Entry vehicle control system design for the Tianwen-1 mission

The entry vehicle for the Tianwen-1 mission successfully landed on the surface of Mars at 7:18 AM BJT on May 15, 2021. This successful landing made China the first country to orbit, land, and release a rover in their first attempt at the Mars exploration. The guidance, navigation, and control (GNC) system plays a crucial role in the entry, descent, and landing (EDL) phases. This study focused on the attitude control component of the GNC system design. The EDL phase can be divided into several sub-phases, namely the angle of attack control phase, lift control phase, parachute descent phase, and powered descent phase. Each sub-phase has unique attitude control requirements and challenges. This paper introduces the key aspects of designing attitude controllers for each phase. Furthermore, flight results are presented and analyzed.


Introduction
The entry vehicle of the Tianwen-1 mission successfully landed on the surface of Mars at 7:18 AM BJT on May 15, 2021. In general, the entry, descent, and landing (EDL) process, which begins at the Mars atmosphere entry interface (EI) at a height of approximately 125 km and involves an initial velocity of 17,000 km/h, is the most dangerous and challenging task in a Mars exploration mission.
As shown in Fig. 1, the EDL process can generally be divided into four phases: the trim angle of attack (AOA) control phase, lift control phase, parachute descent phase, and powered descent phase.
At a height of slightly less than 125 km, the vehicle enters the AOA control phase. In this phase, the vehicle attitude is controlled to a nominal value. Specifically, the AOA is −10 • , the sideslip angle is 0 • , and the bank angle is a predetermined value.
After approximately 70 s, the vehicle enters the lift control phase. In this phase, the vehicle experiences rapid deceleration through a tenuous atmosphere and its bank angle is controlled to eliminate downrange and cross-range errors. At the end of this phase, the vehicle autonomously deploys a trim wing and parachute at 2.8 Mach and 1.8 Mach, respectively.
After the parachute is deployed, the vehicle enters the parachute descent phase. In this phase, the vehicle endures severe dynamic impact and deceleration. The vehicle sequentially jettisons its heatshell and backshell. At the end of this phase, the vehicle attitude is nearly vertical, and its velocity does not exceed 115 m/s. After jettisoning the backshell, the vehicle enters the powered descent phase. In this phase, the 7500 N main engine is used to reduce the residual velocity and ensure a soft landing. The powered descent phase can be divided into the powered deceleration phase, hover and imaging phase, hazard avoidance phase, and slow descent phase.
The guidance, navigation, and control (GNC) system plays a crucial role in the EDL phase and directly determines the success of the entire mission. To address the complexity of the Mars EDL process, GNC algorithms are expected to be robust against and adaptive to uncertainties such as those associated with the Mars environment, aerodynamic parameters, parachute descent motion, and sensor and actuator failures. The Tianwen-1 EDL GNC system is composed of guidance, navigation, and control subsystems. This paper introduces attitude control strategies, whereas the guidance and navigation components are described in different articles. The attitude control requirements, which are different for different phases, must be satisfied using the attitude control system. In Ref. [1], a phase-plane controller with hysteresis switching curves was selected to control the bank angle. In Ref. [2], a hybrid PD/deadband controller with feedforward and reaction control system (RCS) pulse-width modulation was employed for entry attitude control. In contrast to Refs. [1,2], we adopted control strategies characterized by fast and robust command tracking performance. The attitude phase plane is divided into four different parts for fast tracking, certain ideas for which were borrowed from Ref. [3]. In the powered descent phase, fast observers are designed to eliminate the influence of disturbances and the commanded thrust direction is decoupled from the roll attitude to enable faster tracking. A novel method was designed to diagnose RCS faults promptly and perform reconfiguration in the hazard avoidance phase. This paper describes the architecture of the developed GNC system. Additionally, the challenges and control methods in each phase are introduced sequentially, followed by the presentation of in-orbit flight results.

Control system configuration
The GNC system is composed of navigation, guidance, control, optical sensors, radars, inertial measurement units (IMUs), star sensors, and RCSs. The navigation subsystem estimates the vehicle attitude, position, and velocity from the IMU data and two radars are used to correct the position and velocity for inertial navigation. Two star track sensors are configured on the entry vehicle to determine the accurate initial inertial attitude for the EDL process. Six gyros and six accelerometers are installed for inertial navigation in the EDL phase. The guidance component calculates the commanded bank angle in the lift-control phase to eliminate downrange and cross-range errors, and obtain the commanded main thrust direction during the powered descent phase to eliminate residual velocity. The guidance law during the powered descent phase is implemented by the main landing engine (MLE), which can produce a maximum force of 7500 N and a throttling force ranging from 1500 to 5000 N. The composition of the attitude control system is illustrated in Fig. 2. The attitude controller obtains the estimated attitude from the navigation subsystem and commanded attitude from the guidance subsystem, and profiles the goal attitude. Subsequently, the controller estimates the disturbance torques, calculates the control inputs, and determines the on-off status of the RCSs to ensure fast and robust attitude tracking. The attitude controller was implemented using 6 × 25 N RCSs and 16 × 250 N RCSs. As shown in Fig. 3, eight of the 16 × 250 N RCSs are symmetrically installed and used for horizontal hazard avoidance and attitude control.

Trim AOA control phase
After separating from the Tianwen-1 orbiter, the entry vehicle maintains a certain attitude toward the telecommunication relay. At a height of approximately 120 km, the entry vehicle switches to the nominal angle of the trim AOA attitude and stabilizes this attitude. Because the aerodynamic influence is still weak in this phase, a phase plane attitude controller is adopted to facilitate and maintain this attitude adjustment. The Fig. 3 Layout of the 8 × 250 N RCSs used for horizontal avoidance.
deadband for the three-axis attitude control must be smaller than 5 • according to the input requirements. In the first few periods of the AOA phase, two 250 N RCSs, which are used to control the bank angle, are switched on and off to test their operability. If any of the RCSs cannot be operated normally, then the RCS-select logic in the following process is reorganized to eliminate the influence of nonfunctioning RCSs.

Lift control phase
The main task for attitude control in the lift control phase is to track the commanded bank angle from the guidance system as soon as possible while the channels for the angle of attack and angle of sideslip are self-stable and simply rate damped.
As soon as the Mach number decreases to less than 2.8, the trim wing is deployed to change the stable AOA to zero, as shown in Fig. 4. When the Mach number is less than 1.8, a parachute is deployed. In this case, the total AOA must be less than 7 • . If the trim wing is not deployed, then the vehicle angle of attack is expected to be approximately −10 • and the requirement for parachute deployment cannot be satisfied.

Control structure
The main challenge associated with lift control is to track the commanded bank command at an angular velocity of 20 ( • )/s in the cases involving a large aerodynamic torque.
The attitude controller for the lift control phase adopts a modified proportional-integral-derivative (PID) controller. As shown in Fig. 5, to ensure the fast tracking performance of the bank angle command, the state phase plane is partitioned into four zones: the rate limiter region, the nominal rate velocity control zone, parabolic target rate control zone, and PID control zone. When the angle error is greater than θ mL , the angular velocity is controlled to the nominal velocity at a rate of dθ r . When the angle error is between θ mL and θ mS , the angular velocity is controlled to a parabolic target rate and when the angle error is less than θ mS , a traditional PID controller is adopted for fine attitude control. The control parameters must be carefully tuned according to the required accuracy, maximum torque provided by the RCS, inertial matrix of the entry vehicle, time delay, and disturbances.
Considering the aerodynamic torque on the bank angle tracking channel, the integral coefficient of the PID controller must be sufficiently large to suppress the PID control region

influence of disturbances.
Rating damping control is adopted for the angle of attack and sideslip channels and the corresponding proportional coefficients are simply set to zero. To ensure safety, the angle error is introduced into the closed-loop control when it is greater than 10 • .

Coordinates for calculations
Another problem encountered in the lift control phase is related to the inconsistency of coordinate systems. The angles of the bank, attack, and sideslip and control inputs are calculated in the velocity coordinate system (F v ), whereas torques are produced by the RCSs in the control coordinate system (F c ). To obtain an accurate control effect, the control input is first calculated in a frame F v and later transformed into a frame F c as Eq. (1): where T v is the control input calculated in the velocity coordinate system and C cv is the direction cosine matrix from frame F v to frame F c . Matrix C cv is mainly determined by the AOA and sideslip angle, and must be calculated based on navigation requirements. After the trim wing is deployed, the control input is calculated in frame F c . In this case, the AOA channel is a weakly damped system that is prone to severe vibrations, which may be detrimental to parachute deployment. To address this problem, the derivative feedback coefficient must be increased to suppress the vibrations in the angle of attack.
The control input transformed into the frame F c must be pulse modulated. Many methods have been used for pulse modulation. For simplification, the entry vehicle of the Tianwen-1 mission uses a simple linear pulse modulation method with deadband and saturation nonlinearity. Because the velocity of sound in the lift control phase ranges from 2.8 Mach to 4 Mach, the efficiency of the RCS is expected to be less than that in a vacuum. Therefore, the minimum pulse duration must not be excessively small. In the case of Tianwen-1, the minimum pulse time is set to 40 ms and 128 ms for the 250 N and 25 N RCSs, respectively.

RCS selection and fault tolerance
The RCSs are automatically selected based on the magnitude of the calculated control input. If the control input is less than the minimum torque that can be provided by the 250 N RCS, then the 25 N RCS is selected for attitude control. Otherwise, 250 N RCS or 25 N + 250 N RCS combinations are chosen. The advantage of dynamically selecting RCSs is that a fault in any single RCS does not critically deteriorate attitude control.
Additionally, the failure of trim wing deployment must be considered. When the trim wing cannot be opened normally, the GNC system receives a failure signal. In this case, the angle of attack is introduced into the closed-loop control and the 250 N RCS is used to counteract the large aerodynamic torque in the attack channel.

Parachute descent phase
The parachute descent phase involves highly uncertain dynamics. Because the torques imposed by the cords of the parachute may be significant, it is not appropriate to control the pitch and yaw channels actively in the parachute descent phase. Notably, the pitch and yaw channels are still self-stable. In the Tianwen-1 mission, attitude control begins only 13 s after the deployment of the parachute and rate-damping controllers are used for the pitch and yaw channels with large deadbands. The angle error of the roll channel is controlled to be consistent with the local geographic coordinate system, which provides a reasonable initial state for the powered descent phase. At the end of the parachute phase, the attitude of the vehicle is nearly vertical.

Powered descent phase
Following the separation of the parachute, the capsule enters the powered descent phase. This phase typically begins with a height and velocity less than 2000 m and 115 m/s, respectively, and ends with a soft touchdown on the Mars surface. The powered descent phase can be divided into four sub-phases: the powered decelerate phase, hover and imaging phase, hazard avoidance phase, and slow descent phase.

Control structure
The attitude controller in the powered descent phase is a PID-type controller with a discrete pulse-width modulator (PWM). Because the lander is a rigid body that does not exhibit sloshing or flexible vibration, structural filters do not need to be implemented in the controller. The commanded control torques are calculated by considering the errors between the lander attitude and commanded attitude. Subsequently, the RCSs are dynamically selected based on the calculated torques. The control torques are unitized and then sent to the PWM to obtain the final firing time.

Powered deceleration phase
The powered deceleration phase begins at approximately 2000 m and ends at approximately 100 m at a velocity of 0 m/s with a duration of less than 50 s. The main goal of this sub-phase is to eliminate the large residual velocity in a limited time and distance while ensuring that the final state is close to vertical. Another task in this phase, namely backshell avoidance, is designed to avoid potential collisions between the lander and backshell during the landing process. To achieve these goals, the commanded attitude from the guidance law changes rapidly, requiring an angular velocity as high as 15 ( • )/s. Additionally, because the dynamics of the parachute descent phase are relatively complicated, the entry states of the powered descent phase (i.e., position, velocity, attitude, and angular velocity) may vary across a wide range. The GNC system must be adequately robust to eliminate the influence of different entry conditions. Additionally, the attitude control system must be able to track the commanded attitude as quickly as possible with minimum overshoot.
Different methods can be used to calculate the goal attitude in the powered descent phase. Consider that the commanded thrust direction is defined as e cmd according to the guidance law. The local geographic coordinate system is defined as follows. The X g axis is defined as the local sky direction, Y g axis is defined as the south direction, Z g axis is defined as the east direction, and q g represents the quaternion of the local geographic coordinate system. The goal attitude quaternion can be calculated by rotating X g to e cmd through the shortest path, which is formulated as e rot = X g × e cmd ∥X g × e cmd ∥ , ϕ = arccos(X g · e cmd ), δq = e rot sin ϕ 2 e rot cos ϕ 2 (2) The quaternion error is calculated as where q b is the quaternion of the lander with respect to the inertial frame.
However, this approach is optimal only for overall attitude tracking and not for commanded main thrust direction tracking. Therefore, attitude control of the pitch and yaw channels is not implemented, meaning that only the commanded thrust direction is tracked. However, this framework may deteriorate the deceleration performance if the actual entry conditions of the powered descent phase deviate significantly from the nominal states.
To avoid this problem, the entry vehicle of Tianwen-1 adopts a novel method for attitude error calculation. In contrast to the method proposed in Ref. [5], in the new method, the roll axis and thrust direction are decoupled and the pitch and yaw channels are used to track the main thrust direction. As shown in Fig. 6, the basic concept is to decouple any rotation transformation between two coordinate frames into two decoupled frames. (1) First, the current thrust direction (S 1 ) is rotated toward the commanded thrust direction (S d ).
(2) Second, the roll axis is rotated to ensure that the roll angle is in agreement with the goal quaternion. Through these two rotations, the first coordinate frame The quaternion errors related to the first and second rotations are transmitted to the pitch and yaw channels, and the roll channel, respectively. According to this decomposition method, the angle errors of the pitch and yaw channels are only related to the main thrust direction tracking error.
For a commanded thrust direction S d , the actual thrust direction is S 1 . The rotational vector for the first rotation S v , is calculated as where ε is a small positive number used to avoid singularity. Based on this expression, the angle errors of the pitch and yaw channels can be expressed as where ϕ is the angle tracking error of the main thrust direction, which is defined as After the first rotation is determined, the roll angle error can be easily calculated from the first rotation and goal quaternion q G .
To improve tracking efficiency further, the angular phase plane can be partitioned into different zones using the same strategies adopted for the lift control phase. When the angle error in the corresponding channel is small, the PID controller is utilized for fine control and when the angle error is large, the angular velocity is controlled to the designed value. In contrast to those in the lift control phase, the roll, pitch, and yaw channels must be partitioned independently. The commanded angular velocities for the pitch and yaw channels are designed as Eq. (8): where ω r is the designed rate based on trial and balancing. Another problem in the powered deceleration phase is related to large disturbances. At the beginning of the powered deceleration phase, the 7500 N MLE is opened along with 4 × 250 N RCSs to ensure adequate deceleration. However, as a result of MLE misalignment with the mass center and imbalances between the 4 × 250 N RCSs, the maximum disturbance torque may be over 100 Nm. Such a large disturbance may critically deteriorate attitude tracking performance and traditional PID controllers may not be able to address such a disturbance effectively. The Tianwen-1 lander uses a method that rapidly estimates disturbances online and performs feedforward compensation. The disturbance estimator is formulated as shown in Eq. (9): whered is the estimated disturbance, ξ is a dynamical state, ω is the angular velocity, J est is the estimated inertial matrix, T cmd is the commanded torque, and λ is a tunable parameter that controls the convergence speed. By replacing the integral part of the PID controller with the estimated disturbanced, the influence of large disturbances on attitude tracking can be suppressed.

Hazard avoidance phase
When the vehicle altitude drops to 100 m, the lander switches to the hover and imaging phase. In this phase, the vehicle attitude must be vertical and the angular velocity must be sufficiently small for imaging. When the vehicle attitude is stable, the optical sensors capture photos and identify a safe landing site. Because the initial attitude of the hovering phase may deviate from the vertical state, control parameters must be carefully designed to ensure that the attitude can be promptly adjusted and stabilized to a vertical state.
After identifying a safe landing site, the hazard avoidance phase is initiated. As shown in Fig. 7, 8 × 250 N RCSs are used for position control with horizontal avoidance, with two RCSs operating simultaneously in one direction. Typically, because the two RCSs are installed symmetrically, the on-off operation of the two RCSs does not influence the attitude. However, if one 250 N RCS cannot be operated, then a large disturbance Fig. 7 Control results when D7 is faulty.
torque of more than 250 Nm in the roll channel may be generated. In this case, the roll attitude may exhibit large fluctuations, and avoidance failure may occur.
A key task of Tianwen-1 is to ensure that a fault in any individual RCS does not influence the success of landing. Therefore, the GNC system adopts a novel method to diagnose RCS faults promptly and reconfigure RCSs. The basic idea is to estimate the disturbance force in the horizontal channels and disturbance torque in the roll channel. Based on different combinations of the disturbance force and torque, a faulty RCS can be promptly identified. The disturbance torque is estimated as shown in Eq. (9) and the disturbance force is estimated asF where a b is the measured acceleration from the IMU, F d is the estimated disturbance force, η and v d are the dynamical states, λ v is a tunable parameter that controls the convergence speed, and F c is the commanded input in the last sample period. After identifying a faulty RCS, the control system reorganizes the remaining seven RCSs to perform the avoidance task. In this case, certain RCSs may be employed to control both horizontal channels. The distribution of the pulse time between the two directions must be set carefully.

Vertical descent phase
When the lander descends to an altitude of 20 m, it enters the vertical landing phase. In this phase, the attitude control system maintains the vertical state until the vehicle touches the Mars surface. The bandwidth of the controller must be sufficiently small to ensure that the landing states (i.e., attitude, angular velocity, and velocity) are within the required specifications.

Flight results
The flight results for the EDL attitude control of Tianwen-1 are introduced in this section. The AOA phase, lift control phase, parachute phase, and powered descent phase occur from 0 to 67.9 s, 67.9 to 278.9 s, 278.9 to 447.8 s, and 447.8 to 535.9 s, respectively. Figure 8 reveals that in the lift control phase, the sign of the bank angle changes at least four times. The bank angle at approximately 238 s is zero with no change in sign. The bank angle changes rapidly and the maximum angular velocity is approximately 20 ( • )/s, which is identical to the designed value. The roll angle error in the parachute descent phase changes to zero at a rate of approximately 0.5 ( • )/s. The roll angle is controlled to ensure a reasonable initial attitude for the powered descent phase. At the beginning of the powered descent phase, the initial roll angle error is still 7.7 • , which is rapidly eliminated to be near zero within a few seconds.
In the powered descent phase, the roll angle is stabilized at no more than 0.5 • . Figures 9 and 10 present the angle and angular velocity errors of the pitch and yaw channels, respectively. In the lift control phase, in the case shown in Fig. 9, the angle error is equal to the sideslip angle. In contrast, in the case shown in Fig. 10, the angle is the error between the AOA and −10 • (trimmed AOA). In the lift control phase, the angular velocities of the pitch and yaw channels are less than 3 ( • )/s. At approximately 243.5 s, the angular velocities exhibit abrupt fluctuations and the angle of attack changes rapidly from approximately −10 • to 0 • as a result of the deployment of the trim wing. Figures 8-10 reveal that in the parachute descent phase (278.9 to 447.8 s), the maximum angular velocity is slightly less than 20 ( • )/s, which is significantly less than the measurement range of gyros (> 300 ( • )/s). Compared to the results reported in Ref. [6], the angular velocity is also much smaller. In the powered descent phase (447.8 to 535.9 s), the angle errors are relatively small with a maximum value of less than 20 • (from the yaw channel), whereas the maximum angular velocity is nearly 15 ( • )/s, which is consistent with the designed value. The angle error of approximately 20 • in the yaw channel can be attributed to guidance for backshell avoidance.
According to Figs. 8-10, before touchdown on the Mars surface, the angle errors and angular velocities for the three axes are (−0.031 • , −0.060 ( • )/s), (0.22 • , 0.30 ( • )/s), and (−0.089 • , −0.017 ( • )/s), respectively, which are satisfactory for ensuring safe touchdown. Beyond this point, the angle errors and angular velocities exhibit abrupt changes as a result of complicated touchdown dynamics. Figures 11 and 12 present the disturbance torques and forces estimated during the powered descent phase. As shown in Fig. 11, in the initial phase, the estimated disturbance torque increases as a result of the simultaneous opening of the 7500 N + 4 × 250 N devices. The maximum disturbance torque is 60.75 Nm along the yaw axis, which is better than expected. Figure 12  that the estimation of the disturbance force was initiated during hazard avoidance and the maximum force was 40 N. The estimated disturbance torques and forces are relatively small, implying that all 8 × 250 N RCSs can be operated for hazard avoidance. According to Figs. 11 and 12, the disturbance torques and forces exhibit abrupt changes at the end as a result of touchdown on the Mars surface.

Conclusions
The Mars EDL process is characterized by large dynamic uncertainty, large disturbance torque, and rapidly varying commanded attitudes. The attitude control system must address these challenges to ensure safe landing. The attitude control strategies introduced in this paper have all been employed in the Tianwen-1 EDL process, most of which have been implemented for the first time. These strategies were validated through numerous Monte Carlo simulations. According to the in-fight experience, the attitude control results are even better than expected.