# Does Flight Heritage Buy Reliability? A Cross-Mission Regression of Realized On-Orbit Failure Rates Against Heritage and Parts-Class

**Candidate:** JPL_MGMT_SMA_TECH_04
**Program:** COLLEGIUM 1st Battalion
**North Star / JPL category:** Safety, Mission Assurance and Health
**Date:** 2026-06-15

---

## Abstract

Flight heritage is one of the most frequently invoked justifications in spacecraft design reviews. A subsystem or component that has flown before is widely assumed to carry lower delivered risk, and heritage claims routinely shape architecture decisions, parts selection, and the scope of the qualification and acceptance test program. The empirical basis for this assumption is weaker than the rhetorical weight placed on it. Published statistical reliability work on satellites shows that infant mortality and subsystem-level anomalies remain substantial across populations that include heritage-rich designs, and that reliability varies by orbit, mass class, and subsystem in ways heritage alone does not explain. This dissertation proposes a cross-mission regression of realized on-orbit subsystem failure outcomes against three competing drivers: claimed flight heritage depth, electrical, electronic, and electromechanical (EEE) parts class, and integration and test program fidelity, with controls for mission environment, mission prominence, and survivorship.

The falsifiable contribution is stated as a head-to-head test. The null hypothesis (H0) holds that prior-flight heritage is the primary driver of delivered reliability for JPL-class spacecraft. The alternative (H1) holds that realized failure rate is predicted more strongly by parts-class and test-program fidelity than by claimed heritage once confounders are controlled. The design uses a discrete-time and continuous-time survival specification with subsystem random effects, estimated on NASA anomaly and lessons-learned records, NTRS reliability and parts-stress reports, and JPL mission archives that document heritage and parts-class per subsystem. The methodological frame follows the design-based econometrics of Angrist and Pischke and the potential-outcomes and observational-design discipline of Rubin, with explicit attention to selection on observables, bad controls, and survivorship correction. This document is a design-stage analysis plan. Results are presented as expected directions and illustrative magnitudes, clearly labeled as not yet executed on the full assembled dataset. The contribution is the pre-registered specification and the falsification conditions, not estimated coefficients.

---

## 1. Introduction and Contribution

### 1.1 The problem

Spacecraft mission assurance allocates scarce review attention, test budget, and parts-procurement money under deadline and cost pressure. One lever reviewers reach for repeatedly is flight heritage. When a subsystem, box, or component is described as heritage, the implicit argument is that prior on-orbit operation has already retired the risk that fresh design would carry, and that the qualification and acceptance program can therefore be reduced in scope. Heritage is treated, in practice, as a substitute for test fidelity and sometimes for parts-class rigor.

The difficulty is that heritage is a claim about provenance, not a measured property of the delivered article. A heritage label can attach to a design that was rebuilt with different parts lots, modified for a new thermal or radiation environment, integrated by a different team, or subjected to a thinner test campaign than the original. The phrase "same as before" can be true at the level of a block diagram and false at the level of the parts list and the test matrix. If realized reliability is in fact governed by what is inside the box (parts-class) and by how thoroughly the box was exercised before launch (test fidelity), then heritage labeling may be capturing those things only loosely, and may in some cases license the very reductions in parts rigor and test scope that drive failures.

### 1.2 The gap in the literature

The published statistical reliability literature on satellites is mature on description and thin on causal attribution. Castet and Saleh built nonparametric and parametric reliability functions for satellites and satellite subsystems from on-orbit failure data, established that single-Weibull fits are often inadequate and that mixture models capture an early infant-mortality regime followed by a wear-out regime, and extended the analysis to multi-state degradation and to mass and orbit categories [1][2][3][6]. Tafazoli reviewed on-orbit spacecraft failures and located a large share in a small number of subsystems [4]. Saleh and collaborators produced a health scorecard of platform anomalies and failures by subsystem [5]. Dubos, Saleh, and colleagues connected technology readiness level, schedule risk, and slippage, which speaks directly to the maturity-versus-novelty tradeoff that heritage claims invoke [7]. More recent work has extended reliability modeling to deep-space satellites, to two-Weibull segmented populations, and to the reliability of small satellites and COTS-based designs [8][9][10][11][12].

What this body of work does not do is isolate the contribution of claimed heritage from the contribution of parts-class and test-program fidelity, holding mission environment and prominence fixed, on a population that includes JPL-class deep-space and science missions. The descriptive reliability curves do not tell a project whether the next heritage claim is buying delivered reliability or merely buying a justification to cut test scope. That is the gap this dissertation targets.

### 1.3 The single falsifiable contribution

The contribution is one head-to-head comparison of predictors, stated so it can be falsified.

- **H0 (null):** Prior-flight heritage depth is the primary driver of delivered on-orbit reliability for JPL-class spacecraft. After conditioning on observed confounders, heritage depth carries the largest and most robust association with reduced subsystem failure hazard, and parts-class and test-program fidelity add little once heritage is included.
- **H1 (alternative):** Realized subsystem failure rate is predicted more strongly by EEE parts-class and integration-test fidelity than by claimed heritage depth. After conditioning on the same confounders, the parts-class and test-fidelity coefficients dominate the heritage coefficient in magnitude and robustness, and heritage adds little incremental predictive power once parts-class and test-fidelity are included.

The test is decided by the relative strength and stability of the heritage coefficient against the parts-class and test-fidelity coefficients in a specification that controls for mission environment, mission prominence, and survivorship, with subsystem random effects. The contribution is falsified in the direction of H0 if heritage depth retains the dominant, stable association after parts-class and test-fidelity enter the model.

### 1.4 What "heritage" actually denotes

Heritage is not one thing, and the imprecision is part of the problem this dissertation isolates. At least four distinct claims travel under the single word. The weakest is design heritage: the block diagram, the functional architecture, or the algorithm has flown before, but the physical article is newly fabricated. Next is build heritage: the article was manufactured to the same drawings, by a comparable process, often by the same supplier, so the workmanship is presumed equivalent. Stronger still is parts heritage: the same EEE parts, from the same qualified lots or at least the same class, populate the new build, so the intrinsic defect rate is presumed equivalent. The strongest, and the only one that actually retires environmental risk, is same-environment flight heritage: the article, or an article identical to it in design, build, and parts, has already operated successfully in the orbit and radiation environment the new mission will impose.

These are not interchangeable, and a review board that hears "heritage" without disambiguation cannot tell which claim is being made. The decision-relevant failure mode is the substitution of a weaker heritage claim for a stronger one: a design-heritage box flown to a new environment is treated as if it carried same-environment flight heritage, and its qualification and acceptance program is reduced accordingly. The variable construction in Section 3 codes heritage as an ordinal depth precisely so that the regression can distinguish these claims rather than collapsing them, and the falsification test in Section 5 turns on whether the depth that matters for delivered reliability is heritage depth or, instead, the parts-class and test-fidelity of the delivered article.

### 1.5 Why it matters for NASA and JPL

Mission assurance decisions about test scope and parts class are made under the heritage banner on most JPL-class programs. If H1 holds, the policy implication is concrete: heritage claims should be discounted unless accompanied by evidence of equivalent parts-class and equivalent or greater test fidelity in the delivered configuration, and review boards should weight delta-qualification of the as-built article over provenance of the design lineage. If H0 holds, the current reliance on heritage is vindicated and the burden shifts back to demonstrating that test and parts rigor add value beyond what heritage already secures. Either outcome is decision-relevant for the Safety, Mission Assurance and Health portfolio, because either outcome changes where assurance dollars should go. The cost stakes are not marginal: qualification and acceptance test campaigns and high-reliability parts procurement are among the larger discretionary lines in a spacecraft budget, and a heritage argument that justifies cutting them reallocates real money. A wrong heritage discount that produces an on-orbit subsystem failure can cost a mission; a heritage discount that is in fact justified but is denied by an overcautious board wastes test budget that could have funded margin elsewhere. The portfolio needs to know which error it is more often making.

---

## 2. Background and Literature

### 2.1 The descriptive reliability base

The empirical anchor for this work is the satellite reliability program of Castet and Saleh. Their nonparametric reliability estimates, built from databases of on-orbit failures, show that satellite reliability is not well described by a constant hazard and that a non-negligible fraction of failures occur early in life, consistent with infant mortality from latent defects rather than wear-out [1]. Their comparison of single-Weibull and mixture-Weibull fits demonstrates that a mixture, capturing an early-failure subpopulation and a longer-lived subpopulation, fits the data better than a single distribution [2]. The extension to subsystems shows that the aggregate satellite curve hides large differences across subsystems, with some subsystems contributing disproportionately to early failures [3][6]. Tafazoli's review of on-orbit failures reaches a compatible conclusion: failures concentrate in a handful of subsystems and a meaningful share are traceable to design and parts issues rather than to random external causes [4]. The platform health scorecard work catalogs anomalies and failures by subsystem and confirms the uneven distribution [5].

This base matters for the present design in two ways. First, it establishes that the outcome, subsystem-level early and total failure, has enough variation to be modeled and is not so rare that estimation is hopeless. Second, it establishes the dominant confounder structure. Subsystem identity, orbit, and mass class all shift the failure hazard, so any test of heritage must condition on them or absorb them with random effects.

### 2.2 Heritage, maturity, and the novelty tradeoff

The maturity literature provides the conceptual link between heritage and reliability. Dubos and Saleh connected technology readiness level to schedule risk and slippage, showing that lower-maturity technology carries measurable program risk [7]. Heritage is, in effect, an informal maturity claim asserted at the subsystem or box level. The problem this dissertation isolates is that the maturity that matters for reliability is the maturity of the delivered article in its actual mission environment, not the maturity of the design concept. A heritage box flown to LEO and now flown to a high-radiation deep-space orbit has a heritage design but an unproven environmental qualification. The reliability-by-mass and reliability-by-orbit analyses make this concrete by showing that the failure distribution shifts with environment and platform class [6][8], which means a heritage claim that does not account for environment change is an incomplete predictor.

### 2.3 Parts-class and test as the rival predictors

The COTS and parts-reliability literature supplies the rival explanation. Risk assessments for COTS devices in space show that parts-class, specifically radiation tolerance and screening level, is a first-order determinant of device-level reliability, and that the NewSpace move toward commercial parts trades cost against this margin [11][12]. Small-satellite reliability data show systematically different outcomes for designs built with reduced screening and reduced test [9][10]. The mechanism the rival hypothesis proposes is direct: parts-class sets the intrinsic defect and degradation rate of the article, and integration-test fidelity sets the probability that latent defects and integration errors are caught before launch rather than discovered on orbit. Both are properties of the delivered article. Heritage is a property of its ancestry. H1 is the claim that the properties of the article beat the property of the ancestry.

### 2.4 The methodological frame: Angrist-Pischke and Rubin

The estimation problem is observational. No one randomizes heritage, parts-class, or test fidelity across spacecraft. The threat is that the same program characteristics that produce a heritage claim also produce, or fail to produce, parts rigor and test rigor, so a naive regression of failure on heritage will absorb the effect of the omitted rigor variables. The Angrist and Pischke design-based program is the appropriate discipline here: identify the comparison being made, ask what variation in the regressor is being exploited, and ask whether that variation is plausibly unrelated to omitted determinants of the outcome after conditioning [13][14]. Their warning about bad controls is directly relevant. Conditioning on a variable that is itself an outcome of the treatment, for example conditioning on a post-design test result that heritage status influenced, reintroduces bias and must be avoided [13].

Rubin's potential-outcomes framework supplies the design discipline. The assignment mechanism for heritage, parts-class, and test fidelity is unknown and must be reconstructed and defended from observed covariates, and the credibility of any causal reading rests on selection on observables (unconfoundedness) and on overlap between the compared groups [15][16][17]. Rubin's central methodological point, that design should be completed before the outcome data are examined, motivates the pre-registration of this specification: the variable construction, the control set, and the analysis plan are fixed in this document before estimation on the full assembled dataset [16][17][18]. Because heritage status is not randomly assigned, the strongest defensible claim from the observational design is a conditional association under stated unconfoundedness assumptions, and the dissertation states those assumptions and their threats rather than overclaiming causal identification.

### 2.5 Translating the econometric frame to the spacecraft problem

The Angrist-Pischke and Rubin programs were developed for labor and program-evaluation settings, and the translation to spacecraft reliability requires care on three points. First, the potential outcome here is a subsystem's on-orbit failure behavior under a counterfactual heritage, parts-class, or test-fidelity assignment. The estimand of interest is not a single average treatment effect but a comparison of the conditional associations of three regressors with the failure hazard, which is why the dissertation frames the test as a nested-model coefficient comparison rather than as the estimation of one causal contrast. Second, the stable-unit-treatment-value assumption requires that one subsystem's heritage or parts choice does not change another subsystem's failure behavior. This is mostly defensible at the subsystem level but can be violated by common-cause failures, for example a shared power bus or a shared parts lot across subsystems, and the design therefore records lot-level commonality so that violations can be flagged and the affected cells examined separately. Third, overlap has a concrete physical meaning here. It requires that, within a region of environment, prominence, mass class, epoch, and subsystem type, the data contain both heritage-rich and heritage-poor subsystems at comparable parts-class and test-fidelity. Where the field always pairs deep heritage with high parts-class and full test, no within-stratum comparison exists and the heritage effect is not identified separately from the rigor effect. Rubin's insistence on demonstrating overlap before analyzing outcomes is therefore not a formality but the gate that decides whether the question can be answered on this population at all. The dissertation reports the overlap diagnostic as a first-class result, because a finding that the comparison is unidentified is itself informative for the field: it would mean heritage and rigor are so bundled in practice that the heritage discount cannot be evaluated separately, and that the honest assurance posture is to require the rigor regardless of the heritage claim.

The bad-controls warning deserves a spacecraft-specific statement because the temptation to commit it is strong. A natural-seeming control is the result of the qualification and acceptance test campaign, for example whether the article passed thermal-vacuum without anomaly. Conditioning on that result would be a bad control: test outcomes are downstream of both heritage and parts choices and partly downstream of test fidelity itself, so conditioning on them would absorb the very effect under test and bias the heritage and parts coefficients toward zero or worse. The specification therefore uses only pre-launch, pre-outcome inputs (heritage as claimed at design review, parts-class as procured, test-fidelity as planned and as-run in scope) and never conditions on the test's pass or fail verdict. This is the single most important specification decision and it follows directly from the Angrist-Pischke treatment of post-treatment variables [13].

---

## 3. Data

### 3.1 Named sources

The study assembles three classes of records.

1. **NASA spacecraft and instrument failure and anomaly records.** The NASA Lessons Learned Information System (LLIS) and NASA problem reporting and corrective action records provide narrative and coded anomaly entries at the subsystem and component level, including time of occurrence relative to launch where available, the affected subsystem, and a description sufficient to classify root cause as parts, design, integration, environment, or operations. LLIS is publicly accessible through the NASA Engineering Network. Problem reporting data is accessed at the project archive level under JPL records access.

2. **NTRS reliability and parts-stress reports.** The NASA Technical Reports Server hosts reliability analyses, parts-stress and derating reports, radiation hardness assurance reports, and qualification and acceptance test summaries. These supply the parts-class and test-program-fidelity variables for missions where the project documented them, and they cross-check anomaly classifications. NTRS is publicly accessible through its citations API and document store.

3. **JPL mission archives documenting heritage and parts-class per subsystem.** Project documentation, including the heritage assessment matrices, parts control board records, EEE parts lists with class designations, and integration and test plans, supply the heritage-depth and parts-class variables at the subsystem level. These archives are the only source that records heritage claims as made at design review, which is the construct the dissertation tests.

### 3.2 Unit of analysis

The unit of analysis is the mission-by-subsystem cell. For each spacecraft in the assembled population, each functional subsystem (for example attitude control, command and data handling, electrical power, propulsion, thermal, telecommunications, payload instrument) is a record. The outcome variables are measured at this cell. This unit is chosen because the descriptive literature shows that failure behavior is subsystem-specific and that aggregating to the spacecraft level discards the variation that distinguishes the hypotheses [3][5].

### 3.3 Variable construction

- **Outcomes.** Two outcomes are constructed. First, time-to-first-failure of the subsystem, measured in days from on-orbit commissioning to the first recorded anomaly that meets a failure-severity threshold, right-censored at end of mission or end of observation window. Second, an infant-mortality indicator equal to one if a failure-severity anomaly occurred within a fixed early window after commissioning. The early window is set from the inflection of the mixture-Weibull early subpopulation reported in the reliability literature rather than chosen ad hoc [2].
- **Heritage depth.** An ordinal measure constructed from JPL heritage assessment records: no heritage, design heritage only, design plus build heritage, and design plus build plus same-environment flight heritage. Same-environment is coded against the orbit and radiation environment of the prior flight, because heritage to a different environment is the case the rival hypothesis predicts will fail.
- **EEE parts-class.** An ordinal measure from the parts lists and parts control records, mapping the dominant class of the subsystem's EEE parts to the standard space parts hierarchy (for example class S or equivalent high-reliability, class B, and commercial or COTS), with a screening-level subindicator.
- **Test-program fidelity.** An index built from the integration and test plan and as-run records: presence and duration of thermal-vacuum cycling, vibration and acoustic qualification, parts-level screening and burn-in, and system-level functional test coverage. The index is constructed before outcomes are examined.
- **Controls.** Mission environment (orbit class and radiation environment), mission prominence (a proxy for review intensity and budget, for example flagship versus competed-line versus smaller class), spacecraft mass class, and launch epoch to absorb secular technology change.

### 3.4 Coverage and limitations

Coverage is bounded by what the archives recorded. Heritage claims and parts-class are best documented for JPL flagship and competed science missions and thinner for the smallest classes. Anomaly records undercount minor anomalies that did not trigger formal reporting, which biases the outcome toward more severe events; this is acceptable because the hypotheses concern reliability-relevant failures. The most serious data limitation is survivorship: missions and subsystems that failed before producing complete documentation are underrepresented, and heritage claims that were quietly dropped after an early failure may not be archived as heritage. Section 4 treats survivorship as a first-order threat and builds a correction into the design rather than noting it as a caveat.

### 3.5 Record linkage and measurement reliability

The three source classes are linked at the mission-by-subsystem cell. Linkage proceeds in three stages. First, missions are matched across sources by a canonical mission identifier reconciled from launch designation, project name, and launch date, because the same mission appears under different names in the anomaly system, the NTRS reports, and the project archives. Second, subsystems are mapped to a common functional taxonomy, because the anomaly system, the parts records, and the test plans use different subsystem nomenclatures; a fixed crosswalk assigns each source's subsystem label to one of the common functional subsystems, and ambiguous cases are adjudicated by two coders. Third, anomalies are assigned a time relative to commissioning and a root-cause class (parts, design, integration, environment, operations) from the narrative and coded fields, with operations-caused and environment-caused anomalies retained as outcomes but flagged so that sensitivity to their inclusion can be tested, since the hypotheses concern article-intrinsic reliability rather than operator error.

Measurement reliability is reported, not assumed. The two coding-intensive variables, heritage depth and test-fidelity, are coded independently by two analysts on a common subset, and inter-coder agreement is reported as a chance-corrected statistic before the full coding proceeds; disagreements are reconciled against the source document and the reconciliation rule is recorded. Parts-class is the most objective of the three because it is read directly from parts control records, but where a subsystem mixes classes, the dominant-class rule and its alternatives (worst-case class, weighted class) are all constructed so the conclusion can be checked against the coding choice. This auditability is required by the outcome-blind design discipline: every construction decision is fixed and documented before the outcomes enter the estimation [16].

---

## 4. Research Design and Identification

### 4.1 Estimator

The primary estimator is a mixed-effects survival model for time-to-first-failure with subsystem random effects, complemented by a discrete-time logistic hazard model for the infant-mortality indicator. The survival specification is a parametric proportional-hazards model with a flexible baseline (piecewise-constant or Weibull-mixture baseline consistent with the documented early and late failure regimes [2]) and Gaussian random intercepts by subsystem type to absorb the subsystem-specific baseline hazard documented in the literature [3][5]. The discrete-time model is estimated as a complementary-log-log or logistic regression on subsystem-period records, which lets the same covariates enter and produces directly interpretable hazard contributions for the early window.

### 4.1.1 Formal specification

Let the hazard of first failure for subsystem cell i in mission m at on-orbit time t be written as a proportional-hazards form. The log hazard is the sum of a baseline log hazard that depends on time, a linear index in the three regressors of interest, a linear index in the controls, and a subsystem random intercept:

log h(t) = log h0(t) + b1 * Heritage_i + b2 * PartsClass_i + b3 * TestFidelity_i + g * Controls_im + u_s

Here Heritage, PartsClass, and TestFidelity are the ordinal or index regressors defined in Section 3; Controls are environment, prominence, mass class, and launch epoch; u_s is the Gaussian random intercept for subsystem type s, which absorbs the documented subsystem-specific baseline hazard; and h0(t) is the flexible (piecewise-constant or Weibull-mixture) baseline. The coefficients b1, b2, and b3 are the objects of the head-to-head test. Because the regressors are placed on a common standardized scale before estimation, their coefficients are directly comparable in magnitude, which is what the falsification rule requires. The discrete-time companion replaces the continuous baseline with period dummies and estimates the same linear index by complementary-log-log link on subsystem-period records, giving an early-window hazard that maps cleanly onto the infant-mortality outcome.

The hypotheses are statements about the b coefficients. H0 holds that |b1| is the largest of the three standardized magnitudes and remains stable and bounded away from zero when b2 and b3 are added. H1 holds that |b2| and |b3| exceed |b1| and that b1 collapses toward zero, with an interval covering negligible effect, once b2 and b3 enter. The nested comparison estimates the index first without b2 and b3 (Model A) and then with them (Model B), and reads the change in b1 together with the magnitudes of b2 and b3.

### 4.2 Identification strategy

Identification is selection-on-observables, in the Rubin and Angrist-Pischke sense [13][15]. The claim is that, conditional on mission environment, mission prominence, mass class, launch epoch, and subsystem type, the assignment of heritage depth, parts-class, and test fidelity to a subsystem is as good as unconfounded with the residual determinants of failure. The design defends this in three ways. First, the control set is chosen to capture the program-level forces (budget, environment, review intensity) that jointly drive provenance and rigor. Second, overlap is checked: the analysis is restricted to regions of covariate space where heritage-rich and heritage-poor subsystems coexist at comparable parts-class and test-fidelity, because comparisons outside the overlap region are extrapolation, not evidence [16][17]. Third, the specification avoids bad controls: it does not condition on post-design outcomes (such as test anomalies) that are themselves consequences of heritage or parts choices, because conditioning on them would absorb the very effect under test [13].

The head-to-head test is implemented by nested model comparison. Model A regresses the outcome on heritage depth plus controls. Model B adds parts-class and test-fidelity. H1 predicts that the heritage coefficient shrinks toward zero and loses significance when parts-class and test-fidelity enter Model B, while the parts-class and test-fidelity coefficients are large and stable. H0 predicts that the heritage coefficient survives the addition of parts-class and test-fidelity with its magnitude and significance largely intact.

### 4.3 Survivorship correction

Survivorship is addressed by design rather than ignored. Three steps are taken. First, the sampling frame is built from launch manifests, not from surviving-mission documentation, so that early-failed and short-lived missions enter the frame even when their internal records are thin. Second, inverse-probability-of-documentation weighting is applied: a model for the probability that a subsystem cell has complete heritage and parts documentation is estimated from observed mission characteristics, and cells are weighted by the inverse of that probability so that under-documented (and disproportionately early-failed) cells are not silently dropped. Third, a sensitivity analysis varies the assumed failure behavior of the undocumented cells across plausible bounds and reports how the heritage-versus-parts comparison moves, so the reader sees the range of conclusions consistent with the missing data.

### 4.4 Threats to validity

- **Internal validity.** The central threat is omitted-variable confounding between heritage and unobserved rigor. The control set, the overlap restriction, and the bad-controls discipline mitigate it but cannot eliminate it; the design therefore states its conclusion as conditional association under unconfoundedness, not as established causation. A secondary threat is reverse documentation, where a subsystem that failed is retrospectively recoded as less heritage-rich; the launch-manifest frame and provenance-at-design-review coding (heritage as claimed before launch, not after) guard against this.
- **External validity.** The population is JPL-class missions. Results may not transfer to commercial constellations or to the smallest CubeSat class, where the parts and test regimes differ [9][10][11]. The mass-class and orbit controls and a planned subgroup analysis bound this.
- **Construct validity.** Heritage depth, parts-class, and test-fidelity are constructed indices, and a poor construction could understate one predictor and flatter another. Each index is built from documented, auditable fields before outcomes are examined, and inter-coder reliability is reported for the heritage and test-fidelity coding.
- **Statistical-conclusion validity.** The mission-by-subsystem cells are clustered within missions, so standard errors are clustered at the mission level, and the subsystem random effects absorb within-subsystem correlation. Power is bounded by the number of well-documented missions; the design reports the minimum detectable difference in coefficient magnitude given the assembled sample rather than assuming adequate power.

---

## 5. Analysis Plan and Findings

This section is a design-stage analysis plan. It states the procedure and the expected directions. It does not report estimates from the full assembled dataset, because that dataset is still being assembled from the JPL archives and the NASA anomaly records. The numbers below are illustrative expectations used to define the falsification thresholds, not measured results.

### 5.1 Estimation procedure

1. Build the mission-by-subsystem frame from launch manifests for the chosen population and epoch window.
2. Code heritage depth, parts-class, and test-fidelity from the JPL archives and NTRS reports, with two independent coders on the heritage and test-fidelity indices, and record inter-coder agreement.
3. Construct the two outcomes and the censoring structure from the anomaly and lessons-learned records.
4. Estimate the documentation-probability model and form inverse-probability weights.
5. Restrict to the overlap region in covariate space.
6. Estimate Model A (heritage plus controls) and Model B (heritage, parts-class, test-fidelity, controls) for both the survival and the discrete-time outcomes, with mission-clustered standard errors and subsystem random effects.
7. Run the survivorship sensitivity analysis across the bounded assumptions for undocumented cells.
8. Report the nested comparison and the falsification decision.

### 5.2 Expected, illustrative findings (not yet executed)

Under H1, the expected pattern is as follows. In Model A, heritage depth would show a moderate negative association with failure hazard, consistent with the raw correlation that motivates current practice. In Model B, the heritage coefficient would attenuate substantially and lose stability once parts-class and test-fidelity enter, while parts-class (high-reliability classes associated with lower hazard) and test-fidelity (more complete qualification associated with lower hazard, especially for the infant-mortality outcome) would carry the larger and more stable coefficients. The infant-mortality outcome in particular would be expected to load on test-fidelity, because the mechanism for early failure is an uncaught latent defect, which is precisely what screening and system test are designed to catch. These directions are stated as the expectations that define the test; they are not estimated values, and the actual estimates may contradict them, in which case the contribution is falsified toward H0.

A concrete falsification rule is fixed in advance. The contribution is supported (H1) if, across both outcomes and within the survivorship sensitivity bounds, the standardized parts-class and test-fidelity coefficients exceed the standardized heritage coefficient in magnitude and the heritage coefficient's confidence interval includes negligible effect in Model B. The contribution is falsified (H0) if the heritage coefficient remains the largest standardized coefficient and retains a confidence interval excluding negligible effect after parts-class and test-fidelity are added.

### 5.3 Diagnostics and robustness

The estimation is accompanied by a fixed set of diagnostics, specified here so they cannot be chosen after seeing results. The proportional-hazards assumption is checked with scaled residual tests and, where it fails for a covariate, that covariate is allowed a time-varying coefficient rather than being forced into a constant-hazard form; this matters most for the early window, where the mixture literature shows the hazard is far from constant [2]. The random-effects structure is checked by comparing the mixed-effects fit against a fixed-effects-by-subsystem alternative, and the heritage-versus-parts conclusion is reported under both so the reader can see it is not an artifact of the random-effects assumption. The overlap diagnostic is reported as a propensity-style balance table within strata, showing how many heritage-rich and heritage-poor cells coexist at comparable parts-class and test-fidelity; thin cells are flagged and the estimate is reported both on the full overlap region and on a trimmed region that drops the thinnest strata. Coefficient stability is examined by adding controls one block at a time, so a heritage coefficient that moves sharply when a single control enters is identified as fragile rather than reported as a finding.

Three robustness checks are pre-specified. First, the heritage measure is re-coded under a stricter definition that requires same-environment flight for the top category, to test whether any heritage association is driven entirely by the same-environment cases, which would itself be evidence for the rival hypothesis that environment-matched verification, not provenance, is what matters. Second, the analysis is re-run excluding the payload instrument subsystem, because instruments are the most novel and least heritage-eligible subsystem and could dominate the heritage signal. Third, the launch-epoch control is replaced with a finer set of epoch dummies to confirm that the heritage-versus-parts comparison is not a secular technology trend in disguise, since both parts-class norms and heritage practices have shifted across decades [11][12].

### 5.4 Power and the honest sample limit

Power is bounded by the number of well-documented JPL-class missions, which is modest, and the design reports this limit rather than assuming it away. The relevant quantity is the minimum detectable difference between the standardized heritage coefficient and the standardized parts-class or test-fidelity coefficient, given the assembled number of mission-by-subsystem cells, the within-mission clustering, and the censoring rate. The design computes this minimum detectable difference and states it alongside the falsification rule, so that a non-result is interpreted correctly: if the data cannot distinguish coefficient magnitudes at the achieved sample size, the honest report is that the test is underpowered on this population, not that H0 is confirmed. This is the Rubin discipline of fixing the analysis and its interpretation before the outcomes are examined [16], applied to the awkward but common case where the available population is small.

---

## 6. Discussion

### 6.1 Implications

If H1 is supported, mission assurance practice should treat a heritage claim as insufficient on its own. The actionable rule would be that heritage may reduce required test scope only when the delivered article matches the heritage article in parts-class and meets a test-fidelity floor in the new environment, and that delta-qualification of the as-built configuration should be weighted above design-lineage provenance. This is a direct reallocation of assurance attention from provenance review to article verification. If H0 is supported, current practice is vindicated, and the research burden shifts to identifying the conditions under which heritage fails, since even strong average heritage effects coexist with the documented infant-mortality regime.

### 6.2 Rival explanations

Three rival readings must be addressed. First, heritage and rigor may be so tightly bundled in practice that they cannot be separated; the overlap restriction is the test of whether enough independent variation exists, and if it does not, the honest conclusion is that the question is not identified on this population. Second, the heritage effect may be real but operate through parts-class and test-fidelity as mediators rather than as confounders, in which case attenuation in Model B reflects mediation, not spuriousness; the design distinguishes these by examining whether heritage predicts parts-class and test-fidelity and by reporting both the total and the conditional heritage associations. Third, unobserved program competence could drive both heritage retention and low failure; mission prominence and the documentation-probability model are the available proxies, and residual competence confounding is acknowledged as a limit on causal reading.

### 6.3 External validity

The result, in either direction, is a statement about JPL-class missions with documented heritage and parts records. Transfer to commercial NewSpace or to CubeSat populations is not assumed and is explicitly bounded by the mass-class and orbit controls and by the subgroup analysis. The COTS and small-satellite literature suggests the parts-class channel is, if anything, stronger in those populations, but that is a hypothesis for replication, not a claim of this study [9][10][11][12].

### 6.4 What would falsify the contribution

The contribution is falsified by the pre-registered rule: heritage depth retaining the dominant, stable association after parts-class and test-fidelity are added, across both outcomes and within the survivorship bounds. It is also undermined, short of falsification, if the overlap region is too thin to support the comparison, which would render the question unidentified on this data rather than answered in favor of H0. Stating both outcomes in advance is the design discipline that keeps the analysis honest [16][18].

---

## 7. Contribution and Conclusion

This dissertation contributes a pre-registered, falsifiable test of a near-universal spacecraft-design assumption. It does not claim to have already measured the effect. Its contribution is the specification: a cross-mission, mission-by-subsystem survival and discrete-time hazard design that puts claimed flight heritage in direct competition with EEE parts-class and integration-test fidelity, on a JPL-class population, with mission-environment and prominence controls, subsystem random effects, mission-clustered inference, and a survivorship correction built into the sampling frame and the weighting rather than appended as a caveat. The methodological frame is design-based and observational-design-disciplined, following Angrist and Pischke on credible comparisons and bad controls and Rubin on assignment mechanisms, overlap, and outcome-blind design [13][15][16].

The value to the Safety, Mission Assurance and Health portfolio does not depend on which hypothesis wins. If parts-class and test-fidelity dominate, assurance resources should move from provenance review toward verification of the delivered article. If heritage dominates, the field gains a defended empirical warrant for a practice currently held on faith. The next step is to complete the assembly of the JPL heritage and parts records and the NASA anomaly outcomes into the mission-by-subsystem frame and to execute the pre-registered specification, reporting the falsification decision exactly as defined here.

---

## References

[1] J.-F. Castet and J. H. Saleh, "Satellite and satellite subsystems reliability: Statistical data analysis and modeling," *Reliability Engineering and System Safety*, vol. 94, no. 11, pp. 1718-1728, 2009. doi: [10.1016/j.ress.2009.05.004](https://doi.org/10.1016/j.ress.2009.05.004)

[2] J.-F. Castet and J. H. Saleh, "Single versus mixture Weibull distributions for nonparametric satellite reliability," *Reliability Engineering and System Safety*, vol. 95, no. 3, pp. 295-300, 2010. doi: [10.1016/j.ress.2009.10.001](https://doi.org/10.1016/j.ress.2009.10.001)

[3] J.-F. Castet and J. H. Saleh, "Beyond reliability, multi-state failure analysis of satellite subsystems: A statistical approach," *Reliability Engineering and System Safety*, vol. 95, no. 4, pp. 311-322, 2010. doi: [10.1016/j.ress.2009.11.001](https://doi.org/10.1016/j.ress.2009.11.001)

[4] M. Tafazoli, "A study of on-orbit spacecraft failures," *Acta Astronautica*, vol. 64, no. 2-3, pp. 195-205, 2009. doi: [10.1016/j.actaastro.2008.07.019](https://doi.org/10.1016/j.actaastro.2008.07.019)

[5] J. H. Saleh and J.-F. Castet, "Health scorecard of spacecraft platforms: Track record of on-orbit anomalies and failures," *Acta Astronautica*, vol. 68, no. 7-8, pp. 1153-1166, 2011. doi: [10.1016/j.actaastro.2010.08.006](https://doi.org/10.1016/j.actaastro.2010.08.006)

[6] G. F. Dubos, J.-F. Castet, and J. H. Saleh, "Statistical reliability analysis of satellites by mass category: Does spacecraft size matter?," *Acta Astronautica*, vol. 67, no. 5-6, pp. 584-595, 2010. doi: [10.1016/j.actaastro.2010.04.017](https://doi.org/10.1016/j.actaastro.2010.04.017)

[7] G. F. Dubos, J. H. Saleh, and R. Braun, "Technology Readiness Level, Schedule Risk, and Slippage in Spacecraft Design," *Journal of Spacecraft and Rockets*, vol. 45, no. 4, pp. 836-842, 2008. doi: [10.2514/1.34947](https://doi.org/10.2514/1.34947)

[8] Reliability analysis of deep space satellites launched 1991-2020: Bulk population and subsystem analysis, *Quality and Reliability Engineering International*, vol. 40, 2024. doi: [10.1002/qre.3600](https://doi.org/10.1002/qre.3600)

[9] "Statistical Modeling and Analysis of Satellite Failure Based on 2-Weibull Segmented Model," *IEEE Access*, vol. 9, pp. 126280-126293, 2021. doi: [10.1109/access.2021.3113155](https://doi.org/10.1109/access.2021.3113155)

[10] M. Langer and J. Bouwmeester, "Reliability of CubeSats - Statistical Data, Developers' Beliefs and the Way Forward," *Proceedings of the AIAA/USU Conference on Small Satellites*, 2016. URL: [https://digitalcommons.usu.edu/smallsat/2016/S3GuidCont/2/](https://digitalcommons.usu.edu/smallsat/2016/S3GuidCont/2/)

[11] M. Brandhoff et al., "Risk Assessment for the Use of COTS Devices in Space Systems under Consideration of Radiation Effects," *Electronics*, vol. 10, no. 9, art. 1008, 2021. doi: [10.3390/electronics10091008](https://doi.org/10.3390/electronics10091008)

[12] "Radiation Effects and COTS Parts in SmallSats," 2013. doi: [10.1117/12.2231304](https://doi.org/10.1117/12.2231304)

[13] J. D. Angrist and J.-S. Pischke, *Mostly Harmless Econometrics: An Empiricist's Companion*. Princeton, NJ: Princeton University Press, 2009. doi: [10.1515/9781400829828](https://doi.org/10.1515/9781400829828)

[14] J. D. Angrist, G. W. Imbens, and D. B. Rubin, "Identification of Causal Effects Using Instrumental Variables," *Journal of the American Statistical Association*, vol. 91, no. 434, pp. 444-455, 1996. doi: [10.1080/01621459.1996.10476902](https://doi.org/10.1080/01621459.1996.10476902)

[15] P. R. Rosenbaum and D. B. Rubin, "The central role of the propensity score in observational studies for causal effects," *Biometrika*, vol. 70, no. 1, pp. 41-55, 1983. doi: [10.1093/biomet/70.1.41](https://doi.org/10.1093/biomet/70.1.41)

[16] D. B. Rubin, "For objective causal inference, design trumps analysis," *Annals of Applied Statistics*, vol. 2, no. 3, pp. 808-840, 2008. doi: [10.1214/08-aoas187](https://doi.org/10.1214/08-aoas187)

[17] G. W. Imbens and D. B. Rubin, *Causal Inference for Statistics, Social, and Biomedical Sciences: An Introduction*. New York: Cambridge University Press, 2015. doi: [10.1017/cbo9781139025751](https://doi.org/10.1017/cbo9781139025751)

[18] D. B. Rubin, "Bayesian Inference for Causal Effects: The Role of Randomization," *Annals of Statistics*, vol. 6, no. 1, pp. 34-58, 1978. doi: [10.1214/aos/1176344064](https://doi.org/10.1214/aos/1176344064)