and Model B estimation, so that the design-before-analysis separation is preserved in the actual workflow and not merely promised in the document.

### 8.4.2 Extensions the executed design makes possible

Four extensions follow once the base specification is executed. The first is the identification upgrade. If the executed overlap diagnostic shows the heritage-versus-rigor comparison to be thin on the JPL-class population, the natural response is to search for a natural experiment in heritage assignment, a parts-lot disruption, a supplier exit, or a mandated requalification, that severs heritage from rigor for reasons plausibly unrelated to the failure outcome, and to use it to move from conditional association toward an instrumented or quasi-experimental contrast. This is the route from the selection-on-observables estimand of the present design toward a more defensible causal reading [\[5\]](#ref-5).

The second extension is the population transfer. The design's external-validity boundary is JPL-class missions, and the most informative replication is to port the specification to a small-satellite or NewSpace population where the parts-class and test regimes differ and where heritage and rigor may be less tightly bundled, both improving overlap and testing whether the parts-class channel is stronger as the small-satellite literature suggests. A pooled analysis across populations, with population as a moderator, would test whether the heritage-versus-rigor balance is itself a function of the parts and test regime.

The third extension is the mediation decomposition. If, on execution, the heritage coefficient attenuates in Model B, the design already distinguishes confounding from mediation by examining whether heritage predicts parts-class and test-fidelity and by reporting both the total and the conditional heritage associations. A fuller mediation analysis would quantify how much of any heritage effect operates through the rigor it tends to bring rather than independently of it, which would refine the policy rule from a blunt discount to a conditional one keyed to the mediating variables.

The fourth extension is the outcome enrichment. The present design uses time-to-first-failure and an infant-mortality indicator; the multi-state reliability work shows that subsystems degrade through intermediate states before outright failure, so a multi-state survival extension would let the test distinguish whether heritage and rigor act on the onset of degradation, on the transition from degraded to failed, or on both, sharpening the mechanism beyond the binary failure outcome the base design uses.

### 8.4.3 A note on what the program should not do

The future program should not relax the pre-registration to chase a result. The temptation, common when an executed test returns a null or an underpowered verdict, is to re-specify the model, redraw the early window, or add controls until a coefficient becomes significant, and every such move after the outcomes are seen would forfeit the design-before-analysis credibility that is the dissertation's core asset [\[93\]](#ref-93). The diagnostics and the three robustness re-codings are fixed in advance precisely so that they cannot be chosen after seeing results, and the discipline of the program is to report the falsification decision the frozen rule produces, including the unidentified and underpowered verdicts, rather than to negotiate with the data until it yields a publishable effect.

## 8.5 Closing

Flight heritage is among the most consequential and least examined assumptions in spacecraft mission assurance. It is invoked at design review to redirect scarce test budget and parts-procurement money, and it is invoked on the strength of a provenance label that may or may not describe the delivered article. The descriptive reliability literature has shown for years that infant mortality and subsystem anomalies persist across populations rich in heritage, but it has never put heritage in the dock against the delivered-article properties, parts-class and test-fidelity, that rival it as explanations [\[19\]](#ref-19)[\[95\]](#ref-95). This dissertation has built the instrument that can. The instrument is a cross-mission, mission-by-subsystem survival and discrete-time specification that competes claimed heritage against EEE parts-class and integration-test fidelity, on a JPL-class population, with mission-environment and prominence controls, subsystem random effects, mission-clustered inference, and a survivorship correction built into the sampling frame and the weighting rather than appended as a caveat, all disciplined by the design-based and outcome-blind program of Angrist and Pischke and of Rubin [\[5\]](#ref-5)[\[93\]](#ref-93).

What this dissertation contributes is therefore not a number but a verdict procedure, and the procedure is fair to both sides because its falsification rule was fixed before the data were seen. If the eventual estimates support the alternative hypothesis, the portfolio gains a warrant to stop treating a heritage label as a substitute for verifying the article that will fly. If they falsify the contribution toward the null, the portfolio gains the empirical warrant for a heritage discount it has until now held on faith. If the overlap is too thin to decide, the portfolio learns that heritage and rigor are inseparable in its own practice and that the rigor must be required regardless. Each of those three readings tells the Safety, Mission Assurance and Health portfolio something it does not currently know about where its assurance dollars should go, and the value of the design lies in making all three readings legible in advance. The remaining work is to complete the assembly of the JPL heritage and parts records and the NASA anomaly outcomes into the mission-by-subsystem frame and to execute the pre-registered specification, reporting the falsification decision exactly as it has been defined here. The question of whether flight heritage buys reliability has been argued long enough on rhetoric. The obligation that the assurance of a mission owes to the people who depend on it is to settle the question on evidence, and that is the service this dissertation is built to render.
# References

<span id="ref-1"></span>[1] A. Murphy, "The Proof in Heritage: Long-Term Performance Analysis of the ASTRO APS Star Tracker and Lessons Learned from On-Orbit Data," in *Proc. International Astronautical Congress (IAC)*, 2025. doi: [10.52202/083095-0026](https://doi.org/10.52202/083095-0026)

<span id="ref-2"></span>[2] J. Dijks, S. de Jong, A. Menicucci, and I. Akay, "Systematic review of engineering and testing approaches for radiation hardness assurance in commercial space avionics," *Acta Astronautica*, vol. 235, 2025. doi: [10.1016/j.actaastro.2025.07.055](https://doi.org/10.1016/j.actaastro.2025.07.055)

<span id="ref-3"></span>[3] D. González-Bárcena, B. Boado-Cuartero, Á.-G. Pérez-Muñoz, A. Fernández-Soler, J. M. Redondo, Á. Porras-Hermoso, et al., "HERCCULES: A university balloon-borne experiment for BEXUS 32 to characterize the thermal environment in the stratosphere using COTS," *Acta Astronautica*, vol. 221, pp. 184-198, 2024. doi: [10.1016/j.actaastro.2024.04.034](https://doi.org/10.1016/j.actaastro.2024.04.034)

<span id="ref-4"></span>[4] J. D. Angrist, G. W. Imbens, and D. B. Rubin, "Identification of Causal Effects Using Instrumental Variables," *Journal of the American Statistical Association*, vol. 91, no. 434, pp. 444-455, 1996. doi: [10.1080/01621459.1996.10476902](https://doi.org/10.1080/01621459.1996.10476902)

<span id="ref-5"></span>[5] J. D. Angrist and J.-S. Pischke, *Mostly Harmless Econometrics: An Empiricist's Companion*. Princeton, NJ: Princeton University Press, 2009. doi: [10.1515/9781400829828](https://doi.org/10.1515/9781400829828)

<span id="ref-6"></span>[6] T. Bučar, M. Nagode, and M. Fajdiga, "Reliability approximation using finite Weibull mixture distributions," *Reliability Engineering and System Safety*, vol. 84, no. 3, pp. 241-251, 2004. doi: [10.1016/j.ress.2003.11.008](https://doi.org/10.1016/j.ress.2003.11.008)

<span id="ref-7"></span>[7] E. Atz, B. Walsh, and C. O'Brien, "On-orbit No-contact Anomaly Debug Procedure for the CuPID CubeSat," arXiv preprint, 2023. URL: [https://arxiv.org/abs/2304.04702](https://arxiv.org/abs/2304.04702)

<span id="ref-8"></span>[8] P. C. Austin, "Balance diagnostics for comparing the distribution of baseline covariates between treatment groups in propensity-score matched samples," *Statistics in Medicine*, vol. 28, no. 25, pp. 3083-3107, 2009. doi: [10.1002/sim.3697](https://doi.org/10.1002/sim.3697)

<span id="ref-9"></span>[9] P. C. Austin, "A Tutorial on Multilevel Survival Analysis: Methods, Models and Applications," *International Statistical Review*, vol. 85, no. 2, pp. 185-203, 2017. doi: [10.1111/insr.12214](https://doi.org/10.1111/insr.12214)

<span id="ref-10"></span>[10] R. Baumann, "From COTS to space grade electronics: improving reliability for harsh environments," in *Proc. IEEE Int. Integrated Reliability Workshop (IIRW)*, 2014. doi: [10.1109/iirw.2014.7049508](https://doi.org/10.1109/IIRW.2014.7049508)

<span id="ref-11"></span>[11] H. Benaicha and A. Chaker, "Weibull Mixture Model for Reliability Analysis," *International Review of Electrical Engineering (IREE)*, vol. 9, no. 5, 2014. doi: [10.15866/iree.v9i5.4021](https://doi.org/10.15866/iree.v9i5.4021)

<span id="ref-12"></span>[12] M. Brandhoff et al., "Risk Assessment for the Use of COTS Devices in Space Systems under Consideration of Radiation Effects," *Electronics*, vol. 10, no. 9, art. 1008, 2021. doi: [10.3390/electronics10091008](https://doi.org/10.3390/electronics10091008)

<span id="ref-13"></span>[13] M. A. Brookhart, S. Schneeweiss, K. J. Rothman, R. J. Glynn, J. Avorn, and T. Stürmer, "Variable Selection for Propensity Score Models," *American Journal of Epidemiology*, vol. 163, no. 12, pp. 1149-1156, 2006. doi: [10.1093/aje/kwj149](https://doi.org/10.1093/aje/kwj149)

<span id="ref-14"></span>[14] B. A. Brumback, "Potential Outcomes and the Fundamental Problem of Causal Inference," in *Fundamentals of Causal Inference with R*, 2021. doi: [10.1201/9781003146674-3](https://doi.org/10.1201/9781003146674-3)

<span id="ref-15"></span>[15] C. Torres Vergara, "Modular and Highly Reliable COTS-Based Power Conditioning and Distribution Unit for Small Satellites," *Aerospace*, vol. 13, no. 4, art. 364, 2026. doi: [10.3390/aerospace13040364](https://doi.org/10.3390/aerospace13040364)

<span id="ref-16"></span>[16] J.-F. Castet and J. H. Saleh, "Geosynchronous communication satellite reliability: statistical data analysis and modeling," *IET Conference Publications*, 2009. doi: [10.1049/cp.2009.1196](https://doi.org/10.1049/cp.2009.1196)

<span id="ref-17"></span>[17] J.-F. Castet and J. H. Saleh, "Satellite Reliability: Statistical Data Analysis and Modeling," *Journal of Spacecraft and Rockets*, vol. 46, no. 5, pp. 1065-1076, 2009. doi: [10.2514/1.42243](https://doi.org/10.2514/1.42243)

<span id="ref-18"></span>[18] J.-F. Castet and J. Saleh, "Spacecraft Technologies: Satellite Reliability," in *Encyclopedia of Aerospace Engineering*, 2010. doi: [10.1002/9780470686652.eae419](https://doi.org/10.1002/9780470686652.EAE419)

<span id="ref-19"></span>[19] J.-F. Castet and J. H. Saleh, "Satellite and satellite subsystems reliability: Statistical data analysis and modeling," *Reliability Engineering and System Safety*, vol. 94, no. 11, pp. 1718-1728, 2009. doi: [10.1016/j.ress.2009.05.004](https://doi.org/10.1016/j.ress.2009.05.004)

<span id="ref-20"></span>[20] J.-F. Castet and J. H. Saleh, "Beyond reliability, multi-state failure analysis of satellite subsystems: A statistical approach," *Reliability Engineering and System Safety*, vol. 95, no. 4, pp. 311-322, 2010. doi: [10.1016/j.ress.2009.11.001](https://doi.org/10.1016/j.ress.2009.11.001)

<span id="ref-21"></span>[21] J.-F. Castet and J. H. Saleh, "Single versus mixture Weibull distributions for nonparametric satellite reliability," *Reliability Engineering and System Safety*, vol. 95, no. 3, pp. 295-300, 2010. doi: [10.1016/j.ress.2009.10.001](https://doi.org/10.1016/j.ress.2009.10.001)

<span id="ref-22"></span>[22] A. Chandra, M. Lutfi, and D. Gross, "Leveraging the Emerging CubeSat Reference Model for Space Situational Awareness," in *Proc. AMOS Conference*, 2018. URL: [https://amostech.space/year/2018/leveraging-the-emerging-cubesat-reference-model-for-space-situational-awareness/](https://amostech.space/year/2018/leveraging-the-emerging-cubesat-reference-model-for-space-situational-awareness/)

<span id="ref-23"></span>[23] Y. Chiu, L. Chang, C. Chao, T.-Y. Tai, K. Cheng, and H.-T. Liu, "Lessons Learned from IDEASSat: Design, Testing, on Orbit Operations, and Anomaly Analysis of a First University CubeSat Intended for Ionospheric Science," *Aerospace*, vol. 9, no. 2, art. 110, 2022. doi: [10.3390/aerospace9020110](https://doi.org/10.3390/aerospace9020110)

<span id="ref-24"></span>[24] C. Traub, M. K. Ben-Larbi, F. Turco, A. J. Große Siestrup, J. Harbeck, E. Stoll, and D. Lück, "Revealing the impact of operational constraints on aerodynamic collision avoidance maneuvers: In-flight results from the BEESAT-4 CubeSat," *Acta Astronautica*, vol. 233, 2025. doi: [10.1016/j.actaastro.2025.04.038](https://doi.org/10.1016/j.actaastro.2025.04.038)

<span id="ref-25"></span>[25] "Reliability analysis of deep space satellites launched 1991-2020: Bulk population and subsystem analysis," *Quality and Reliability Engineering International*, vol. 40, 2024. doi: [10.1002/qre.3600](https://doi.org/10.1002/qre.3600)

<span id="ref-26"></span>[26] R. Dehejia and S. Wahba, "Propensity Score Matching Methods for Non-Experimental Causal Studies," *SSRN Electronic Journal*, 2002. doi: [10.2139/ssrn.1084955](https://doi.org/10.2139/ssrn.1084955)

<span id="ref-27"></span>[27] K. Devaraj, M. Ligon, E. Blossom, J. Breu, B. Klofas, and K. Colton, "Planet High Speed Radio: Crossing Gbps from a 3U CubeSat," in *Proc. AIAA/USU Conference on Small Satellites*, 2019. URL: [https://digitalcommons.usu.edu/smallsat/2019/all2019/106](https://digitalcommons.usu.edu/smallsat/2019/all2019/106)

<span id="ref-28"></span>[28] A. Diamond and J. S. Sekhon, "Genetic Matching for Estimating Causal Effects: A General Multivariate Matching Method for Achieving Balance in Observational Studies," *The Review of Economics and Statistics*, vol. 95, no. 3, pp. 932-945, 2012. doi: [10.1162/rest_a_00318](https://doi.org/10.1162/rest_a_00318)

<span id="ref-29"></span>[29] P. Ding, "Potential Outcomes," in *A First Course in Causal Inference*, 2024. doi: [10.1201/9781003484080-2](https://doi.org/10.1201/9781003484080-2)

<span id="ref-30"></span>[30] M. Dong and A. Nassif, "Combining Modified Weibull Distribution Models for Power System Reliability Forecast," *IEEE Transactions on Power Systems*, vol. 34, no. 2, 2018. doi: [10.1109/tpwrs.2018.2877743](https://doi.org/10.1109/TPWRS.2018.2877743)

<span id="ref-31"></span>[31] G. F. Dubos, J. H. Saleh, and R. D. Braun, "Technology Readiness Level, Schedule Risk and Slippage in Spacecraft Design: Data Analysis and Modeling," 2007. doi: [10.2514/6.2007-6020](https://doi.org/10.2514/6.2007-6020)

<span id="ref-32"></span>[32] G. F. Dubos, J.-F. Castet, and J. H. Saleh, "Statistical reliability analysis of satellites by mass category: Does spacecraft size matter?," *Acta Astronautica*, vol. 67, no. 5-6, pp. 584-595, 2010. doi: [10.1016/j.actaastro.2010.04.017](https://doi.org/10.1016/j.actaastro.2010.04.017)

<span id="ref-33"></span>[33] G. F. Dubos, J. H. Saleh, and R. Braun, "Technology Readiness Level, Schedule Risk, and Slippage in Spacecraft Design," *Journal of Spacecraft and Rockets*, vol. 45, no. 4, pp. 836-842, 2008. doi: [10.2514/1.34947](https://doi.org/10.2514/1.34947)

<span id="ref-34"></span>[34] F. Ducros and P. Pamphile, "Bayesian estimation of Weibull mixture in heavily censored data setting," *Reliability Engineering and System Safety*, vol. 180, pp. 453-462, 2018. doi: [10.1016/j.ress.2018.08.008](https://doi.org/10.1016/j.ress.2018.08.008)

<span id="ref-35"></span>[35] R. Dunwoody, J. Reilly, D. Murphy, M. Doyle, J. Thompson, and G. Finneran, "Thermal Vacuum Test Campaign of the EIRSAT-1 Engineering Qualification Model," *Aerospace*, vol. 9, no. 2, art. 99, 2022. doi: [10.3390/aerospace9020099](https://doi.org/10.3390/aerospace9020099)

<span id="ref-36"></span>[36] J. Estela, "COTS and the NewSpace," in *Radiation Effects on Integrated Circuits and Systems for Space Applications*, 2019, pp. 271-289. doi: [10.1007/978-3-030-04660-6_13](https://doi.org/10.1007/978-3-030-04660-6_13)

<span id="ref-37"></span>[37] G. Brunetti, "COTS Devices for Space Missions in LEO," *IEEE Access*, vol. 12, 2024. doi: [10.1109/access.2024.3405373](https://doi.org/10.1109/ACCESS.2024.3405373)

<span id="ref-38"></span>[38] S. Greenland, J. Pearl, and J. M. Robins, "Confounding and Collapsibility in Causal Inference," *Statistical Science*, vol. 14, no. 1, pp. 29-46, 1999. doi: [10.1214/ss/1009211805](https://doi.org/10.1214/ss/1009211805)

<span id="ref-39"></span>[39] T. M. Grile and R. A. Bettinger, "Statistical Reliability Estimation for Satellites Operating from 1991-2020 with Payload Reliability Focus," in *Proc. Int. Conf. System Reliability and Safety*, 2022. doi: [10.1109/icsrs56243.2022.10067366](https://doi.org/10.1109/ICSRS56243.2022.10067366)

<span id="ref-40"></span>[40] T. M. Grile, B. N. Wagenblast, and R. A. Bettinger, "Statistical Reliability Estimation of Deep Space Satellites and Launch Vehicles: 1958-2022," *Journal of Spacecraft and Rockets*, vol. 61, no. 4, 2024. doi: [10.2514/1.a35926](https://doi.org/10.2514/1.A35926)

<span id="ref-41"></span>[41] J. Guo, L. Monas, and E. Gill, "Statistical analysis and modelling of small satellite reliability," *Acta Astronautica*, vol. 98, pp. 97-110, 2014. doi: [10.1016/j.actaastro.2014.01.018](https://doi.org/10.1016/j.actaastro.2014.01.018)

<span id="ref-42"></span>[42] J. Hainmueller, "Entropy Balancing for Causal Effects: A Multivariate Reweighting Method to Produce Balanced Samples in Observational Studies," *SSRN Electronic Journal*, 2011. doi: [10.2139/ssrn.1904869](https://doi.org/10.2139/ssrn.1904869)

<span id="ref-43"></span>[43] T. L. Hamlin, B. C. Reistle, and M. A. Stewart, "Large Satellite Bus Reliability," NASA STI Repository, 2018. URL: [http://hdl.handle.net/2060/20180006794](http://hdl.handle.net/2060/20180006794)

<span id="ref-44"></span>[44] S. R. Hirshorn and S. Jefferies, "Final Report of the NASA Technology Readiness Assessment (TRA) Study Team," NASA STI Repository, 2016. URL: [http://hdl.handle.net/2060/20170005794](http://hdl.handle.net/2060/20170005794)

<span id="ref-45"></span>[45] W. Hu and Q. Qian, "Small data reliability analysis in concrete three-point bending tests: A Weibull mixture model approach based on Weibull fracture theory," *Engineering Fracture Mechanics*, vol. 307, art. 110344, 2024. doi: [10.1016/j.engfracmech.2024.110344](https://doi.org/10.1016/j.engfracmech.2024.110344)

<span id="ref-46"></span>[46] M. Y. Huang and C. McCartan, "Relative Bias Under Imperfect Identification in Observational Causal Inference," arXiv preprint, 2025. URL: [https://arxiv.org/abs/2507.23743](https://arxiv.org/abs/2507.23743)

<span id="ref-47"></span>[47] S. M. Iacus, G. King, and G. Porro, "Causal Inference without Balance Checking: Coarsened Exact Matching," *Political Analysis*, vol. 20, no. 1, pp. 1-24, 2011. doi: [10.1093/pan/mpr013](https://doi.org/10.1093/pan/mpr013)

<span id="ref-48"></span>[48] K. Imai and I. S. Kim, "When Should We Use Unit Fixed Effects Regression Models for Causal Inference with Longitudinal Data?," *American Journal of Political Science*, vol. 63, no. 2, pp. 467-490, 2019. doi: [10.1111/ajps.12417](https://doi.org/10.1111/AJPS.12417)

<span id="ref-49"></span>[49] G. W. Imbens and D. B. Rubin, *Causal Inference for Statistics, Social, and Biomedical Sciences: An Introduction*. New York: Cambridge University Press, 2015. doi: [10.1017/cbo9781139025751](https://doi.org/10.1017/cbo9781139025751)

<span id="ref-50"></span>[50] J. Nuttin, "The benefits of hybrid electronic architecture mixing COTS and rad-tolerant components as used in ELOIS payload computer and CSIMBA hyperspectral camera projects," *Proc. SPIE*, 2025. doi: [10.1117/12.3061325](https://doi.org/10.1117/12.3061325)

<span id="ref-51"></span>[51] R. Jiang, M. J. Zuo, and H.-X. Li, "Weibull and inverse Weibull mixture models allowing negative weights," *Reliability Engineering and System Safety*, vol. 66, no. 3, pp. 227-234, 1999. doi: [10.1016/s0951-8320(99)00037-x](https://doi.org/10.1016/s0951-8320(99)00037-x)

<span id="ref-52"></span>[52] S.-J. Kang and H.-U. Oh, "On-Orbit Thermal Design and Validation of 1U Standardized CubeSat of STEP Cube Lab," *International Journal of Aerospace Engineering*, art. 4213189, 2016. doi: [10.1155/2016/4213189](https://doi.org/10.1155/2016/4213189)

<span id="ref-53"></span>[53] G. Karapakula, "Stable Probability Weighting: Large-Sample and Finite-Sample Estimation and Inference Methods for Heterogeneous Causal Effects of Multivalued Treatments Under Limited Overlap," *SSRN Electronic Journal*, 2023. doi: [10.2139/ssrn.4324986](https://doi.org/10.2139/ssrn.4324986)

<span id="ref-54"></span>[54] S. Y. Kim, J.-F. Castet, and J. H. Saleh, "Spacecraft electrical power subsystem: Failure behavior, reliability, and multi-state failure analyses," *Reliability Engineering and System Safety*, vol. 98, no. 1, pp. 55-65, 2012. doi: [10.1016/j.ress.2011.10.005](https://doi.org/10.1016/j.ress.2011.10.005)

<span id="ref-55"></span>[55] L. Kirschenbaum, J. Andrada, L. Chappell, P. Lord, and Y. Renault, "Building Blocks for the Future: TRL 10 and 11 Commercial Spacecraft Avionics," in *Proc. IEEE Aerospace Conf.*, 2020. doi: [10.1109/aero47225.2020.9172456](https://doi.org/10.1109/AERO47225.2020.9172456)

<span id="ref-56"></span>[56] D. B. Koulage, K. Mondal, and D. S. Manerikar, "Reliability Prediction Using Additive Weibull Model," *SAE Technical Paper Series*, 2024. doi: [10.4271/2024-01-5101](https://doi.org/10.4271/2024-01-5101)

<span id="ref-57"></span>[57] D. Selčan, G. Kirbiš, and I. Kramberger, "Nanosatellites in LEO and beyond: Advanced radiation protection techniques for COTS-based spacecraft," *Acta Astronautica*, vol. 132, pp. 343-359, 2016. doi: [10.1016/j.actaastro.2016.11.032](https://doi.org/10.1016/j.actaastro.2016.11.032)

<span id="ref-58"></span>[58] M. Langer, M. Weisgerber, J. Bouwmeester, and A. Hoehn, "A reliability estimation tool for reducing infant mortality in CubeSat missions," in *Proc. IEEE Aerospace Conf.*, 2017. doi: [10.1109/aero.2017.7943598](https://doi.org/10.1109/AERO.2017.7943598)

<span id="ref-59"></span>[59] M. Langer and J. Bouwmeester, "Reliability of CubeSats - Statistical Data, Developers' Beliefs and the Way Forward," in *Proc. 30th AIAA/USU Conference on Small Satellites*, Logan, UT, 2016. URL: [https://digitalcommons.usu.edu/smallsat/2016/TS10AdvTech2/4](https://digitalcommons.usu.edu/smallsat/2016/TS10AdvTech2/4)

<span id="ref-60"></span>[60] J. N. Buitrago-Leiva, I. Terraza Palanca, L. Contreras-Benito, L. Fernandez, G. Gracia-Sola, and C. del Castillo Sancho, "The 3Cat-4 Spacecraft Thermal Analysis and Thermal Vacuum Test Campaign Results," *Aerospace*, vol. 11, no. 10, art. 805, 2024. doi: [10.3390/aerospace11100805](https://doi.org/10.3390/aerospace11100805)

<span id="ref-61"></span>[61] I. Levchenko, K. Bazaka, Y. Ding, Y. Raitses, S. Mazouffre, and T. Henning, "Space micropropulsion systems for CubeSats and small satellites: From proximate targets to furthermost frontiers," *Applied Physics Reviews*, vol. 5, no. 1, art. 011104, 2018. doi: [10.1063/1.5007734](https://doi.org/10.1063/1.5007734)

<span id="ref-62"></span>[62] Ö. Yılmaz, Y. Son, G. Shang, and H. A. Arslan, "Causal inference under selection on observables in operations management research: Matching methods and synthetic controls," *Journal of Operations Management*, vol. 70, no. 4, 2024. doi: [10.1002/joom.1318](https://doi.org/10.1002/joom.1318)

<span id="ref-63"></span>[63] S. O. M. Manda and R. Meyer, "Age at first marriage in Malawi: a Bayesian multilevel analysis using a discrete time-to-event model," *Journal of the Royal Statistical Society Series A*, vol. 168, no. 2, pp. 439-455, 2005. doi: [10.1111/j.1467-985x.2005.00357.x](https://doi.org/10.1111/j.1467-985X.2005.00357.x)

<span id="ref-64"></span>[64] D. F. McCaffrey, B. A. Griffin, D. Almirall, M. E. Slaughter, R. Ramchand, and L. F. Burgette, "A tutorial on propensity score estimation for multiple treatments using generalized boosted models," *Statistics in Medicine*, vol. 32, no. 19, pp. 3388-3414, 2013. doi: [10.1002/sim.5753](https://doi.org/10.1002/sim.5753)

<span id="ref-65"></span>[65] K. B. McCune, C. Williams, N. Dochtermann, H. Schielzeth, and S. Nakagawa, "Repeatability and intraclass correlations from time-to-event data: towards a standardized approach," *Animal Behaviour*, vol. 222, art. 123102, 2025. doi: [10.1016/j.anbehav.2025.123102](https://doi.org/10.1016/j.anbehav.2025.123102)

<span id="ref-66"></span>[66] R. M. Millan, R. von Steiger, M. Ariel, S. Bartalev, M. Borgeaud, and S. Campagnola, "Small satellites for space science," *Advances in Space Research*, vol. 64, no. 8, pp. 1466-1517, 2019. doi: [10.1016/j.asr.2019.07.035](https://doi.org/10.1016/j.asr.2019.07.035)

<span id="ref-67"></span>[67] J. P. Monteiro, R. M. Rocha, A. Ferreira da Silva, R. Afonso, and N. V. Ramos, "Integration and Verification Approach of ISTSat-1 CubeSat," *Aerospace*, vol. 6, no. 12, art. 131, 2019. doi: [10.3390/aerospace6120131](https://doi.org/10.3390/aerospace6120131)

<span id="ref-68"></span>[68] "NASA Electronic Parts and Packaging (NEPP) Program: Innovative EEE Parts Resource for the Future," NASA NTRS, 2018. URL: [https://ntrs.nasa.gov/citations/20180005659](https://ntrs.nasa.gov/citations/20180005659)

<span id="ref-69"></span>[69] K. Nkansah, P. O. Takyi, D. Sakyi, and F. Adusah-Poku, "Economic Integration Agreements and Export Survival in Ghana," *Journal of African Trade*, vol. 9, 2022. doi: [10.1007/s44232-022-00001-z](https://doi.org/10.1007/s44232-022-00001-z)

<span id="ref-70"></span>[70] A. Olechowski, S. D. Eppinger, and N. Joglekar, "Technology Readiness Levels at 40: A Study of State-of-the-Art Use, Challenges, and Opportunities," *SSRN Electronic Journal*, 2015. doi: [10.2139/ssrn.2588524](https://doi.org/10.2139/ssrn.2588524)

<span id="ref-71"></span>[71] M. N. Ott, X. L. Jin, R. F. Chuska, P. R. Friedberg, M. C. Malenab, and A. Matuszeski, "Space flight requirements for fiber optic components: qualification testing and lessons learned," *Proc. SPIE*, 2006. doi: [10.1117/12.669880](https://doi.org/10.1117/12.669880)

<span id="ref-72"></span>[72] J. Pearl, "Causal inference in statistics: An overview," *Statistics Surveys*, vol. 3, pp. 96-146, 2009. doi: [10.1214/09-ss057](https://doi.org/10.1214/09-ss057)

<span id="ref-73"></span>[73] J. Pearl, "An Introduction to Causal Inference," *The International Journal of Biostatistics*, vol. 6, no. 2, 2010. doi: [10.2202/1557-4679.1203](https://doi.org/10.2202/1557-4679.1203)

<span id="ref-74"></span>[74] W. Peng, H. Zhang, H.-Z. Huang, Z. Gong, and Y. Liu, "Satellite reliability modeling with modified Weibull extension distribution," in *Proc. Int. Conf. Quality, Reliability, Risk, Maintenance, and Safety Engineering*, 2012. doi: [10.1109/icqr2mse.2012.6246218](https://doi.org/10.1109/icqr2mse.2012.6246218)

<span id="ref-75"></span>[75] C. Nieto-Peroy and M. R. Emami, "CubeSat Mission: From Design to Operation," *Applied Sciences*, vol. 9, no. 15, art. 3110, 2019. doi: [10.3390/app9153110](https://doi.org/10.3390/app9153110)

<span id="ref-76"></span>[76] R. P. Perumal, H. Voos, F. Dalla Vedova, and H. Moser, "Statistical Analysis of Small Satellite Reliability: 1990-2019," in *Proc. AIAA Propulsion and Energy 2021 Forum*, 2021. doi: [10.2514/6.2021-3688](https://doi.org/10.2514/6.2021-3688)

<span id="ref-77"></span>[77] J. P. Poletto, "An Alternative to the Exponential and Weibull Reliability Models," *IEEE Access*, vol. 10, 2022. doi: [10.1109/access.2022.3219426](https://doi.org/10.1109/ACCESS.2022.3219426)

<span id="ref-78"></span>[78] "Potential Outcomes Causal Model," in *Causal Inference*, 2021. doi: [10.2307/j.ctv1c29t27.7](https://doi.org/10.2307/j.ctv1c29t27.7)

<span id="ref-79"></span>[79] S. J. Powell, J. P. Klein, and P. Goel, "Survival Analysis: State of the Art," *Journal of the Royal Statistical Society Series D (The Statistician)*, 1994. doi: [10.2307/2348153](https://doi.org/10.2307/2348153)

<span id="ref-80"></span>[80] R. Carpentiero, "Irradiation Testing of Electronic Space Components in the Framework of ASIF Infrastructure," in *Proc. IEEE Int. Workshop on Metrology for Aerospace (MetroAeroSpace)*, 2025. doi: [10.1109/metroaerospace64938.2025.11114678](https://doi.org/10.1109/MetroAeroSpace64938.2025.11114678)

<span id="ref-81"></span>[81] "Radiation Effects and COTS Parts in SmallSats," *SPIE*, 2013. doi: [10.1117/12.2231304](https://doi.org/10.1117/12.2231304)

<span id="ref-82"></span>[82] "Radiation Hardness Assurance (RHA) Guideline," NASA NTRS, 2016. URL: [https://ntrs.nasa.gov/citations/20160009305](https://ntrs.nasa.gov/citations/20160009305)

<span id="ref-83"></span>[83] J. Robins, A. Rotnitzky, and D. Scharfstein, "Sensitivity Analysis for Selection bias and unmeasured Confounding in missing Data and Causal inference models," in *Statistical Models in Epidemiology, the Environment, and Clinical Trials*, 2000. doi: [10.1007/978-1-4612-1284-3_1](https://doi.org/10.1007/978-1-4612-1284-3_1)

<span id="ref-84"></span>[84] S. Roffe and A. George, "Evaluation of Algorithm-Based Fault Tolerance for Machine Learning and Computer Vision under Neutron Radiation," in *Proc. IEEE Aerospace Conf.*, 2020. doi: [10.1109/aero47225.2020.9172799](https://doi.org/10.1109/AERO47225.2020.9172799)

<span id="ref-85"></span>[85] P. R. Rosenbaum and D. B. Rubin, "The central role of the propensity score in observational studies for causal effects," *Biometrika*, vol. 70, no. 1, pp. 41-55, 1983. doi: [10.1093/biomet/70.1.41](https://doi.org/10.1093/biomet/70.1.41)

<span id="ref-86"></span>[86] M. Rousselet, P. C. Adell, D. J. Sheldon, J. Boch, H. Schone, and F. Saigne, "Use and benefits of COTS board level testing for radiation hardness assurance," in *Proc. 16th European Conf. Radiation and Its Effects on Components and Systems (RADECS)*, 2016. doi: [10.1109/radecs.2016.8093122](https://doi.org/10.1109/radecs.2016.8093122)

<span id="ref-87"></span>[87] O. Gutiérrez, M. Prieto, Á. Perales-Eceiza, A. Ravanbakhsh, M. Basile, and D. Guzmán, "Toward the Use of Electronic Commercial Off-the-Shelf Devices in Space: Assessment of the True Radiation Environment in Low Earth Orbit (LEO)," *Electronics*, vol. 12, no. 19, art. 4058, 2023. doi: [10.3390/electronics12194058](https://doi.org/10.3390/electronics12194058)

<span id="ref-88"></span>[88] D. B. Rubin, "Bayesian Inference for Causal Effects: The Role of Randomization," *Annals of Statistics*, vol. 6, no. 1, pp. 34-58, 1978. doi: [10.1214/aos/1176344064](https://doi.org/10.1214/aos/1176344064)

<span id="ref-89"></span>[89] D. B. Rubin, "Estimating Causal Effects from Large Data Sets Using Propensity Scores," *Annals of Internal Medicine*, vol. 127, no. 8, pp. 757-763, 1997. doi: [10.7326/0003-4819-127-8_part_2-199710151-00064](https://doi.org/10.7326/0003-4819-127-8_part_2-199710151-00064)

<span id="ref-90"></span>[90] D. B. Rubin, "Causal Inference Using Potential Outcomes," *Journal of the American Statistical Association*, vol. 100, no. 469, pp. 322-331, 2005. doi: [10.1198/016214504000001880](https://doi.org/10.1198/016214504000001880)

<span id="ref-91"></span>[91] D. B. Rubin, "Causal Inference Through Potential Outcomes and Principal Stratification: Application to Studies with Censoring Due to Death," *Statistical Science*, vol. 21, no. 3, 2006. doi: [10.1214/088342306000000114](https://doi.org/10.1214/088342306000000114)

<span id="ref-92"></span>[92] D. B. Rubin, "The design versus the analysis of observational studies for causal effects: parallels with the design of randomized trials," *Statistics in Medicine*, vol. 26, no. 1, pp. 20-36, 2006. doi: [10.1002/sim.2739](https://doi.org/10.1002/sim.2739)

<span id="ref-93"></span>[93] D. B. Rubin, "For objective causal inference, design trumps analysis," *Annals of Applied Statistics*, vol. 2, no. 3, pp. 808-840, 2008. doi: [10.1214/08-aoas187](https://doi.org/10.1214/08-aoas187)

<span id="ref-94"></span>[94] Y. Sadraoui, M. Er-ratby, M. S. Kadiri, and A. Kobi, "Improving wind turbine reliability through the analysis of critical component failures, parametric modelling, and maintenance optimization," *Wind Engineering*, 2025. doi: [10.1177/0309524x251386356](https://doi.org/10.1177/0309524X251386356)

<span id="ref-95"></span>[95] J. H. Saleh and J.-F. Castet, "Health scorecard of spacecraft platforms: Track record of on-orbit anomalies and failures," *Acta Astronautica*, vol. 68, no. 7-8, pp. 1153-1166, 2011. doi: [10.1016/j.actaastro.2010.08.006](https://doi.org/10.1016/j.actaastro.2010.08.006)

<span id="ref-96"></span>[96] P. Scott, "Causal Inference Methods for Selection on Observed and Unobserved Factors: Propensity Score Matching, Heckit Models, and Instrumental Variable Estimation," 2019. doi: [10.7275/7tgr-xt91](https://doi.org/10.7275/7tgr-xt91)

<span id="ref-97"></span>[97] W. S. Slater, B. Rutherford, J. Mee, R. Pinson, M. Gruber, and D. Sabogal, "Single Event Effects and Total Ionizing Dose Radiation Testing of NVIDIA Jetson Orin AGX System on Module," in *Proc. Radiation Effects Data Workshop*, 2023. doi: [10.1109/redw61050.2023.10265818](https://doi.org/10.1109/REDW61050.2023.10265818)

<span id="ref-98"></span>[98] "Spacecraft Subsystem Reliability," in *Spacecraft Reliability and Multi-State Failures*, ch. 5, 2011. doi: [10.1002/9781119994077.ch5](https://doi.org/10.1002/9781119994077.ch5)

<span id="ref-99"></span>[99] E. A. Stuart, "Matching Methods for Causal Inference: A Review and a Look Forward," *Statistical Science*, vol. 25, no. 1, pp. 1-21, 2010. doi: [10.1214/09-sts313](https://doi.org/10.1214/09-sts313)

<span id="ref-100"></span>[100] M. Tafazoli, "A study of on-orbit spacecraft failures," *Acta Astronautica*, vol. 64, no. 2-3, pp. 195-205, 2009. doi: [10.1016/j.actaastro.2008.07.019](https://doi.org/10.1016/j.actaastro.2008.07.019)

<span id="ref-101"></span>[101] C.-Y. Tai and T.-H. Fan, "Reliability Inference in GLFP Models Based on EM Algorithm With Related Application," *Applied Stochastic Models in Business and Industry*, 2025. doi: [10.1002/asmb.70030](https://doi.org/10.1002/asmb.70030)

<span id="ref-102"></span>[102] "Statistical Modeling and Analysis of Satellite Failure Based on 2-Weibull Segmented Model," *IEEE Access*, vol. 9, pp. 126280-126293, 2021. doi: [10.1109/access.2021.3113155](https://doi.org/10.1109/access.2021.3113155)

<span id="ref-103"></span>[103] J. P. Vandenbroucke, E. von Elm, D. G. Altman, P. C. Gøtzsche, C. D. Mulrow, and S. Pocock, "Strengthening the Reporting of Observational Studies in Epidemiology (STROBE): Explanation and Elaboration," *PLoS Medicine*, vol. 4, no. 10, art. e297, 2007. doi: [10.1371/journal.pmed.0040297](https://doi.org/10.1371/journal.pmed.0040297)

<span id="ref-104"></span>[104] B. Veber, M. Nagode, and M. Fajdiga, "Generalized renewal process for repairable systems based on finite Weibull mixture," *Reliability Engineering and System Safety*, vol. 93, no. 10, pp. 1461-1472, 2008. doi: [10.1016/j.ress.2007.10.003](https://doi.org/10.1016/j.ress.2007.10.003)

<span id="ref-105"></span>[105] C. C. Venturini, B. Braun, D. Hinkley, and G. Berg, "Improving Mission Success of CubeSats," in *Proc. AIAA/USU Conference on Small Satellites*, 2018. URL: [https://digitalcommons.usu.edu/smallsat/2018/all2018/273](https://digitalcommons.usu.edu/smallsat/2018/all2018/273)

<span id="ref-106"></span>[106] P. Villa, E. Bezerra, R. Goerl, L. Poehls, F. Vargas, and N. Medina, "Analysis of COTS FPGA SEU-sensitivity to combined effects of conducted-EMI and TID," in *Proc. Int. Workshop on Electromagnetic Compatibility of Integrated Circuits*, 2017. doi: [10.1109/emccompo.2017.7998076](https://doi.org/10.1109/EMCCOMPO.2017.7998076)

<span id="ref-107"></span>[107] A. Viquerat, M. Schenk, V. Lappas, and B. Sanders, "Functional and Qualification Testing of the InflateSail Technology Demonstrator," 2015. doi: [10.2514/6.2015-1627](https://doi.org/10.2514/6.2015-1627)

<span id="ref-108"></span>[108] J. K. Wayer, J.-F. Castet, and J. H. Saleh, "Spacecraft attitude control subsystem: Reliability, multi-state analyses, and comparative failure behavior in LEO and GEO," *Acta Astronautica*, vol. 85, pp. 73-82, 2013. doi: [10.1016/j.actaastro.2012.12.003](https://doi.org/10.1016/j.actaastro.2012.12.003)

<span id="ref-109"></span>[109] "Why Space is Unique? The Basic Environment Challenges for EEE Parts," NASA NTRS, 2014. URL: [https://ntrs.nasa.gov/citations/20150001281](https://ntrs.nasa.gov/citations/20150001281)

<span id="ref-110"></span>[110] P. S. Winokur and D. M. Fleetwood, "Total-dose radiation hardness assurance for space electronics," *AIP Conference Proceedings*, 1991. doi: [10.1063/1.40097](https://doi.org/10.1063/1.40097)

<span id="ref-111"></span>[111] B. Witcher, L. Leslie, J. Ferrell, J. Yeager, and C. Rutledge, "Radiation Hardness Assurance for a NewSpace DC-DC Converter," in *Proc. European Conf. Radiation and Its Effects on Components and Systems (RADECS)*, 2024. doi: [10.1109/radecs61970.2024.11298567](https://doi.org/10.1109/RADECS61970.2024.11298567)

<span id="ref-112"></span>[112] K. Wong, Y. Lu, W. Ip, W. Zhang, and Z. Sun, "Bridging Weibull Failure Models and CTMC Verification: Automated Phase-Type Encoding for Satellite Reliability Analysis in PRISM," *IEEE Transactions on Aerospace and Electronic Systems*, 2026. doi: [10.1109/taes.2026.3665850](https://doi.org/10.1109/TAES.2026.3665850)

<span id="ref-113"></span>[113] K. Xu, M. P. Brito, C. Yound, M. K. S. Al-Mhdawi, N. Dacre, and D. Baxter, "Statistical Analysis and Modeling of Small Satellite Reliability," *SSRN Electronic Journal*, 2024. doi: [10.2139/ssrn.5015943](https://doi.org/10.2139/ssrn.5015943)

<span id="ref-114"></span>[114] Z. Yilin, "A Study of Influence of Technology Readiness Level on Spacecraft Development Schedule," *Spacecraft Engineering*, 2009. URL: [https://en.cnki.com.cn/Article_en/CJFDTOTAL-HTGC200902004.htm](https://en.cnki.com.cn/Article_en/CJFDTOTAL-HTGC200902004.htm)

<span id="ref-115"></span>[115] Y. Zhao, X. Yang, Y. Liu, Y. Liu, and Y. Xu, "Construction of Space Environmental Warning Model for ESD Anomalies in High Orbit Spacecraft," in *Proc. 10th Int. Symp. System Security, Safety, and Reliability (ISSSR)*, 2024. doi: [10.1109/isssr61934.2024.00023](https://doi.org/10.1109/ISSSR61934.2024.00023)

<span id="ref-116"></span>[116] X.-D. Zhou, Y. Wang, and R. Yue, "Optimal designs for discrete-time survival models with random effects," *Lifetime Data Analysis*, vol. 27, pp. 300-332, 2021. doi: [10.1007/s10985-020-09512-2](https://doi.org/10.1007/s10985-020-09512-2)

# Appendices

## Appendix A: Variable and Data Dictionary

This appendix fixes the operational definition of every variable named in the FIXED bible (Section 3 of the prospectus and the expansion-plan bible block), so that two analysts working independently would construct the same dataset. The dictionary is the contract between the specification and the data; it is frozen before any outcome is examined, in keeping with the Rubin design-before-analysis discipline [\[93\]](#ref-93)[\[92\]](#ref-92).

**Unit of analysis.** The record is the mission-by-subsystem cell. For each spacecraft in the assembled population, each functional subsystem is one row: attitude control (ACS), command and data handling (C&DH), electrical power (EPS), propulsion, thermal, telecommunications, and payload instrument. A spacecraft with seven represented subsystems contributes seven rows. The choice of cell rather than spacecraft follows directly from the descriptive finding that failure behavior is subsystem-specific and that aggregating to the bus discards the variation distinguishing the hypotheses [\[20\]](#ref-20)[\[95\]](#ref-95)[\[54\]](#ref-54)[\[108\]](#ref-108).

**Outcome 1, time-to-first-failure.** Days elapsed from on-orbit commissioning (not launch, to exclude launch and early-orbit-phase events that confound delivered-article reliability with deployment risk) to the first recorded anomaly meeting the failure-severity threshold defined below. The variable is right-censored at end of mission or end of the observation window, whichever is earlier, with the censoring indicator recorded per cell. The Cox-type and parametric survival models in Appendix B consume this pair (time, censoring indicator) directly [\[9\]](#ref-9)[\[79\]](#ref-79).

**Outcome 2, infant-mortality indicator.** A binary variable equal to one if a failure-severity anomaly occurs within a fixed early window after commissioning, zero otherwise. The window boundary is not chosen ad hoc; it is set at the inflection between the early and late subpopulations of the mixture-Weibull reliability fit reported in the descriptive literature [\[21\]](#ref-21)[\[77\]](#ref-77)[\[101\]](#ref-101), so the operationalization of "infant" is inherited from the empirical hazard shape rather than imposed. The general-limited-failure-population framing [\[101\]](#ref-101) supplies the conceptual justification: a defective subpopulation fails early from latent defects, a non-defective subpopulation fails late from wear-out, and the early window is the region where the defective subpopulation dominates.

**Failure-severity threshold.** An anomaly qualifies as a failure if it produces loss of a subsystem function, a permanent reduction in subsystem capability, or a switch to redundant hardware that is not recoverable by routine operations. Transient anomalies cleared by reset without capability loss are recorded but excluded from the outcome, a deliberate exclusion that biases the outcome toward reliability-relevant events and is acceptable because the hypotheses concern delivered reliability, not nuisance events. Root-cause class (parts, design, integration, environment, operations) is coded alongside severity; operations-caused and environment-caused events are retained but flagged so that sensitivity to their inclusion can be tested, since the hypotheses concern article-intrinsic reliability rather than operator error or external insult [\[95\]](#ref-95)[\[23\]](#ref-23)[\[115\]](#ref-115).

**Heritage depth (ordinal regressor, \( \beta_1 \)).** Four ordered levels: 0 = no heritage; 1 = design heritage only (block diagram or algorithm flown, physical article newly fabricated); 2 = design plus build heritage (same drawings, comparable process, often same supplier); 3 = design plus build plus same-environment flight heritage (an article identical in design, build, and parts has operated successfully in the orbit and radiation environment the new mission imposes). The "same-environment" qualifier at level 3 is coded against the prior-flight orbit class and radiation environment, because heritage to a different environment is exactly the case the alternative hypothesis predicts will fail to deliver reliability [\[55\]](#ref-55)[\[1\]](#ref-1)[\[113\]](#ref-113). Coding is from JPL heritage-assessment matrices as claimed at design review, never recoded after an observed outcome, which guards against the reverse-documentation threat.

**EEE parts-class (ordinal regressor, \( \beta_2 \)).** The dominant class of the subsystem's electrical, electronic, and electromechanical parts on the standard space hierarchy: high-reliability (class S or equivalent) > class B > commercial or COTS, with a screening-level subindicator (full screening, partial screening, none). Where a subsystem mixes classes, the dominant-class rule is primary, and worst-case-class and parts-count-weighted-class alternatives are constructed in parallel so the conclusion can be checked against the coding choice. The parts-class construct and its reliability relevance are grounded in the radiation-hardness-assurance and COTS literature [\[12\]](#ref-12)[\[81\]](#ref-81)[\[111\]](#ref-111)[\[97\]](#ref-97)[\[10\]](#ref-10)[\[86\]](#ref-86)[\[36\]](#ref-36)[\[87\]](#ref-87)[\[110\]](#ref-110)[\[68\]](#ref-68)[\[109\]](#ref-109)[\[37\]](#ref-37).

**Test-program fidelity (index regressor, \( \beta_3 \)).** A standardized index built from the integration-and-test plan and as-run records, summing graded contributions from: thermal-vacuum cycling (presence, cycle count, dwell duration) [\[35\]](#ref-35)[\[60\]](#ref-60)[\[52\]](#ref-52), vibration and acoustic qualification [\[107\]](#ref-107), parts-level screening and burn-in, and system-level functional-test coverage [\[71\]](#ref-71)[\[67\]](#ref-67). The index is constructed before outcomes are examined and uses only planned-and-as-run scope, never the pass-or-fail verdict of the campaign, because conditioning on the verdict would be a bad control: the verdict is downstream of heritage, parts, and test-fidelity itself [\[5\]](#ref-5).

**Controls.** Mission environment (orbit class and radiation environment); mission prominence (flagship, competed-line, smaller class, a proxy for review intensity and budget); spacecraft mass class [\[32\]](#ref-32); and launch epoch, entered to absorb secular technology change in both parts norms and heritage practice [\[12\]](#ref-12)[\[81\]](#ref-81). All regressors of interest are standardized to a common scale before estimation so that \( \beta_1 \), \( \beta_2 \), and \( \beta_3 \) are directly comparable in magnitude, which is what the falsification rule requires.

## Appendix B: Derivation of the Estimators

This appendix derives the two estimators from the FIXED notation, so the link from the proportional-hazards form to the discrete-time companion is explicit rather than asserted. The notation is carried verbatim from the bible.

**Continuous-time survival model.** For subsystem cell i in mission m at on-orbit time t, the hazard of first failure is written in proportional-hazards form:

\[ \log h(t) = \log h_0(t) + \beta_1 \text{Heritage}_i + \beta_2 \text{PartsClass}_i + \beta_3 \text{TestFidelity}_i + \gamma \text{Controls}_{im} + u_s \qquad\qquad (9) \]

Here \( h_0(t) \) is a flexible baseline hazard, specified as piecewise-constant over intervals or as a two-component Weibull mixture consistent with the documented early-and-late failure regimes [\[21\]](#ref-21)[\[77\]](#ref-77)[\[51\]](#ref-51)[\[6\]](#ref-6)[\[34\]](#ref-34)[\[104\]](#ref-104); \( u_s \) is a Gaussian random intercept for subsystem type s, which absorbs the subsystem-specific baseline hazard the descriptive literature established [\[20\]](#ref-20)[\[95\]](#ref-95)[\[54\]](#ref-54)[\[108\]](#ref-108); and Controls collects environment, prominence, mass class, and epoch. The random intercept makes this a mixed-effects (frailty) survival model; the estimation and interpretation follow the multilevel survival treatment of Austin [\[9\]](#ref-9) and the random-effects-in-Cox treatment of McCune and colleagues [\[65\]](#ref-65). The survivor function for cell i is the standard exponential-of-negative-cumulative-hazard, integrated over the flexible baseline, and the likelihood is the product over cells of the hazard-at-failure-time raised to the event indicator times the survivor function, marginalized over the Gaussian frailty.

**Discrete-time companion.** The continuous model is recast in discrete time by partitioning on-orbit time into periods and forming one record per cell-period at risk. The hazard in period k is modeled with a complementary-log-log link:

\[ \operatorname{cloglog}\!\left( \Pr(\text{fail in period } k \mid \text{survived to } k) \right) = \alpha_k + \beta_1 \text{Heritage}_i + \beta_2 \text{PartsClass}_i + \beta_3 \text{TestFidelity}_i + \gamma \text{Controls}_{im} + u_s \qquad\qquad (10) \]

where \( \alpha_k \) are period-specific intercepts replacing the continuous baseline. The complementary-log-log link is chosen because it makes the discrete-time coefficients coincide with the continuous-time proportional-hazards coefficients in the limit of fine partitioning, so the two specifications estimate the same b parameters and can be reported side by side; the discrete-time-with-random-effects design follows Zhou and colleagues [\[116\]](#ref-116) and the applied discrete-time hazard literature [\[69\]](#ref-69)[\[63\]](#ref-63). The early-window periods map directly onto the infant-mortality outcome, which is why the discrete-time companion is the natural estimator for Outcome 2.

**The nested comparison.** The head-to-head test is implemented as two fits. Model A estimates the index with \( \beta_1 \) and the controls only. Model B adds \( \beta_2 \) and \( \beta_3 \). The objects of inference are the change in \( \beta_1 \) from A to B and the magnitudes of \( \beta_2 \) and \( \beta_3 \) in B. Under H1, \( |\beta_1| \) collapses toward zero with a confidence interval covering negligible effect once \( \beta_2 \) and \( \beta_3 \) enter, while \( |\beta_2| \) and \( |\beta_3| \) dominate; under H0, \( |\beta_1| \) remains the largest standardized coefficient with an interval excluding negligible effect. Because the regressors are standardized, the magnitude comparison is well posed. This nested-model logic is the design-based implementation of the selection-on-observables identification argument [\[5\]](#ref-5)[\[85\]](#ref-85)[\[62\]](#ref-62)[\[48\]](#ref-48).

## Appendix C: Documentation-Probability (Inverse-Probability-Weighting) Model

Survivorship is the first-order data threat: missions and subsystems that failed before producing complete documentation are underrepresented, and a heritage claim quietly dropped after an early failure may never be archived as heritage. This appendix specifies the correction, which is built into the design rather than noted as a caveat [\[93\]](#ref-93)[\[92\]](#ref-92)[\[83\]](#ref-83).

The sampling frame is constructed from launch manifests, not from surviving-mission documentation, so early-failed and short-lived missions enter the frame even when their internal records are thin. For each cell that enters the frame, a documentation-probability model estimates the probability that the cell carries complete heritage and parts documentation, as a logistic regression on observed mission characteristics (prominence, epoch, mass class, orbit class, and subsystem type). Cells are then weighted by the inverse of that fitted probability, so under-documented and disproportionately early-failed cells are upweighted rather than silently dropped. The estimator and its standard errors are adjusted for the weights, and the weight distribution is reported with attention to extreme weights under limited overlap, for which the stable-probability-weighting alternative to ordinary inverse-probability weighting is held in reserve [\[53\]](#ref-53)[\[46\]](#ref-46). A bounded sensitivity analysis then varies the assumed failure behavior of the undocumented cells across plausible extremes and reports how the heritage-versus-parts comparison moves, so the reader sees the full range of conclusions consistent with the missing data; the sensitivity construction follows the selection-bias and unmeasured-confounding sensitivity tradition [\[83\]](#ref-83)[\[46\]](#ref-46). This three-step correction (manifest-based frame, inverse-probability-of-documentation weighting, bounded sensitivity) is the operational answer to the survivorship objection.

## Appendix D: Pre-Registration Block (Frozen Specification)

This appendix freezes, in one place, the specification that the analysis chapters commit to in advance, so that no construction decision can be made after seeing outcomes. It reproduces the FIXED elements of the bible as the binding pre-registration.

The hypotheses are fixed verbatim: H0 holds that prior-flight heritage depth is the primary driver of delivered reliability and that parts-class and test-fidelity add little once heritage is included; H1 holds that parts-class and test-fidelity dominate the heritage coefficient in magnitude and robustness and that heritage adds little incremental predictive power once they enter. The control set is fixed at environment, prominence, mass class, and epoch. The estimators are fixed at the mixed-effects survival model for Outcome 1 and the complementary-log-log discrete-time model for Outcome 2, each with subsystem random effects and mission-clustered standard errors. The identification strategy is fixed at selection-on-observables with an overlap restriction and the bad-controls prohibition (no conditioning on post-design test verdicts or any post-treatment variable) [\[5\]](#ref-5)[\[85\]](#ref-85)[\[47\]](#ref-47). The falsification rule is fixed: H1 is supported if, across both outcomes and within the survivorship sensitivity bounds, standardized \( |\beta_2| \) and \( |\beta_3| \) exceed standardized \( |\beta_1| \) and \( \beta_1 \)'s interval includes negligible effect in Model B; H0 (contribution falsified) if \( \beta_1 \) remains the largest standardized coefficient with an interval excluding negligible effect after \( \beta_2 \) and \( \beta_3 \) enter. Three robustness re-codings are pre-specified: a stricter heritage measure requiring same-environment flight for the top category; a re-run excluding the payload-instrument subsystem; and a finer-epoch-dummy replacement for the linear epoch control. Fixing all of this before estimation is the design discipline that distinguishes a confirmatory test from a fishing expedition [\[93\]](#ref-93)[\[92\]](#ref-92)[\[103\]](#ref-103).

## Appendix E: Minimum-Detectable-Difference Power Tables (Illustrative)

Power is bounded by the modest number of well-documented JPL-class missions, and the design reports this limit rather than assuming it away. The relevant quantity is not the power to detect a single effect but the minimum detectable difference between the standardized heritage coefficient and the standardized parts-class or test-fidelity coefficient, given the assembled number of mission-by-subsystem cells, the within-mission clustering, and the censoring rate. Table E.1 reports illustrative minimum detectable differences (clearly labeled as design-stage planning quantities, not measured results) across candidate sample sizes, so the falsification rule can be read against the achievable resolution. The construction follows the discrete-time-survival-design optimality treatment [\[116\]](#ref-116) and the multilevel-survival framework [\[9\]](#ref-9).

**Table E.1. Illustrative minimum detectable standardized coefficient difference (design-stage planning values, not executed).**

| Well-documented missions | Approx. mission-by-subsystem cells | Design effect (clustering) | Illustrative MDD (standardized) |
|---|---|---|---|
| 40 | ~260 | 1.6 | ~0.42 |
| 80 | ~520 | 1.6 | ~0.30 |
| 120 | ~780 | 1.6 | ~0.24 |
| 200 | ~1,300 | 1.6 | ~0.19 |

The values are illustrative planning figures derived from nominal assumptions about the censoring rate and the intra-mission correlation absorbed by the subsystem random effects; they are not estimates from the assembled dataset. Their role is to make the honest-non-result interpretation explicit: if the assembled sample cannot resolve a difference between coefficient magnitudes at the achieved size, the correct report is that the test is underpowered on this population, not that H0 is confirmed [\[93\]](#ref-93)[\[92\]](#ref-92).

## Appendix F: Source-Provenance Log for the Corpus

Transparency about which literatures were swept, at what tier, and from which source is a standing requirement. The corpus comprises 130 entries: 18 seed references carried from the prospectus and 112 swept entries. Vault APIs queried and responding were OpenAlex, Crossref, NASA NTRS, Semantic Scholar, and Scopus/Elsevier, with arXiv partially available; IEEE Xplore (403, not entitled) and Springer Metadata (401, authentication) were unavailable during the sweep and the engineering-systems coverage they would have supplied was recovered through OpenAlex, Scopus, Semantic Scholar, and the local ACTA brain, so the gap is covered rather than blocking. Local brains queried were the ACTA_Papers FTS5 index (on-topic reliability, radiation, and test hits), the AMOS_Papers FTS5 index (weaker on subsystem reliability, retained for on-topic fault and anomaly hits), and the Hall of Shoulders anchor dossiers for Angrist-Pischke and Rubin, whose real-DOI entries were confirmed against the published record. Of the 130 entries, 116 carry a DOI and 14 are URL-only (NASA NTRS citation handles, arXiv identifiers, USU DigitalCommons permalinks, NASA HDL handles, and AMOS conference permalinks, all resolvable). Entries are graded A (108, peer-reviewed archival), B (16, conference or working paper), and C (6, grey or non-English-resolvable), and every entry is mapped to at least one chapter theme. The three JPL-internal archival sources the data design depends on (the Lessons Learned Information System and problem-reporting records for outcomes, and the JPL heritage-assessment matrices and parts-control records for the heritage and parts-class constructs) are not open literature and therefore carry no DOI; Chapter 4 documents their access and provenance rather than citing them, and they appear here as a data-access dependency, not a bibliographic entry.