The simulator runs these equations. Where a number appears here, it came from the same constants.
00The shape of the problem
A booster returning to a pad is a rigid body with one force it can point and throttle, an atmosphere that pushes back, and a mass that shrinks as it works. It has to arrive at a specific point on the ground with almost no velocity, almost no tilt, and almost no rotation, using less propellant than it has, and it gets exactly one attempt.
Four things make it genuinely hard, and they are worth naming before any equations appear, because every design decision later is a response to one of them.
The vehicle cannot hover. At the end of the flight it is nearly empty, and the engine has a minimum throttle. If minimum thrust divided by mass exceeds local gravity, then any lit engine accelerates the vehicle upward. There is no steady state to settle into. You get one continuous braking maneuver, and it has to end at the ground.
Propellant is the binding constraint. The fuel-optimal solution is to fall as long as possible and brake as hard as possible at the last moment. That solution is also the one with the least margin, because braking late means every error has to be corrected with the authority left over from an already saturated engine.
Translation and rotation are coupled through the same actuator.The only way to accelerate sideways is to tilt the whole vehicle, and the only way to tilt is to point the engine off-axis, which steals thrust from the vertical channel. Wanting to move left and wanting to slow down are the same actuator fighting itself.
Control authority is not constant. It depends on thrust, air density and speed, all of which change by orders of magnitude during the descent. A controller tuned for the conditions at three kilometres is tuned for a different vehicle than the one that exists at twenty metres.
01Kinematics: choosing what to track
Kinematics is the bookkeeping of motion without asking what causes it. It sounds like the easy part. It is where most of the subtle mistakes live, because kinematics is where you choose what the numbers mean, and a wrong choice there is invisible until it produces a landing that is off by fifteen metres for no apparent reason.
The state vector
Pick the smallest set of numbers that determines the future. For a booster with a single centred engine:
Eleven numbers. Everything the vehicle knows about itself.
Three position, three velocity, two attitude angles, two angular rates, one propellant mass. Notice what is missing: there is no roll angle and no roll rate.
Why two attitude angles and not three
A single engine on the centreline produces a force through the centreline. Rotate the vehicle about its own long axis and nothing about that force changes. The engine has no lever arm to produce roll torque, so roll is uncontrollable with this actuator, and worse, it is unobservable in the dynamics that matter. Real boosters solve roll separately with cold gas thrusters or differential fin deflection, which is a different subsystem with a different bandwidth.
Dropping it is not laziness. Carrying an unactuated third angle would let the vehicle drift into orientations where the two remaining angles stop being independent, which is gimbal lock: a coordinate singularity where two of your three rotation parameters describe the same physical rotation and the equations lose a degree of freedom. Two angles about two fixed horizontal axes cannot lock, and for a vehicle that never intentionally tilts past about thirty degrees they are exact enough.
If you did need full three-axis attitude, the standard answer is quaternions, which have no singularities at the cost of one redundant parameter and a normalisation constraint you must enforce every step.
The body axis as a unit vector
Both angles collapse into one useful object, the direction the vehicle is pointing:
Thrust acts along +û. Everything else is bookkeeping around this vector.
The state tracks the centre of mass, but the vehicle touches the ground with its engine bell, which sits roughly sixteen metres below the centre of mass along the body axis. Altitude is therefore not ry:
Tilting the vehicle raises its lowest point, because the bell swings up on its arm. A booster leaning ten degrees has about twenty-five centimetres more clearance than the same booster upright. Get this wrong and every altitude-triggered event fires at the wrong moment, in a way that scales with tilt, which is precisely when you can least afford it.
02Translational dynamics
Now the causes. Three forces act on the centre of mass: thrust along the deflected body axis, gravity down, drag opposing motion through the air.
Drag is written with |v|·v rather than v² so the sign follows the direction automatically in all three components.
Two details in that line carry real weight.
First, thrust points along the deflected axis,û(φ + δ_φ, ψ + δ_ψ), not the body axis. The gimbal angle is small, at most fifteen degrees, but it is the entire steering mechanism, so it belongs in the force equation and not just the torque equation.
Second, the relative velocity v_rel = v − v_wind is what generates drag, not ground-relative velocity. A vehicle descending vertically in a crosswind is flying at an angle of attack and feels a sideways force, which is how wind actually disturbs a booster: not by pushing on it directly, but by changing the direction of the air it is moving through.
Air density is not a constant
Scale height H is the altitude over which density falls by a factor of e.
An exponential atmosphere is the simplest model that gets the physics right, and the consequence is stark. At eight kilometres the density is about a third of sea level. Every aerodynamic quantity in this article, drag, fin authority, damping, weathervane stiffness, is proportional to ρ, so all of them vary by a factor of three over a stretch of descent that takes under a minute.
Mass is a state, not a parameter
Integrated over a burn, this is the Tsiolkovsky rocket equation.
Specific impulse I_sp is exhaust velocity expressed in seconds, a convention that survives because it is unit-system independent. The vehicle in the header carries 5 200 kg of propellant on a 22 200 kg dry mass, so it burns about nineteen percent of its total mass during a landing.
This matters more than it first appears. Available acceleration isT/m, and as mass falls, the same throttle setting produces more acceleration. A controller that is well behaved at the start of the burn is more aggressive at the end of it, and a pure feedforward plan computed at ignition will overshoot. The mass state is what lets the guidance law recompute against the vehicle that actually exists right now.
The engine cannot run below about forty percent. The set of achievable thrust magnitudes is 0 ∪ [T_min, T_max], which is not convex, and that single fact is why powered descent guidance is a research area rather than a textbook exercise.
Concretely: near the end of the burn the vehicle masses about 24 000 kg, so minimum thrust gives 338 kN, or 14.1 m/s² of acceleration against 9.81 m/s² of gravity. A lit engine cannot descend gently. It cannot descend at all. The only options are shut down and accelerate downward at g, or light up and accelerate upward at 4.3 m/s². Landing softly means threading between two unstable behaviours.
The modern treatment is lossless convexification (Açıkmeşe and Ploen, 2007), which introduces a slack variable for thrust magnitude, relaxes the non-convex constraint to a convex one, and then proves the relaxation is tight, meaning the optimal solution of the easy problem is the optimal solution of the hard one. It is one of the genuinely elegant results in the field and it is what made real-time onboard trajectory optimisation practical.
03Rotational dynamics
Treat the booster as a uniform slender rod of length L rotating about its centre:
A crude approximation. It is off by tens of percent for a real vehicle with dense engines at one end, and it is the right level of detail for understanding the behaviour.
That number is large, and largeness is the point. The vehicle is a long thin object rotating about its middle, so it responds to torque slowly. Angular accelerations of a few tenths of a radian per second squared are typical, which means attitude changes take seconds, which in turn means the attitude loop must be much faster than the guidance loop or the two will interfere. We will return to that in section 06.
Torque from the gimbal
L_arm is the distance from the centre of mass to the gimbal joint, 16 m here.
The sign is negative because deflecting the nozzle to one side pushes the tail the other way, rotating the nose toward the deflection. This is the counterintuitive part of steering a rocket and it catches people out: the vehicle rotates opposite to how a car turns.
The magnitude is worth putting numbers to. At full thrust and full gimbal,845 000 × 16 × sin 15° = 3.5 × 10⁶ N·m, giving about 0.71 rad/s², roughly forty degrees per second squared. Respectable. And exactly zero when the engine is off.
The angular acceleration is torque divided by inertia. In an earlier version of the simulator behind this article, the aerodynamic damping term was added to the torque sum but never divided by I. The code ran. It produced numbers. Those numbers reached 10302 within about three seconds of simulated time and then became NaN, and every downstream value silently became NaN with them.
The bug was invisible to inspection because the line looked correct, and invisible to unit tests that only checked that a landing was attempted. It was found by printing the state every tenth of a second and watching for the first value that stopped making sense. The lesson is cheap and worth internalising: every term you add to a sum must have the same units, and [N·m] is not [rad/s²]. Write the units in a comment next to every physical constant.
04Two actuators, and why the vehicle needs both
Here is the question that motivates this whole section. The booster already has a fully steerable engine capable of forty degrees per second squared of angular acceleration. Why bolt four heavy aerodynamic surfaces to the top of it?
Because for most of the descent, the engine is off.
The fuel-optimal strategy is to coast as long as possible and brake late. During that coast the vehicle is falling through thickening air at hundreds of metres per second with no thrust, and therefore no gimbal authority whatsoever. Without another actuator it is a lawn dart with no say in its own orientation.
Grid fin torque
A grid fin is a lattice of small aerofoils in a box. Compared to a flat plate of the same area it stalls at much higher angles of attack and has far lower hinge moment, which is why it can be small and still be moved quickly by a modest actuator. Model it as a lifting surface with an effective lift-curve slope:
Every fin effect in this article is proportional to q. That is the whole story.
The crossover
Now compare the two actuators as functions of what they depend on:
Over a descent these are almost perfectly complementary. High and fast in dense air, q is enormous and the engine is off. In the last hundred metres the vehicle is slow, q has collapsed toward nothing, and the engine is lit and at full authority. The handover between them requires no logic, no mode switch, no scheduling. It falls out of the physics.
Read the shape of the accent trace carefully, because it is not obvious. Fin authority does not increase monotonically as the vehicle descends into thicker air. It peaks and then falls, because q = ½ρv² is a product of a rising term and a falling one: density climbs as the vehicle descends, while speed drops once braking begins. The maximum sits where their product does, near three kilometres. Aerospace engineers call this region max-q, and on an ascending launch vehicle it is the moment of peak structural loading for exactly the same reason.
Weathervane stability
The fins produce torque even when they are not deflected at all, and this effect is arguably more important than their control authority.
Consider a booster falling engine-first with its body axis at some angle to the oncoming airflow. The fins sit at the top, which on a vehicle falling tail-first means they sit downstream. Air hits them at that angle of attack, they generate lift, and because they are downstream of the centre of mass that lift produces a torque that rotates the body toward alignment with the flow. It is fletching on an arrow, and it is passive: no sensor, no actuator, no controller.
A restoring moment proportional to angle of attack. This is a spring.
Move the same surfaces below the centre of mass and the sign flips. The lift now torques the body away from alignment, small disturbances grow, and the vehicle tumbles. Static stability in atmospheric flight is entirely a question of whether the aerodynamic centre of pressure sits behind the centre of mass along the direction of travel, and since a booster travels engine-first on the way down and nose-first on the way up, a vehicle that is stable in one phase is unstable in the other.
Aerodynamic damping
There is a third effect, and it is easy to miss because nothing in the geometry moves to cause it. A rotating vehicle sweeps its fins through the air at speed ω · L_fin. That transverse motion adds an angle of attack of ω·L_fin / v, purely because the fins are rotating. The resulting lift opposes the rotation:
One factor of v cancels. Damping scales with ρ·v, not ρ·v².
So the atmosphere provides a spring (weathervane) and a damper (this term), which together make the vehicle a second-order system with real dynamics of its own before any controller is attached. The fins contribute roughly ρ v S C_L,α L_fin² to the damping coefficient, which for this geometry dwarfs the contribution of the bare cylindrical body by more than an order of magnitude.
On the Moon, ρ is zero. Dynamic pressure is zero at every altitude and every speed. The fins produce no control torque, no weathervane restoring moment, and no damping. They are dead weight, and the vehicle is an undamped double integrator in attitude that will hold whatever rotation rate you leave it with, forever.
On Mars, ρ₀ is about 1.6 percent of Earth's. Fin effects are present but weak, and the throttle floor problem is worse because gravity is only 3.7 m/s², so the ratio of minimum thrust to weight is far above one. Mars landings are the hard case in this model and in reality, which is part of why every successful Mars lander so far has used a fundamentally different terminal strategy.
05Allocation: one signal, two actuators
Given a desired torque, how do you split it between gimbal and fins? The general problem is control allocation and it can get sophisticated, with weighted pseudo-inverses and constrained optimisation running every cycle.
For this vehicle there is a simpler answer that is worth understanding before reaching for anything clever. Send the same command to both, scaled and clipped to each actuator's limits:
No scheduling, no blending, no mode logic.
This works precisely because of the crossover established in section 04. When the engine is off, the gimbal command has no effect on anything, because the torque it produces is multiplied by T = 0. When q is negligible, the fin command has no effect, because its torque is multiplied by q ≈ 0. Each actuator automatically ignores commands it cannot execute, and the physics performs the blend that you would otherwise have to schedule by hand.
The lesson generalises well beyond rockets. When two actuators have naturally disjoint regions of authority, commanding both and letting the plant sort it out is more robust than writing logic to decide which one is in charge. Mode-switching logic is where systems fail, because the switch happens at a specific moment and something is always in the wrong state at that moment.
06Control: two loops, two timescales
Guidance decides where to point. Attitude control gets the vehicle pointed there. Keeping those as separate loops is the single most important structural decision in the whole stack.
The inner loop
Proportional on angle error, derivative on rate. No integral term.
The derivative term does the real work here. The plant is a double integrator: torque produces angular acceleration, which integrates to rate, which integrates to angle. Proportional feedback alone on a double integrator gives you an undamped oscillator, which will ring at √(K_p · T · L_arm / I) forever and never settle. The derivative term is what makes it a damped second-order response.
There is no integral term, deliberately. Integral action accumulates error over time to defeat steady-state bias, but a landing lasts under a minute, has no meaningful steady state, and any integrator that winds up while the actuator is saturated will keep pushing after the error has reversed. Integral windup during saturation is a classic failure and the cheapest defence is not to have the integrator.
Timescale separation
| Loop | Rate | Decides |
|---|---|---|
| Guidance | ~10 Hz | Direction and magnitude of desired acceleration |
| Attitude | 100 Hz | Actuator deflections to achieve that direction |
| Integration | 100 Hz | The physics, unaware of either |
Cascade control is valid only when the inner loop settles faster than the outer loop changes its mind. The attitude loop takes roughly a second to swing fifteen degrees; the guidance loop must therefore not meaningfully revise its command faster than that, or it will be issuing corrections based on an attitude the vehicle has not reached yet and will never reach.
Break the separation and the two loops start arguing, producing an oscillation that looks like an instability in either loop taken alone but is actually a property of the coupling. If you have access to the simulator, this is worth causing deliberately: slow the attitude loop or speed up guidance and watch a stable system come apart.
07Guidance: when to light the engine
This is the decision that determines whether the vehicle lands or arrives. Light too early and you burn propellant fighting gravity at altitude, then run dry. Light too late and no amount of thrust can stop you.
Start from constant-acceleration kinematics, the same expression from a first mechanics course, and ask what deceleration is required to arrive at the ground at the touchdown speed:
Divide by what the vehicle can actually produce, and you have a single dimensionless number that describes the entire situation:
Light the engine when κ reaches 1.
κ below one means you are falling more slowly than you need to, and could afford to fall further. κ at one means braking at full authority will exactly reach the ground at the target speed. κ above one means the situation is already unrecoverable and no control input exists that prevents a crash.
The popular name for triggering at κ = 1 is the suicide burn, and the name is honest. It is fuel-optimal, because it delays the burn as long as physics permits. It also has, by construction, exactly zero margin: at the moment of ignition, full thrust is the only survivable input, so any subsequent disturbance, modelling error or actuator lag eats into a budget that is already empty.
Real vehicles trigger at κ somewhat below one and hold the reserve. Deciding how much reserve is the central engineering trade of the whole descent, and it is a trade, not a calculation: propellant spent on margin is propellant unavailable for payload.
A reference profile
Once lit, one approach is to track a reference descent rate derived from the same kinematics, and use feedback to stay on it:
A feedforward term that knows the physics, plus a feedback term that fixes the difference.
This is easy to reason about and easy to tune, which are real virtues. Its weakness is that it controls altitude and vertical speed as a decoupled problem and treats horizontal position as an afterthought, so it lands with more residual horizontal velocity than it should.
08ZEM/ZEV guidance
The more capable law asks a different question. Not "am I on the right descent rate" but "given where I am and where I need to be, what acceleration profile gets me there".
Define two quantities. Zero-effort miss is where you will be at arrival if you do nothing from now on. Zero-effort velocity is the velocity error you will have under the same assumption.
Both include gravity, because gravity acts whether or not you do.
Now pose the optimisation: find the acceleration history that nulls both, while minimising ∫ |a|² dt. Calculus of variations gives a two-point boundary value problem whose solution has a striking property: the optimal acceleration is linear in time. Write a(t) = c₀ + c₁t, integrate twice, impose the terminal conditions on position and velocity, and solve the resulting 2×2 system. The command at the current instant is:
Three lines of code, and it handles all three axes simultaneously with no separate lateral controller.
Several things are worth noticing. It is a feedback law, not a trajectory: recompute it every cycle against the current state and it corrects for everything that has gone wrong since the last cycle. It is also the same structure as Apollo's E-Guidance and as proportional navigation in missile guidance, which is not a coincidence. Terminal guidance problems keep producing this form because minimising integrated square acceleration subject to fixed endpoint conditions is a recurring shape.
Minimising ∫|a|²dt is not the same as minimising propellant, which would be ∫|a|dt. The quadratic cost is chosen because it is analytically tractable, and it produces smooth commands that respect actuator limits better. The fuel-optimal solution is bang-bang, all or nothing, which is harsh on hardware and offers no margin.
The term everyone gets wrong
Notice that t_go appears in a denominator, squared. As the vehicle approaches touchdown, t_go → 0 and the commanded acceleration goes to infinity. Every implementation needs a floor on t_go and a saturation on the output, and the terminal phase is where these laws are most fragile.
There is a deeper trap. It is tempting to treat t_go as a free variable and solve for the value that minimises cost. In practice that optimisation tends to select aggressive short times, produce large commands, and run the tanks dry. Estimating t_go from simple geometry, t_go ≈ 2h / (|v| + v_t), works better than optimising it, which is an uncomfortable but repeatable result.
09Crossrange: the phase with its own deadline
Flying sideways is not a small correction added to the descent. It is a separate problem with a separate deadline, and getting that deadline wrong is the most common way a well-implemented guidance law still misses the pad.
The naive approach targets zero lateral offset at touchdown. It fails, and the reason is a hard constraint rather than a tuning issue. In the last thirty metres the tilt limit must fold toward vertical, because a booster that arrives leaning lands on one leg and falls over. Folding the tilt limit removes lateral authority at exactly the moment the naive law is relying on it. The arithmetic is unforgiving: about 3 m/s² of remaining lateral acceleration over under two seconds is roughly 5 m/s of steering, total. Arrive at thirty metres with 12 m/s of drift and no control law saves it. The geometry decided the outcome several seconds earlier.
The fix is to give the crossrange problem an earlier deadline than touchdown:
The same ZEM/ZEV algebra, restricted to the horizontal plane, on a different clock.
Kill the crossrange by forty-five metres, then descend. Real landers sequence it the same way, and once you see the authority argument it is hard to imagine sequencing it otherwise.
The floor of eleven seconds looks wrong. Why would you deliberately give the controller a horizon longer than the time it actually has?
Because a short horizon makes the law hot. With t_go in the denominator squared, a short clock demands acceleration far beyond what the tilt limit can deliver. The command saturates, the vehicle overshoots the pad, comes back, overshoots again, and arrives with more lateral velocity than it started with. Slowing the clock keeps the command inside the achievable envelope, so the divert converges monotonically instead of ringing. In the reference implementation, that one change moved Earth landing success from three of seven entry states to six of seven.
The general principle: a controller that asks for more than the plant can deliver is not aggressive, it is open loop. Once saturated, feedback has stopped functioning, and the sign of the error no longer influences the output.
Trigger on projected miss, not present offset
One more subtlety in the ignition logic. The decision to light early for a divert must be based on where drift will have carried the vehicle by arrival, not where it is now:
A booster drifting at 12 m/s with eight seconds remaining will be a hundred metres off target even while it is directly above the pad at this instant. Triggering on present offset says everything is fine right up until it is not.
10Numerics: where good physics goes to die
Everything above is continuous mathematics. A computer must approximate it in discrete steps, and the approximation has failure modes of its own that look exactly like physical instabilities.
Integrator choice
Forward Euler is the obvious method and the wrong one. Its local error is second order, its global error first order, and for oscillatory systems it does not merely lose accuracy, it injects energy. An undamped oscillator integrated with forward Euler will grow in amplitude without any physical reason. On a vehicle whose attitude dynamics are a lightly damped oscillator, that is fatal.
Classical fourth-order Runge-Kutta evaluates the derivative four times per step and combines them so that error terms through fourth order cancel:
Four derivative evaluations, fourth-order global accuracy. At h = 0.01 s the truncation error is far below anything else in the model.
Fixed step, and why
Adaptive integrators shrink the step where the solution moves fast and are more efficient for the same accuracy. They are also non-deterministic in wall-clock time, which means a simulation is not exactly reproducible, and reproducibility is worth more than efficiency when you are hunting a bug that appears once in forty runs. Fixed step also matches how flight software actually executes, on a fixed-rate scheduler.
Zero-order hold
The control input u does not appear inside the four stages above. It is computed once at the start of the step and held constant throughout, which is what real digital control does: the actuator command changes only at sample instants.
This has a consequence people frequently miss. The plant is integrated to fourth-order accuracy, but the control is only piecewise constant, which is first-order accurate.
This section is unfinished in the source draft -- it cuts off mid-sentence here. Picking it back up (and whatever came after it) is a future increment.