Inside Zipline's Autonomous System: 140M Miles, Zero Incidents
In a Nutshell
Zipline built a vertically integrated autonomous logistics system that has flown 140 million miles with zero incidents and now saves an estimated 10,000–12,000 lives per year through medical deliveries. The aircraft is only 15% of the solution; the remaining 85% is the software, maintenance, regulatory integration, and operations stack required to run 24/7 at global scale. The company is now hyperscaling home delivery, targeting one million deliveries per day, with unit economics already below car-based delivery and plans to replace the legacy air-traffic-control model with direct aircraft-to-aircraft coordination.
These notes were generated by AI and may contain inaccuracies.
Keller describes early visits to doctors and lab techs in Rwanda to gather feedback on Zipline's service. Instead of comments about the drone technology, the main feedback received was that people get sick 24/7, questioning why the service was only open 12 hours a day, especially when delivering life-saving blood. This insight demonstrated product-market fit in a market solving a real need, where customers' primary request was for more of the service.
Keller (co-founder) and Eric (systems engineering and safety lead) discuss Zipline's history. The company does not want to be described as a drone company. The goal has always been to build an automated logistics system for Earth that approximates teleportation. Customers do not care about the technology behind the curtain; they care about the ability to download an app, see brands and restaurants, click a button, and receive delivery five minutes later.
Zipline was founded in 2011 and pivoted in 2014, well before AI, robotics foundation models, or related technologies. Starting a robotics company at that time was considered extremely difficult. When pitching the vision of an autonomous logistics system that would be 10 times as fast, half the cost, and zero emission, investors commonly asked whether the concept was illegal in the US, since flying beyond visual line of sight was not permitted. Most investors declined to invest in what they viewed as illegal activity.
Because operations were restricted in the US, Zipline pursued launch in other parts of the world where the value of the service would be extremely high. The company launched in Rwanda in 2016, delivering blood transfusions directly to hospitals and primary care facilities. This powerful use case enabled the government to work closely with Zipline and grant an exemption to the existing regulatory framework.
When Zipline launched in 2016 with a contract to serve 21 hospitals, the team initially served only one hospital for the first nine months. Eric spent significant time in Rwanda with little sleep. In the US, the team was frequently woken at midnight when the distribution center activated, finding that everything was broken. The initial error was believing the cool vehicle constituted the majority of the solution.
The team learned that the physical drone hardware represents only 15% of the complexity of the overall solution. The remaining 85% required building auxiliary software systems, maintenance systems, inventory management, integration with national civil aviation authorities, integration with national healthcare systems, and ordering and demand management systems.
Zipline achieved 24/7 operations within the first year and now operates 24/7 365 days per year. On Christmas Day, Keller calls distribution centers to thank staff and check in. The company has grown from serving one hospital to 20, then 500, and now 5,000 hospitals and health facilities across eight countries. It has become the largest commercial autonomous system on Earth.
The system has crossed 140 million commercial autonomous miles. This distance is equivalent to driving on every road in the United States more than 30 times. A University of Pennsylvania study showed a 51% reduction in maternal mortality due to Zipline's service. Across all use cases, partners estimate Zipline is saving between 10,000 and 12,000 lives per year, with impact growing exponentially.
In December, Zipline announced a $550 million partnership with the US State Department to expand the life-saving service across countries where Zipline already operates. With US aid being shut down, the US sought new engagement methods that would accelerate economies in these countries and provide economic benefit to the US. The strategy is termed "commercial diplomacy," with the goal that the developing world should be built on top of US AI and robotics technology.
Countries expressed fatigue with low-quality aid provided by NGOs for free, as such services create dependence and prevent economic growth. What countries want is high-paying jobs, entrepreneurship, and technology. The US strategy incentivizes adoption of US robotics and AI infrastructure, which saves lives and money while securing US leadership in manufacturing and robotics.
Over 10 years of production operations, lessons emerged that were not anticipated at launch. One unexpected challenge is solar weather. Solar flares send radiation to Earth that can mess with the ionosphere, causing GPS satellite RF signals to arrive faster or slower than expected, leading to navigation system degradation. Zipline has designed navigation and GNSS systems to be robust to these conditions, maintaining centimeter-level precision during solar flares, and has built redundancy beyond GNSS for safe operation when conditions are severe.
Eric describes the compute failover architecture. The flight computer receives sensor data, performs calculations, and sends commands to actuators (motors, control surfaces). The design assumes any part of the system can experience a fault. Zipline uses two flight computers, both of which believe they are flying the aircraft at all times, receiving all sensor information and sending commands to actuators. A third "orbiter" computer monitors the health of the two flight computers and determines which one other nodes should listen to.
If the arbiter fails, the primary computer that was flying continues the mission. This architecture enables robust, reliable, and safe operation. One recent event occurred after a delivery when the main flight computer had a hiccup; the system switched to the backup, and the aircraft flew itself home and landed without incident.
Many safety concepts Zipline employs are not revolutionary; a Boeing 737 uses a secondary flight computer. However, a flight computer on a Boeing 737 costs millions of dollars. Zipline's approach applies aerospace safety best practices using components from the smartphone supply chain, achieving similar safety levels at 1/100th the cost while moving 100 times as fast.
Zipline is a real-world AI robotics company with electromechanical systems operating in the real world. Testing encompasses hardware, software, and integrated system aspects across multiple environments. Hardware testing includes component-level testing and HALT (highly accelerated lifetime testing), subjecting components such as motors to rain, heat, humidity, corrosion, UV, and other conditions while exercising them.
The aircraft contains 700 unique components designed from scratch by Zipline, including the flight computer, power distribution board, motor controllers, battery, battery management system, and the delivery pod (a smaller robot with an Nvidia GPU-powered flight computer). There are 43 major sub-assemblies. Electric motors were designed from scratch due to thrust-to-weight ratio requirements not available in off-the-shelf motors.
System-level testing places full aircraft and other system parts on vibration tables, in wind tunnels, and in walk-in thermal chambers. The goal is not merely to confirm the system is good enough, but to understand how it will break so improvements can be made. Testing occurs from 49°C (hot conditions in Phoenix during summer) down to -25°C (northern United States).
Because Zipline began with life-saving medical deliveries, the initial philosophy was that customers should be able to count on the service whenever the sun is shining. In the first couple of years, the company took significant risk, flying life-saving deliveries even in challenging conditions with a civil aviation authority partner. The team learned extensively from these operations. A parachute serves as the safety mechanism of last resort to bring the aircraft gently to the ground; such events were common in early years but are now very rare.
Zipline's original safety goal was to be 10 times safer than cars. At a recent board meeting, the goal was reset to being two times safer than Waymo by the end of the current year, as cars represent archaic technology. Waymo is approximately 10 times safer than cars. Zipline has flown 140 million commercial autonomous miles with zero safety incidents. Driving 140 million miles would statistically result in 600 accidents, 100 injuries, and between two and six fatalities depending on the country.
Individual aircraft in the commercial fleet have flown more than one million commercial autonomous miles, demonstrating that the systems are more rugged and durable than commonly perceived.
The aircraft operates at approximately 100 meters altitude. Precision delivery is achieved through multiple layers, beginning with the delivery pod that descends from the aircraft.
The drone hovers above the target location, such as a coffee table, and accounts for wind conditions by shifting upwind before lowering the delivery pod. While real-time kinematic GNSS provides centimeter-level positioning accuracy, the system does not rely on pre-surveyed GPS coordinates for individual delivery spots like tables. Instead, it uses GNSS to navigate to the general area, such as a backyard, and then employs the delivery pod's onboard perception and autonomy systems to identify the optimal placement location.
The pod uses real-time onboard compute to analyze the scene and determine the best spot to leave the package. For example, if a table has drinks on it, the system will avoid placing the package on top of the drinks and instead select the ground next to the table. After identifying the location, the pod descends, touches the ground, opens its doors, and retracts back up once the package is delivered.
The delivery pod contains its own NVIDIA GPU running a dedicated AI autonomy stack, enabling it to survey and precisely locate delivery points even at night. The pod actively controls its own position in the X and Y axes, allowing it to both identify the correct location and physically move to adjust its placement.
This architecture provides two major advantages. First, it enables a quiet delivery experience. Zipline maintains a dedicated team of aerodynamics, aeroacoustics, and controls experts who design every part of the vehicle with sound reduction in mind, targeting noise levels no louder than gentle leaves moving in trees. During delivery, the main aircraft remains 100 meters in the air, keeping the primary noise source far from the delivery location.
Second, the architecture offers significant safety benefits. The only component that comes close to people, families, pets, or children is the delivery pod, which is described as a cute, anthropomorphic styrofoam tub. This design minimizes risk by keeping the larger aircraft at a safe distance.
Zipline spent approximately eight years testing the technology outside the United States, with commercial service launching in Rwanda in 2016. The next-generation home delivery service, which is now in hyperscaling mode, launched in January of the previous year. Depending on measurement criteria, the development timeline could be considered as long as nine years.
Meaningful engagement with US regulators, including the FAA, began around 2020. The process was a collaborative partnership rather than a smooth or automatic approval. Regulators and Zipline aligned on shared goals of safe and efficient airspace integration, combining Zipline's international experience with US regulatory perspectives to establish workable pathways over several years.
The aircraft represents only one component of a much larger system. Zipline is building an infrastructure layer that enables instant product access through a network of charging locations, hundreds of aircraft distributed across areas, and autonomous cloud-based systems. These systems manage demand and supply matching, aircraft positioning, upcoming demand patterns such as dinner rushes, weather conditions at different locations, and dynamic self-balancing of resources.
While the aircraft operate autonomously without requiring human intervention during flights, trained aviation professionals called fleet commanders monitor the network. These individuals are alerted when issues arise, such as changing wind conditions, allowing for appropriate human oversight without constant one-to-one control.
Initially, US operations required a one-to-one pilot-to-aircraft ratio, with each remote pilot in command observing a single aircraft from an office. As systems proved reliable, the ratio improved progressively to one-to-three, one-to-six, one-to-twenty, one-to-forty, and currently one-to-one hundred, with plans to increase further.
The term was changed from "pilots" to "fleet commanders" because "pilot" was considered confusing. The name draws inspiration from Ender's Game. The updated terminology appears in FAA documentation, which specifies the responsibilities of fleet commanders overseeing groups of 100 aircraft.
This shift demonstrates how autonomy enables humans to uplevel their roles from performing operational tasks to strategically managing robotic systems.
Zipline took nearly a decade, from 2014 to approximately 2024 or early 2025, to complete its first cumulative million deliveries. The company is now approaching the capability to perform a million deliveries per day. At this scale, events with a one-in-a-million probability will occur daily, requiring significantly higher system reliability.
Maintenance becomes particularly challenging at this volume. The scale of the fleet, the cost of inefficiencies, and the criticality of all processes increase dramatically. One advantage of autonomous systems is their ability to operate continuously, 24/7. Unlike human-driven logistics limited to typical working hours, Zipline's aircraft can deliver at any time, including 2 or 3 a.m., with packages ready for customers by 6 a.m.
Vehicles will soon fly directly from the South San Francisco factory into commercial operation, similar to Tesla vehicles. This enables proactive maintenance workflows where aircraft fly themselves to maintenance depots, undergo service, and return to operations autonomously. Capacity can also be dynamically reassigned across a metro area based on real-time system needs rather than fixed home bases.
Current manufacturing, maintenance, support, and troubleshooting processes will not scale to a million deliveries per day. New tools, software systems, and processes are required. This includes investment in "machines that build the machines," following principles such as designing the systems that manufacture and operate the core technology.
The largest US airline operates approximately 5,000 flights per day. Zipline is projected to surpass this volume within the next month. At a million deliveries per day, Zipline would conduct between 40 and 80 times as many flights in US commercial airspace as all other airlines combined.
Existing air traffic control systems, designed in the 1950s with pencils, paper, and human visual monitoring, will require fundamental transformation. The sky offers substantial unused capacity that could reduce ground-level traffic, noise, and pollution while returning space to human use. This transformation must incorporate AI and autonomy rather than relying on legacy manual approaches.
Zipline advocates for collaborative innovation across the industry rather than isolated company-specific solutions. Aircraft should communicate directly with each other, automatically detecting potential conflicts and coordinating responses such as altitude adjustments. Zipline's aircraft already implement this capability, and the company is working with other autonomous aircraft operators to ensure interoperability.
Zipline also engages with regulators and standards bodies to promote best practices and innovations for broad adoption. When launching in other countries, the company built monitoring software from scratch and provided it to civil aviation authorities. Multiple US public companies specializing in air traffic control software are valued at over $10 billion, illustrating the scale of systems that Zipline has had to develop internally.
Current air traffic control faces a labor crisis, with 50% of controllers over age 45 and 20% nearing retirement, while few new workers are entering the field. Recent incidents, including a plane-helicopter collision in DC and a taxiway collision at an airport, highlight the urgency for modernization driven by both labor shortages and the influx of autonomous technology.
Zipline operates as a highly vertically integrated company, designing its own parts, building its own aircraft, writing its own software, and managing its own operations, manufacturing, and maintenance. Early attempts to purchase components and off-the-shelf solutions resulted in crashes and unreliable performance, leading to a decision to design critical systems such as motor controllers, GPS modules, and navigation systems from scratch.
The company recognized that existing drone technologies, including DJI consumer quadcopters and large military UAVs, did not meet the reliability and cost requirements needed to compete with cars and motorcycles. An automotive-grade solution was necessary: highly reliable and extremely cost-effective.
Benefits of vertical integration include speed and tight integration. All disciplines, firmware engineers, mechanical engineers, autonomy engineers, cloud infrastructure teams, aeroacoustics specialists, guidance navigation and controls experts, systems engineers, and manufacturing personnel, work in close physical proximity. The factory is three minutes away, and test sites are a short drive, enabling rapid iteration when issues arise.
When problems occur, teams can immediately collaborate across desks rather than navigating supplier contracts and multi-year fault investigations typical of traditional aerospace procurement. This structure makes cross-disciplinary collaboration straightforward because all teams share the same goals and can directly examine code, hardware, and test results together.
Questioning every requirement is essential when building complex AI and robotic systems combining hardware and software. Requirements often appear sensible at first but reveal their flaws when examined two levels deep. Every team must be empowered to challenge assumptions.
Another core principle is to delete parts whenever possible. The most reliable component on an aircraft is the one that does not exist because it was removed in a previous design iteration. This approach draws inspiration from established engineering practices emphasizing simplicity and reliability through elimination.
Building complex AI and robotic systems that combine hardware and software reveals the deep truth of how flawed requirements usually are. Questioning every requirement was central to developing Raptor engines and Zipline's aircraft iterations. The team built the EV3 aircraft alongside the EV2 and EV1 aircraft, plus 10 different hardware versions on the first version of Zipline's technology. The process involved constant deletion of components. Deleting things is difficult because it requires courage—no one wants to remove a part and risk system failure. True confidence in the physics and performance of the system enables deletion of parts. Full integrated control of all systems makes it possible to question every requirement and remove components.
First principles thinking played a major role in simplifying the aircraft. The early Platform One aircraft had a deployable tail hook for landing—a meter-long hook that would catch on a line to slow the airplane. The team decided to move complexity from the aircraft to the ground systems, creating a recovery system similar to an aircraft carrier where a robot grabs the airplane. This approach made the aircraft simpler, lighter, and more reliable. When building the next generation aircraft, the team faced a decision: include the meter-long tail hook or delete it and install a two-centimeter tail hook while betting the new system would work. The team chose to delete the tail hook. From first principles, the system should work, so they committed to making it function. The team, including Keller, worked late nights to get the system operational, and the first aircraft were successfully caught and landed. Being grounded in first principles thinking with a tight integrated team enables these decisions.
The discussion addressed whether Zipline might eventually deliver human beings instead of medicine and food. The concept of using battle-tested, safe, and reliable autonomous systems to liberate people from reliance on streets was raised. Building a new infrastructure layer for the planet that delivers packages as efficiently as the internet moves information represents one of the biggest business opportunities. The team remains humble and aware of the execution challenges ahead.
Zipline has a goal of reaching a million deliveries a day. Multiple partners have each requested to purchase a million deliveries a day of capacity. The operating plan has become the unit of sale. The factory was originally sized to build 20,000 aircraft per year for a million deliveries daily, but demand has exceeded expectations. The market is significantly larger than initially projected. There are 5.5 billion instant deliveries performed by humans in the United States every year using 4,000-pound gas combustion vehicles, taking 30 minutes to an hour. Over 50% of drivers report eating some of the food they delivered in the past month, and there are significant safety concerns with this delivery method.
If customer buying behavior observed in Dallas extends across the United States, there would be 55 billion instant deliveries annually rather than 5.5 billion. This represents a 10x market expansion. The Uber analogy illustrates this phenomenon: predictions that Uber would capture 33% of the San Francisco taxi market and become a $15 billion company missed that Uber grew to 10 times the size of the taxi market. Making something more convenient, less expensive, and offering a better product experience drives increased consumption. Zipline customers are ordering every day rather than a couple times per month. One 80-year-old customer ordered 350 times in a year. Nursing homes represent major demand centers. Older adults are comfortable using Apple ID, Apple Pay, and Face ID to order deliveries. There are not enough humans in the United States to handle 55 billion deliveries, and there are not enough roads to support that volume. Traffic in major cities makes adding more cars unsustainable. The solution requires taking cars off roads to enable human growth.
Zipline currently performs almost 5,000 flights per day. The company anticipates exiting the year above 30,000 flights per day. The goal is to reach a million flights per day as quickly as possible. Supply chain and manufacturing capacity decisions are designed to reach a million deliveries daily and accelerate beyond that milestone.
Hardware projects typically cost 10 times initial estimates. Advice to hardware founders is to assume costs will be 10 times projections and evaluate whether the business works at that cost. When Zipline launched in 2016, the company charged $30 per delivery for blood transfusions over 80 to 100 miles, expecting costs around $30 per delivery. Actual costs were $300 per delivery. Costs were reduced progressively: $120, then $75, then $40, then $28, then $18, and now $12 for long-range operations outside the US. This summer, fully burdened unit economics for these systems are falling below the cost of using cars for delivery. It is now more cost-effective to use robots in logistics than humans. This development will impact neighborhoods through reduced traffic, noise, and pollution, while customers benefit from faster, more reliable, and less expensive service. Customers particularly appreciate the absence of tipping requirements and the ability to know exact costs upfront.
Hardware development takes longer than expected. A Sequoia memo discusses why hardware companies will be among the most impactful for humanity's progress and why they are difficult to launch and fund. For 10 years, hardware companies were considered undesirable investments compared to software and app businesses. Building a robotics company for a decade before it became fashionable demonstrates commitment. US competitiveness and the ability to build a future worth passing to future generations requires renewed focus on manufacturing and infrastructure. The nation depends on infrastructure built by previous generations. The anti-suicide nets recently installed on the Golden Gate Bridge cost more than the original bridge construction. Building infrastructure, manufacturing, and managing complex supply chains again is essential. Bold belief in ambitious future visions is necessary to create them.
Keep Sequoia Capital in your library
Save the videos and channels worth coming back to, and find them again in one place.
