BIBLE MARS — REFERENCE DOSSIER

Human Mars lander: the EDL problem above 20 tonnes

Heavy crewed Mars lander in terminal descent, retropropulsion engines firing and dust lifted from the surface. — Conceptual visualisation of a heavy crewed lander in terminal descent. At large mass, retropropulsion must control velocity, attitude, propellant margin, plume–surface interaction and sensor visibility at the same time; the dust shape is illustrative rather than a CFD result.

MEASURED / DEMONSTRATEDENGINEERINGEXPLICIT SCENARIO

Why twenty tonnes changes the physics of landing

“Human Mars lander: the EDL problem above 20 tonnes” addresses the scaling break between robotic heritage and human-class landed payloads around 20 tonnes or more.

The central observables are landed mass, concept aerodynamic area, thrust, propellant, dispersion and structural margin.

Those omissions are engineering information.

the published roughly 1,025 kg value is the landed Perseverance rover mass; NASA human studies consider roughly 20 t or larger landed payload classes depending on concept

This evidence is used only for what it demonstrates.

Recompute scale factor = m₂/m₁; any geometric scaling law must define the shapes being compared with units visible. The result is not accepted in isolation: then check whether the change also modifies landed mass, concept aerodynamic area, thrust, propellant, dispersion and structural margin.

Landed mass is a coupled design variable

For a human-class lander, landed mass is not useful as a single headline number. The engineering question is how that mass is divided among structure, propellant still aboard at ignition, landing gear or other touchdown hardware, life-support equipment and payload that must remain usable immediately after landing. Increasing mass raises more than one demand at once: ballistic coefficient, required thrust, propellant retained for the terminal phase and structural loads all move together. A credible margin therefore closes vertical speed, crew acceleration, engine-out stopping capability, ground clearance and stability on the expected slope distribution. A thrust reserve computed at a convenient propellant state is not the reserve available in the actual worst case.

The decisive integrated test is consequently a family of off-nominal cases rather than one clean landing. Landed mass, centre of gravity, navigation dispersion, atmospheric density and loss of a propulsion element must be varied together to determine whether a reachable safe set still exists. A human vehicle also has a post-touchdown requirement: crew, refuge, cargo and critical resources must remain accessible after the most energetic event in the surface campaign, including cases in which the landing system itself is damaged.

Comparing heavy-lander architectures without hiding margins and failure modes

avoiding false rule-of-three scaling because mass changes aerodynamics, propulsion, structure, control and surface interaction together

parametric architecture studies, integrated simulation, demonstrators, precursor cargo flights and progressive qualification

Verification asks whether the requirement is met;

From the first crewed lander to a surface logistics chain

Why twenty tonnes is already a category change

Historical Mars landers delivered masses far below those of a human habitat, reactor, pressurized rover or return inventory. Moving to 20 tonnes is therefore not simply building a rover twenty times heavier. Frontal area does not automatically grow with mass, parachutes become enormous, deployment loads rise and available atmospheric time remains short. NASA human-EDL studies use this class as a regime where inherited architectures must be substantially changed.

Ballistic coefficient exposes the effect. With constant 15 m diameter and Cd = 1.5, β rises from about 75.5 kg/m² at 20 t to roughly 377.3 kg/m² at 100 t. At fixed area, five times the mass produces five times β. The heavy vehicle retains speed into denser, lower atmospheric layers, shrinking altitude available for everything that follows. Increasing area, generating lift or igniting engines earlier are three different ways to recover margin.

For settlement, 20, 50 and 100 t classes are not interchangeable. Twenty tonnes might represent a specialized module; fifty tonnes a large habitat or industrial unit; one hundred tonnes an integrated vehicle or massive cargo shipment. Each class needs its own energy, thrust, propellant, aerodynamic-area and dispersion budget. Saying that a technology ‘can land 100 tonnes’ without those budgets is not a demonstration.

The critical transition to retropropulsion

Supersonic retropropulsion is attractive because it does not depend on a parachute capable of handling the entire payload. Engines can begin removing speed at high Mach number and continue through touchdown. But this requires starting, feeding and controlling high-power propulsion while atmospheric flow is striking the vehicle. Plume/external-flow interaction changes pressure, moments and sometimes sensor measurements.

Ignition timing is a trade. Igniting early creates altitude margin but consumes more propellant. Igniting late saves fuel but brings the vehicle closer to the ground with substantial energy remaining. Thrust must exceed Martian weight with enough authority to control attitude, while preserving capability after an engine loss if that failure is in the requirements. Engines must also throttle: hardware designed only for maximum thrust can struggle to deliver a soft touchdown after the vehicle has become much lighter.

Tank integration becomes central. Landing propellant is carried through the transit unless another refueling strategy exists. It must remain available despite slosh, microgravity and maneuvers. Engine feeds must not ingest vapor during the critical burn. Propellant management devices and pressurization are therefore part of EDL even though they are invisible in animations.

Ballistic coefficientβ = m/(Cd × A)

With Cd = 1.5 and 15 m aerodynamic diameter: β ≈ 75.5 kg/m² at 20 t; 188.6 kg/m² at 50 t; 377.3 kg/m² at 100 t. Teaching example, not a real-vehicle design.

Touchdown: engines meet the ground

As the vehicle descends, plumes encounter unprepared ground. Martian regolith can be mobilized, accelerated and ejected. At small scale this is dust on instruments; at large scale it becomes erosion, cratering, particle return toward the structure and danger to nearby infrastructure. Engine geometry—central or peripheral placement, height and angle—changes the surface pressure field.

A crewed lander must remain stable after contact. A slope, one foot on a rock, a sinking leg or residual tank load shifts the center of gravity. For a tall vehicle, allowable tip angle can dominate site selection. Terrain sensing and descent control must therefore seek not just obstacle-free ground but geometry compatible with static stability.

Finally, the lander must become infrastructure after being a vehicle. Doors must open despite dust, power systems must connect, cargo must be unloaded and crew must reach the surface. A safely landed vehicle that cannot be unloaded has not completed its mission. Material-handling equipment, elevators, cranes, ramps and robots therefore belong in the mass budget of a heavy lander.

20, 50, 100 Tonnes: an energy illustration

At the same 5.5 km/s speed, kinetic energy grows directly with mass. Twenty tonnes represents about 302.5 GJ; fifty tonnes about 756.2 GJ; one hundred tonnes about 1,512.5 GJ. Five times the mass gives exactly five times the energy. Mars’s atmosphere does not become five times denser to help. Architecture must therefore increase area and lift, accept more heating, provide more thrust and propellant, or combine these levers.

This comparison does not predict heat absorbed by the shield: much energy goes into shock-layer gas and is distributed along the trajectory. It exists to establish scale. A human vehicle is not an enlarged rover; its energy budget approaches major industrial phenomena. Thermal and propulsion margins must therefore be treated quantitatively, not by visual analogy.

For a settlement fleet, total energy per opportunity is likewise large. Ten 100 t vehicles arrive with more than 15 TJ of kinetic energy to be dissipated across the campaign. Arrivals must be spaced to avoid traffic conflicts, dust contamination and surface-team saturation. EDL becomes a capacity-management problem like an airport, but with far rarer and far more energetic events.

A human-class contingency landing zone

A robotic lander can accept mission loss without endangering people. A crewed vehicle must consider what happens when the primary point becomes unavailable. Several compatible zones can be prepared with distributed depots, beacons and surface routes. Precision navigation shrinks dispersion, but resilience comes from making an error survivable.

Contingency sites must account for suit and rover range, maximum distance to habitat, communications and power. A perfectly flat zone fifty kilometers away with no rover may be less safe than a more demanding zone five kilometers from refuge. The hazard map therefore needs operational information, not geology alone.

In the long term, multiple prepared pads also separate cargo, crew and emergency arrivals. Specialization reduces incident consequences and allows one pad to be inspected while others remain available. A Martian spaceport becomes a redundant system like other critical infrastructure.

Heavy landing is an architecture problem before it is an engine problem

A heavy lander forces decisions upstream. If touchdown propellant is carried from Earth, its mass affects launch and transit; if it is produced at Mars, the production plant must arrive earlier and demonstrate output before a crew depends on it. If a large aeroshell is required, launcher diameter and on-orbit assembly become constraints. If a lifting vehicle is selected, center-of-mass control and aerodynamic authority affect internal packaging. The landing system therefore cannot be optimized after the spacecraft is designed: it shapes the spacecraft from the first mass model.

Heavy cargo also changes what 'success' means after touchdown. A hundred-tonne payload may contain several systems that must be separated, unloaded and moved before they become useful. The surface team needs lifting, towing, electrical isolation and safe access around a vehicle that may still contain hazardous propellants. Dust and plume erosion can contaminate solar arrays, seals and optical systems. A landing-zone concept must therefore include post-landing safing and unloading timelines, not stop at zero vertical velocity.

For human missions, contingency mass is real mass. Engine-out capability, landing reserve, backup navigation, fire suppression, emergency egress and surface survival kits all compete with nominal payload. Removing them can make performance look spectacular on paper while reducing survivability. The correct comparison between heavy-lander concepts must therefore use the same safety assumptions and reserve policy; otherwise mass numbers that appear comparable describe fundamentally different missions.

Beyond twenty tonnes, a lander is not just a scaled-up rover

Robotic missions have progressively increased landed mass on Mars, but human-scale delivery changes several variables at once. Mass tends to grow faster than frontal area, ballistic coefficient rises, the vehicle remains fast deeper in the atmosphere, and the descent system must remove more energy in less time. The important threshold is therefore not the number “20 tonnes” by itself; it is the change of physical regime that appears when a very large vehicle is forced through a thin atmosphere.

A simplified ballistic coefficient is β = m / (C_DA). The Greek letter β (“beta”) is expressed in kg/m², m is mass in kilograms, C_D is the dimensionless drag coefficient, and A is reference area in m². Increasing area helps a heavier vehicle, but a very large aeroshell brings its own launch, structural, heating, and control penalties.

Order of magnitude — how mass changes ballistic coefficient

Take a 65,000 kg vehicle, A = 80 m², and C_D = 1.5. Then β = 65,000 ÷ (1.5 × 80) ≈ 542 kg/m². Raise mass to 80,000 kg without changing area or drag coefficient and β becomes about 667 kg/m². The symbol ÷ means division and × means multiplication. These are teaching values, not a declared NASA vehicle design.

A higher ballistic coefficient generally requires denser atmosphere or a longer atmospheric path to achieve a comparable deceleration. On Mars, density is low and varies with elevation, season, temperature, and dust. Landing-site altitude therefore becomes part of the energy budget: a lower site provides more atmospheric column before the ground is reached.

Supersonic retropropulsion turns the engine into part of the aerodynamics

Human-scale studies have repeatedly considered supersonic retropropulsion: firing descent engines while the vehicle is still supersonic. The exhaust plume does not simply point downward. It alters the flowfield, interacts with shocks, can affect aerodynamic forces, and creates a control transition from primarily aerodynamic deceleration to propulsion-dominated flight.

Mars thrust-to-weight is a first constraint. If vehicle mass is m and Mars gravity g_M is about 3.71 m/s², weight is m × g_M. A 70,000 kg vehicle weighs roughly 260 kN on Mars. A total thrust of 780 kN corresponds to a Mars thrust-to-weight ratio near 3 before trajectory losses and control margins. That ratio does not by itself define a safe descent, but it shows the scale of the thrust requirement.

An engine-out event is also a geometry problem. Losing one engine removes thrust and can create a moment if the cluster becomes asymmetric. Gimbal authority, response time, remaining-engine margin, and centre-of-gravity motion as propellant is consumed must be analysed together. “N+1 engines” is not proof of fault tolerance unless the remaining configuration can actually control the vehicle.

The Martian surface becomes part of the propulsion system during the final seconds

Near touchdown, rocket plumes can erode regolith, eject particles, excavate beneath a footpad, obscure sensors, and expose nearby structures to dust and debris. For a settlement, that problem extends beyond the lander: habitats, radiators, antennas, solar arrays, and previously landed vehicles all become part of the hazard analysis.

A prepared pad may reduce risk, but it has to exist before a regular cadence of heavy landers can depend on it. Robotic precursor construction, site inspection, grading, and marking can therefore become architectural prerequisites. A settlement expecting repeated cargo arrivals eventually needs landing infrastructure rather than an unprepared patch of terrain.

Plume-driven dust can also degrade optical sensors used for hazard detection or relative navigation. Robust designs combine modalities such as inertial sensing, radar or lidar, cameras, and velocity or altitude estimates. The objective is not sensor count; it is avoiding a common cause in which one dust cloud defeats every measurement the controller still needs.

Packaging, centre of gravity, and surface access must be solved together

A human lander packages payload, tanks, engines, primary structure, legs, power equipment, and possibly a habitat or ascent system. The centre of gravity must remain within a range compatible with entry and powered control. Moving cargo to simplify unloading can worsen entry trim; adding shielding changes moments; propellant depletion moves the centre of gravity during the descent itself.

Surface access is another mass driver. A tall vehicle needs lifts, cranes, stairs, or ramps that must still work after cruise, cold soak, and dust exposure. Mass saved in the basic aeroshell can be lost in a complicated unloading system. The useful design question is therefore not “how much mass reaches the surface?” but “how much usable, maintainable capability reaches the surface?”

NASA’s EDL Architecture Study used manifests that included multiple landers with payloads around 22 tonnes. The lesson is not that a single design has been selected. It is that EDL geometry and the surface manifest are coupled: packaging feasibility, centre of gravity, and access constraints are part of the landing architecture.

Four faults that should influence the design before flight

Late ignition of one retropropulsion engine

Vertical speed remains high and the recovery timeline collapses. The controller must redistribute thrust, preserve attitude margin, and determine whether maximum thrust still permits a controlled touchdown. The design should know the lowest altitude at which that class of fault is still recoverable.

Centre of gravity moves outside the expected envelope

Uneven propellant consumption, fluid motion, or shifted payload changes dynamics. Estimation must distinguish a sensor fault from a real vehicle change. Control can compensate only until actuator or gimbal authority saturates.

Optical visibility is lost in the plume

Navigation must continue with sensors less sensitive to dust. If optical terrain matching is still required very low, the architecture needs a defined transition to inertial/radar or lidar-based estimates. The timing of that handover is a safety decision.

The touchdown zone is partly blocked

A late hazard may require lateral translation. That consumes propellant and changes plume interaction. Diversion limits must therefore be explicit: below some altitude or fuel reserve, searching for a “better” spot can become more dangerous than completing the current approach.

Primary references include NASA NTRS — Human Mars Entry, Descent, and Landing Architecture Study: Phase 3 Summary, which discusses human-scale vehicles and roughly 20–22 t payload manifests, and NASA NTRS — Entry, Descent, and Landing Performance for a Mid-Lift-to-Drag Ratio Vehicle at Mars, which studies supersonic retropropulsion for human-scale delivery. These are studies and simulations, not an operational lander specification.

A twenty-tonne lander is not a scaled-up rover

The scale jump changes ballistics, structures, propulsion, and surface operations at the same time. A much heavier entry vehicle carries far more kinetic energy and cannot simply receive a proportionally larger parachute. Mars offers limited dynamic pressure, while aeroshell size is constrained by launch, orbital assembly, and structural stiffness. NASA human-EDL studies therefore examined systems delivering payloads on the order of twenty metric tons and architectures in which supersonic retropropulsion becomes a central phase rather than a final trim manoeuvre.

Mass must be read in layers. Payload on the ground is not entry-interface mass. Structure, thermal protection, engines, tanks, descent propellant, avionics, landing gear, margins, and discarded hardware all sit above it. A “20 t payload” requirement can therefore imply an entry vehicle of several tens of tonnes. Extra structural mass requires more propellant; propellant requires tank and support mass, creating a strongly coupled mass loop.

Ballistic coefficient shows why aerodynamic area matters

A useful quantity is β = m/(C_DA). Here m is vehicle mass in kg, C_D is dimensionless drag coefficient, and A is reference area in m². β has units kg/m². At constant mass, more area or drag reduces β and lets the atmosphere slow the vehicle higher. At constant geometry, more mass raises β and pushes deceleration deeper into the thin atmosphere.

Example — area and β

With m = 50,000 kg, C_D = 1.5 and A = 200 m², β ≈ 167 kg/m². Increasing A to 300 m² under the same assumptions gives about 111 kg/m². This is not a trajectory solution—C_D, lift and atmospheric density vary—but it explains why large-mass studies explore lifting bodies and deployable decelerators rather than simply making a dense capsule larger.

Retropropulsion is an aerodynamic-propulsive transition

Lighting engines at supersonic speed in an atmosphere is not the same as braking in vacuum. Plumes interact with the external flow and alter pressures, moments and stability. Small changes in configuration, thrust or attitude can therefore change both trajectory and loads. NASA work still identifies representative hot-gas, multi-engine test and validation gaps for human-scale systems; promising simulation results must not be presented as qualified capability.

Ignition timing is architectural. Too early consumes propellant; too late reduces stopping margin and increases sensitivity to an engine fault. Throttle and attitude can trade energy against lateral reach, but reserve must remain for dispersions and touchdown. Near the ground, plumes also entrain dust and debris, so EDL cannot be separated from landing-zone design.

What a human architecture must prove

A credible architecture must close at least five evidence chains: known-enough aerodynamics, thermal protection across dispersions, propulsion that starts reliably after cruise, autonomous navigation to a reachable safe region, and engine-out logic. It must also show that plume effects do not create unacceptable hazards to crew, sensors or nearby infrastructure.

“Twenty tonnes” should therefore remain a study-scale order of magnitude, not an operational promise. NASA Phase 3 work evaluated vehicles carrying about 20 t human-scale payloads, and related manifest studies used three roughly 22 t landers. Those numbers define the challenge; they do not mean a human Mars landing system of that class is qualified today.

Primary sources: NASA NTRS — Human Mars Entry, Descent, and Landing Architecture Study: Phase 3 Summary; NASA NTRS — New Developments in Retropropulsion Testing for Mars Entry, Descent, and Landing.

human lander energy chain — Chapter-specific synthesis diagram.

Packaging and centre of gravity can reject an otherwise good mass solution

A human-scale lander is not only a scalar mass. Payload location sets centre of gravity, moments of inertia and structural load paths. A large aeroshell may have adequate drag yet become uncontrollable if centre of gravity cannot be placed within the guidance envelope. NASA Phase 3 work explicitly included packaging and centre-of-gravity feasibility for reference payload manifests.

Surface unloading also feeds back into layout. A habitat, ascent vehicle or power unit must leave the lander without creating unacceptable ramps, cranes or tip-over risk. “Twenty tonnes delivered” is useful only when the payload can be accessed and integrated into surface operations.

Engine-out authority must be demonstrated with geometry, not slogans

If one engine fails, remaining engines may need to throttle asymmetrically. Whether they can do so depends on thrust-vector location, centre of gravity, control authority and remaining altitude. An engine-out case therefore couples propulsion, structure, GNC and landing-gear limits.

Case study — verify braking for a heavy human payload

For 20,000 kg on Mars, weight is m g = 20,000×3.71 ≈ 74.2 kN. With 120 kN, thrust-to-weight is only 1.62. If 80 m/s must be removed over 400 m, a = v²/(2s) = 8 m/s² and ideal thrust needed to decelerate while supporting the vehicle exceeds m(a+g) ≈ 234 kN.

Slow thrust build-up or altitude bias can consume tens of metres before diagnosis. Guidance may need to reduce divert or accept another landing point rather than pursue an impossible geometry.

Engine tests, six-degree-of-freedom dynamics and Monte Carlo campaigns must close touchdown speed, attitude, propellant reserve and hazard clearance after a representative fault.

Touchdown is not complete until the heavy vehicle is mechanically stable

A human-class lander carries enough mass that landing-leg stroke, footpad pressure, slope and residual horizontal velocity become part of the EDL problem. A vehicle can meet vertical-speed limits and still tip, sink or overload a leg if the surface is weaker or more inclined than assumed. Terminal guidance therefore needs a landing zone whose terrain statistics are compatible with the mechanical design, not merely a point that is reachable.

After contact, engine shutdown timing also matters. Thrust that persists too long can unload one leg and drive another into the soil; shutdown that occurs too early can increase sink rate. The final acceptance state is a stable vehicle with known attitude, structural margins and a surface that can support subsequent unloading or ascent operations.

Touchdown stability must include mass migration and engine-out cases

A heavy human lander does not arrive with a perfectly fixed center of mass. Propellant depletion moves liquid between tanks and leaves residuals; landing gear deployment changes geometry; cargo may be distributed asymmetrically; crew and movable equipment contribute smaller but real offsets. Touchdown analysis therefore has to sweep center-of-mass location together with horizontal velocity, surface slope, leg stroke and contact timing. A stable nominal pose on level ground is not enough evidence.

The relevant mechanics can be understood through the overturning moment. A lateral force acting at a high center of mass creates a moment that must remain below the restoring moment generated by vehicle weight acting through the support polygon. Increasing landing-leg span helps, but it adds mass and deployment complexity. Lowering the center of mass helps, but it can conflict with tanks, engines and cargo layout. Reducing residual lateral speed helps all cases and places a direct requirement on navigation, guidance and terminal control.

Engine-out behavior is coupled to this problem. If one engine loses thrust late in descent, the controller may compensate with the remaining engines, but that compensation can introduce lateral acceleration, attitude excursion and uneven plume loading just when there is little altitude left to recover. A credible design therefore evaluates whether to continue, divert or command an early safe shutdown as a function of altitude and remaining control authority. The acceptance test is not simply “the vehicle can hover with one engine out”; it is whether the combined guidance, structure, gear and propulsion system can still reach a survivable contact state.

Sources and references

Primary sources to read

Primary sources and research landmarks

Sources used for this expansion, checked 2026-08-14.