Industry: Aerospace
Product: ModelRisk
Application: Delta-V Budget and Landing-Ellipse Sizing

The heritage delta-v reserve looks fine on the mean — but the tail eats it: 16% of propagated descents need more than the reserve carries, and the P99 breaches it by 182 m/s

Apollo-era trajectory analysis published a single nominal delta-v and a single nominal landing site. Modern crewed and uncrewed lander programs publish a landing ellipse: a 95-percent-confidence region on the surface inside which the lander is expected to touch down. For a lunar south-pole mission targeting an illuminated rim site, an ellipse that is too tight risks programmatic failure when the spacecraft lands outside the published cone; an ellipse that is too loose forces the surface-systems team to design the rover egress ramp, the science-instrument deployment, and the in-situ-resource-utilization architecture against a much wider terrain set than the spacecraft will actually visit. But the prior question is the propellant one: does the heritage delta-v reserve actually cover the descent under the propagated uncertainty in mass, specific impulse, navigation, and thrust-pointing — or only on the mean?

A lunar lander prime contractor rebuilt its delta-v budget and landing-dispersion analysis in ModelRisk for a South-Pole demonstration mission. The team replaced the heritage 3σ root-sum-square (RSS) delta-v reserve with a fully probabilistic propagation that produced the actual distribution of required delta-v, the joint distribution of touchdown position, and a tank-and-margin sizing recommendation directly comparable to the deterministic plan.

The headline result is the required-delta-v distribution across 100,000 propagated trials — and where the heritage reserve actually sits on it.

Mean required delta-v is 2,194 m/s, P90 is 2,249 m/s, P95 is 2,285 m/s, and P99 is 2,410 m/s. The heritage 3σ-RSS reserve places planned propellant capacity at 2,228 m/s — which the simulation puts at only the 84th percentile. The reserve sits comfortably above the mean (a 34 m/s cushion), so a deterministic check passes. But 15.9% of propagated descents require more delta-v than the reserve carries, and the P99 demand of 2,410 m/s breaches the reserve by 182 m/s. The "3σ-RSS" label implied a 99.7th-percentile margin; the actual propagation says the margin is a 1-in-6 proposition.

Delta-v is a sum of correlated draws, not an RSS

The descent delta-v budget decomposes into:

• Nominal Hohmann-like descent delta-v = 2,150 m/s (deterministic, from the trajectory design).
• Mass uncertainty contribution: dry mass is Normal(μ = 1,840 kg, σ = 28 kg) from the mass-properties analysis at CDR; propellant load uncertainty Normal(σ = 12 kg) from servicing dispersion.
• Specific impulse uncertainty: main engine Isp is Normal(μ = 318 s, σ = 2.4 s) from acceptance-test data on the engine lot.
• Pointing-induced delta-v penalty: thrust vector control pointing error is Normal(σ = 0.37 deg) per axis, producing a per-burn delta-v penalty quadratic in pointing-error magnitude.
• Navigation-induced trajectory-correction delta-v: pre-PDI navigation knowledge error modeled as 2-D Gaussian on cross-track and along-track position errors with σ = 950 m cross, σ = 1,750 m along, ρ = −0.18, with the trajectory-correction (TCM) delta-v proportional to the navigation-error magnitude.
• Maneuver-execution variance: every commanded TCM is executed with a proportional error (≈7% 1σ), so a large commanded correction is also the one most likely to over-burn.

The contribution that makes the tail is a shared launch-injection-error common factor — a single latent injection-quality draw per trial (LogNormal, median 1.0, right-skewed) that multiplies the navigation knowledge error and the maneuver-execution variance together. A poor orbit insertion does not enlarge one correction in isolation; it enlarges the navigation error that sizes the corrections and the execution error that spends them. Modeling these per-maneuver errors as independent (the implicit assumption behind an RSS sum) makes them average out by the central-limit theorem into a tight bell that any reserve trivially covers — which is exactly the "no risk" artifact the unrealistic version of this model produced. The shared factor restores the physical coupling: the worst trials are the ones where a bad injection drives large corrections that are then executed sloppily, and those trials are what push the P99 past the reserve.

The total required delta-v per attempt is:

\[ \Delta v_{\text{req}} = \Delta v_{\text{nom}} + \frac{m_{\text{wet}}}{m_{\text{dry}}} \cdot \delta_{\text{Isp}} + k_{\text{point}} \cdot \theta^2 + \Delta v_{\text{TCM}}(r_{\text{nav}}) \]

with each term sampled per trial and the navigation and execution terms scaled by the common injection factor.

What the deterministic 3σ-RSS reserve hides

The legacy 3σ-RSS reserve sized the descent propellant load at +78 m/s above nominal, placing planned capacity at 2,228 m/s. A deterministic check against the mean required delta-v (2,194 m/s) passes with a 34 m/s cushion — which is exactly why the reserve was signed off. The propagation shows what that check hides: the reserve sits at only the 84th percentile, 15.9% of descents need more than it carries, and the P99 demand of 2,410 m/s exceeds it by 182 m/s.

The gap between the "3σ" label and the reality is the independence assumption. The RSS construction adds the per-maneuver error variances as if they were independent, so it never sees the trials where a poor injection enlarges the navigation error and the execution error at once. Those coupled trials are not in the tail of an RSS sum — but they are the entire upper tail of the real distribution. The reserve the team carried as a nominal 99.7th-percentile margin is, under the shared injection factor, a 1-in-6 margin: a descent that draws a bad injection has a meaningful chance of running the tanks past the planned reserve before touchdown.

Where the touchdown actually lands

The same propagated trial set produces a 2-D dispersion of touchdown position on the surface, plotted on the planned landing site:

The 95% confidence ellipse measures 2,341 m along its major axis by 1,412 m along its minor axis at touchdown, oriented at 107° in the cross/along-track frame. The heritage analysis had published a circular 1,800 m radius ellipse based on a single-σ navigation error pulled through the closed-form descent equations. The simulation places the actual 95% region at a noticeably different shape and orientation — an oriented ellipse whose major axis runs past the heritage circle, not a circle — and the difference matters for the rover-egress and science-deployment planning that the surface-systems team is doing in parallel.

What actually drives dispersion

Sensitivity ranking on the 95% along-track dispersion:

The dominant driver is the launch-injection-error common factor (a 900 m swing on the 95% along-track dispersion) — the same shared factor that drives the delta-v tail also drives the touchdown spread, because both flow from the navigation and execution errors it scales. The second is along-track navigation error at PDI (760 m) — directly buyable down by adding a terrain-relative-navigation update during descent at the cost of a small mass and complexity penalty. The third is TVC pointing error (520 m), driven by the actuator-quality grade selected for the descent engine; then Isp acceptance-test tolerance (280 m) and maneuver-execution proportional error (210 m).

What changed

• Propellant reserve found inadequate at the tail against the simulated distribution — the heritage +78 m/s RSS reserve (2,228 m/s) sits at only the 84th percentile, with 15.9% of descents requiring more and a P99 of 2,410 m/s that breaches it by 182 m/s. The team resized the reserve toward the P99 (a +260 m/s allocation against nominal) rather than carrying an unvalidated "3σ" label that was really a 1-in-6 margin.
• Published landing ellipse revised from a 1,800 m circle to a 2,341 m × 1,412 m oriented ellipse, allowing the surface-systems team to plan rover egress against the actual 95% touchdown region rather than a circular approximation that both understated the size and misrepresented the orientation.
• Terrain-relative navigation update added at PDI−45s based on the dispersion tornado, targeting the navigation error that the ranking identified as the second mover (behind the injection-error common factor) and shrinking both the delta-v tail and the touchdown ellipse.
• An analysis the systems engineer can defend. The model and its assumptions are sitting in Excel, the inputs are linked to the actual component-test data sheets, and a parameter change at the next subsystem CDR re-runs the propagation in under five minutes — versus the two weeks the prior legacy analytic build required.

ModelRisk Functionality Used

• Shared launch-injection-error common factor — one latent injection-quality draw per trial that scales the navigation knowledge error and the maneuver-execution variance together. This imposed correlation is what produces the upper tail; without it the per-maneuver errors are independent and the sum collapses (CLT) to a tight bell the reserve trivially covers — the unrealistic "no risk story" the model would otherwise tell.
• Joint propagation across the delta-v contributions with a Gaussian copula on the cross-contribution correlations (ρ = 0.18 to 0.20 from component-test data), recovering the joint tail an independent-RSS sum systematically underestimates.
• Normal mass/Isp/pointing-error inputs with σ values pulled from the CDR mass-properties document and the engine-lot acceptance test data — the right family for symmetric, well-characterized measurement uncertainties.
• 2-D Gaussian navigation error with off-diagonal correlation, sampled per trial, scaled by the injection factor, and propagated through the descent geometry to produce the actual cross/along-track touchdown dispersion shape — an oriented ellipse, not a circle.
• Quadratic pointing-error model for the TVC delta-v penalty (\(\delta v \propto \theta^2\)), the correct functional form rather than the linear approximation that under-counts large-pointing-error draws.
• Sensitivity ranking on 95% along-track dispersion that identified the injection-error common factor and PDI navigation error as the top two movers, putting the terrain-relative-navigation add quantitatively on the agenda for the next CDR delta.

A delta-v reserve that passes on the mean can still be a 1-in-6 margin on the tail. The difference is the correlation: a poor launch injection enlarges the navigation error that sizes the corrections and the execution error that spends them, and an RSS sum that assumes those are independent never sees the trials where both go wrong at once. Monte Carlo simulation in ModelRisk is what turns "+78 m/s 3σ-RSS, adequate" into "the reserve sits at the 84th percentile, 16% of descents exceed it, and the P99 needs 182 m/s more — here is what each subsystem improvement does to that tail."