Landing missions are essential to planetary science, providing detailed information on materials at planetary surfaces through sample-return or in-situ analysis. Landings on Mars, the Moon, and several asteroids have provided critical insights into the origins of life and planetary formation. To further advance this field, exploration of more diverse environments with distinct origins is required. However, such missions face the formidable challenge of executing landings in unknown terrain. Planetary landing missions have traditionally relied on detailed information from previous missions. While this multi-mission approach enhances safety, it incurs significant time costs, especially to distant bodies. Single-mission architecture that fully integrates mapping and landing offers a promising alternative. This approach is pioneered by asteroid exploration missions including JAXA's Hayabusa series and NASA's OSIRIS-REx. The main challenge is selecting landing sites within limited time, especially when onboard observation resolution is limited. For example, in the Hayabusa2 mission, multiple risky touchdown rehearsals were required to construct fine terrain maps for evaluating safe landing sites. For heavier target bodies, such as Mars's moon Phobos targeted by JAXA's MMX, this challenge becomes more severe as fuel consumption for each landing attempt increases significantly.

These challenges highlight the importance of developing landing algorithms that incorporate sequential safety-map updates during descent. One recent approach, Reachability-Steering, formulates hazard detection and avoidance as a partially observable Markov decision process, wherein the lander's policy maximizes safety value within its field of view. While this approach couples sequential safety-map updates with the landing problem, it does not account for uncertainty in the safety map, rendering it vulnerable to unknown risks. Another approach, Deferred-Decision Trajectory Optimization, provides a trajectory that keeps candidate landing sites within the reachable set as long as possible during descent. This approach better handles unknown risks but does not include sequential observational updates that dynamically adapt the target landing site. Thus, there is a need to develop an uncertainty-aware landing algorithm incorporating sequential observational updates.

This paper proposes a stochastic model predictive control (SMPC) framework with sequential safety-map updates that directly addresses map uncertainty while maintaining propellant efficiency. This algorithm provides the best control input, balancing multiple candidate sites weighted by safety at each step. Our approach extends lossless-convexification-based optimal landing into a scenario-based SMPC framework that explicitly accounts for probabilistic landing-site selection and a spatially distributed safety field over the terrain. The nonconvex thrust-magnitude and pointing constraints in each realization are convexified via lossless convexification, yielding a single coupled second-order cone program. The safety map, representing spatially varying surface risk, is updated online and incorporated directly into the landing objective. This formulation enables the guidance law to reason about both fuel efficiency and spatial risk within a unified optimization problem. At each control step, the current safety map and environmental uncertainty are reduced to a finite set of stochastic realizations, each defining a deterministic powered-descent subproblem with its own terminal condition and safety-weighted cost. Target points are sampled using a dedicated algorithm. The first control input is shared across all realizations (one-step stochastic lookahead), while subsequent inputs are realization-dependent. The objective is to minimize a risk-aware expected cost combining fuel consumption with penalties from the safety map, subject to state and control constraints.

Numerical simulations demonstrate that the proposed approach autonomously balances exploration and exploitation in landing-site selection. The algorithm explores a larger area when the map indicates complex, hazardous terrain and executes a fuel-optimal landing when conditions are favorable. We also observe that SMPC initiates the landing burn earlier than deterministic optimal control and deviates slightly from bang-bang behavior. This enables the lander to divert to a safer region during final descent, a maneuver difficult to realize with deterministic control due to insufficient robustness margins.

Because this architecture is independent of the target body's gravitational parameter, it offers a promising framework for future missions to less-explored worlds such as asteroids, Phobos, Enceladus, and Titan. Future work will incorporate more accurate safety-map representations, off-nadir camera pointing, real-time onboard computation, and experimental verification. This work establishes a foundation for autonomous single-mission architectures applicable to diverse planetary destinations.