The hard part of the flying Roadster is the controller

In October 2026 Tesla showed a Roadster that drives up a curved wall until it hangs upside down, drops off the top, turns upright in the air and lands on cold-gas thrusters. Later in the same show it jumped a row of parked vehicles and rolled a full turn on the way over. The press repeated three numbers: a 1.7-tonne car, a 600-litre tank, and nitrogen at 10 000 psi11. One psi is one pound-force per square inch, 6 894.76 Pa. Ten thousand psi is 68.9 MPa; one atmosphere is 101 325 Pa, or 14.7 psi.. My first reaction, on a whiteboard, was to try to show that those numbers could not work. They can, and the reasons are in the first half of this post.

The second half is about the part the numbers leave out. Lifting two tonnes with compressed gas for a few seconds is ordinary physics. Keeping those two tonnes on a planned path while they turn upside down, with thrusters that can only push, valves that open late, a tank that cools as it empties, and a sensor that never quite agrees with itself, is a control problem. I build the simplest controller that flies both stunts, a PID loop, check it against the telemetry, and then show where it stops being enough.

Tesla’s demonstration and claims

Tesla’s livestream (Tesla 2026a) carried four demonstrations, and Tesla posted two of them as short videos (Tesla 2026c, 2026b). In the first, the car climbed a curved wall slowly, parked upside down at the top, came back down, and then repeated the climb at speed, left the top of the wall upside down and landed on its thrusters. In the second, the car launched itself over a Tesla Semi and a row of cars, rolled through a full turn in the air and landed. The third was a 0 to 60 mph run in 0.81 seconds. In the fourth, at the end of the livestream, the car rose beside a pylon, turned over in the air and landed on its thrusters. CNET’s cut of the livestream, which I measured, ends before it, and I analyse neither of the last two.

The people on stage made the claims that matter for this post. A presenter described “a fan suction system on the bottom of the car that can pull up to 2 Gs”, adding that “we borrowed some technology from SpaceX to do the rest”. Elon Musk said the car has “attitude control thrusters and main thrusters in the rear” and “an advanced ultra-high pressure air tank” that the car recharges itself. Lars Moravy, Tesla’s vice president of vehicle engineering, said the car carries two carbon-overwrapped tanks, “a total of 600 L”, feeding ten nozzles, and a presenter said the four rear thrusters, the ones that push the car forward, create “over 80 kN of thrust”. In an interview with Hagerty, recorded the day before and published the same day (Hagerty 2026), Moravy put the car at “just under 1,700 kilos” and the tanks at 10 000 psi of nitrogen22. On the livestream Moravy also put the gas at “about 250 kilos of air”. At 20 °C, 250 kg in 600 litres is 6,338 psi of air or 7,143 psi of nitrogen, short of the 10 000 psi rating. I use the rating, which puts 297 kg of nitrogen in the tanks. With 250 kg every gas budget below shrinks by about a sixth, and a full tank is still one stunt.. Those are the numbers the press repeated. He also named the ten nozzles: four in the rear for the 0 to 60 run, and a flight system of “one in each corner and then two at the front to yaw”. Tesla said air on stage and nitrogen to Hagerty. Air is 78% nitrogen by volume, and a tank of air holds about 7% more mass than the same tank of nitrogen, so I work with nitrogen and give the air figure where it matters.

The livestream telemetry

The broadcast overlaid the car’s telemetry on the video: a left gauge that reads downforce in kilograms during the slow climb and G-force during the flights33. An accelerometer cannot feel gravity. In free fall it reads zero; standing on the ground it reads 1 g, because the road pushes up. What it measures is specific force: every force except gravity, divided by the mass. In the air that is thrust and a little drag., a pitch gauge during the climb, an altitude gauge in feet, a small 3-D model of the car that turns with the car’s attitude44. Attitude is the car’s orientation in space, given by three angles: roll about its long axis, pitch about its side-to-side axis and yaw about its vertical axis., and a top view of the car with six rings that light up when a thruster fires: one at each corner and two at the nose. I downloaded CNET’s ten-minute cut of the livestream (CNET 2026), 1280×720 at 29.97 frames per second, and read these gauges from every frame of the three windows that matter, 14 seconds of slow climb and two flights of about five seconds each.

Off-the-shelf OCR failed on the gauges. The HUD font draws zero with a slash, and Tesseract (Smith 2007) reads it as a two, so 0.9 g came back as 2.9 g. I segmented each gauge into glyphs, grouped 4 841 glyphs into 24 clusters, labelled the clusters once by eye, and classified every frame against them. The lamps needed no OCR: a ring reads about 55 on a 0–255 scale when dark and 165 to 190 when lit. The attitude icon I read by eye at 0.1-second steps; it is sharp at the states that are hard to confuse (upright, on a side, upside down) and good to about 20° in between.

The video frames supplied the rest. The wall’s height, 21.1 m from the altitude gauge, served as a ruler for the car, which measures 4.4 m long to within half a metre once I allow for perspective. The horizontal motion could not be measured: there is one camera, it looks at the wall at an angle, and when I scaled the car’s position by the wall its height came out up to 5 m off the gauge. I report the vertical motion from the gauges and treat the horizontal motion as a rough few metres per second.

None of this measures the car’s mass. Every kinematic equation divides it out, so a video can tell you accelerations and never kilograms. The mass needs a known force. The broadcast offers one, and only through an assumption: the gauge read 4 700 kgf of downforce55. The gauge’s kilograms are kilograms-force, the weight of that many kilograms: 1 kgf is 9.81 N, so 4 700 kgf is 46.1 kN. The altitude gauge is in feet: 1 ft is 0.3048 m, so 69 ft is 21.0 m. with the car parked at the top, and the presenter said the fans “can pull up to 2 Gs”. If the fans were pulling their stated maximum, the car weighs 2 350 kg. I make that assumption and use 2 350 kg throughout; every energy and gas figure below scales with it. Tesla’s 80 kN does not check it: that figure belongs to the rear thrusters, which push the car forward, and the 3.3 g peak on the gauge comes from the corner thrusters braking its fall. If the four corner thrusters were as strong as the four rear ones, 80 kN at 3.3 g would give 2,472 kg, consistent but not a measurement. Hagerty’s 1.7 t is the car in the studio, which carries a 200-litre tank; the flight system adds another 400 litres of tank, six thrusters and their gas. At the 0.6 kg per litre of composite 70 MPa hydrogen tanks, the extra tank weighs about 240 kg and its nitrogen about 200 kg, so the flying car would weigh about 2.1 t before its thrusters and plumbing, within about 10% of the figure I use.

The half loop

The wall is close to a half circle. Plotting the pitch gauge against the altitude gauge during the slow climb removes time from the problem and leaves geometry: a first arc of 9.1 m radius takes the car from the floor to vertical, a second of 9.8 m takes it to 170°, nearly upside down, and the altitude keeps rising to 21.1 m while the pitch reads 170°. Taken at face value, that last part is a straight inverted section about 13 m long; the frames suggest a shorter lip, so the altitude reference may sit above the road surface. The arcs are the part I use.

Four forces act on the car on the wall: its weight $mg$, the fans’ suction $S$ pulling it toward the road, the road’s normal force $N$ pushing it away, and the tyres’ traction $F_t$ along the road. With $\theta$ the angle of the road (0 on the floor, 90° vertical, 180° upside down) and $R$ its radius, Newton’s second law across and along the road66. Across the road the car follows a curve, and a body moving at speed v on a curve of radius R needs a net force m v²/R toward the centre of the curve. On the wall that centre lies on the car’s roof side. reads

The tyres stay on the road while $N\ge 0$, and they hold while $|F_t|\le \mu N$77. The friction coefficient μ is the largest ratio of friction force to normal force a tyre carries before it slides: about 0.9 to 1.1 for road tyres on dry concrete, over 1.5 for racing slicks.. For the slow climb, where $v\approx 0$, the grip the tyres need is

With suction equal to twice the weight, that requirement peaks at $\mu =0.58$ at 120°, inside what a road tyre gives on dry concrete. With suction equal to the weight it diverges as the car turns over: at 150° the car would need $\mu =3.7$, and upside down no tyre holds. “Two g” is the suction that lets a car crawl around a half loop with a margin of about 1.7 on grip.

The fast run shows the same thing from the other side. A car without suction going around a loop of radius 9.8 m needs at least $\sqrt{gR}$ = 9.8 m/s at the top, and therefore at least 21.5 m/s at the bottom. Inverting the altitude record through the wall profile gives the Roadster’s speed on the two arcs: between 5 and 10 m/s, 6.1 m/s on average, covering their 28 m in 4.0 s. The suction carries what speed would otherwise have to.

As a check on the gauge itself, the specific force those speeds imply, $v^2/R+g\cos \theta$ across the road and the drive force along it, matches the G-force gauge to 0.4 g RMS. That is too loose to recover the speed from the gauge, but it says the gauge is reading the car and not decoration.

Energy

Mass appears in every energy and in no speed. The car’s speeds are the measured quantities; the energies below scale with the 2 350 kg I assumed.

Climbing the wall costs the battery at least 0.13 kWh. The flight is the expensive part, and its energy comes from the tank.

Nitrogen at 10 000 psi

Ten thousand psi is 68.9 MPa, 680 atmospheres. At that pressure nitrogen is far from an ideal gas. The ideal-gas law puts 475 kg of nitrogen in 600 litres at 20 °C; the reference equation of state for nitrogen (Span et al. 2000), evaluated with CoolProp (Bell et al. 2014), gives 495 kg/m³ and 297 kg. The compressibility factor is 1.6088. The compressibility factor Z = p/(ρRT) compares a real gas with an ideal one. At Z = 1 the gas is ideal; above 1 the molecules’ repulsion makes it stiffer than the ideal-gas law predicts, so less of it fits in the tank.: the molecules sit close enough that their repulsion holds the volume open. Air, on the equation of state for air (Lemmon et al. 2000), gives 319 kg.

That nitrogen is a supercritical fluid99. Above its critical temperature and pressure a substance has no boiling point: compressed further, it grows denser continuously and never forms a liquid surface. Supercritical carbon dioxide, above 31 °C and 7.4 MPa, is one of the solvents used to take the caffeine out of coffee., which is a different thing from a superfluid. Nitrogen’s critical point is 126.2 K and 3.40 MPa; the tank sits at 2.3 times the critical temperature and 20 times the critical pressure. There the distinction between liquid and gas disappears: the fluid in the tank is 495 kg/m³, 61% as dense as liquid nitrogen at its boiling point, but it fills the tank like a gas, with no surface, no bubbles and no boiling. A superfluid is a quantum liquid that flows with zero viscosity1010. Superfluid helium-4 creeps up the walls of its container, leaks through pores a few nanometres wide, and keeps flowing around a ring without slowing down. A large share of its atoms share one quantum state, which takes very light atoms at very low temperature.. Helium-4 becomes one below 2.17 K (Kapitza 1938; Allen and Misener 1938); nitrogen freezes at 63 K long before quantum effects could matter, so nitrogen is never superfluid.

Three things happen to that gas on its way out.

The regulator drops it to the thruster’s chamber pressure; I assume 20 MPa. Throttling keeps the enthalpy1111. Enthalpy, h = u + p/ρ, is a fluid’s internal energy plus the work it does pushing its way into a space. When gas passes through a valve without exchanging heat or work, its enthalpy is the same on both sides. constant, and at these pressures throttling warms nitrogen slightly instead of cooling it1212. This is the Joule-Thomson effect. Most gases cool when throttled, because their molecules attract and pulling them apart costs energy; refrigerators and gas liquefiers work this way. At high enough pressure the molecules’ repulsion dominates and the gas warms instead. The boundary is called the inversion curve, and this tank starts above it., so with a full tank it leaves the regulator at 294 K, about one kelvin warmer than it went in. Once the tank falls below about 40 MPa the same valve cools the gas instead.

The nozzle accelerates it. An ideal expansion from 20 MPa to one atmosphere gives an exhaust speed of 656 m/s, a specific impulse of 67 s1313. Thrust is the momentum the nozzle throws backwards each second, F = ṁ v_e, plus a pressure term that is zero for an ideal nozzle. Specific impulse is the exhaust speed divided by standard gravity, 9.81 m/s²: the seconds one kilogram of propellant can hold up its own weight. Cold nitrogen gives about 70 s; a kerosene and oxygen rocket engine about 300 s., and a thrust coefficient of 1.601414. The thrust coefficient C_F = F/(p_c A_t) measures how well a nozzle turns chamber pressure p_c, acting on the throat area A_t, into thrust. An ideal nozzle expanding nitrogen from 20 MPa to one atmosphere gives 1.6. (Sutton and Biblarz 2016). The exhaust leaves at 77 K with about 89% of it still vapour; the rest condenses into droplets. The white plumes in the video are probably that mist mixed with condensed moisture from the air, though the stage also used fog, and I cannot tell the three apart.

The tank cools. Each kilogram that leaves does work pushing the rest out, and if the walls supply no heat the gas left behind follows an isentrope1515. Adiabatic means no heat crosses the boundary; isentropic means adiabatic and without friction or mixing, so the entropy stays constant. A gas that expands isentropically does work on whatever it pushes and cools down.: after a third of the gas is used the tank drops below a 20 MPa regulator setting, and after 40% it is at 200 K and 15 MPa. Composite tanks have polymer liners that insulate, so the real tank sits somewhere between this adiabatic path and room temperature. Below the regulator setting the thrust falls with the tank’s pressure, so a tank that cools loses thrust within a single stunt.

The peak of 76 kN shared by four corner thrusters is 19 kN each. At 20 MPa that needs a throat of 5.9 cm², 2.8 cm across, and all four together swallow 116 kg of nitrogen a second. At that rate the full tank lasts 2.6 s.

The gauge also tells us how much nitrogen each stunt used. The G-force gauge reads thrust per unit of the car’s weight, so the integral of its reading over a flight, times the car’s weight, is the thrust impulse, and dividing by the exhaust speed gives the gas. I integrate only while the car is in the air; on its wheels the accelerometer reads the road’s support, not thrust. The kickflip’s lift burns used 120 kg and the descent off the wall 163 kg, 55% of the tank. The accelerometer cannot see a pure torque, so the roll adds roughly 41 kg, which brings the kickflip to about the same as the descent. With 10% uncertainty in the mass and 5% in the exhaust speed, the mass of gas alone might stretch to two stunts. Pressure settles it. The thrusters need the regulator’s 20 MPa, and the tank stays above that only until a third of its gas is gone if it cools as it empties, or a little over half if its walls keep it warm. One stunt uses about half. A full 600-litre tank is one stunt, not several, and the car must refill between them.

Refilling is not free. The least work that can compress nitrogen from the atmosphere into that tank is its exergy1616. Exergy is the most work a substance can deliver as it comes into equilibrium with its surroundings, and so also the least work it takes to put it in that state. For a gas compressed at room temperature it is the rise in enthalpy plus the room temperature times the fall in entropy., 595 kJ per kilogram, or 49 kWh for the whole tank. Real compressors reach perhaps half to two thirds of that ideal, so a refill costs something like 70 to 100 kWh, comparable to the whole battery of most electric cars, for one stunt. Hagerty’s presenter adds that filling all 600 litres takes six to seven hours today, that it is not something done at home, and that Tesla is working to bring it down to about half an hour (Hagerty 2026). Over six and a half hours that refill draws 11 to 15 kW on average; in half an hour it would draw 140 to 200 kW. Musk said on stage that the car recharges its tank itself, but a refill that cannot be done at home suggests that, for now, the compressor is not in the car.

The kickflip

The kickflip is a roll about the car’s long axis. Seen from behind, the car’s corner thrusters push along the car’s own up axis: they can push and never pull. Their difference makes a torque, $\tau =(F_B-F_A)d$, with $d\approx$ 0.85 m, half the distance between the left and right corners. Their sum makes a force along the car’s up axis, and once the car is upside down that force points at the ground.

So the corners can roll the car, but every newton-metre they make comes with a push, and for half the roll that push is aimed at the ground. The gauges say the car does not pay that price. If the corners made all the torque the measured roll needs (below), the G-force gauge would read at least 1.1 g at the roll’s peak; through the roll it reads about 0.2 g. For the corners alone to fit that reading, the car’s roll inertia would have to be below 279 kg·m², a radius of gyration of 34 cm, far easier to roll than a car of this size can be. So the car makes torque in some way that adds little net force, and Moravy’s list of nozzles does not say how. Musk spoke of “attitude control thrusters”, and mid-roll the frames show plumes leaving the corners sideways, which canted corner nozzles would produce. I model the source as a couple1717. A couple is two equal and opposite forces that do not act along the same line. They add to zero, so they do not move the centre of mass, but they turn the body; the torque is either force times the distance between their lines., ${\tau }_c$, a torque with no net force, and the simulators below let you switch it off and fly on the corners alone.

The roll itself I read from the HUD’s attitude icon. A turn that starts and ends at rest must speed up and then brake, so I fitted a profile with those end conditions built in: a minimum-jerk curve1818. Jerk is the rate of change of acceleration. A minimum-jerk curve is the smoothest way to move from rest to rest in a given time; human arm movements follow it closely. plus two shape terms that vanish, with their first two derivatives, at both ends. The fit has the roll start 285.5 s into CNET’s cut and take 2.1 s: the car turns its first half-turn in about 0.8 s, almost stops while upside down, and turns the second half in another 0.8 s. The turn rate peaks at 6.0 rad/s. Treating the car as a uniform box of 2.0 by 1.2 m gives a roll inertia1919. The moment of inertia is to rotation what mass is to a push: torque equals the moment of inertia times the angular acceleration. For a uniform box of mass m, width w and height h rolling about its long axis, it is m(w² + h²)/12. of 1,065 kg·m², an upper estimate for a car that carries its battery in the floor, and the torque the profile needs peaks at 22 kN·m, which from the corners alone would take a difference of 26 kN, more than one corner thruster’s 19 kN.

The same reading settles how the car turns upright after it leaves the wall. It goes from 170° to level in 1.5 s. Done as a roll, that needs 12 kN·m; done end over end, as a pitch, the inertia is 4,073 kg·m² and the torque 46 kN·m, nearly four times as much. A car is much easier to roll than to flip end over end, so I take the turn off the wall to be a roll and model both stunts in the roll plane.

Equations of motion

Seen from behind, the car is a rigid body in a vertical plane with three coordinates: sideways position $h$, height $z$ and roll angle $\phi$, zero upright and positive anticlockwise. The state and the inputs are

with $F_A$ and $F_B$ the thrust of the left and right corner pairs and ${\tau }_c$ the couple that makes torque without lift. Newton and Euler give

subject to $0\le F_A,F_B\le F_{max}$ and $|{\tau }_c|\le {\tau }_{max}$, where ${\tau }_d$ collects what the controller does not command: a misaligned nozzle, a gust, the fans’ wake. The valves do not deliver a command at once; each thrust follows its command through a lag of about 30 ms, $T_v\dot{F}=F_{cmd}-F$. The controller measures $\phi$ with noise, 100 times a second.

The rotational part does not depend on the translation. Its transfer function2020. A transfer function describes a linear system as the ratio of output to input after a Laplace transform, in which s stands for differentiation and 1/s for integration. So 1/(I s²) reads as divide by I and integrate twice; e^(−sT) is a pure delay of T seconds; 1/(T s + 1) is a lag that covers 63% of a step in T seconds. from commanded torque to roll angle is a double integrator behind the valve lag and any delay $T_d$:

A double integrator never settles on its own and has no damping: any constant torque error grows into an angle error quadratically. The coupling runs the other way: the translation depends on $\phi$ through $\cos \phi$ and $\sin \phi$, so a roll error turns into a sideways drift and a loss of lift.

The controller

The attitude controller, the loop that turns the car to the roll angle the plan asks for, is a PID on the roll error2121. Feedback means acting on the measured error. It corrects whatever happens, including what nobody modelled, but only after the error has appeared. with a feed-forward term2222. Feed-forward means acting on the plan instead of the error: the controller applies the torque the reference needs before any error appears. It is fast but blind to surprises, so controllers pair it with feedback, which is slower but sees them., normalised by the inertia so that the gains are in units of frequency:

The feed-forward term is the torque the reference needs if everything goes to plan, computed from the reference itself. The PID terms correct what the plan got wrong2323. The proportional term pushes against the present error; the integral against the error accumulated so far, which removes steady offsets; the derivative against the error’s rate of change, which damps the motion.. I clamp the integral so that it cannot wind up2424. When the thrusters are at their limit the error persists and the integral keeps growing. When the error finally reverses, the oversized integral throws the car past its target. Clamping the integral prevents this windup. while the actuators saturate, and take the derivative as a finite difference of the sampled error.

The allocation turns a torque and a collective force into thruster commands. Torque goes to the couple up to its limit. Whatever is left goes to the corner pair as a difference, but only while the car is within 72° of upright; past that, the corner pair’s net force would push the car sideways or down. If a split would need a negative thrust on one side, that side shuts and the other makes the torque alone.

The collective force has its own small logic, one rule per phase. For the kickflip: a launch burn, then the measured 0.2 g of residual lift while the car coasts, then a landing law. Within 30° of upright the corner pair makes it. Past that none of the nozzles Tesla lists can push up and I cannot see what does, so the model applies it there as a vertical force. For the descent off the wall: no thrust while the car turns upright, then a lander’s sink-rate law, which commands a vertical speed that falls with height,

a constant deceleration $a_b$ down to a gate at $z_g$ = 3 m and $v_g$ = −2 m/s, then a linear slow-down to 1 m/s at contact. A PI loop on the error in vertical speed sets the thrust, divided by $\cos \phi$ so that a tilted car still holds its vertical rate. A proportional tilt on the horizontal speed brings the sideways drift to zero.

In the simulator the PID is five lines, run every 10 ms:

err = ref - a_meas
derr = 0.0 if prev_err is None else (err - prev_err) / p.ctrl_dt
prev_err = err
integ = max(-p.i_limit, min(p.i_limit, integ + err * p.ctrl_dt))
tau = inertia * (
    p.kp * err
    + p.ki * integ
    + p.kd * derr
    + (ref_acc if p.feedforward else 0.0)
)

and the allocation is a function that knows the thrusters can only push:

def allocate(
    collective: float, tau: float, arm: float, cap: float
) -> tuple[float, float]:
    """Split a collective force and a torque between two push-only groups.

    Torque wins: if the split would need a negative thrust, that group is shut
    and the other alone makes the torque, adding |tau|/arm of net force.
    """
    half = tau / (2 * arm)
    fa, fb = collective / 2 - half, collective / 2 + half
    if fa < 0:
        fa, fb = 0.0, abs(tau) / arm if tau > 0 else 0.0
    if fb < 0:
        fa, fb = abs(tau) / arm if tau < 0 else 0.0, 0.0
    return min(max(fa, 0.0), cap), min(max(fb, 0.0), cap)

Tuning

With the gains normalised by the inertia, the closed rotational loop, ignoring the valve lag, has the characteristic polynomial $s^3+K_d{s}^2+K_{p}s+K_i$. Choosing

places two poles close to the natural frequency, at $0.93{\omega }_n$ with damping 0.752525. In a second-order loop the natural frequency sets how quickly it responds and the damping ratio how much it overshoots. A damping ratio of 0.7 to 0.8 gives 2 to 5% overshoot and no ringing. That holds for a pure second-order loop. This one also has the PID’s zeros, which make a bare step in the reference overshoot by about 20%; a planned turn with feed-forward never asks for a step. and a third, slow pole near ${\omega }_n/10$ that removes steady errors (Åström and Murray 2021). That leaves one number to choose. Ziegler and Nichols’ rules (Ziegler and Nichols 1942) tune from a measured step response or from the gain at which the loop oscillates; a double integrator has neither, so pole placement is the natural method here.

Faster is better until delay catches up. The valve lag and the sampling period already cost phase, and each millisecond of extra latency costs more at higher frequency2626. A delay of T seconds shifts a sinusoid of angular frequency ω by ωT radians. Once a correction arrives half a cycle late it adds to the error instead of cancelling it, and the loop oscillates. Every loop has some delay, so every loop has a highest frequency it can work at.. I swept ${\omega }_n$ for three latencies:

Without extra latency the error falls until about 16 rad/s. Past that the derivative term turns sensor noise into torque demands larger than the couple’s 30 kN·m, and the excess goes to the corner pair. During the launch both corners are at full thrust, so the only way they can make a difference is to throttle one side down: from 20 rad/s the car loses enough lift that it no longer reaches the 6 m it needs to clear the row, though it still lands upright and slow. With 30 ms extra it fails beyond 12 rad/s, and with 60 ms beyond 8. Noise sets the other limit: the derivative term multiplies the measurement noise by $K_d/\Delta t$, and that torque is real gas spent on nothing. I chose ${\omega }_n$ = 8 rad/s, which gives $K_p$ = 64 s⁻², $K_d$ = 12 s⁻¹ and $K_i$ = 512/12 ≈ 43 s⁻³, which I round to 40. It sits well inside the delay limit and leaves room for noise.

The model against the measurement

The controller structure is mine; the size of each burn is the car’s, and the telemetry pins it. I fitted the kickflip’s launch burn and the descent’s braking level by least squares on the gauge altitude2727. This is system identification: choosing a model’s unknown parameters so that its output matches measured data. Here the parameters are the size and length of the launch burn and the braking level of the descent, and the data are the altitude gauge.. The launch comes out as 3.3 g for 0.44 s, close to the 3.2 g the gauge shows at lift-off, and the braking as a design deceleration of 1.1 g. The descent fits best with no lift burn while the car turns upright. The gauge shows 0.3 to 0.5 g in that half second and the right corner lamps are lit, so the car is firing; the fit says that push is too small, or points too far sideways, to change its height much.

The simulated nitrogen agrees with the gauge estimate to within 8%, inside the uncertainty of the mass and the exhaust speed. Two disagreements are worth stating, and the figures below show both. The real car brakes sooner and harder than my sink-rate law: off the wall the gauge passes 1.5 g at 12.1 m and peaks at 3.3 g at 6.7 m, where the PID passes 1.5 g at 9.6 m and peaks at 2.5 g at its 3 m gate. Tesla’s controller takes most of the speed off high up and then sinks slowly through the last few metres. And the real car lights its corner thrusters while it turns, where my allocation sends the torque to the couple first.

Sideways drift

In the kickflip the car also moves sideways, and it is fair to ask whether anyone controlled that. Two cameras help, and they see different things. Tesla’s far shot sees the car side-on and the parked row end-on: there the large horizontal motion is the car travelling forward along its own axis, which is the jump that clears the row. The livestream’s wide shot sees the car end-on during the first half of the roll, so the horizontal motion there is sideways: about half a metre in the first 0.75 s, measured against the Semi with the car’s own width as the ruler. In the second half the car turns side-on to that camera, so it also yaws by about 90° while it rolls, which my planar model cannot represent. My best estimate of the total sideways drift is one to two metres; the cameras do not allow a better one.

The simulation drifts too, 1.7 m by touchdown, and the cause is the coupling in the equations of motion. The only sideways force the car can make is its lift tilted with the body, $m\ddot{h}=-F\sin \phi$. During the 3.3 g launch, the nozzle bias and the sensor noise hold the car about 1° off level, and 1° of a 76 kN burn pushes 2 350 kg sideways at 0.56 m/s². The residual lift adds a few tenths of a metre per second as the roll starts. Once the car is rolling nothing can push it back: the lift is off and the couple makes torque, not force. The car crosses the row carrying about half a metre per second sideways for three seconds.

Holding the sideways position means tilting against the drift, and the car can only do that once it is upright again, with about 1.3 s left and a tilt it would rather not have at touchdown. With a sideways-hold loop the simulated kickflip lands 1.2 m from its line instead of 1.7 m, and 1° off level instead of level. The descent off the wall has more time after the turn, and the same loop brings its offset from 2.8 m to 0.9 m, starting from the rough 1.5 m/s of sideways speed I assumed.

So the drift is easy to explain and hard to remove with a loop per axis. The car is underactuated2828. A system is underactuated when it has fewer independent controls than coordinates to control. A car on a road is one: it cannot move sideways directly, which is why parallel parking takes several manoeuvres.: three coordinates and, during the roll, only one way to make a force. This is the planar vertical take-off and landing aircraft of the control literature (Hauser, Sastry, and Meyer 1992), and the known remedy is to plan the position and the attitude together instead of controlling them one by one. A trajectory can be chosen so that the sideways impulses of the launch and the landing cancel (Fliess et al. 1995; Martin, Devasia, and Paden 1996). Planning position and attitude together is also how quadcopters fly aggressive paths through narrow gaps (Mellinger and Kumar 2011), and adjusting a planned manoeuvre from one flight to the next lets them chain several flips (Lupashin et al. 2010). My guess is that Tesla left the drift alone: on an empty lot, landing a metre to one side costs nothing, and landing tilted costs a lot.

Fly it

Both simulators below run the same model as the analysis, ported line by line to JavaScript and checked against it to six significant figures. Change a gain or a toggle and the page recomputes the flight; press fly to watch it.

Failure cases for the PID

The PID flies both stunts in simulation. Here is what happens when the assumptions behind it fail, one at a time:

The PID handles four of these. On/off valves change nothing, because 100 Hz modulation and a 30 ms lag average the pulses into the thrust the controller asked for. A constant bias is what the integral term is for. It tolerates 50 ms of extra latency, and it survives losing the feed-forward at a cost in accuracy. Large latency, heavy sensor noise, the corner thrusters alone and a cooling tank break it. Latency and noise break any feedback loop past some bandwidth. The last two share a cause: a PID reacts to the error it sees now. It does not know that the tank has less to give than it had a second ago, that the ground is three metres away, or that the torque it is about to ask for comes with a push toward that ground. It cannot plan.

The model also leaves out things a real car has to deal with. It is planar; the real car rolls, pitches and yaws together, and a controller written on Euler angles fails when the pitch reaches 90°2929. Euler angles describe attitude as three successive rotations. At 90° of pitch two of the three axes line up and one degree of freedom disappears; this is gimbal lock, and the equations divide by the cosine of the pitch. Quaternions, four numbers on a unit sphere, describe every attitude without such a point., which this car passes through on the wall. The car’s four spinning wheels are gyroscopes: at 20 rad/s, four wheels of roughly 1 kg·m² carry 80 N·m·s of angular momentum, and rolling at 6 rad/s turns that into about 500 N·m of yaw torque, small next to 22 kN·m but a coupling a per-axis loop ignores. The fans’ downforce has to hand over to the thrusters as the car leaves the wall. Plumes reflected off the ground change the thrust in the last metre. And the controller needs to know where the car is: an inertial unit drifts, so something has to measure height and attitude independently3030. The standard tool is a Kalman filter, which blends a model’s prediction with noisy measurements, weighting each by its uncertainty, to estimate quantities that no single sensor measures well..

A likely flight-control stack

Tesla has not said, so this section is inference. The presenters credited SpaceX with “the rest”, and Lars Blackmore of SpaceX has described how the company lands rockets: a convex optimisation solved on board in a fraction of a second, with a solver generated by CVXGEN (Blackmore 2016). The problem behind it is powered-descent guidance: the thrust history that uses the least propellant while respecting the thrust limits, a pointing limit, the ground and a soft touchdown. It is non-convex because a rocket engine cannot throttle below some minimum, and the method that made it solvable in milliseconds proves that a convex3131. A problem is convex when the set of allowed solutions has no dents and the cost has a single valley. Any local optimum is then the global one, and a solver finds it reliably in a bounded time, which is what a flight computer needs. relaxation of the thrust constraint is exact at the optimum (Açıkmeşe and Ploen 2007). Code generators such as CVXGEN turn such a problem into a solver small and fast enough for a flight computer (Mattingley and Boyd 2012), and successive convexification extends it to the full six-degree-of-freedom problem (Szmuk and Açıkmeşe 2018). Re-solving the problem from the measured state at every step is model predictive control3232. Model predictive control plans the next few seconds with a model, applies only the first step of the plan, measures where the car really is, and plans again. The re-planning is what makes it feedback. (Mayne et al. 2000).

I tried this on the descent. From the moment the car is upright again, 16.6 m up and falling at 8.8 m/s, the fuel-optimal descent needs 84 kg of nitrogen; the PID’s sink-rate law, with the 1.1 g of braking fitted to the gauge, needs 127 kg on the same point-mass model. The optimal profile holds a light 0.2 to 0.5 g while the car falls, then brakes near full thrust, 3.2 g, and arrives at touchdown speed at the ground. That is closer to the real descent, which brakes at 3.3 g, than my PID is.

The problem the guidance solves treats the car as a point with position $𝐫$ and velocity $𝐯$ in the vertical plane, pushed by a thrust $𝐮$ per unit mass:

Here $\Gamma$ bounds the size of the thrust, so its integral times $m/v_e$ is the nitrogen used; $T_{max}$ is what the tank can give, the measured 76 kN peak while the tank is above the regulator’s 20 MPa and less once it is not, the tilt limit ${\theta }_{max}$ is 15° and the touchdown speed $v_{land}$ is 1 m/s. Every constraint is linear or a cone, so the problem is convex3333. An engine that cannot throttle below $T_{min}$ makes the constraint $T_{min}\le m\Vert 𝐮\Vert$ non-convex. Açıkmeşe and Ploen replace the thrust’s size by a slack $\Gamma$, with $\Vert 𝐮\Vert \le \Gamma$ and $T_{min}/m\le \Gamma$, which is convex, and prove that at the optimum $\Vert 𝐮\Vert =\Gamma$, so the relaxation loses nothing. My version has no minimum thrust, so $\Gamma$ only names the thrust’s size. and a solver finds its optimum in milliseconds. The controller wraps it in a loop: every 0.2 s it measures $𝐫$ and $𝐯$, solves the problem for final times $t_f$ from 0.2 to 3.2 s, keeps the plan that uses the least nitrogen, flies the first 0.2 s of it, and plans again. When the tank cools as it empties, the thrust limit depends on how much gas the plan itself uses, which is not convex. The controller solves with the limit the tank gives now, recomputes the limit along the plan’s own gas use, and solves again until the two agree: a small case of successive convexification.

In closed loop, re-planning every 0.2 s:

The comparison favours the MPC in one way: the plant here is the same point-mass model it plans with, and its model of the tank is exact. A real MPC plans with an imperfect model and relies on re-planning to absorb the difference. The MPC lands softly on the cooling tank because it plans with the thrust the tank will still have, which a real system reads from the tank’s pressure and temperature. A PID could be given the same reading, by scheduling its sink-rate law on the tank pressure, but it would still not plan; it reacts to the speed it sees now.

Neither controller can land the second stunt. From the tank the first stunt leaves, cold, the thrusters can give at most 1.1 g once the car is upright again, barely enough to hover, and the softest touchdown any thrust history allows is 13 m/s. The PID finds that out at the ground. The MPC’s first plan is already infeasible, so a car running it would know before it committed to the stunt.

Under the guidance there is still an attitude loop, the layer that turns the car to the orientation the guidance asks for, and it may well look like the PID in this post or be a linear-quadratic regulator3434. A linear-quadratic regulator, or LQR, takes its gains from a linear model of the vehicle: they minimise a weighted sum of the squared tracking error and the squared control effort. The PID in this post is tuned by placing its poles; an LQR’s gains follow from the weights instead., written on quaternions (four numbers that describe any orientation without the singularity Euler angles have at 90° of pitch) and with feed-forward from the plan. Below it, an allocation layer decides which nozzles fire and for how long; for on/off thrusters that is usually pulse-width or pulse-width-pulse-frequency modulation3535. An on/off valve cannot open halfway. Pulse-width modulation opens it for a fraction of each short period, so that the average thrust over the period equals the command; pulse-width-pulse-frequency modulation also varies the period., or a small linear or mixed-integer programme3636. A linear programme finds the values that minimise a linear cost under linear constraints: here, which nozzles to fire to make the commanded force and torque with the least gas. In a mixed-integer programme some of the values must be whole numbers, which can encode that a valve is either open or shut. (Wie 2008). Around everything, a state estimator, usually a Kalman filter that weighs a model’s prediction against noisy measurements, fuses the readings of the inertial measurement unit (IMU), the wheels, the ranging sensors and the tank’s pressure gauge. The PID is the part that is easy to explain; the guidance above it is the part that lands the car softly with a tank that is running out. That is the part I would call the hard one.

Conclusions

Tesla’s numbers hold up. With the 2 350 kg that the downforce gauge and the stated 2 g of suction imply, the fans let the car crawl around the half loop with a margin of about 1.7 on grip. The 600-litre tank holds 297 kg of supercritical nitrogen, enough for one stunt: the tank drops below the regulator’s 20 MPa after a third to a half of its gas, and a stunt uses about half. A refill takes at least 49 kWh, and the six to seven hours that Hagerty quotes suggest that the compressor is not in the car.

The measured roll does not fit Tesla’s list of nozzles. Rolling on the corner thrusters alone would push the car toward the ground hard enough for the gauge to read at least 1.1 g, and the gauge reads about 0.2 g. The car therefore makes most of its roll torque some other way, which I model as an inferred couple ${\tau }_c$.

In simulation a PID loop flies both stunts and follows the gauge altitude closely. It fails with large latency, heavy sensor noise, the corner thrusters alone or a tank that cools as it empties, because it reacts to the error it sees and does not plan. A model-predictive descent that plans with the thrust the tank will have uses 82 kg of nitrogen against the PID’s 127 kg with a warm tank, and with a cooling tank it still lands at 1.4 m/s while the PID’s touchdown speed rises to 2.6 m/s. From the tank the first stunt leaves, neither controller can land a second.

The forces and the gas are ordinary physics. The hard part is the guidance above the attitude loop, which has to plan a descent while the tank’s thrust falls.

How this was made

The analysis is a small Python project. The gauges are read by matching their glyphs against the labelled clusters described above, the nitrogen comes from CoolProp (Bell et al. 2014), the stunts from a planar simulator written for this post, and the convex descent from cvxpy (Diamond and Boyd 2016), solved with Clarabel (Goulart and Chen 2024). Every number in the text is filled in from those outputs when the page is built. The simulators on this page are a line-by-line JavaScript port of the Python simulator, checked against it on eleven cases to six significant figures.

References