The Tianwen-1 Guidance, Navigation, and Control for Mars Entry, Descent, and Landing

Tianwen-1, the ﬁ rst mission of China ’ s planetary exploration program, accomplished its goals of orbiting, landing, and roving on the Mars. The entry, descent, and landing (EDL) phase directly determines the success of the entire mission, of which the guidance, navigation, and control (GNC) system is crucial. This paper outlines the Tianwen-1 EDL GNC system design by introducing the GNC requirements followed by presenting the GNC system architecture and algorithms to meet such requirements. The actual ﬂ ight results for the whole EDL phase are also provided in this paper.


Introduction
Mars has atmosphere and surface environment similar to the Earth, making it a prime target for deep space exploration. In order to investigate the Mars surface environment, it is necessary to perform soft landing missions to place a lander on the surface. Of the eighteen landing missions that have been carried out, nine achieved a complete success. They are Viking-1, Viking-2 [1], Mars Pathfinder [2], Mars Exploration Rover [3], Phoenix [4], Mars Science Laboratory (MSL) [5], InSight [6], Mars 2020 [7], and Tianwen-1 [8]. As the first Chinese Mars landing mission, Tianwen-1 was launched successfully at 12:41 p.m. Beijing Time (BJT) on 23 July 2020, and delivered its lander to the Mars surface with a soft touchdown velocity and a stable predefined attitude at 7:18 a.m. BJT on 15 May 2021. The successful deployment of the rover on 22 May 2021 completed the mission's goals of orbiting, landing, and releasing a rover on the Mars.
The entry, descent, and landing (EDL) phase, which began at the Mars atmosphere interface and ended with a surface touchdown, is crucial for a Mars landing mission and directly determines the success of the entire mission. The success rate of mars missions is about 50%, and most failures occur during the EDL phase [9]. The guidance, navigation, and control (GNC) system guarantees the touchdown safety and accuracy, playing an important role in the EDL phase. Because of the time urgency of the EDL process and large communication delay between the Mars and the Earth, the spacecraft must perform autonomous GNC to provide reliable key event triggers and accurate and reliable state estimates and to implement accurate and reliable trajectory and attitude controls. Any mistake may lead to a mission failure.
The uncertainties such as Mars environments, parachute descent motion, and initial state, the complexity of the EDL process (multistage deceleration, many key events, etc.), and the limited on-board computational ability bring great challenges to the design of EDL GNC system. To meet these challenges, the GNC hardware should have a certain degree of redundancy, and the GNC algorithms should be suitable for on-board implementation, robust to sensor and actuator partial failures, and adaptive to uncertainties. This paper summarizes the Tianwen-1 EDL GNC design by analyzing the EDL GNC requirements, presenting the GNC modes and GNC hardware configurations, and finally describing the EDL GNC algorithms. The flight results that have validated the GNC design will also be provided.
the Tianwen-1 spacecraft consists of an orbiter and a descent module, as shown in Figure 1, where the descent module is composed of a heatshield, a backshell, and a lander that consists of a landing platform and a rover. Figure 2 illustrates the mission profile of the Tianwen-1 [8], which is divided into five stages: Earth-Mars transfer stage, Mars orbit insertion stage, Mars orbit parking stage, deorbit and landing stage, and scientific exploration stage. In the former three stages, the orbiter and the descent module form as a single probe. In the deorbit and landing stage, the descent module is separated from the orbiter and then will enter the Mars atmosphere a few hours later, starting its EDL process. With deceleration of Mars atmosphere, parachute, and the main landing engine (MLE), the lander lands on the Mars surface softly. And after a few days, the rover is released from the lander for scientific exploration.

EDL Sequence
Profile. The EDL sequence profile of the Tianwen-1 consists of atmospheric entry, parachute descent, and landing phases.
The atmospheric entry phase begins when the vehicle reaches the atmospheric boundary of Mars (at an altitude of approximately 125 km) and ends in parachute deployment at a specified value of navigated velocity. During this phase, Tianwen-1 performs a guided lifting entry at a liftto-drag ratio of 0.13 with a nonzero trim angle-of-attack (AOA) and then deploys the trim wing at a specified navigated velocity. With the effects of the trim wing, the trim value of the total AOA is secured suitable for the parachute deployment.
The atmospheric entry phase is followed by the parachute descent phase, during which the heatshield is first jettisoned at a specified value of navigated velocity, and then landing radars begin to work such that the vehicle's altitude and velocity with respect to the Mars can be measured. When the vehicle reaches its stable descent velocity and the navigated altitude and velocity are deemed suitable for terminal braking within the available propellant budget, the descent module releases the backshell and ignites the MLE, implying that the landing phase begins.
The landing phase is also known as the powered descent phase. In this phase, the lander performs a velocity reduction via the MLE, executes a backshell evasion maneuver, when necessary, selects a safe landing site, and finally lands on the selected landing site safely to achieve the soft landing.

Overview of the EDL GNC System
3.1. GNC Requirements. The GNC system requirements for Tianwen-1 EDL process are as follows: (1) Key events, such as trim wing deployment, parachute deployment, heatshield jettison, backshell separation, MLE ignition, and touchdown detection, should be triggered properly (2) After backshell separation, the lander should not be collided with the backshell (3) The actual landing site should be selected on-board within the preselected landing area (4) The lander's touchdown attitude, angular rate, and vertical and horizontal velocities should meet the requirements (5) The fuel consumption of the EDL process needs to be within a reasonable range.

GNC Modes.
According to the EDL process profile and GNC requirements, the EDL process is divided into eight GNC modes: the AOA-trim mode, the lift control mode, the parachute descent control mode, the powered deceleration mode, the hover and imaging mode, the hazard avoidance maneuver mode, the slow descent mode, and ended with the no-control mode. The transition of these eight modes is shown in Figure 3.
In the atmospheric entry segment, the GNC system operates with the AOA-trim mode initially, in which the descent module's attitude is adjusted to a predefined attitude for guided lift entry. Once the sensed acceleration magnitude exceeds 0.2 Earth g, the lift control mode is activated to produce proper lift to control the entry trajectory.
With the deployment of parachute, the GNC system switches to the parachute descent control mode and uses this mode throughout the whole parachute descent phase. In this mode, the descent module's velocity would descent to about 95 m/s at an altitude of about 1.2 km above the Mars surface.
In the landing phase, the GNC system operates with the powered deceleration mode, hover and imaging mode, hazard avoidance maneuver mode, slow descent mode, and ends at the no-control mode when the lander has softly touched down. The powered deceleration mode begins with the backshell separation and ends before hover. The main task of this mode is to use the MLE to reduce the lander's velocity, to avoid collisions with the detached backshell, and to image and select a wide safe landing area for coarse hazard avoidance. In the hover and imaging mode, the lander maintains a hover state to take 3D images of the landing area and then selects a safe landing site. Once the landing site is selected, the GNC system switches to the hazard avoidance maneuver mode to perform hazard avoidance and descent such that the lander would descent to 20 m altitude above the landing site with a zero horizontal velocity and a preset value of vertical velocity (about 1.5 m/s). Then, the GNC system switches to the slow descent mode. In this mode, the lander slowly descends at a preset speed, eliminates the horizontal speed, and maintains a vertical attitude. Once the lander's touchdown is detected, the GNC system sends a shutdown signal to turn off the MLE and then switches to the no-control mode, in which no further orbit control and attitude control are performed any more.

GNC System
Configuration. The EDL GNC system scheme is illustrated in Figure 4, where sensors, actuators, and the GNC computer will be described in this subsection, and the GNC algorithms will be presented in the following sections.

Landing Radars.
A microwave radar and a phased array sensor (PAS) are configured to provide Mars-related measurements. The microwave radar contains four beams, each of which works automatically. The PAS contains nine beams, four of which are selected by the GNC system to provide measurements at every measurement time. Every beam for the two radars can measure slant-range and groundrelative velocity along its axis simultaneously.

Hazard Avoidance Sensors.
Two hazard avoidance sensors are equipped for hazard avoidance and landing site selection. One is called the optical obstacle avoidance sensor  The other is called the multifunction obstacle avoidance sensor (MOAS), consisting of an optical imaging lens and a laser imaging lens. During the powered deceleration mode, 2D images of the landing area are taken by the OOAS and then a safe area for coarse hazard avoidance is selected. During the hover and imaging mode, 3D images are taken and a safe landing site for precise hazard avoidance is selected. An     Space: Science & Technology additional option for precise hazard avoidance is that the OOAS can work in conjunction with the optical imaging mode of the MOAS.
3.5. Actuators. 6 × 25 N thrusters and 20 × 250 N thrusters are mounted for attitude control, of which 8 × 250 N thrusters are additionally used for translation control in the horizontal plane after the hover and imaging phase. In addition, a MLE for translation control is carried out to produce either a constant thrust with 7500 N or a throttleable thrust in the range from 1500 N to 5000 N.
3.6. GNC Computer. The GNC computer, referred to as entry and descent control unit (EDCU), collects and processes data from the sensors, actuators, and On-Board Data Handling (OBDH) system, performs real-time GNC calculation, and then sends control signals for orbit and attitude control. During the powered descent phase, the EDCU is also responsible for hazard recognition and landing site selection by analyzing the images obtained from the hazard avoidance sensors.

Guidance Algorithm
The Tianwen-1 performed a guided entry, an unguided parachute descent, and a guided powered descent in succession.

Entry Guidance.
For the entry phase, early missions adopted the unguided ballistic trajectory, leading to a large landing error ellipse. The MSL was the first mission that flew the guided lifting entry at Mars. Because of the displacement of the center of mass of the entry with its axis of symmetry, a nonzero trim angle-of-attack can be generated to produce a lift force. By modulating the bank angle to change the direction of the lift vector, the entry trajectory can be controlled such that the parachute deploy ellipse is minimized. To minimize size of the parachute deploy ellipse, the Tiawen-1 also adopted active guidance during the entry phase. Depending on the bank angle command, the entry guidance of the Tianwen-1 is divided into four phases: prebank, range control, heading alignment, and zero-bank.
In the AOA-trim mode, the prebank guidance is executed by commanding a constant nominal bank angle. When the AOA-trim mode is switched to the lift control mode, the range control begins. In this mode, the descent module flies with its trim angle-of-attack. Based on the estimated drag accelerations, altitude rate, and range errors with respect to a reference trajectory [18] stored on-board, an analytic predictor-corrector guidance algorithm calculates the commanding bank angle and then sends it to the attitude control system such that the range error can be minimized.
When the navigated Mars-related velocity drops to 1700 m/s, the range control capability is greatly reduced, and the commanding bank angle is easy to saturate. At this time, the range control algorithm is ceased, and the heading alignment algorithms begin to minimize the cross-range error until the trim wing is deployed. Then, the zero-bank phase begins, in which the bank command is set to 0°.
If the error between the navigated and nominal states at entry interface (EI) was too large, it might not be possible to track the reference trajectory, which may saturate the guidance bank command and make it impossible to meet the parachute deployment requirements. To cope with this case, a range compensation algorithm is designed to implement at the beginning of the AOA-trim mode such that the parachute deployment altitude constraint is satisfied at the expense of parachute deployment ellipse.
The flow chart of the entry guidance algorithm is summarized in Figure 5.

Powered Descent
Guidance. The main purpose of powered descent guidance is to reduce the vehicle's velocity and execute hazard avoidance and backshell evasion. As mentioned in Section 3.2, the GNC operates in five modes in the powered descent process, i.e., powered deceleration, hover and imaging, hazard avoidance, slow descent, and no-control. There is no trajectory guidance for the nocontrol mode. The powered descent guidance is mainly inherited from the ChangE-3 [16,17], except that the backshell evasion should be considered for the Tianwen-1 during the powered deceleration phase.
Here, we only introduce the powered deceleration guidance. For the guidance algorithms of other four modes, readers may refer to Refs. [16,17]. The main tasks of the powered deceleration are reducing the lander's velocity using the MLE, executing a backshell evasion maneuver, and performing coarse hazard avoidance through the safe landing zone detection by the OOAS. The powered deceleration guidance consists of two segments. In the first segment, the lander's velocity is reduced, and a backshell evasion maneuver may be executed, depending on the magnitude of the lander's navigated velocity at the time of backshell separation. When the lander reaches a specified altitude with an almost vertical attitude, the OOAS begins to work, trying to determine a safe landing zone. Once the safe landing zone is determined, the second segment begins, of which a hazard avoidance maneuver is executed with a throttleable thrust explicit guidance [19] until the lander is hovered at a 100 m altitude above the Mars surface slowly.

Navigation
The radar-updated inertial navigation strategy is used for the Tianwen-1 EDL phase, whereas the GNC system relies on the inertial navigation system (INS) only before the heatshield jettison and the radar-derived states are used to correct the INS-derived states once the heatshield is separated, such that accurate altitude and velocity estimates can be provided. In the slow descent stage, in order to avoid the adverse effects of engine plumes on the landing radars, pure inertial navigation is restored at this stage.
The Tianwen-1 EDL navigation framework after heatshield separation is mainly inherited from the ChangE-3 lander [16,17,20]. Note that at most eight beams can be used for correction. For each measurement time, at most eight 5 Space: Science & Technology beams can be available which can provide a much more redundancy. Therefore, a multiple-beam fault detection, isolation, and recovery (FDIR) algorithm for the landing radars has been designed. Noting that the working beams for the PAS are not fixed, the velocity corrections in the presence of coplanarity have also designed for the Tianwen-1. In addition, high dynamic oscillatory motion at the beginning of the parachute descent phase may saturate the gyroscope and produce large attitude estimation errors, thereby producing a high landing risk. To address this problem, an online INS reinitialization algorithm [21] is designed by combining the data from the IMU and the radars. The flow chart of the EDL navigation algorithm is summarized in Figure 6.
5.1. Inertial Navigation Algorithm. The descent module's navigated states are initialized a few minutes before the orbiter/descent module separation, where position and velocity are uploaded by ground tracking and attitude knowledge is provided by star sensors. Since then, the descent module's attitude is propagated by the gyroscope measurements with the aid of the star sensors, and its position and velocity are propagated using attitude information and high-order orbit model, where the accelerometers are used to detect and compensate for nongravitational acceleration. Because of the block of the Mars, the star sensors are not available about 10 seconds prior to the entry interface. After that, the descent module relies on the INS to propagate the navigation state using the IMU measurements.
To compensate for the high dynamical motion during the parachute descent phase, based on ChangE-3's algorithm [20], a four-interval strapdown algorithm with recursive form attitude propagation and lever arm compensation based on least-square methods is designed.   Given the selected beams for altitude correction, a distributed fusion architecture is used [20]. Firstly, the second-order state equation for altitude and vertical velocity is formulated, and local estimates of altitude corrections for each beam are updated using the Kalman filter, the gain of which is approximated as a function of altitude, which is calculated offline according to the predefined landing

Velocity Correction.
Before implementing the velocity correction, an FDIR algorithm is used for velocimeter measurement validation and outlier removal. As mentioned in Section 5.2, at most eight beams can be available at each update, which allows for multiple-beam FDIR. The velocimeter FDIR algorithm is based on parity equations of five beams. For the case when eight beams are available, 56 (C 5 8 ) combinations should be evaluated. Because the PAS's working beams are not fixed, the 56 combinations should be calculated online, exceeding the limited on-board computational capability. Therefore, an FDIR velocimeter algorithm based on hybrid fault tree and parity equations is designed for the Tianwen-1, in which details will be presented in an additional paper.
Once the velocimeter FDIR algorithm is implemented, the beams that used for velocity correction can be selected. For velocity correction, the first-order equation for the ground-relative velocity along each beam is established, and the velocity correction for each beam is updated using the Kalman filter, the gain of which is approximated as a function of velocity magnitude. These corrections are then fused to form a 3D velocity correction. Note that the number of selected beams for correction is not fixed, and multiple beams may be coplanar or almost coplanar. The fusion strategy depends on the number of selected beams. If only one beam is selected, then only the velocity along the beam is corrected. For the case when two and more beams are selected, if these beams are coplanar or almost coplanar, then a plane is constructed by two beams, and the velocity along the plane is corrected using a least-square method; otherwise, the 3D velocity correction is performed.

INS Online Reinitialization.
At the beginning of the parachute descent phase, high dynamic oscillatory motion, such as parachute inflation and area oscillation [22], may cause a high angular rate and saturate the gyroscope. The saturation of the gyroscope would produce large attitude knowledge errors and thereby cause large errors of the altimeter-derived altitude, estimated vertical and horizontal velocities, and the landing attitude, which may cause serious consequences such as a complete system loss. To cope with the gyroscope saturation, an online INS reinitialization algorithm is designed. The key for online initialization is the determination of the nadir vector in a redefined inertial frame using the measurements from the IMU and the radars. Given the nadir vector, the INS can be reinitialized, and the gravitational acceleration can be modeled such that the INS navigation equation can be propagated, and finally, crucial parameters used for guidance and control systems can be derived. Once the online initialization is accomplished, the radar-updated inertial navigation algorithm presented in Sections 5.2 and 5.3 can be implemented.

Attitude Control Algorithm
In this section, the attitude control algorithms for the Tianwen-1 EDL phase will be summarized, details of which will again be presented in an additional paper.

Attitude Control for Entry Phase.
In the AOA-trim mode, the controller commands the RCS thrusters on the backshell to track the predicted bank command, the predicted trim angle-of-attack, and the zero sideslip. Here, the 3-axis attitude is decoupled into three independent channels, and a phase plane logic controller with straight switching lines is used for each channel.
In the lift control mode, the controller tracks the guidance bank command using a proportional-integralderivative (PID) controller with a pulse-width-modulation (PWM) technique. It is realized that the powerful capability of the 250 N thrusters may result in angular rate resonance phenomenon. To cope with this problem, an attitude planning technique is proposed to improve the tracking capability. For the attitude control of the angles of attack and sideslip, rate damping controllers are adopted to stabilize them around their trim values. It should be noted that, for the case when the trim wing is not deployed properly, the trim values of the angle-ofattack and sideslip angle are still not around zero, which cannot meet the requirements of parachute deployment. In this case, a PID controller is used for keeping the angle-of-attack being zero. In view of its self-stabilizing characteristics, the rate damping controller is still used for the sideslip angle control.
6.2. Attitude Control for Parachute Descent Phase. In the parachute descent, the attitude controller begins to work after a few seconds of parachute deployment. The control strategy in this phase is similar to the one in the lift control mode. The only difference is that the commanded attitude in the roll channel here is calculated according to the local upsouth-east frame.  Due to the uncertainties of the parachute descent phase, the state dispersion from the nominal values may be large at the beginning of the powered descent phase. Therefore, the attitude controller should have a strong robust capability. For example, the controller in the powered deceleration mode should track the guidance command with a maximum angular rate of 15 deg/s. Meanwhile, the rapid attitude tracking may suffer from large disturbance. As shown in Figure 7, the attitude phase plane is partitioned into four regions: a PID control region, a nominal rate control region, a rate limiter region, and a parabolic target rate control region. In the nominal rate and parabolic target rate control regions, the proportional-integral (PI)+PWM controllers are used to track the desired rate. In the rate limiter region, when the angular rate exceeds the threshold, the available thrusters work fully on control to drive the angular rate to the set range. In the PID control region, the traditional PID+PWM controller is used to track the desired attitude angle and angular rate.
Several additional strategies are also designed. Firstly, observers are designed for disturbance online identification and compensation. Secondly, the commanded thrust direc-tion is decoupled from the attitude and is sent directly to the pitch and yaw channels, which makes the tracking of the commanded thrust direction as fast as possible. Thirdly, an attitude controller based on multiple-level thruster switching logic is designed based on the level of attitude error. Finally, an FDIR algorithm is designed for the Tianwen-1 to identify fault thrusts and rearrange the remaining ones, which makes the controller more robust in case that any thrust cannot be opened.

Flight Results
In this section, the actual flight results for the Tianwen-1 EDL process are presented. The descent module was separated from the orbiter at 04:18:54 a.m. BJT on May 15, 2021. About three hours later, the descent module entered the Mars atmosphere at 07:08:54 a.m. BJT on May 15, 2021. Through 537-second EDL process, the lander landed successfully on the surface of Mars. The longitude and latitude of the actual landing site are 109.925°E and 25. 066°N , respectively, and the downrange and cross-range errors of which with respect to the predefined landing site are   Figures 8 and 9, the angles of bank, sideslip, and attack during the atmospheric entry are shown in Figure 10, and the telemetry Marsrelated velocity during the powered descent phase is given in Figure 11. It can be seen that the atmospheric entry phase lasted 279 seconds, in which the AOA-trim mode took 68 seconds. When the descent module's sensed acceleration magnitude exceeded 1.96 m/s 2 at a navigated altitude of about 63 km and navigated velocity of about Mach 24, the lift control mode began. The trim wing was deployed at a navigated velocity of Mach 2.8, after which the trim values of the total angle-of-attack approached to around zero.
The parachute was deployed at a navigated velocity of Mach 1.8 when the navigated altitude is about 13 km. After 20 seconds when the descent module's velocity reduced to about Mach 0.5, the heatshield was jettisoned, and then the landing legs were deployed, and the two radars began to provide Mars-related measurements to correct the INS errors.
At a navigated altitude of 1.3 km and navigated velocity of Mach 0.25, the backshell was separated, implying the beginning of the powered descent phase, which lasted 90 seconds. About 1 second after backshell/lander separation, the MLE was ignited, the lander's velocity was reduced   11 Space: Science & Technology further, and a backshell evasion maneuver was also performed. Then, the OOAS obtained images of the predefined landing area used for coarse hazard avoidance. When the lander's altitude reduced to about 100 m, the GNC switched to the hover and imaging mode. In this mode, the MOAS obtained the 3D images of Mars surface and determined the final landing site. Then the GNC switched to the hazard avoidance mode. When the lander was at an altitude of 20 m above the landing site with a 1.5 m/s vertical velocity and 0 m/s horizontal velocity, the GNC switched to the slow descent mode. Finally, the lander landed on the Mars softly with a stable vertical attitude. The touchdown horizontal velocity is less than 0.16 m/s, and the attitude error is less than 0.1 deg.
The image of the actual landing positions of the lander, backshell, and heatshield is shown in Figure 12, and the image of the lander taken by the Zhurong rover is shown in Figure 13. Therefore, the effectiveness of the backshell evasion and hazard avoidance was demonstrated.

Conclusions
According to the Tianwen-1 EDL GNC requirements, the GNC modes, GNC architecture, and key GNC algorithms have been described in this paper.
The effectiveness of the GNC system design was demonstrated by the successful landing of the Tianwen-1, which landed on the Mars with a small landing ellipse, a soft touchdown velocity, and a stable vertical attitude.
It should be noted that the Tianwen-1 landed at a site with a low MOLA elevation around a relative flat area. In the future, China will target areas that have higher scientific value, more rugged terrain, and higher MOLA elevation. This puts forward new requirements for the EDL GNC technology, e.g., the GNC system must have high precision navigation capability and have stronger maneuverability or deceleration capability.

Data Availability
The data used to support the findings of this study are included within the article.

Conflicts of Interest
The authors declare that they have no conflicts of interest.