Coming back down

A rocket coming home has to lose everything it gained on the way up, in the right place, and arrive over a pad at walking pace. Most of that speed can be given to the air for nothing. The rest costs propellant the vehicle has carried all the way up and back, and the last of it has to be spent in a burn that cannot be undone, cannot be paused, and has exactly one correct ending.

This page follows the two ways home in the reference Full mission program — the booster's, which never reaches orbit, and the upper stage's, which does — and then the last seconds they share. The numbers are from that program flying Aster from Starbase on the default mission, seed 7. Both stages landed; both landings were graded bullseye.

Two ways home

The booster is cut off 141 s after launch at 69 km, climbing at 1.2 km/s and moving at 2.4 km/s over the ground, with 27 t of usable propellant kept back for the return. It never goes into orbit. It is on a ballistic arc that would come down hundreds of kilometres out to sea, and it has about six minutes to turn that into a landing on a drone ship stationed 620 km downrange.

The upper stage goes on to orbit, releases the payload, and waits. From Starbase its ground track does not pass over home on the next revolution, so it asks fc.passes() when it will, sleeps through most of the wait, and burns out of orbit over an hour later. It meets the air at 7.8 km/s and has to lose all of it before a landing burn a few hundred metres above Landing Zone 1.

The booster's way home

Flip and boostback

A booster bound for a drone ship is flying roughly towards it, and too fast: left alone it would overshoot. The boostback is a burn against the direction of travel that pulls the landing point back. A booster returning to its launch site has the harder job — its whole horizontal speed is carrying it away from home — and it has to turn completely round and burn towards the pad, which is why a return-to-launch-site mission cuts the booster off earlier, with more propellant in hand.

Before any of that the stage has to turn round. Its engines are off, so the cold-gas thrusters do the flip. On real sites they are not strong enough to turn a stage against air still thick enough to push back, so on a drone-ship return the reference program waits, nose-first, until the dynamic pressure is below 400 Pa.

The subtle part is what the boostback aims at. It is not the ballistic impact point. A landing burn is a retrograde burn: it cancels the horizontal speed as well as the vertical, so the stage always stops short of where it would have hit. The booster aims the stop point of its landing burn, and one call predicts the whole return — the coast, an entry burn, and the latest landing burn that still stops at the surface:

const plan = fc.predict({
  entryBurn: { altitude: 55000, engines: 3, throttle: 1, untilSpeed: 1150 },
  landingBurn: { engines: 1, throttle: 0.9, attitude: 'auto' },
});
// plan.error: how far long (+) or short (−) of the target the return stops

The boostback burns until that planned stop point sits a little long of the ship — 400 m on real sites — because the entry burn, which only ever shortens the range, trims the rest. The last kilometres of the boostback are flown on one engine at minimum throttle, re-planned every tick: at this point in the flight a metre per second of boostback moves the landing point about 2 km.

The entry burn

At 55 km on the way down the booster is falling at 1.3 km/s and moving at 2.2 km/s, into air that is getting thicker quickly. Two things grow with speed. The dynamic pressure grows with its square, and the heating with its cube:

This is the Sutton–Graves stagnation-point heat flux the simulator uses, with $\rho$ the air density, $r_n$ the radius of the leading surface, $v$ the speed, and $k\approx 1.74\times 10^{-4}$ in SI units. Halving the speed cuts the heating eightfold. The booster has no heat shield — its engine bay is rated to 900 K — so it fires three engines for twenty seconds and arrives in the thick air at 962 m/s instead of 2.2 km/s: by the cube law, a twelfth of the heating in air of the same density. On seed 7 its base never got above 321 K.

The burn is also the return's main range corrector. It is cut when the planned landing burn's stop point sits on the target, and on real sites it is budgeted: every re-plan adjusts where it ends so that the planned landing burn leaves 300 kg of usable propellant. The booster lands nearly empty, as a real one does, and it has to: whatever it keeps is weight the landing burn must stop.

See also: Coming back through the atmosphere on why the booster needs this burn at all, and Bringing the booster home on what each way home costs.

The descent and the grid fins

From 35 km to 1.5 km the booster falls tail-first and the air does the braking: 962 m/s becomes 304 m/s by 6 km and 226 m/s by 1.5 km. Near the ground it is close to its terminal speed, and still slowing as the air thickens.

Four grid fins stand out from the top of the stage. They add drag — on real sites all four count, and a lattice fin chokes in transonic flow, dragging about 1.6 times its subsonic value between Mach 1 and 1.2 — and they steer. Tilt the nose off the relative wind and the body's drag and the fins together push the stage towards the side the nose leans to. Pitch it back and the landing point comes short; yaw it right and the point moves right.

The push is small, so the steering has to start early. Nulling a miss $e$ in the time left $t$ takes a sideways acceleration of about $2e/t^2$, and each degree of tilt gives roughly $0.2q/m$ of it, with $q$ the dynamic pressure and $m$ the mass. The tilt is also capped by the structure: the bending load $q\alpha$ has to stay inside a share of its 250 kPa·° limit, so at 26 kPa the reference program allows under 6°. The landing burn can fix only a few metres. Anything the fins have not removed by then stays.

The upper stage's way home

The upper stage's return is longer and hotter, and the hard part of it happens before it touches the air.

The de-orbit. Off the equator, a ground track passes over home only on some revolutions. The reference program asks fc.passes() for the next pass it can afford — on seed 7, one whose ground track runs 221 km to the side of Landing Zone 1, 1.64 hours after launch — and sleeps until 40 minutes before it. The de-orbit burn then does two jobs at once, slowing the stage and tilting its orbit so the ground track runs over the pad, and is aimed in both axes with fc.predict(). Steering and guidance walks through how.

Entry. The stage meets the 100 km mark at 7.8 km/s, tail-first behind its heat shield, and loses almost all of that speed to the air. On seed 7 the heating peaked at 80 W/cm² at 45 km, at 5.9 km/s; the base reached 1,805 K against the heat shield's 2,400 K; the air pushed at up to 80 kPa and the deceleration peaked at 8.5 g, against a structural limit of 15. Behind a heat shield the base is the stage's strongest part, which is why it enters engines-first.

The descent. Below the heat, the upper stage steers with body lift and its own grid fins, exactly as the booster does, onto the stop point of its planned landing burn. It reaches 200 m/s by 6 km and 142 m/s by 500 m, near its terminal speed.

The landing burn. One Merlin 1D, lit at 438 m and 142 m/s, planned at 64 % throttle. At full throttle the nearly empty stage would feel about 6 g, and a burn that stops it in two seconds leaves no margin for a late ignition and no time to steer out the last metres, so the program caps the planned thrust at about 4 g. It burns for 6 s and uses about a tonne. Touchdown on Landing Zone 1 is 0.70 m/s down and 0.48 m/s sideways, 1.3° off vertical and 1.3 m from the centre.

The hoverslam

Both stages end the same way, and the way they end is forced on them by one number. At its 40 % minimum throttle one Merlin 1D at sea level gives 286 kN. The upper stage weighs 15.4 t at ignition, so the engine at its gentlest still pushes nearly twice the stage's weight, and more as the propellant burns. It cannot hover. If the stage stops above the ground, the engine lifts it away again, and if the engine is cut, the stage falls the rest of the way.

That leaves a single acceptable ending: vertical speed zero at height zero. Everything else about the burn follows backwards from that.

Why there is one ignition altitude

With a constant deceleration $a=F/m-g$ — thrust over mass, less gravity — a vehicle falling at $v$ stops in a distance

For a burn at a fixed throttle, that distance is fixed, so the ignition altitude is fixed: exactly $d$ above the ground, plus whatever the stage falls while its engine starts. Light it higher and the stage stops higher. Light it lower and it reaches the ground still moving.

The two mistakes are equally fatal, and it is worth seeing why with numbers. In the model behind the figure below, Aster's upper stage at a fixed 64 % has to be lit at 430 m.

• Lit 1 m late, it reaches the ground at 7.1 m/s: past what the legs can absorb.
• Lit 1 m early, it stops 1 m up. The engine cannot hold it there. Cut, it drops the last metre and lands at 4.4 m/s: hard, with the crush cores used.
• Lit 30 m early, it stops 30 m up and falls at 24 m/s.
• Lit 30 m late, it hits at 39 m/s.

The window that lands at 3 m/s or less runs from about 0.2 m late to about 0.45 m early: two thirds of a metre, in all. At 142 m/s the stage covers that in under 5 ms, less than a quarter of one program tick. No program can time an ignition that precisely, because no program is called often enough to try.

What the throttle buys

The way out is the throttle. Lit anywhere between the altitude where full throttle only just stops the stage and the altitude where the minimum only just stops it, there is a throttle setting that arrives at zero speed at zero height. For this stage, in this model, that band runs from 276 m to 813 m. The window is no longer a quarter of a tick; it is half a kilometre.

But only for a program that steers the throttle all the way down. A burn lit inside the band and then left alone still has one correct altitude — the one for its throttle — and misses. The band exists because the program measures, many times a second, where the burn is going to stop, and corrects.

The band is not free, and its two edges cost different amounts. At full throttle from 276 m the burn lasts 3.4 s and uses 871 kg; at the minimum from 813 m it lasts 12 s and uses 1,399 kg, because every second of burning is a second of holding the stage up against gravity. The cheapest landing is the latest one the engine can stop, which is why the planners look for the latest ignition that still stops at the surface. The cheapest landing is also the one with no margin left, which is why the reference programs plan below full throttle — 90 % on the booster, and on a stage light enough that full throttle would be more than 4 g, whatever throttle keeps it to 4 g — and keep the rest for correcting.

Planning it, and flying it

A program does not have to solve any of this itself. fc.predict({ landingBurn }) coasts the vehicle forward with drag and the forecast wind, and finds the latest ignition that stops it at the surface, or at landingBurn.altitude metres above it:

const lb = fc.predict({ landingBurn: { engines: 1, throttle: 0.9, attitude: 'auto' } });
// lb.ignitionTime: seconds from now; lb.ignitionAltitude: metres above the surface
// lb.crashed: true if no ignition, however early, is early enough

On real launch sites the time it returns is when to call fc.ignite(): the engine's dead time is already inside it. A hand-made trigger has to add it — 0.3 s for a Merlin, which at 225 m/s is 68 m of fall before any thrust at all. The reference programs refresh the plan every half second high up, every fifth of a second in the last few kilometres, and every tick in the last second before ignition, and light the engine on the tick the plan says.

Once the engine is lit, fc.stopPoint() answers the question that matters: held as it is, where does this burn end? The reference programs bisect the throttle ten times a second for the one that stops 12 m above the surface, and lean the thrust a few degrees off the reference direction to walk the stop point onto the pad. Steering and guidance shows the loop.

The last metres

Below 60 m, or 20 m/s, the reference programs change laws. The last few metres are flown on a constant-deceleration profile that aims for about 1 m/s at the pad, steering over its centre on both horizontal axes — relative to the deck, which on a drone ship is moving. Then the engine has to be cut, and the cut has to be timed too: thrust tails off over 0.25 s, so the program cuts when that tail-off plus the last drop will bring the legs down at about 1 m/s.

A landing-burn ignition can also fail. The reference programs check, on every tick of the burn, that the engine is actually running, and relight at once if it is not and an ignition is left. A Merlin 1D has five starts; an Aster booster uses four on a drone-ship return — launch, boostback, entry, landing — which leaves exactly one for this.

How a landing is judged

On real launch sites the simulator judges a landing by what happens to the hardware, not by a speed limit. Each of the four legs is a strut in series with a one-shot crush core, sized for the mass the stage was built to land with: the empty stage plus 2 % of its propellant, or the landing reserve set in the designer. At that mass the cores start to crush at about 3 m/s and are used up at about 6 m/s. Land heavier and they give sooner.

• A leg collapses when its core has used its whole stroke and the load still climbs, or when the load across the strut is too much.
• The stage tips over when its centre of mass passes outside its feet with no way back — for Aster's booster, at 25° towards a leg and 18° between two.
• It crashes if the body touches first, if the engine end strikes faster than 5 m/s, or if a contact pulls more than 15 g. Engine bells that hit the surface faster than 1 m/s are crushed, and their engines are lost.

Once it has stood on at least three feet for 2 s, the landing is graded on four things, and the grade is the worst of them:

Anything worse is Hard, and so is any use of the crush cores. On the drone ship everything is judged relative to the moving deck, and a landed stage keeps riding it: a nearly empty Aster booster standing on the deck is blown over by a surface wind of about 26 m/s, and a stage lost after it landed loses its landing. The classic equatorial range keeps simpler rules — fixed limits of 6 m/s down, 6 m/s sideways and 35° of tilt. Fidelity and its limits describes both.

What goes wrong

• A stale plan. At 150 m/s a landing plan 0.2 s old lights the burn 30 m late, and 30 m late is a crash.
• A target plane that spins. Close to the target, a { target } plane pivots about it; freeze it with fc.setPlane({ azimuth: fc.target.bearing }) within a few kilometres, or forward turns round overhead.
• A miss left for the landing burn. The burn can only fix a few metres sideways. Crossrange left at 2 km is crossrange at touchdown, or a tip-over.
• Landing heavy. A stage that keeps more propellant than its legs were built for crushes them sooner. One heavy enough that a single engine cannot stop it needs more engines lit, which the reference program works out before the descent: enough for 1.6 times the stage's weight at 90 % throttle.
• No start left. The landing burn is the last relight of the flight. A program that spent an ignition on an unsettled relight, or on a boostback that was not needed, finds out here.