Attitude and Trajectory Control

Attitude and trajectory control has to point a vehicle, and move it along a path, with no ground operator in the loop and with actuators, sensors and models that are only partly known before flight. The deadline is shortest in entry, descent and landing: about seven minutes of flight, a vehicle that reconfigures itself about a dozen times, and a landing that cannot be commanded from Earth [1]. The same problem recurs at other timescales: a 1.8 kg rotorcraft whose bare airframe is unstable [6][7], a rover that adjusts wheel speeds eight times a second [12], and an orbiter that must hold pointing on fewer reaction wheels than it was built with [18].

Families of approach

Seven families cover the corpus. What has flown is stated for each.

Family	What it controls	Status in the corpus
Entry attitude and bank control	Lift vector direction of an unguided-shape capsule	Flown: MSL, Mars 2020 [2][3]
Powered descent guidance	Thrust profile to a target point	Flown: Mars 2020 polynomial guidance [11], SLIM explicit guidance [10]; convex optimization not flown on Mars [4][9]
Hazard-relative and map-relative retargeting	Divert to a safe site	Flown on Mars 2020 [11]; lidar hazard detection analyzed only [5][23]
Rotorcraft flight control	Attitude of an aerodynamically unstable vehicle	Flown: Ingenuity [6][7][14]
Surface vehicle control	Wheel speed, steering, path tracking	Flown: Curiosity traction control [12]; planner and terramechanics work in simulation and laboratory [22][31][32]
Orbiter attitude control and fault reconfiguration	Pointing with reduced actuators	Paper designs [18]
Manipulator and proximity control	Arm and chaser motion on a moving base	Analysis and laboratory testbeds [28][29][30]

The Mars 2020 stack, and what it runs at

The Mars 2020 EDL flight software is three components: a timeline engine that prepares and coordinates events, a navigation mode commander that manages the filter configuration and either propagates the descent IMU or fuses it with the Ka-band terrain descent sensor radar, and an EDL GNC mode commander that reconfigures the vehicle and guides it down [1]. All three run in the 64 Hz rate group, called in that order so the state knowledge is current before guidance uses it. The navigation filter integrates a 200 Hz descent IMU and corrects with a six-beam radar cycled at 20 Hz; it was changed from MSL to model the local gravity field, which departed from the onboard model by almost 450 microg near Gale, and to edit sandy radar returns that corrupted the MSL velocity estimate during sky crane [19].

The timeline is built from timechains, sequences of events anchored either to an absolute time or relative to another anchor, with actions such as pyro firings at each timepoint [1]. Triggers rather than fixed times drive guidance start, heading alignment start, straighten up and fly right, chute deployment, heatshield ejection, engine priming, backshell separation and touchdown. MSL established the pattern, but its guidance heading alignment and parachute deployment triggers were all atmospheric-relative-velocity-magnitude triggers on inertially propagated velocity, not a range trigger; heatshield separation used a variant of the same, and backshell separation was an altitude against vertical velocity trigger fed by the landing radar [3].

Effectors [1]:

Effector	Count	Output
Descent reaction control thrusters	4 clusters of 2	about 150 N in blowdown during the exo-atmospheric phase, about 275 N regulated during entry
Mars Landing Engines	8	throttleable to about 3200 N
Terrain descent sensor	1	Ka-band radar, 6 pencil beams
Entry balance masses	6	ejected during straighten up and fly right

Two capabilities were added over Curiosity: a range trigger for parachute deployment, worth a 40 percent smaller landing ellipse, and terrain relative navigation with safe target selection, so the vehicle can land around hazards inside that ellipse [1]. Both were driven by science site access rather than by a control deficiency. Two Curiosity anomalies were also mitigated: parachute deployment exciting structural resonances into unexpectedly large IMU rates, and an out-of-spec touchdown velocity. The vision side of terrain relative navigation is covered under terrain relative navigation. The paper reports the mode transition record, not the accuracy of what was commanded [1]; the broader as-flown reconstruction is an 830 page, 25 chapter JPL compendium whose entry guidance chapter is the reference for performance against prediction [24].

Entry guidance: modulating a lift vector nobody can steer directly

The entry capsule has no control surfaces. Its center of mass is displaced from the axis of symmetry so that it trims at a non-zero angle of attack and generates lift, and the guidance law steers only the direction of that lift vector, by rolling the capsule about its velocity vector [3]. MSL was the first Mars mission to fly guided entry. Before it, the five US Mars landings flew Viking-derived ballistic entry systems sized for the 0.6 to 1 t class, and a 40 to 80 t human-class lander is a different control problem [25].

The guidance law is derived from the Apollo command module final phase algorithm, adapted to Mars: it issues bank angle commands to control range-to-go and cross-range error by adjusting drag acceleration, and when cross-range error exceeds a threshold it commands a bank reversal [2]. Perseverance entered with a lift-to-drag ratio of 0.24 at Mach 24, and the range control phase lasts about 3 minutes, ending at parachute deploy near Mach 1.8 [2].

The controller underneath is three single-axis channels, bank, angle of attack and sideslip, each with a feedforward path for large commanded turns and a phase plane feedback path operating on attitude and rate deadbands. A bank reversal is a large turn, so the bank profiler plans it as a single-axis accelerate, coast, decelerate maneuver and the feedforward path executes it. The bank channel’s phase plane is tuned for tracking; the angle of attack and sideslip channels are tuned for rate damping and minimum fuel. Gains and deadbands are scheduled by flight mode and capsule speed. Thruster logic converts the desired torque into pulse width modulation of the 8 thrusters [2], which deliver about 275 N each in regulated mode [1].

Measured deadbands and rates from the flight reconstruction:

Quantity	Value
Capsule spin rate at cruise stage separation	about 12 deg/s
Exo-atmospheric attitude deadband	about 2 deg
Angle of attack and sideslip deadband during entry	10 deg
Rate damping engagement threshold	6 deg/s
Observed oscillatory mode rates during entry	up to about 2 deg/s
Straighten up and fly right bank slew	180 deg

Source: [2].

Perseverance landed on 18 February 2021 inside a required 8 by 7 km ellipse [2]. The flight reconstruction reports the spindown feedforward profile decelerating faster than intended, which engaged the feedback path and reduced the control action, and the same on the acceleration part of the turn to entry. During entry, an unexpected initial bank command cost more fuel than predicted, but overall fuel use stayed in family with the EDL Monte Carlo expectations, and bank control errors sat well inside the watermarks from the verification and validation campaign [2]. Trim angles drifted a few degrees over the entry as expected, and each balance mass ejection was followed by the controller adjusting its predicted trim angle of attack. This is one flight, reported by the team that built the controller [2].

Entry also fixes the atmosphere the vehicle flew through. Wind during the Mars 2020 parachute and powered descent has been inferred by fitting a trajectory model to the reconstructed path between 12 km and 2.2 km altitude, which is a fit and not a direct measurement [26]. Navigation of the same vehicle from Earth to the entry interface, including the entry parameter updates that set the starting state for these controllers, is described in the navigation team’s own briefing [34].

Powered descent guidance

Powered descent guidance is a minimum-fuel trajectory optimization with a non-convex control constraint: the engines cannot be throttled below a lower bound, so the feasible thrust magnitude set is an annulus rather than a ball [4]. Lossless convexification relaxes that into a second order cone program whose optimum provably coincides with the original problem’s, which matters operationally because interior point methods for second order cone programs solve in polynomial time with a deterministic convergence criterion, and a general nonlinear program run onboard does not. An outer search over time of flight wraps the inner cone program, and the 2008 enhancements need 4 solves for it [4]. A survey of roughly 400 works places this inside a wider convex-optimization literature that spans landing, rendezvous, reorientation and manipulation, with solve times quoted secondhand from the original papers [9].

The published cost is 2 to 3 seconds for a typical fuel-optimal solution using the MATLAB implementation on a 2.16 GHz Intel processor [4], a ground workstation rather than a flight part. Every result in that paper is simulation, and the onboard table lookup approximation it proposes is stated to be under development. Set against a 64 Hz EDL rate group on a RAD750 [1], the gap is the reason Mars 2020 flies a polynomial guidance law rather than an onboard optimizer. Learning-based work targets the same gap: a transformer model that predicts the active constraints and an initial guess for six degree of freedom successive convexification cut mean solve time by 66 percent over 545 Mars test cases, from a baseline mean of 14.61 s, and ran inference in 4.59 ms against 894 ms for linear interpolation of a lookup table; the benchmark hardware is not named [20].

What has flown is a different set of algorithms. The Mars 2020 powered descent flew an MSL heritage controller through a 586.57 m terrain relative divert with a maximum off-vertical angle of 38.9 degrees [11]. It held the vertical phase ground track inside a 30 by 30 cm box, needed a 5.5 m altitude correction in vertical descent, and exposed a modeling error visible only in flight, an inferred bias of about 95 N per engine. Terrain relative navigation accuracy is not established by that report. SLIM, the JAXA lunar lander, flew an explicit powered descent guidance algorithm and landed within 100 m of its target site in January 2024; its boost-start-time correction was fitted on simulated data [10]. For Mars, the propellant arithmetic is that each additional kilometer of divert capability costs about 3 percent of propellant mass fraction, roughly 63 kg for an MSL class vehicle, and correcting parachute wind drift alone costs about 65 kg per kilometer [23].

Before guidance of this kind existed, terminal guidance was closed-form. A 1961 NASA report derives rendezvous guidance relations from simplified relative equations of motion and exercises the loop on an IBM 704 for a 400 nautical mile circular orbit station; it was simulation only [21].

Hazard-relative and map-relative retargeting

Detecting a hazard and diverting to a safe site is a sensing and geometry problem before it is a control problem, and the driving parameter is not the sensor. Analysis for the Autonomous Landing and Hazard Avoidance Technology project set the hazards to detect at rocks taller than 0.3 m and slopes steeper than 5 degrees, for a lander about 15 m in diameter [5]. Because rock size distributions are exponential, the vehicle’s own hazard tolerance dominates every other parameter: raising it sharply reduces the number of hazards, the area that must be imaged, and the number of lidar samples across that area. That analysis used synthetic terrain and Monte Carlo only, with no hardware [5]. The Mars equivalent was solved by moving the problem into descent imagery and a prior map rather than a lidar [1].

Worked parameter sets show the trade [5]:

	0.3 m hazard	0.5 m hazard
Detection slant range	about 500 m	about 1000 m
Ground sample distance	finer	0.3 m
Touchdown error required	tighter, feature tracking or hazard relative navigation likely needed	plus or minus 2.5 m, which may remove that need
Opportunity for repeat passes	one	multiple

Source: [5], Section 6. Both assume a 45 degree trajectory angle, a 90 by 90 m touchdown area so that only a small divert is required, and a 3 s hazard detection data collection window. The system still lands in 20 percent rock abundance, covering most feasible lunar sites [5]. Hazard map areas from 45 by 45 m to 360 by 360 m were analyzed, with no divert fuel cost published for any of them [5].

The passive alternative matches descent images to an orbital map. A field comparison of two such algorithms on imagery from ten flights found the correlation-based method produced solutions for over 97 percent of mid-day images with mean error under 15 m, with performance degrading outside mid-day lighting; processing was on a workstation after the fact [23]. Crater-landmark matching was studied earlier in a simulator built to size the camera field of view and the landmark count, assuming perfect image-to-database matching [33]. In-flight divert targeting has also reached rotorcraft: Ingenuity’s 2022 software release added a landing hazard detection that picks the frame region with the fewest tracked features, generated at 3 Hz, together with a digital elevation map in the navigation filter [16].

Rotorcraft attitude control

A Mars rotorcraft is not a small Earth helicopter. Air density in the 0.014 to 0.02 kg per cubic meter range gives a blade Lock number of 0.3 to 0.6 against roughly 4 on Earth, which inverts the sign of the rotor’s contribution to angular damping: the vehicle’s roll and pitch response is self-amplifying rather than self-damping [6]. Control authority comes from upper and lower swashplates giving 22 degrees of total collective range and cyclic control, on a vehicle under 1.8 kg with the rotor speed fixed by density in the 2600 to 2800 RPM band [6]. Collective actuator limits are -4.5 to 17.5 degrees and cyclic plus or minus 10 degrees, on a 1.2 m two-bladed coaxial rotor [7].

The structural design is set by the control bandwidth. Blades and hub were made unusually stiff so the rotating flap frequency sits at about 80 to 90 Hz, which puts every resonant mode well above the control system’s bandwidth; the low-order rotor model used for control design is valid to about 10 Hz [6]. Model errors found in ground testing were all in the direction of less damping than predicted. Apparent inertia measured about 60 percent above the rigid-rotor case against a predicted 50 percent, attributed to distributed higher-order rotor flexing that the single-hinge model does not capture; phase lag in the moments was 11 degrees against 8 degrees predicted [6]. The first controlled flight in Mars atmospheric conditions ran in JPL’s 25 foot space simulator in May 2016, in a CO2 atmosphere at 0.0175 kg per cubic meter. The authors state that low density and Mars gravity cannot be combined in a chamber [6]. A 2019 proposal would fly a vacuum chamber on Mars-gravity parabolas to combine them; it contains one simulation and nothing built or flown [8].

Flight results followed. The Ingenuity team’s summary through flight 13 covers the transition from technology demonstration to operations demonstration, flight control performance and the software updates [14]. Over flights 14 to 33 the rotor speed had to be raised from 2537 to 2800 rpm to compensate for summer density loss, a speed above anything tested on Earth, which moved the limiting factor from power to motor temperature [17]. Navigation attitude telemetry was later inverted to retrieve wind: tilt in steady hover gave a wind profile from 3 to 24 m, with speeds near 25 m/s on flight 59 where mesoscale models allowed about 15 m/s, a discrepancy the authors attribute to upwind terrain roughness; the retrieval depends on a steady-state aerodynamic model and covers seven flights [27].

Flights 68 and 69, in December 2023, were the first dedicated system identification flights of an aerial vehicle on another planet: frequency sweeps of 0.1 to 10 Hz, 22 s long, at 0.6 to 0.7 degree amplitude were injected into the swashplate cyclic during out-and-back legs at 10 m/s commanded groundspeed [7]. Above about 1 to 1.5 Hz the identified roll response matched the pre-flight physics model within the Cramer-Rao bounds, which validates the ground test campaign for that band, and the roll control derivative was 8.4 against 8.0 modeled on the Flight 69 out leg [7].

Below crossover, wind fed back through the stabilizing controller biased the Direct Method result, giving an angle-of-attack derivative of 0.96 against 0.15 modeled, and the Joint-Input-Output method recovered roughly half of the bias [7]. Wind inferred from cyclic effort reached 15 m/s horizontal airspeed with no instability or sustained control saturation, the same inverse approach that attitude-based wind retrievals use [7][27]. Coherence alone did not flag the bias, and roll damping and the speed derivatives could not be identified, so the flights do not independently identify the full lateral model.

The concept follow-on, a Mars Sample Recovery Helicopter, carries the Ingenuity architecture to a larger vehicle that takes off from a lander deck, with a 35 cm landing-knowledge requirement from map-relative localization and curved-path guidance [15]. Every value for it is a requirement or design target, and the 35 cm figure is one of them.

Surface vehicles

Wheel-level control on Mars is flown on Curiosity. Traction Control uses only proprioceptive sensing, the rocker, bogie, differential and attitude angles, to estimate each wheel’s terrain contact angle and command no-slip wheel rates at 8 Hz [12]. Ground testing measured a 19 percent average resultant load reduction on the leading front wheels. The flight comparison covered 483 sols across different terrain, so the benefit in flight is confounded by terrain [12]. The earlier conference version compared 44 sols of adjacent driving and reported 11.2 percent longer traverse time with control enabled; those flight numbers were later revised [13]. Steering on loose soil has a terramechanics model with a side-force term, validated on FJS-1 lunar simulant at 1 g in a laboratory only [32].

Trajectory-level control for rovers has not flown beyond waypoint driving. CRESCENT, the planner for the three CADRE lunar rovers, runs a 5.12 m global horizon at 1 Hz and a 0.64 m local horizon at 5 Hz over signed distance fields; its numbers are from simulation and an Earth analog yard, written before the rovers flew [22]. An energy-constrained planner tracked by model predictive control for an RTG and solar rover is simulation only [31].

Orbiter attitude control, manipulators and proximity operations

Cassini flew on three of four reaction wheels after the articulable fourth wheel was moved onto a degraded one. A 2012 study showed that two surviving wheels plus four thrusters could meet science pointing in the two operational modes, using two different hybrid architectures; neither was flown, and either would have needed flight software and fault protection changes [18].

For manipulators, the equations of motion of a free-floating spacecraft with an arm are derived in closed form with a five-mode classification of maneuvering, analytically with no test article [30]. For flexible long-reach arms, an end-point controller estimates base motion from strain gauges instead of sensing the end effector, validated on a single planar laboratory testbed [28]. For docking with a tumbling target, a sampling-based model predictive controller is demonstrated in simulation with idealized rigid bodies [29]. None of these has flown.

Comparison of the deadlines

System	Control rate	Deadline	Processor
Mars 2020 EDL GNC	64 Hz rate group	about 7 minutes of flight, no ground loop	RAD750, shared with the rest of the flight software [1]
Convex powered descent guidance	one solve per guidance update	not flown on Mars	2 to 3 s on a 2.16 GHz Intel workstation [4]
Lunar hazard detection and avoidance	one pass	3 s data collection window [5]	not published
Curiosity traction control	8 Hz	continuous during drives	rover flight computer [12]
CRESCENT rover planner	1 Hz global, 5 Hz local	per planning cycle	simulation and analog yard [22]

What is not established

No onboard solver for convexified powered descent has a published flight timing on a flight-class processor; the 2 to 3 s figure is a workstation prototype and the learning-based speedups name no hardware [4][20]. Lidar hazard requirements for landing rest on synthetic terrain and Monte Carlo, with no measured divert fuel cost [5]. The entry controller results are one flight reported by its developers [2], and the Curiosity traction control benefit cannot be separated from terrain differences [12]. Ingenuity’s low-frequency stability derivatives are poorly determined, and its airspeed is inferred, so the lateral model is only partly validated in flight [7]. Orbiter reconfiguration, manipulator, proximity and rover planning methods listed above are demonstrated in analysis, simulation or laboratory only [18][22][28][29][30][31].