BIBLE MARS — REFERENCE DOSSIER

Mars entry, descent and landing: understanding the complete EDL chain

MEASURED / DEMONSTRATEDENGINEERINGEXPLICIT SCENARIO

Entering the Martian atmosphere: a chain of energy that must be dissipated

“Mars entry, descent and landing: understanding the complete EDL chain” addresses the EDL chain as a sequence of energy states and irreversible decisions.

The central observables are velocity, altitude, kinetic energy, Mach number, dynamic pressure, deceleration and event state.

Those omissions are engineering information.

Mars 2020 provides demonstrated flight heritage while human-Mars studies provide scaling evidence rather than one universal recipe

This evidence is used only for what it demonstrates.

Recompute E_k = 1/2 m v² with units visible. The result is not accepted in isolation: then check whether the change also modifies velocity, altitude, kinetic energy, Mach number, dynamic pressure, deceleration and event state.

EDL is a chain of compatible states

Entry, descent and landing must be designed as a sequence of states rather than a catalogue of devices. The vehicle enters with a certain energy and state uncertainty; each phase has to reduce one without delivering an impossible condition to the next. Thermal protection can survive the heating pulse yet still leave a velocity or altitude incompatible with parachute deployment. A parachute can produce excellent drag and still release the vehicle too low or in the wrong attitude for powered descent. Transition logic therefore belongs to velocity, Mach number, dynamic pressure, altitude and the quality of the estimated state, not to a clock alone.

EDL margin is measured in time and altitude as much as in kilograms. A few extra seconds in one phase take height away from the next. A navigation error can move the vehicle toward terrain that requires more divert precisely when propulsion is already consuming its reserve. Integrated simulation must propagate dispersions all the way to touchdown and test whether apparently independent protections actually depend on the same atmospheric model or navigation source.

Measuring the margins of a complete EDL architecture

partitioning deceleration among aerodynamics, decelerators, propulsion and guidance without merely moving risk into the next event

six-degree-of-freedom simulation, dispersion Monte Carlo, subsystem testing and flight-telemetry reconstruction

Verification asks whether the requirement is met;

Making landing a repeatable capability rather than a one-time feat

Seven minutes tell only part of the problem

The phrase ‘seven minutes of terror’ popularized Mars EDL but can hide the engineering. Entry starts with enormous kinetic energy and ends near zero velocity. For 20 tonnes arriving at 5.5 km/s, kinetic energy is about 302.5 GJ—roughly the energy of 72 tonnes of TNT if 4.184 GJ per tonne of TNT is used solely as an energy comparison. At 100 tonnes it reaches about 1.51 TJ. That energy does not explode; it must become atmospheric and heat-shield heating, aerodynamic work and finally rocket exhaust. EDL is the art of dissipating this energy without simultaneously exceeding thermal, structural, propulsion and human limits.

Viking established a foundational combination of aeroshell, parachute and terminal rockets. Pathfinder and the Mars Exploration Rovers added airbags. Phoenix and InSight used legs and terminal propulsion. Curiosity and Perseverance introduced the sky crane for heavy rovers, and Perseverance added Range Trigger and Terrain Relative Navigation. The history is a progression: each generation does not merely replace a device; it gains capability in mass, precision or access to more hazardous terrain.

The jump to human-class payloads is qualitative. NASA studies emphasize that conventional parachutes do not simply scale to roughly 20-tonne payloads. A heavy vehicle carries more inertia per aerodynamic area, traverses the thin atmosphere quickly and can reach the surface before a practical parachute has removed enough energy. This motivates studies of large inflatable decelerators, lifting shapes and especially supersonic retropropulsion, where engines begin braking while the external flow is still supersonic.

The three regimes: hypersonic, supersonic, subsonic

During hypersonic flight, the heat shield and vehicle shape convert motion into shock heating and aerodynamic work. Drag follows D = ½ρv²CdA. The term ½ρv² is dynamic pressure q. This equation explains an apparent Martian contradiction: density ρ is low, but speed v is so high that v² partly compensates. As an illustration, with ρ = 0.015 kg/m³ and v = 1,000 m/s, q is 7,500 Pa or 7.5 kPa. This is not a universal trajectory point, only a demonstration of quadratic speed sensitivity.

The supersonic transition is difficult because the vehicle changes mode while the flow remains severe. Supersonic parachutes have a remarkable Mars heritage, but deployment produces transient loads and diameter becomes problematic for very large payloads. Supersonic retropropulsion attempts to operate engines into an opposing high-speed flow. Plumes change pressure around the vehicle; the interaction is not a simple subtraction of thrust and drag. Testing and simulation must capture the coupling.

In subsonic and terminal descent, precision and control dominate. Radar or lidar measures altitude and relative velocity, cameras can identify terrain, and propulsion must remove the final meters per second while preserving reserve. At tens of meters, plumes lift dust and regolith, can excavate the surface and eject particles toward the vehicle or nearby infrastructure. The final fraction of descent is therefore linked to the design of a future landing zone.

Drag and dynamic pressureD = ½ρv²CdA; q = ½ρv²

D: drag; ρ: density; v: speed; Cd: drag coefficient; A: reference area; q: dynamic pressure. Illustrative example: ρ = 0.015 kg/m³ and v = 1,000 m/s gives q = 7.5 kPa.

Why mass changes everything: ballistic coefficient

Ballistic coefficient β = m/(Cd·A) captures a central idea. As mass m rises without a proportional increase in area A, β rises and the vehicle penetrates deeper before slowing. Consider an idealized 15 m diameter aerodynamic disk with Cd = 1.5. Frontal area is about 176.7 m². At 20 t, β is about 75.5 kg/m²; at 50 t, 188.6 kg/m²; at 100 t, 377.3 kg/m². Geometry is unchanged, but the heavy payload carries five times the inertia for the same geometric drag capability.

Increasing diameter is an obvious response, but a rigid aeroshell is limited by launcher diameter and structure. HIAD concepts seek to deploy an aerodynamic area larger than the launch envelope. Lifting bodies use greater lift-to-drag ratio to fly farther through the atmosphere and modulate loading. Each solution moves the difficulty: deployment and thermal survival for inflatables, mass and control for lifting bodies, propulsion and propellant for SRP.

The scaling problem is not that an old technology suddenly ‘stops working’ at a magical mass. Rather, margins close: available altitude, deployment time, area, dynamic pressure, stability, thrust, propellant and distance to the ground become difficult simultaneously. The 20 t class often appears in human-landing studies because it is already far above historical Mars landed masses; settlement vehicles carrying 50 or 100 t push the design space further.

Seeing the ground: precision, TRN and hazard detection

Perseverance marked an important step by using terrain-relative navigation: images acquired during descent are compared with an onboard map to estimate position and avoid hazardous areas. This changes exploration geography. Wide landing ellipses favored broad safe plains; better precision allows access nearer scientifically valuable but hazardous terrain. For settlement, the same logic can target a logistics zone near pre-positioned infrastructure.

TRN does not replace other navigation. An inertial measurement system provides accelerations and rotations, radar or lidar provides altitude and relative velocity, maps provide absolute reference, and state-estimation filters fuse measurements with uncertainty. A dust-obscured camera, disturbed radar or misregistered map must not immediately generate a hazardous command. The system must know which sensor to trust and when to relax precision.

‘Safe site’ itself evolves. A small probe may only need to avoid a rock. A human-class lander also needs acceptable slope, a surface that plume interaction will not catastrophically disturb, safe distance from habitats, traversable routes and perhaps access to beacons. Settlement hazard detection therefore combines natural terrain with infrastructure maps.

A failure tree instead of a perfect animation

An EDL animation shows a flawless sequence. Engineering must describe branches where events diverge. If the heat shield runs hotter than predicted, what margin remains? If a parachute does not fully inflate, can propulsion begin earlier? If an engine fails, can remaining thrust preserve attitude control? If TRN cannot localize, is there a fallback landing ellipse? Every branch must lead toward a safe state or be explicitly recognized as loss of mission.

For humans, the requirement rises further: common-cause failures must be examined. Two identical radars can be blinded by the same phenomenon; multiple engines can share software; two computers can ingest the same faulty sensor. Physical redundancy is insufficient when chains share a cause. Tests must seek correlated errors and off-nominal scenarios.

Qualification of heavy EDL will likely not rest on a single terrestrial test. Martian gravity, atmospheric density, composition and full scale cannot all be reproduced simultaneously on Earth. Wind tunnels, engine tests, high-altitude campaigns, flight demonstrators, validated computation and ideally progressive Mars demonstrations must be combined. The objective is a converging chain of evidence, not a claim that one simulator ‘proves Mars.’

From isolated landing to a Martian spaceport

First missions will land on natural terrain. A durable settlement will benefit from progressively engineering the area: geotechnical survey, marking, separation from habitats, roads, hardened or prepared pads, possible deflectors, recovery equipment and fire procedures. As cadence rises, risk comes not only from the lander but from interactions with nearby infrastructure.

Plumes sit at the center of this transition. High-velocity jets can erode regolith, eject particles and excavate a crater. Expensive infrastructure could be damaged by debris from another landing. Safety distances and surface materials therefore become urban-planning parameters. Where a spacecraft fires its landing engines can determine where the first settlement districts are built.

A Martian spaceport is therefore the logical end state of EDL: not merely onboard technology, but a system combining vehicle, navigation, weather, surface engineering, communications, maintenance and traffic management. Settlement exposes what one-off exploration can hide: landing is a network operation.

Certification requires evidence across scales and environments

Human Mars EDL cannot be certified by heritage alone. Viking, Phoenix, Curiosity and Perseverance establish invaluable physics and operational heritage, yet a human-class lander changes mass, geometry, propulsion authority, touchdown hazards and consequence of failure. Qualification therefore has to decompose the problem. Thermal-protection materials can be tested in arc-jet facilities; engines and throttling can be tested on Earth; parachute or inflatable decelerator behavior can be explored in flight tests; plume interactions can be measured and simulated; guidance software can be exposed to Monte Carlo campaigns with thousands of atmosphere, sensor and engine cases. No single test reproduces Mars, but multiple validated lines of evidence can converge.

Monte Carlo analysis is especially important because EDL is driven by uncertainty. Atmosphere density, winds, aerodynamic coefficients, navigation error, engine performance and sensor noise vary simultaneously. The question is not whether the nominal trajectory succeeds but what fraction of the uncertainty distribution remains inside structural, thermal, propulsive and landing constraints. For a crewed system, rare combinations matter. Designers therefore look for sensitivity: which uncertainty most strongly moves the outcome, and which technology investment buys the largest reduction in risk?

A settlement adds an operational feedback loop that exploration missions lack. Every landing can update atmospheric models, terrain maps, plume-damage predictions and navigation performance. Prepared pads and local meteorology can reduce uncertainty over time. If data standards are maintained, the first cargo landings become experiments for the later crew system. A Mars spaceport should therefore be designed to learn from every arrival, not simply receive it.

EDL is a chain of states in which every event prepares the next one

Entry, Descent and Landing is often described as a dramatic sequence of hardware events: heat shield, parachute, engines, touchdown. The engineering problem is state continuity. Every event receives a speed, altitude, attitude, uncertainty, and energy state and must hand the next event a state that lies inside its operating envelope. A parachute deployed too early can see excessive dynamic pressure; too late and it may leave insufficient time for powered descent. A heat shield released too early exposes hardware; too late and it can block the sensors needed for terminal navigation.

Transitions should therefore use physical conditions rather than a clock alone. Velocity, Mach number, dynamic pressure, estimated altitude, angular rates, and navigation quality can all contribute. Time remains useful as a monitor for a stuck sequence, but “240 seconds after entry interface” does not prove the vehicle is in the expected aerodynamic state.

The vehicle also changes control authority several times. High in the atmosphere, lift and bank angle can move the trajectory. Lower down, a parachute or deployable decelerator may dominate. Powered descent then controls velocity and translation directly. Finally, landing gear absorbs the residual. An architecture that does not describe the handovers between these control regimes hides some of its most important risks.

Follow the energy instead of memorising the event list

Kinetic energy is E_k = ½ m v². Mass m is in kilograms, velocity v in m/s, and energy in joules. Because velocity is squared, doubling speed quadruples kinetic energy at the same mass. A relatively small velocity difference at powered-descent ignition can therefore have a large propellant consequence.

Example — energy still to remove before touchdown

For a 30,000 kg vehicle at 500 m/s, E_k = 0.5 × 30,000 × 500² = 3.75 × 10⁹ J, or 3.75 gigajoules. At 300 m/s the same mass has 1.35 GJ. The difference is 2.40 GJ that must be removed by drag, propulsion, or both. This simplified calculation omits potential energy and propulsion losses; its purpose is to make the square-law effect visible.

Aerodynamic drag turns part of that energy into heat in the flow and the vehicle. Guidance tries to exploit the atmosphere without violating heat-flux, temperature, dynamic-pressure, or acceleration limits. An energetically efficient entry can be too hot; an entry that reduces peak g may extend heating. There is no single variable that can be minimised in isolation.

Autonomy is mandatory because Earth receives the story after it has happened

Mars EDL lasts minutes, while one-way radio time between Earth and Mars ranges from several minutes to more than twenty depending on geometry. Ground commands therefore cannot close the terminal control loop. The vehicle must estimate its state, recognise transition conditions, detect anomalies, and execute recovery logic onboard.

This does not require unconstrained “intelligence.” Safer autonomy is built from explicit states, transition criteria, limits, and tested recovery responses. Flight software should know why a transition is permitted or rejected. Sensors should provide quality and uncertainty, not merely values. Recorded data should allow engineers to reconstruct what the vehicle believed at the instant of a decision.

Perseverance added terrain-relative navigation that compared descent imagery with an onboard map. That flight demonstrated an ability to estimate position relative to known hazards and reach a safer region. A human-scale vehicle would still need to integrate that concept with different propulsive margins, sensor geometry, and consequences of failure.

Robust EDL is designed around failed transitions

The parachute is not declared safe at the expected time

The controller must choose whether to wait, change attitude, or move to another branch of the sequence. On a heavy vehicle for which retropropulsion already carries much of the deceleration burden, the practical question may become how much additional velocity the engines can remove without exhausting reserves.

The heat shield does not fully separate

A partial separation may block a radar or camera and alter aerodynamics. Fault logic must distinguish a sensor that no longer sees the ground from an actual separation anomaly. Redundant sensors sharing the same obstructed field of view do not remove that common cause.

Navigation diverges after a sudden scene change

Dust, feature-poor terrain, or rapid rotation can degrade imaging. The estimator should increase uncertainty rather than maintain unjustified confidence. A system that recognises its poor position knowledge can choose a conservative landing option; an overconfident system can make the wrong choice decisively.

Powered descent starts with lower-than-modelled thrust

Guidance must reshape the trajectory around the thrust actually available. Remaining altitude becomes both time and propellant margin. Recovery then depends as much on replanning logic as on kilograms of propellant.

Three technology maturity levels must remain separate in the public explanation

Robotic Mars entry, supersonic parachutes, and the sky-crane concept have flight heritage. Terrain-relative navigation was demonstrated by Mars 2020. By contrast, multi-engine supersonic retropropulsion for a lander of tens of tonnes and the associated plume aerodynamics remain areas of study and maturation. Replacing “NASA has studied” with “NASA uses” would materially change the technical claim.

A NASA NTRS paper on retropropulsion testing explains that human-scale powered-descent simulations still face relevant-data and test-capability gaps. That uncertainty belongs in the architecture. A credible program reserves testing time, instrumentation, and schedule to close it rather than hiding the gap behind a smooth diagram.

Primary references: NASA TechPort Mars 2020 Terrain Relative Navigation; NASA NTRS — New Developments in Retropropulsion Testing for Mars Entry, Descent, and Landing. The former records a capability demonstrated on Mars; the latter documents test gaps for a technology associated with human-scale landings.

EDL is an energy chain, not a checklist of events

The most robust way to understand entry, descent and landing is to follow the energy that must disappear. At entry interface, specific kinetic energy is roughly v²/2. Halving speed quarters that energy. By the time a vehicle goes from kilometres per second to metres per second, most energy has been dissipated well before touchdown. Thermal protection, atmosphere, decelerators and engines divide the job according to architecture and mass.

Every transition has entry conditions. A parachute is not deployed merely “at an altitude”; Mach number, dynamic pressure, stability and structural load must be inside an envelope. Retropropulsion is not commanded by altitude alone; speed, remaining mass, flight-path angle, lateral reach, terrain and available engines matter. A safe EDL therefore needs state-based event logic rather than a rigid clock.

Energy scale — simple example

For m = 40,000 kg and v = 5,500 m/s, E_k = ½mv² ≈ 6.05 × 10¹¹ J, or 605 GJ. This energy does not all become vehicle heat; much is transferred to the flow and atmosphere. The calculation simply exposes the scale and why a few poorly controlled seconds can involve extreme thermal and mechanical power.

Sensors must survive a rapidly changing environment

During entry, state estimation combines inertial data, dynamics and external observations that may become available only in later phases. After heat-shield separation, radar, lidar or cameras can suddenly provide better measurements. The filter must accept those new observables without creating an inconsistent jump. Better visibility at low altitude still produces a bad landing if the map, coordinate frame or timestamp is wrong.

Observability is central. An IMU measures accelerations and angular rates but its biases integrate. Radar measures range or relative velocity but depends on geometry and terrain. TRN matches images to a map but depends on visible features and map quality. Safety comes from complementary evidence and inconsistency detection, not from one magical sensor.

For human scale, failure becomes a time-remaining problem

At 20 km altitude and hundreds of metres per second, an engine fault may leave tens of seconds to reconfigure. Two metres above the ground leaves almost none. EDL FDIR must therefore be temporal: detect fast enough, isolate the fault, redistribute thrust, recompute a reachable trajectory and, if necessary, accept less landing precision.

Multiple engines do not automatically provide fault tolerance. Common power, common software, common valves or common model errors can defeat apparent redundancy. Testing must include common causes and engine-start transients, particularly during attitude transitions.

The landing “site” is really a shrinking reachable region

Early in entry, the vehicle may still have substantial crossrange. As energy disappears, the reachable set contracts. Terrain-relative navigation must therefore combine hazards with the region that remains physically reachable using available propellant and margins.

This connects EDL, TRN and retropropulsion: metre-level precision is not an end in itself. The mission seeks the highest probability of reaching survivable terrain with final speed, attitude, propellant and slope compatible with touchdown and subsequent operations.

Sources: NASA NTRS — Entry, Descent, and Landing Performance for a Mid-Lift-to-Drag Ratio Vehicle at Mars; NASA TechPort, Terrain Relative Navigation.

edl energy ladder — Chapter-specific synthesis diagram.

Case study — propagate ballistic coefficient all the way to touchdown

Ballistic coefficient β = m/(C_D A). With m = 20,000 kg, C_D = 1.5 and A = 80 m², β ≈ 167 kg/m². C_D is drag coefficient and A reference area. Adding mass without increasing area changes the conditions delivered to later phases.

A thinner atmosphere or later deployment leaves more energy for propulsion to remove. The same altitude reserve cannot be independently credited against every dispersion.

Each Monte Carlo case should record velocity, altitude, dynamic pressure, navigation state, propellant and hazard distance at every transition.

Handover gates must carry uncertainty, not only a nominal state

Each EDL phase hands the next one more than position and velocity. It also hands uncertainty in altitude, attitude, winds, thermal state, propellant and navigation quality. A parachute or powered-descent phase that begins at the correct nominal Mach number can still be unsafe if dispersions have consumed the corridor margin.

Useful gates therefore include both state and confidence: deploy only if the estimated condition is inside the certified envelope with enough margin for sensor error and atmospheric variation. This turns the EDL sequence from a timed script into a chain of verified conditions, which is essential when communication delay prevents ground intervention.

EDL margins disappear quickly because the timeline is compressed

A navigation delay of only a few seconds can consume hundreds of metres of altitude during high-speed descent. The same delay may also shift parachute, engine-start or divert conditions. Timeline analysis should therefore convert sensor and software latency into trajectory consequences, not list latency as an isolated avionics number. Fast decisions matter because altitude is a non-renewable resource during EDL.

Transition criteria are part of the vehicle, not labels on a timeline

An EDL sequence is usually drawn as a line of named events, but the engineering problem lies in the conditions that authorize each transition. A parachute or drag device cannot be commanded only because a clock has reached a planned time; the vehicle must be inside an envelope of Mach number, dynamic pressure, attitude and altitude. Likewise, ignition of terminal propulsion depends on the estimated state and the braking distance available, not on a fixed geometric point.

This makes the estimator and the event logic inseparable. If atmospheric density is lower than predicted, the vehicle may arrive at a transition faster and lower. Waiting for the nominal velocity can then consume altitude that cannot be recovered. Trigger design therefore uses several observables and must define what happens when they disagree. A robust sequence distinguishes a late but acceptable event from a state in which the next phase no longer has enough authority.

Interface testing should deliberately move the initial state of each phase around its boundary. The question is not only whether entry, descent and landing each work in isolation; it is whether the output dispersions of one phase fit inside the capture envelope of the next. This “handover margin” is one of the clearest ways to see why EDL is a chain rather than a collection of technologies.

Sources and references

Primary sources to read

Primary sources and research landmarks

Sources used for this expansion, checked 2026-08-14.