The Curiosity rover landed on Mars once. Before that it landed several thousand times in software, and every one of those landings was wrong on purpose in a different way.
That is a Monte Carlo simulation: you answer a question by running the same model thousands of times with randomly varied inputs and reading the statistics of the outcomes. No serious spacecraft flies without one, because the question in spaceflight is never “does the design work?” — it is “does the design work when the atmosphere is thinner than forecast, the drag is a few percent off, the winds are unkind, and the navigation is slightly wrong, all at once?” No single simulation can answer that. Thousands of imperfect ones can.
The bookkeeping is the part outsiders underestimate. The Curiosity entry simulation modeled fourteen separate bodies — descent stage, parachute, heatshield, backshell, rover, and eight ejected balance masses — with 682 independently dispersed uncertainties and 4,834 recorded output variables, and the operational campaigns ran 8,000-case Monte Carlos. The vehicle that touched down in Gale Crater had already made the trip through every unlucky version of Mars its engineers could think of.
The method’s origin is worth thirty seconds, because it is one of the great origin stories in applied mathematics. In 1946 the physicist Stanislaw Ulam was convalescing from an illness and playing solitaire, and wondered what the odds were of a given deal coming out. The combinatorics were hopeless, but he realized he could just play a hundred hands and count. He brought the idea to John von Neumann, who saw what it meant for the neutron-diffusion problems of nuclear physics; the newly operational ENIAC supplied the arithmetic; and Nicholas Metropolis gave the technique its name, after the Monte Carlo casino where Ulam’s uncle used to gamble with borrowed money. The account is preserved in Los Alamos Science’s 1987 Monte Carlo special issue. That is Metropolis’s own retelling of the method’s beginnings, with the solitaire story in Ulam’s words in the companion piece.
What Ulam noticed at the card table is the entire method: when the analysis is intractable, sample. Eighty years later, that is the certification backbone of planetary landing and launch.
The aerospace name for the workhorse version is dispersion analysis, and the recipe is exactly what Ulam would recognize. Build an end-to-end simulation of the flight: atmosphere, aerodynamics, parachute, thrusters, sensors, and the actual guidance software. Have every engineering team declare the uncertainties in its domain: atmospheric density, wind profiles, aerodynamic coefficients, mass properties, the navigation state, sensor errors, each with a distribution. Then sample all of them at once, fly one virtual mission, record everything, and repeat until the statistics converge.
The machinery behind this is unglamorous and superb. NASA Langley’s POST2 simulator has been the end-to-end EDL performance tool from Mars Pathfinder through the Mars Exploration Rovers, Phoenix, Curiosity, InSight, and Perseverance; JPL’s DSENDS plays the high-fidelity, hardware-in-the-loop counterpart. The generation before Curiosity, the Mars Exploration Rovers and Phoenix, standardized on 2,000-case batches. Phoenix’s pre-flight analysis predicted a 99% landing ellipse of roughly 103 × 20 km and, rather than hiding the ~3% of runs that showed off-nominal touchdown conditions, used exactly those cases to steer design decisions. That is the cultural point of the method: the failures you simulate are the ones you don’t fly.
For a normal distribution, ±3 standard deviations covers 99.73% of outcomes; the one-sided version (99.865%) is the standard design level for launch vehicles, and “3-sigma” is the shorthand you hear constantly. NASA Marshall’s engineers verify requirements statistically: a requirement passes if it is met in at least the specified fraction of Monte Carlo cases at 90% confidence, worst-case structural loads and heating are taken at the 99.865th percentile, and the rocket carries a flight performance reserve (extra propellant sized by the same statistics) against the day-of-flight draw from the distribution. The practice is even law: for commercial launch, FAA regulations (14 CFR Part 417) require 3-sigma trajectory dispersion analysis for the safety case, with Monte Carlo among the accepted methods for producing it.
Which puts a great deal of weight on the distributions themselves, and here the practitioners are candid: how you disperse the inputs matters as much as how far. A study on NASA’s Ares I program showed that the traditional way of dispersing aerodynamic data, biasing entire curves at once, was physically unrealistic and hyper-conservative, inflating predicted roll rates and oversizing the control thrusters; a physics-based dispersion model reduced the predicted extremes dramatically. Monte Carlo certification is only as trustworthy as the uncertainty models feeding it. Garbage distributions in, confident garbage out.
What keeps that honest is the audit afterward. Post-flight reconstruction rebuilds the actual trajectory from sensor data and grades it against the pre-flight Monte Carlo. The MER reconstructions fell almost entirely within the pre-entry 3-sigma bounds, with the small mystery that both rovers met slightly thinner air than predicted. InSight’s reconstruction found an atmosphere about one sigma below the pre-flight mean, which neatly explained a peak deceleration a hair over the 99% prediction and a touchdown 12 km uprange, still comfortably inside the ellipse.
So the loop closes: the simulation predicts, the flight grades the simulation, and the next mission’s dispersions get better. It is one of the more disciplined predict-then-verify habits in engineering.
The clearest public evidence that any of this works is the history of Mars landing ellipses, the region the lander is statistically promised to hit.
Curiosity’s 20 × 7 km ellipse at Gale Crater was described by JPL as seven percent the size of the previous best; the rover ultimately touched down 2.385 km from its target. Perseverance’s ellipse at Jezero — 7.7 × 6.6 km per JPL — was small enough to fit inside terrain that would have disqualified the site entirely a decade earlier, because terrain-relative navigation lets the lander localize itself against an onboard map during descent.
Counting events that almost never happen. If the question is “what is the probability a spent stage lands outside the safety zone” and the answer is on the order of one in a million, a 2,000-run campaign will simply never see it. The statistical error of crude Monte Carlo shrinks only with the square root of the run count.
The fix is a family of variance-reduction methods. Importance sampling deliberately samples from a distribution biased toward the failure region, then re-weights every draw to recover the true probability — adaptive versions have been demonstrated on exactly the launcher-stage impact problem. Subset simulation decomposes one tiny probability into a product of larger conditional ones, walking toward the rare event in stages. And when even sampling is too expensive, researchers propagate the whole probability distribution through the dynamics at once rather than one trajectory at a time. The frontier of the field is not more runs; it is smarter questions per run.
I write mostly about agentic AI and decision systems, and the resemblance is hard to miss. Aerospace Monte Carlo is, and has been for fifty years, roughly what the AI industry is now reinventing: build a faithful simulation, enumerate your uncertainties honestly, run the system through thousands of imperfect worlds, design to the tails rather than the average, and audit predictions against reality after every flight. When today’s teams stress-test an autonomous agent across thousands of randomized scenarios before deployment, they are practicing dispersion analysis, whether they know the term or not. The engineers who land robots on Mars never had the luxury of vibes.
References