Autonomous Drone Delivery in a Zip  ## Document Notes ## Highlights - **Rwanda Began Zipline's Mission** - Zipline started by delivering blood to hospitals in Rwanda after discovery work with health systems. - Keenan and team found deeper field research increased conviction they could save lives and money by solving logistics. Transcript: Keenan Wyrobek Yeah. So we started almost 12 years ago now. And we started in a niche of a niche of delivering blood to hospitals in Rwanda. That's where we started. Adam Stacoviak Why there? Keenan Wyrobek Yeah. So really, Rwanda earned this. We knew we wanted to start in health. With the very beginning of this, we started exploring the space based on really just stories from family and friends. My wife's an epidemiologist and she would tell me these stories about health intervention campaigns that would get stuck on logistics, right? These would be like vaccine campaigns where they had the vaccines, they had the doctors, they had, but then like the logistics got in the way and they couldn't be successful. And so, yeah, that's how we started. Went deep on that. I'm a, I'm, I'm personally not an early adopter. I'm, I'm a very tech skeptic. So went deep in Central America and Africa at the time, expecting to come away with a thousand reasons why we couldn't possibly make a difference. And, uh, and the opposite happened. The deeper we went, the more conviction we got that we could make a big difference. And one of those places we were exploring with was Rwanda, and they turned out to be a phenomenal first customer for us, and really a partner figuring this out together. Yeah, and blood, of course. Why blood? It's just this rare commodity everywhere right there's never enough of it it's actually very expensive we think of it as free because we donate it right but the cost of the collection The testing the transportation uh is very expensive hundreds of dollars a unit uh even in in places like rwanda way more and places like here and it has a very short shelf life right As Little as seven days from the time it's donated to the time it expires if you don't give it to somebody who needs it. And so it's just by centralizing blood in one place and then delivering it when you know what blood type is needed for what patient, what time, it turns out you can virtually eliminate Blood waste, saving a ton of money and a ton of lives for the health system. ([Time 0:03:46](https://share.snipd.com/snip/58a5c3f9-5bfe-4ea6-abb1-2b43ee16710f)) - **Two-Drone Design Enables Quiet Precision** - Zipline uses a large carrier drone plus a small 'delivery zip' to enable quiet, precise home delivery. - Keeping the heavy aircraft high lets the mini-drone handle precise, low-noise landings in tight spaces. Transcript: Keenan Wyrobek Yeah so that to that sort of double drone drone inside of a drone design um it came from just an obsession of figuring out what would actually work for our customers so our first platform That does long-range delivery um has a lot of great attributes but it requires you know about two parking spots worth of space to deliver in because it literally just flies over, drops The package with a little paper parachute on it, and the package floats to the ground. But so many of our customers in the health space and otherwise were like, we want home delivery. We want in-metro delivery where you don't have that kind of space. And at the time, we're kind of like, well, we don't do that. And eventually, they asked us enough times, we started thinking about how would you do this? And we knew from that platform that one of the things that makes people love our service is you don't hear our drones. And that's way harder than it sounds. And we're like, well, we don't know how to do a super precision delivery without hearing the drone. And we've seen other ways of doing this. It's usually loud and noisy and kicks up a dust storm and can't deliver very precisely. And so this two-part architecture enables a bunch of things. One thing it enables is quiet. It lets the drone itself stay up at 100 meters, 300 plus feet up in the air, which is one of the many things we do to make that just silent in even suburban places. And then that little mini drone that comes to the ground, we call it the delivery zip, that comes to the ground, you know, that actually carries, delivers the package for you. It has its own little, you know, propellers on it so that if in windy days and stuff, it can still be super precise and get into a tight space. And so really those two things, helping us be really quiet and be super precise, right? We can get into a really tight space with that little drone that comes to the ground while the big drone stays up high that does the, you know, we call it, it does the heavy lifting. Like it's, it's literally there to carry the weight, the distance. And yeah, that's why we have the whole drone inside of a drone solution. ([Time 0:10:43](https://share.snipd.com/snip/656866e1-c1e0-4cd7-8c70-9ebfb51f0ee4)) - **Validate Flight Software Before OTA Updates** - Release flight-critical software on a strict cadence and validate extensively before dispatch. - Run tens of thousands of flight and hardware-in-loop tests during a multi-week release campaign before field updates. Transcript: Keenan Wyrobek Yeah, absolutely. So we think about software and software deployment. There's sort of two worlds for us. One we call, we think it was flight software and then cloud software. Flight software is all the pieces, some few parts of the cloud, but mostly things on the actual aircraft that we consider flight critical. Right. And we that software release process takes us about six weeks. So every six weeks we release software to that system. And we do just in those six weeks, we do tens of thousands of flight tests. We do a bunch of hardware-in testing. So these are basically, think of it as the matrix where you take the electronics of the aircraft and basically plug it into a simulation, literally, and fool it. So it thinks it's flying over in Dallas somewhere, but it's actually over in our basement, plugged into the simulation. Plus, of course, software-in simulation where you're doing like, you know, millions of flight tests. And yeah, and that whole journey takes us about six weeks to get to the point where we're like, yep, this new software release is good to go. And then we release it. And then we have an over-the update system that updates all the process, the software on the aircraft and deploys. Yeah, we do that. People often ask, do we do that in the air or not? It's like, no, no. When our aircraft are docked, they update themselves. They check themselves. They're like, okay, good software is good to go. ([Time 0:15:55](https://share.snipd.com/snip/f2ed7b71-9a27-4948-9cd7-f9cee69cb11f)) - **Swiss-Cheese Testing For Aviation Safety** - Zipline treats safety testing as layered 'Swiss cheese' slices across unit, simulation, hardware-in-loop, and flight tests. - They use automated chaos experiments and near-miss mining to ensure gaps in one layer are covered by others. Transcript: Keenan Wyrobek Oh, great question. So there's a, there's a, there's a, there's a model for thinking about this that was called the Swiss cheese model. I did not come up with that name, although I'm known for naming things with really dumb names. It was actually a NASA name, the Swiss cheese model. And the way conceptually, basically what it is, is it's like every sort of, every approach to testing is like one slice of your Swiss cheese, right? It's going to have good coverage of some aspects. But if you look at it, it's going to have holes, right? For every type of testing you do, you obviously have many different layers of testing that you do. And the intent is if you stack up those layers of Swiss cheese and look at them, you know, through the stack, then you're not going to see through holes, right? If you're doing it well. And we spend a lot of, so examples of our of Swiss cheese, you know, some of them are going to be familiar with things like unit testing and static testing and things like that, that are Commonly done in software, software in the loop testing. So this is where you have like full on physics level simulation running of your full system, even your full fleet. And you're able to then write test scenarios on top of that. We talked a little bit about the hardware in the loop testing, where you take the hardware itself, the brain of the aircraft, plug it into a simulator and fool it into thinking it's in The real world. That's great for testing, you know, like the actual like hardware level components. Like if you short out a certain bus, does the actual full software stack detect that short and do the right thing? And then a lot of things in flight tests. We do all kinds of different flight tests. We do on the order of 10,000 plus flights a week at this point across our flight testing. And almost every single one of those flights is pushing the system to an extreme in some way. We actually have this fully automated software system we call Chaos Monkey, where basically what it's doing as we're dispatching all these flights is it is Chaos Monkey is literally Throwing chaos into the system as those missions are happening that either will cause the airplane to do something extraordinarily like dynamic against the physics limits of the Aircraft or turning off subsystems of the software, killing various rotors, things like that, and making sure that the system, despite in this given flight having dozens of weird Things happen, that off-nominal events, as we call them, happen in that flight, does the whole system handle it gracefully and safely? And this is just on the software side, right? When we think about hardware, very similar thing, and many layers of testing of the hardware to make sure we understand deeply its performance and its reliability. Yeah, and there are entire teams of folks who look at all that testing and basically are constantly questioning, hey, okay, in this release, we have a new capability we're releasing. Did we add enough testing to all the different layers of the Swiss cheese such that that's going to be responsible to ship? And there are times we think we're ready and we do that, that review of everything we did. And we're like, Nope, this isn't ready. We're pulling this from this release. ([Time 0:31:07](https://share.snipd.com/snip/273e0dd9-8d71-4358-95ab-0778542c7267)) - **Extensive Logging And Parachute Backups** - Zipline logs extensive telemetry and uses it for root cause and longitudinal analysis across thousands of flights. - They equip aircraft with parachutes as a backup and analyze any parachute events deeply to learn rare failure modes. Transcript: Keenan Wyrobek Yeah, so absolutely. So we log a ton of data on the vehicles at all times. And that's, of course, done in all this testing, but also in production. And that's, you know, the philosophy is that like anything that could possibly go wrong or be a near miss, you got to study. And you mentioned crashes. I should mention we have a parachute system for the aircraft that's kind of the backup to the redundancy. So there's redundancy in the aircraft so it can nominally fly when things don't work. But the backup to the backup is a parachute. So it'll float to the ground like it's actually made for us by a skydiving parachute company. So it's like a skydiver coming to the ground. And so, yeah, if we ever have a parachute landing in tests or operations or anything that's even close to a weird data, like we go study that to basically deeply, deeply understand it Because quite often it's a new insight. We're so far in the long tail of the problem that many of the problems we see now, they happen one in hundreds of thousands of flights. And so you basically, like, if we didn't log it, think of it as like, oh, no, like now we have to wait for this to happen again in hundreds of thousands of flights, which is a total shame. Total shame. Should happen more often. Exactly. No, no, that's not the shame. The shame is not the logging it. So we log these things. Now, in addition to the logging to enable us to go through those logs and understand everything that happened, we use those logs, not just for root causing a specific problem, we use Those logs to understand things in aggregate. And so we have tools where you can mine those logs longitudinally, like across a bunch of, across thousands and thousands of flights to deeply understand the statistics of a certain Thing. That's really important as well. And then, of course, during live operations, yeah, the aircraft are reporting over radios, like live what's going on. We have a remote operations center that's monitoring all of that. And so during live operations, we have certain things that basically, our pilots, I think of them more like an air traffic controller where they can be like, okay, you go back and dock And that kind of thing and understand what's going on at a very sort of fleet level. ([Time 0:38:18](https://share.snipd.com/snip/96edd59e-a77d-4ed9-9b6a-281347829ffc)) - **Chasing Storms To Expand Flight Limits** - Zipline actively chases extreme weather in testing to expand operational envelopes. - Techniques include forecasting microbursts and designing control logic to 'hang' and punch through gusts safely. Transcript: Keenan Wyrobek It really depends how big it is. This is actually one of the first things we developed AI to forecast. It's because if this is really big, right, if it's kilometers across and really strong, then we can't, you know, if we're in it, we're going to end up parachute landing. And so we know this because in a lot of our operations around the world, when we're doing emergency deliveries for, you know, patient on the table delivering blood situations, we will Take, we will basically ignore our weather limits and fly in very extreme weather. So we go through these things. But then for non-emergency deliveries, we rely on our forecasting to keep us out of this stuff. In those really extreme events, if they're small enough, yeah, the control system will fight its way through it. But of course, you know, the aircraft has its physics limits, right? It can only climb so fast, it can only do so much. So if in certain situations, it can't overcome them. And yeah, that's when the parachute kicks in. Adam Stacoviak I assume there's some sort of wind limit that there's just no chance for anything to fly through successfully. It's got to be around a hundred miles per hour or so, maybe a little bit less. I don't know, but there's certain storms where it's just like, you better just parachute out. Cause there no there there there's no success as a possibility regardless of the size of this thing like you know 30 seconds at 150 miles per hour is knocking down massive trees here and Keenan Wyrobek Some assuming it's taken a drone off its course quite a bit there there's a certain mountain pass in rwanda i'm very familiar with because we have to fly through this mountain pass to Serve about a third of the country there. And in this mountain pass, it is the winds get whipping, like the winds can be higher than we, you know, we fly, we fly that aircraft at like, what is it? 60, 70 miles an hour. And the winds, yeah, get up to a hundred miles an hour. And you'll see our drones flying backwards as it tries to fight through it. Developing the control system and logic to like, because most of those winds are gusty, right? So if you can kind of hang, if you can stay in the air long enough and stay out and then punch through it at the right moment, you can get to the mountain pass. And yeah, it was a big breakthrough when we figured out how to make that logic robust. And you see the drones flying backwards for a while, flying backwards for a while, flying backwards for a while, and then floored at the right second. ([Time 0:41:05](https://share.snipd.com/snip/19d11d9e-f161-4c01-94df-b9acd5a8153c)) - **API + Kiosk Integration For Rapid Delivery** - Integrate with partners via APIs and kiosks so partners prep orders normally and Zipline collects them. - Provide precise ETAs and deliver rapidly (minutes), improving customer experience and reducing uncertainty. Transcript: Keenan Wyrobek So soon you'll be able to start in the chipotle app today you start in the zipline app um and depending on where you live if you live in the best place in the dallas fort worth area you open That app and you're going to see a bunch of different storefronts. You'll see Walmart, very soon Walmart Pharmacy, you'll see Blue Bell Ice Cream, you'll see Chipotle, you'll see, well, just a whole bunch of great restaurants, Buffalo Wild Wings And others. And yeah, you pick what you want. That part of the experience feels a lot like DoorDash or someone driving the thing to you. Then they'll start prepping it. Our partners will prep the food or prep the order. And then we put it in this thing that we call a zipping point, which is this fun little kiosk you put the package into. And similar to how we deliver, the drone stays up high and the delivery zip comes down hundred meters, grabs the package out of the kiosk and brings it to you. And this is where things are very different than like delivery by car. Um, we actually have to warn people, you know, Hey, your food may be too hot to eat. Um, so we deliver so fast that like, we've had people be like, Oh yeah, like I just assume my, my, my, my hot wings would be soggy and they just stuck them in their mouth and burnt their mouth Because they just like they're so used to how long it takes for deliveries to happen the old-fashioned way that when it takes only a few minutes it's it's uh and it's well insulated and Controlled the way we do it like the food's actually fresh uh and sometimes very hot still yeah that's a great problem to have. Adam Stacoviak So show me the Chipotle side, like from your integrators, your restaurants. And I'm just picking on them because I know they're a partner of yours. Obviously, there's going to be a bunch of them. But imagine that I do order a Chipotle burrito out of zip line. I assume an API call kicks off over to the Chipotle and makes the order. And then they have to like somehow tell the zip when it's ready. Like, how do they do that? Keenan Wyrobek Yeah. So they do, they, with Chipotle, they use their software system the way they use it for any order, right? If you're ordering over the counter or you place an order through the Chipotle app and it shows up on their, they call their make line. That's, that's, that's the people actually like put the thing, put the order together. So they're going to make this like any, any other food they're making. Our system gets hit over the API. So we know when they started that and we know when they're done. And then when they're done, we'll put it in that kiosk, dispatch the zip, the drone over to come get it. It'll come pick it up. That's usually about a minute or two after it's ready. And then we deliver it anywhere from one to five minutes later, depending how far you are away are. We deliver it in your yard. And yeah, we have a fun little app that shows you the drone coming and gives you that really super precise ETA. ([Time 0:54:42](https://share.snipd.com/snip/55e47de2-ab63-44b2-b7fb-618de1414867)) - **Unexpected Use: Johnny Appleseed Of Salads** - A Dallas user ordered salads to different addresses daily and turned out to be a postal carrier eating healthier on route. - Keenan framed this as an unexpected use case showing how customers invent novel workflows. Transcript: Keenan Wyrobek So a couple this summer, we were looking at our usage data. And most people would either order one address or order to maybe two addresses. But we saw this one person who was ordering to a different address almost every single day. Like, what is this? Like, what's going on here? And so we send this user an email saying, would you share like how you're using the service? And so this is a postal delivery carrier. And he, his New Year's resolution for this year was to eat healthier. ([Time 1:07:42](https://share.snipd.com/snip/0eb816d6-c596-4783-98a3-62d020804c29)) - **Small Payloads Often Win Economically** - An eight-pound payload covers a large fraction of common packages and meals, making scale efficient. - Multiple small drones can beat one large drone by cost and responsiveness for many use cases. Transcript: Keenan Wyrobek So and then yeah, if you need more, we just send to, to deliveries, I mean, back to back. And yeah, it's two little bags of food. It's no boxes, none of this other stuff. So I'll be interested to see how it evolves. If I was a betting person, I think we will increase our payload over time beyond eight pounds. There's a good chance it won't go a ton past that, maybe 10, maybe 12 pounds. And really what it comes down to is like, what doesn't fit, right? You know, once we get to that scale, we can deliver a very full bag of groceries at that scale. The advantage of having one platform as opposed to different variants is we can drive the cost down further and further just from scale. ([Time 1:10:05](https://share.snipd.com/snip/5e7fba63-ae41-4bba-9298-6534ad4662d6)) - **Decentralized Intent For Scalable Airspace** - Scaling airspace requires real-time, decentralized intent-sharing and distributed algorithms, not central reservations. - Zipline prototypes short-horizon intent broadcasts so aircraft negotiate emergent, robust avoidance behaviors locally. Transcript: Adam Stacoviak To be figured out. And we're spending a lot of time on that. Do you see a world where there's some sort of open orchestration communication channel where you're not just detecting objects and avoiding them, but maybe you're actually publishing Your future path. And so other systems can know like there's zips going this way and that. And so I can avoid those paths. Keenan Wyrobek Yeah, absolutely. So today there's a version of that that we use in Dallas and it's not live. It's done before you take off. So basically there's a federated cloud-based system where the different operators talk, systems talk to each other. And basically it's very rudimentary today. Kind of think of it a little bit like a game of Battleship of like, okay, I'm trying to share my intended path in the air, sort of a tube in time, and I share it with the others, and they're Kind of like, nope, that collides with something I've already reserved, and then you try to find another tube, and then it finds a tube, and then you're expected to stay in that tube about 95% of the time. Not very scalable. It's not a very efficient way to use the airspace, which is plentiful. Internally, our aircraft share information live with each other over a point-to radio link where they share their intent of where I'm going in the next 10 seconds or so. And they do that also over the IP network. I can't announce the partner yet, but there's a commercial drone operator in Dallas. We're going to be announcing a partnership later this year. They'll be using that same protocol so we can share the airspace without those big reservations. And that's to kind of explore, hey, is this more scalable? All right, can we build up the data and then share with the rest of the regulators and industry to kind of bring everybody along and make the case for what we think is a better idea than what We have today? And then we'll move to that idea. So yeah, I think what you're describing, I think it's going to be the beginning of where we go with this. I think there's going to end up being a fair bit of structure, a lot of real-time sharing to make sure we use the airspace really efficiently and scalably. Jerod Santo It's like DNS in the cloud, basically, in the sky, literally the cloud, the, pluralized, not the internet cloud as we know it but it's kind of like that it's like a phone system in a way Or a route system or a flight path you now have to have predefined or known things and it's like well we have you know these coordinates and we know where we're at in the world so maybe they're Keenan Wyrobek Logistically you know like that or something like that but yeah but constantly changing yeah exactly yeah we spend a lot of time talking to the original folks who created ican which, Which created the DNS system. So like, you know, how did that actually come to be? Because in some ways it's kind of a miracle, right? How open the Internet is and how it evolves. And like, it's like, all right, cool. We want to learn all the lessons from that because, you know, we really want the future of the airspace to be similarly democratized and open and innovative and evolving. Jerod Santo Right. So you're studying DNS to learn how to do things in the, in the sky. Keenan Wyrobek Absolutely. Yep. Yeah. And not just the technical layer of DNS, but also like if you go to ICANN, the international is a corporation of names and numbers, I think. Anyway, it's basically the people behind sort of the, the, the internet that like agree internationally of how it's going to work. Um, the, the, just cause like they figured out how to, how to be a group of people that doesn't make bad decisions, you know? Right. And, uh, we want to learn from that as well. Cause I can see if you don't get the right incentives and the right people and the right mindset, the right kind of structure. I, I, I think it's really clear how this, this kind of gets stuck in gridlock and doesn't evolve and innovate. Right. Adam Stacoviak So when you operate on a 2D plane, everybody gets one place. So like my house address leads to one place. Now there's many paths to that place. So you can alternate routes and that's all well and good. But on a 3D plane, if you have conflicting paths, how feasible is it to just change the Z-axis and say, well, we're going to fly five feet lower than we were going to. And now we're just completely hesitant. Stuck free airspace. Is that like foolish thought? Is that legit thought? Keenan Wyrobek That's exactly how our drones don't hit each other. Adam Stacoviak Okay. So they're just like, well, I'll go up or down a little bit. Keenan Wyrobek Exactly. They basically, there's a distributed algorithm. They share their 10 seconds out intent with each other. And there's a distributed algorithm based on what they hear from the people around them that they'll adjust their course in a way where you get an emergent behavior you're talking about Of like, okay, great. We're slow, you know, you end up with that nice passage very efficiently and dynamically. Yeah, I think you're describing exactly how this needs to happen. But the challenge is it has to happen in a very robust way, right? It can't be like, oh, if you can reach a server on the cloud and your cell connection is working and the server is working and everybody's talking at the same time and there's some central Orchestration that doesn't have a problem, then it works. We have a lot of experience to learn the hard way that you just can't scale that way. It's got to be simpler. ([Time 1:25:10](https://share.snipd.com/snip/9b4ee13d-e7f4-4786-a495-2507dbadb9e7))