The drone is 15% of Zipline: 140 million miles, zero incidents

Start with three numbers. Zipline has just crossed 140 million commercial autonomous miles with zero safety incidents — a distance Eric Watson, who leads systems engineering and safety, likes to translate as driving every road in the United States more than thirty times. Keller Rinaudo Cliffton, the co-founder, notes that the same mileage in a car would produce about 600 accidents, 100 injuries, and somewhere between two and six fatalities. The third number is $12: the long-range overseas cost of a delivery that ran $300 when the company launched blood service in Rwanda in 2016.

On Sequoia Capital’s Training Data podcast, hosts Alfred Lin and Pat Grady sit down with both men. Lin is on Zipline’s board. Keller has never liked the label “drone company.” Customers, he says, do not care about drones at all. The goal was always an automated logistics system for Earth that would be ten times as fast, half the cost, and zero-emission — something that approximates teleportation. People living on the service today open an app, see restaurants and brands, tap a button, and get a delivery five minutes later. The technology behind the curtain is not the product.

That product now spans eight countries and 5,000 hospitals and health facilities. A University of Pennsylvania study found a 51% reduction in maternal mortality in areas Zipline covers. Partners estimate the system saves between 10,000 and 12,000 lives a year. In December the company announced a $550 million partnership with the US State Department — “commercial diplomacy,” in the administration’s phrase — to expand the service after USAID shut down, on the theory that developing countries should be built on US AI and robotics rather than free, low-quality NGO aid.

Zipline was founded in 2011 and pivoted to logistics in 2014, years before foundation models made robotics fashionable. Keller was 23 or 24 when he pitched the vision. The question investors asked most often — Lin asked it too — was whether the plan was illegal in the United States. It was. Beyond-visual-line-of-sight flight was not allowed; most investors simply said they did not invest in illegal things. So the company launched in Rwanda in 2016, delivering blood transfusions to hospitals and primary-care facilities, a use case powerful enough that the government carved an exemption into its rules.

The first year was a disaster. They had signed a contract to serve 21 hospitals and served one for the first nine months. When the distribution center came online, it was midnight in the US, and Keller would get woken up because everything was broken. Eric spent long stretches in Rwanda and slept very little. The error, Keller says, was thinking the cool aircraft was the majority of the solution. What they learned is that the drone is 15% of the complexity. The other 85% is auxiliary software, maintenance, inventory management, integration with a national civil aviation authority, integration with a national healthcare system, and ordering and demand management.

Eric went out to meet doctors and lab techs expecting notes on the aircraft. The main feedback was that people get sick 24/7 — why were they only open 12 hours a day? That, he says, is product-market fit: the product was not great yet, but it solved a real need, and the customer’s complaint was that they wanted more of it. They went 24/7 within the first year and now run 24/7/365. On Christmas Day, Keller calls the distribution centers to thank them. Service grew from one hospital to 20, then 500, then 5,000 facilities across eight countries — what they call the largest commercial autonomous system on Earth.

Among the surprises of ten years in the real world, solar weather ranks high. Solar flares send radiation that disturbs the ionosphere and makes GPS signals arrive faster or slower than expected, which degrades navigation. Zipline’s answer is twofold: design GNSS so that the aircraft still knows where it is to centimeter precision during flare events, and keep redundancy beyond GNSS so the system can still fly safely if things get really bad. Keller adds another failure mode that belongs in the same family: a bit flip from solar radiation.

The compute failover is the piece Eric is proudest of. Two flight computers both receive every sensor and both send commands to motors and control surfaces. A third, smaller arbiter watches their health and tells every other node who is in charge. If the arbiter itself fails, the primary that was already flying simply keeps flying. A couple of weeks before the taping, after a delivery, the main flight computer hiccuped. The system switched to the backup; the aircraft flew itself home and landed. That is how, Eric says, you get to 2.5 million deliveries and 140 million miles with no safety incidents.

A secondary flight computer is not a new idea — it is how a Boeing 777 works. The 777’s computer costs millions of dollars. Zipline’s job is to take aerospace best practices and build them from smartphone-supply-chain components, for tens or hundreds of dollars, at a hundred times the speed and a hundredth the cost. Boeing, Keller notes, takes about three years to ship a software update. Testing is equally unglamorous: HALT on components (rain, heat, humidity, corrosion, UV, while the motor is spinning), full aircraft on vibration tables, wind tunnels, and walk-in thermal chambers from 49°C — Phoenix in summer, where they actually fly — down to −25°C in the northern United States. The point is not to prove nothing failed. The point is to take the thing to failure and learn how it breaks.

Early on they flew in bad weather because lives were on the line, with a parachute as the last resort. Those “paralands” were common in the first years and are very rare today. The original safety goal was to be ten times safer than cars. At a board meeting Lin called that a “BS goal” and told them to be two times safer than Waymo, which is itself about 10x cars. Eric reset the year-end target. Individual aircraft in the commercial fleet have now flown more than a million autonomous miles. Keller’s challenge: raise your hand if you have a car with a million miles on it.

Pat Grady had watched delivery videos and thought the drone hovered 100 feet up. Eric corrects him: 100 meters, which makes the problem harder. The aircraft hovers, accounts for wind by shifting upwind, then lowers a delivery pod on a cable. Real-time kinematic GNSS gives centimeter-level confidence in the aircraft’s own position, but nobody has surveyed the GPS coordinates of a backyard table. The pod has to get close, then finish the job itself.

That pod carries its own NVIDIA GPU and runs its own autonomy stack. On the way down it perceives the scene, fights wind in X and Y, and decides where to leave the package — on the ground beside the table, for example, rather than on top of a row of drinks. It works at night. After touchdown it opens its doors, the package stays, the pod retracts, stows, and the aircraft flies home. Two architectural advantages follow. First, quiet: most drones make a grating noise, so Zipline staffs a team of aerodynamics, aeroacoustics, and controls people and aims to be no louder than leaves in trees. Second, safety: the only object that comes near people, pets, and kids is what Keller calls a cute anthropomorphic Styrofoam tub. The noisy vehicle stays a hundred meters up.

The other 85% is a network: charging sites, hundreds of aircraft, and cloud schedulers that balance demand, supply, dinner rush, and weather. Humans have not vanished; they have changed jobs. Trained aviation professionals monitor the network. When Zipline first got US permission, the ratio was one remote pilot in command watching one aircraft — terrible unit economics. As the systems proved out, it went 1:3, 1:6, 1:20, 1:40. They now operate 1:100 and plan to go well beyond that. They dropped the word “pilot” because it is confusing. Inspired by *Ender’s Game*, they call the role fleet commander, and the phrase appears in FAA documentation: “Fleet commanders shall do the following.”

Getting into the US took the better part of a decade. Commercial service launched in Rwanda in 2016; the next-generation home-delivery product, now in hyperscale, only launched in January of last year. Meaningful engagement with the FAA started around 2020. It was not a 2025 arrival followed by smooth sailing. It was a multi-year partnership over shared goals of safe and efficient airspace integration, with Zipline bringing experience from other countries and both sides arguing about how the path should look.

Scale collides with air traffic control. The largest US airline does about 5,000 flights a day; Zipline will surpass that in the next month. At a million deliveries a day it would fly 40 to 80 times as many US commercial flights as all airlines combined. ATC still treats those as flights. The current system was designed in the 1950s with pencils, paper, and note cards. Fifty percent of controllers are over 45; 20% are about to retire; almost nobody is entering the career. Zipline’s direction is aircraft talking to each other, detecting conflicts, and negotiating “you go up, I go down,” then pushing those practices into regulators and standards bodies. Keller notes that several US public companies that build ATC software are worth more than $10 billion — and Zipline had to grow the equivalent in-house because every country required monitoring software from scratch.

Over Keller’s desk hangs a flag: “We do this not because it is easy, but because we thought that it would be easy.” Hardware companies, he says, always try not to vertically integrate first. Tesla’s Roadster used a Lotus Elise chassis and a bought battery pack; it lost a lot of money and was not very reliable, but it was the step to the Model S. Zipline started the same way — buying everything, paying people to design pieces — and crashed airplanes at test sites until the parts were too expensive and too unreliable. Then, piece by piece, they ripped things out: motor controller, GPS module, navigation system, even the electric motor, because the thrust-to-weight ratio they needed was not on the shelf.

DJI’s plastic quadcopters and $20 million Predator aircraft are both, in this view, too unreliable and on the wrong unit economics to compete with cars and motorcycles that have had a hundred years to get cheap and robust. The aircraft now has 700 unique components designed from scratch and 43 major sub-assemblies, including the pod’s NVIDIA flight computer and the electronics in the docking station. The office is packed like sardines: firmware next to mechanical next to autonomy next to cloud infra next to aeroacoustics. The factory is a three-minute drive; test sites are nearby. When something breaks, you walk to someone’s desk and pull an all-nighter. If you are Boeing and a 787 battery fails, Keller says, you sue a supplier and spend two years arguing whose fault it is, three layers deep in procurement.

Eric finds cross-discipline work easy once everyone is rowing the same direction and there is no “that’s IP, I can’t show you the source.” You sit down, pull up the code, and reconcile assumptions. Two methods get repeated. First, SpaceX’s rule: question every requirement, because the requirement is usually stupid, and you often have to dig two levels deep to see why. Second: delete the part. The most reliable part on an aircraft is the one that is not on the aircraft. Visitors who see EV1, EV2, and EV3 next to each other — like Raptor 1, 2, and 3 — see delete, delete, delete. Deleting takes courage; you look like an idiot if the system then cannot perform. Confidence in the physics is what lets you do it.

On the early Platform One aircraft, landing used a meter-long deployable tailhook and a catch line. The team wanted to move that complexity to the ground, like an aircraft-carrier robot grabbing the plane. The next generation was about to be built and the grabber was not working yet. The choice was a meter-long hook or a two-centimeter stub and a bet. They got in a room and said delete it. The following weeks were late nights. The first aircraft of that generation were caught and landed.

Keller’s advice to hardware founders is one line: you said the system would cost X, plan for 10X. In 2016 they signed Rwanda at $30 a delivery for an 80-to-100-mile blood run and thought that was the cost. It launched at $300. Lin was surprisingly calm. Then $120, $75, $40, $28, $18, and now $12 for the long-range overseas technology. This summer, he says, the fully burdened unit economics are falling below the cost of using cars. It is not on the front page of the *New York Times*, but it is now more cost-effective to use a robot in logistics than a human. Customer comment number one is not the aircraft. It is “no tip,” with three exclamation points — a known price and no guilt.

Demand is larger than the factory they sized. The United States already does 5.5 billion so-called instant deliveries a year, in 4,000-pound gas vehicles, in 30 to 60 minutes; more than half of drivers, Keller says, report eating some of the food they delivered in the last month. Extrapolating Dallas buying behavior nationwide implies 55 billion, not 5.5 billion — the Uber pattern, where a better, cheaper product expands the market roughly tenfold. He recently met an 80-year-old grandmother who had ordered 350 times in a year. Nursing homes are already big demand centers. There are not enough humans or roads for that volume.

Zipline is doing almost 5,000 flights a day and expects to exit the year above 30,000, with a goal of a million a day as fast as possible and four more metros in the next four months. It took roughly a decade to complete the company’s first million deliveries; a million a day is now the near-term target. Several partners have each asked to buy a million deliveries a day of capacity. “Our operating plan has now become our unit of sale.” The factory was sized for 20,000 aircraft a year. South San Francisco planes will soon fly straight off the line into commercial service, like Tesla cars delivering themselves, and fly themselves to a depot when they need maintenance.

Asked whether they will eventually carry people, Keller stays measured: a new infrastructure layer that moves packages as efficiently as the internet moves information will be one of the biggest companies on Earth, and they want to stay humble and paranoid about how hard the next few years of execution will be. He quotes Bane — “You adopted the darkness, I was born in it” — for a decade as the black-sheep hardware company while capital chased SaaS. An internal Sequoia memo, he says, argued that hardware companies will matter most for humanity and are the hardest to fund. Installing anti-suicide nets on the Golden Gate Bridge cost more than building the bridge. The close is a plea to get good at manufacturing, supply chains, and infrastructure again, and to believe in the sci-fi future if we want to build it.