Attitude and Trajectory Control

Entry, descent and landing is the shortest-deadline control problem a planetary robot has. Seven minutes of flight, no ground in the loop, and a vehicle that reconfigures itself about a dozen times along the way. The rotorcraft case is the same problem at 100 Hz and 1.8 kg [7].

The Mars 2020 stack, and what it runs at

The Mars 2020 EDL flight software is three components: a timeline engine that prepares and coordinates events, a navigation mode commander that manages the filter configuration and either propagates the descent IMU or fuses it with the Ka-band terrain descent sensor radar, and an EDL GNC mode commander that reconfigures the vehicle and guides it down [1]. All three run in the 64 Hz rate group, called in that order so the state knowledge is current before guidance uses it.

The timeline is built from timechains, sequences of events anchored either to an absolute time or relative to another anchor, with actions such as pyro firings at each timepoint [1]. Triggers rather than fixed times drive guidance start, heading alignment start, straighten up and fly right, chute deployment, heatshield ejection, engine priming, backshell separation and touchdown. MSL established the pattern, but its guidance heading alignment and parachute deployment triggers were all atmospheric-relative-velocity-magnitude triggers on inertially propagated velocity, not a range trigger; heatshield separation used a variant of the same, and backshell separation was an altitude against vertical velocity trigger fed by the landing radar [3].

Effectors [1]:

Effector	Count	Output
Descent reaction control thrusters	4 clusters of 2	about 150 N in blowdown during the exo-atmospheric phase, about 275 N regulated during entry
Mars Landing Engines	8	throttleable to about 3200 N
Terrain descent sensor	1	Ka-band radar, 6 pencil beams
Entry balance masses	6	ejected during straighten up and fly right

Two capabilities were added over Curiosity: a range trigger for parachute deployment, worth a 40 percent smaller landing ellipse, and terrain relative navigation with safe target selection, so the vehicle can land around hazards inside that ellipse [1]. Both were driven by science site access rather than by a control deficiency. Two Curiosity anomalies were also mitigated: parachute deployment exciting structural resonances into unexpectedly large IMU rates, and an out-of-spec touchdown velocity. The vision side of terrain relative navigation is covered under terrain relative navigation.

Entry guidance: modulating a lift vector nobody can steer directly

The entry capsule has no control surfaces. Its center of mass is displaced from the axis of symmetry so that it trims at a non-zero angle of attack and generates lift, and the guidance law steers only the direction of that lift vector, by rolling the capsule about its velocity vector [3]. MSL was the first Mars mission to fly entry guidance at all.

The guidance law is derived from the Apollo command module final phase algorithm, adapted to Mars: it issues bank angle commands to control range-to-go and cross-range error by adjusting drag acceleration, and when cross-range error exceeds a threshold it commands a bank reversal [2]. Perseverance entered with a lift-to-drag ratio of 0.24 at Mach 24, and the range control phase lasts about 3 minutes, ending at parachute deploy near Mach 1.8.

The controller underneath is three single-axis channels, bank, angle of attack and sideslip, each with a feedforward path for large commanded turns and a phase plane feedback path operating on attitude and rate deadbands. A bank reversal is a large turn, so the bank profiler plans it as a single-axis accelerate, coast, decelerate maneuver and the feedforward path executes it. The bank channel’s phase plane is tuned for tracking; the angle of attack and sideslip channels are tuned for rate damping and minimum fuel. Gains and deadbands are scheduled by flight mode and capsule speed. Thruster logic converts the desired torque into pulse width modulation of the 8 thrusters [2], which deliver about 275 N each in regulated mode [1].

Measured deadbands and rates from the flight reconstruction:

Quantity	Value
Capsule spin rate at cruise stage separation	about 12 deg/s
Exo-atmospheric attitude deadband	about 2 deg
Angle of attack and sideslip deadband during entry	10 deg
Rate damping engagement threshold	6 deg/s
Observed oscillatory mode rates during entry	up to about 2 deg/s
Straighten up and fly right bank slew	180 deg

Source: [2].

Perseverance landed on 18 February 2021 inside a required 8 by 7 km ellipse [2]. The flight reconstruction reports the spindown feedforward profile decelerating faster than intended, which engaged the feedback path and reduced the control action, and the same on the acceleration part of the turn to entry. During entry, an unexpected initial bank command cost more fuel than predicted, but overall fuel use stayed in family with the EDL Monte Carlo expectations, and bank control errors sat well inside the watermarks from the verification and validation campaign. Trim angles drifted a few degrees over the entry as expected, and each balance mass ejection was followed by the controller adjusting its predicted trim angle of attack.

Powered descent, and the cost of solving for the optimum

Powered descent guidance is a minimum-fuel trajectory optimization with a non-convex control constraint: the engines cannot be throttled below a lower bound, so the feasible thrust magnitude set is an annulus rather than a ball [4]. Lossless convexification relaxes that into a second order cone program whose optimum provably coincides with the original problem’s, which matters operationally because interior point methods for second order cone programs solve in polynomial time with a deterministic convergence criterion, and a general nonlinear program run onboard does not. An outer line search over time of flight wraps the inner cone program, since the optimal duration is not known in advance.

The published cost is 2 to 3 seconds for a typical fuel-optimal solution using the MATLAB implementation on a 2.16 GHz Intel processor [4], a ground workstation rather than a flight part, and no flight measurement appears in the paper. Set against a 64 Hz EDL flight software rate group on a RAD750 [1], the gap is the reason Mars 2020 flies a polynomial guidance law rather than an onboard optimizer.

Additional refinements in the same work address a discretization artifact rather than the optimizer: because the glide slope constraint is imposed only at the sample times, the piecewise cubic position trajectory between samples can dip below the surface, so an inter-sample constraint is added [4].

Hazard-relative retargeting

Detecting a hazard and diverting to a safe site is a sensing and geometry problem before it is a control problem, and the driving parameter is not the sensor. Analysis for the Autonomous Landing and Hazard Avoidance Technology project set the hazards to detect at rocks taller than 0.3 m and slopes steeper than 5 degrees, for a lander about 15 m in diameter [5]. Because rock size distributions are exponential, the vehicle’s own hazard tolerance dominates every other parameter: raising it sharply reduces the number of hazards, the area that must be imaged, and the number of lidar samples across that area. The Mars equivalent was solved by moving the problem into descent imagery and a prior map rather than a lidar [1].

Worked parameter sets show the trade [5]:

	0.3 m hazard	0.5 m hazard
Detection slant range	about 500 m	about 1000 m
Ground sample distance	finer	0.3 m
Touchdown error required	tighter, feature tracking or hazard relative navigation likely needed	plus or minus 2.5 m, which may remove that need
Opportunity for repeat passes	one	multiple

Source: [5], Section 6. Both assume a 45 degree trajectory angle, chosen to balance sensor performance against crew visibility, a 90 by 90 m touchdown area so that only a small divert is required, and a 3 s hazard detection data collection window, held short so the data can be treated as collected at a single altitude and so a pilot gets prompt feedback. The system still lands in 20 percent rock abundance, covering most feasible lunar sites [5]. Hazard map areas from 45 by 45 m to 360 by 360 m were analyzed, with no divert fuel cost published for any of them [5].

Rotorcraft attitude control

A Mars rotorcraft is not a small Earth helicopter. Air density in the 0.014 to 0.02 kg per cubic meter range gives a blade Lock number of 0.3 to 0.6 against roughly 4 on Earth, which inverts the sign of the rotor’s contribution to angular damping: the vehicle’s roll and pitch response is self-amplifying rather than self-damping [6]. Control authority comes from upper and lower swashplates giving 22 degrees of total collective range and cyclic control, on a vehicle under 1.8 kg with the rotor speed fixed by density in the 2600 to 2800 RPM band.

The structural design is set by the control bandwidth. Blades and hub were made unusually stiff so the rotating flap frequency sits at about 80 to 90 Hz, which puts every resonant mode well above the control system’s bandwidth; the low-order rotor model used for control design is valid to about 10 Hz [6]. Weather limits were 9 m/s horizontal wind, 2 m/s vertical, and 3.5 m/s maximum gust, with airspeed capped at 10 m/s horizontally.

Model errors found in ground testing were all in the direction of less damping than predicted. Apparent inertia measured about 60 percent above the rigid-rotor case against a predicted 50 percent, attributed to distributed higher-order rotor flexing that the single-hinge model does not capture; phase lag in the moments was 11 degrees against 8 degrees predicted, modeled as a 1.7 ms aerodynamic lag [6]. The first controlled flight in Mars atmospheric conditions ran in JPL’s 25 foot space simulator in May 2016 in CO2 at 0.0175 kg per cubic meter, fully autonomously: takeoff, climb to 2 m at 1 m/s, 30 s hover, descent at 0.5 m/s, landing, with the vehicle generating its own gusty weather inside the chamber. The flown vehicle’s inner-loop crossover ended up at 2.5 to 3 Hz, well inside the 10 Hz validity limit of the model the design was built on [7].

Ingenuity flew the architecture that resulted. The controller is an outer position and velocity loop feeding a reference into an inner attitude loop, with fixed gains across the flight envelope and two gain sets for two rotor speed operating points selected by atmospheric density [7]. The frequency range of interest for control is 0.15 to 8 Hz, the servo actuator bandwidth is 12 Hz, and the inner-loop crossover is around 2.5 to 3 Hz. Collective actuator limits are -4.5 to 17.5 degrees and cyclic plus or minus 10 degrees [7]. Ingenuity showed the pitch-heave instability that grows with advance ratio predicted by the flight dynamics work.

Sensing and estimation rates [8]:

Element	Rate
Inertial measurement units	two, redundant
IMU raw acceleration and angular rate	1600 Hz and 3200 Hz
IMU into the filter after downsampling	500 Hz
Altimeter	50 Hz
Downward navigation camera	30 Hz
Motors	8, four per rotor: one holds rotor speed, three set blade pitch

Source: [8]. The IMU chain filters, integrates, downsamples, applies bias corrections and buffers measurements for a state propagation process that runs between filter updates, and an inclinometer calibrates IMU biases before each flight.

Two system identification flights were flown on 20 and 22 December, injecting chirp signals and identifying stability and control derivatives in forward flight by a joint input-output frequency-response method, so that the identified state-space models could be compared against the pre-flight predictions [7]. Closed-loop identification is the difficulty: the controller correlates the input with the response, so the excitation has to be designed around it. The vehicle’s own navigation system, not its aerodynamics, was the limiting factor on flight speed [8]. Ingenuity is described under Ingenuity.

Comparison of the deadlines

System	Control rate	Deadline	Processor
Mars 2020 EDL GNC	64 Hz rate group	about 7 minutes of flight, no ground loop	RAD750, shared with the rest of the flight software [1]
Convex powered descent guidance	one solve per guidance update	not flown	2 to 3 s on a 2.16 GHz Intel workstation [4]
Lunar hazard detection and avoidance	one pass	3 s data collection window [5]	not published
Ingenuity attitude loop	inner-loop crossover 2.5 to 3 Hz, IMU into filter at 500 Hz	90 s of flight endurance	commercial smartphone-class parts [7][8]

Failure modes

Entry control failures in the flight record are transients rather than losses: a feedforward profile that decelerated faster than commanded, an unexpected first bank command costing fuel, and trim drift that the balance mass ejections were designed to absorb [2]. None crossed a deadband.

The rotorcraft failure modes are aerodynamic and navigational. Negative rotor damping makes the bare airframe unstable, so control is not optional at any point in the flight [6]. Sensitivity to edgewise flow was about 2.5 times larger than predicted, producing wind-induced pitching moments. On the navigation side, flight over featureless sand starves the downward camera of trackable features, degrading the velocity estimate and therefore landing accuracy; a hard landing on such terrain damaged the rotor blades in January 2024 and ended the mission after 72 flights [8].