Engineering for safe drone delivery

Embed safety in concept and design

Engineering small, uncrewed delivery vehicles requires navigating tradeoffs with surgical precision. Every ounce of mass we add affects aircraft performance or the weight of the package we can deliver. 

With this in mind, we have equipped P2 with systems whose sole purpose is safety. Our redundant systems are a key example. We have multiple computing systems onboard so there’s always a backup. We also have backups for sensors that are used to determine the position and speed of the Zip and collect information about the weather, the location of other aircraft, and the delivery environment. 

Redundancy is complicated to design, build, and test—it takes precious time and resources. Take our cell communication technology, for example. Each Zip has two communications systems, so there’s a back-up. But that involves so much more than installing the extra hardware, which already adds mass. It also requires software so the Zip can process the second set of data, reconcile any discrepancies between the two, and ultimately make the right decision. 

Adding a redundant comms system exponentially increases the engineering hours required. But, for safety, there was no question we would make the investment. 

In the same vein, the technology onboard the aircraft that detects the environment around it and avoids obstacles exists primarily for safety. We’ve dedicated significant mass, size, weight, and power on the Zip—not to mention dozens of engineers and years of development—to these systems.

We have also designed the Zip to be able to safely fly in the event that the motor or the system that controls movement of the wing and tail goes down. Both our Zips and Droids are equipped with our paraland system in the event that they need to clear the airspace immediately, for any reason. 

All told, the features we have developed exclusively for safety take up about 15% of the mass of the Zip and Droid. We’ve made the tough trade-offs around weight and payload because safety matters most.

Prioritize safety milestones

We set our safety and reliability benchmarks internally before we begin testing. Then, we cross-check them with the goals we must hit to comply with civil aviation authorities such as the U.S. Federal Aviation Administration. 

During testing, we don’t move the goalposts on those milestones, no matter how long it takes to achieve them. We complete thousands of successful deliveries in flight testing—and many more cycles in ground testing and simulation—before we begin customer deliveries. 

We prioritize safety testing over other timelines for our business because our business depends on us being safe. 

We bring this approach to every benchmark we need to hit before launch. We believe this is the responsible way to bring new technology to communities, rather than holding ourselves to a calendar deadline.

Never stop learning

Zipline has ambitions to bring drone delivery to millions of people every single day. That is not where we will start. When we launch P2, we will deliver to a small number of carefully selected neighborhoods. In other words, we will initially operate in conditions much less complicated than those in which we’ve conducted testing.  

We do this type of graduated roll-out because we will collect invaluable learnings from operating—information that will help us understand how to safely and reliably fly in more types of weather, deliver in more complicated environments, and reach even more people. 

We design these initial operations and our expansion plan in partnership with communities. Because we’re not just providing a service but rather building a new transportation infrastructure to enable instant deliveries, we need the communities we serve to have a real voice in how we grow.