No. 101·中文精读

1.4亿英里零事故:无人机只占Zipline这门生意的15%

Inside Zipline's Autonomous System: 140M Miles, Zero Incidents

联合创始人 Keller Rinaudo Cliffton 与系统安全负责人谈为何无人机只占方案的 15%,其余是库存管理、空域整合与工程体系。

节目音频00:00 / 55:18
中文精读由 AI 基于原始访谈改写,非官方翻译,可能存在偏差或错误;表述以原节目为准。

先看三个数字。

1.4亿英里。这是Zipline累计完成的商业自动驾驶飞行里程,全程零安全事故。负责系统工程与安全的Eric Watson给过一个换算:相当于把美国的每一条公路都跑上30遍。

600起。同样这1.4亿英里,换成人类司机来开,按事故率折算,大约对应600起事故、100起人员受伤,外加2到6起死亡。

12美元。2016年,Zipline送一单血的实际成本是300美元;现在,其海外长途配送的单件成本降到了12美元。就在这个夏天,这个数字跌破了用汽车送货的成本线。

红杉资本播客Training Data这期请来Zipline联合创始人Keller Rinaudo Cliffton和Eric Watson,主持人Alfred Lin本身就是Zipline的董事会成员,另一位是合伙人Pat Grady。两个人把十年踩过的坑摊开讲了一遍。

21家医院的合同,头9个月只服务了1家

Zipline 2011年成立,2014年转向物流。融资那会儿Keller才23、24岁,出去讲的愿景是:建一套覆盖地球的自动化物流系统,比现有方式快10倍,便宜一半,零排放。投资人最爱问的问题只有一个:这在美国是不是违法的?

答案:是。当时美国连无人机超视距飞行都不允许。多数投资人听完直接表态,我们不投违法的东西。

于是他们去了卢旺达。2016年,Zipline在卢旺达启动商业运营,给医院和基层医疗机构直送血液。用例足够硬,政府愿意全力配合,专门为它开了监管豁口。

然后现实给了第一巴掌。合同签的是21家医院,头9个月只服务了1家。卢旺达的分发中心开机时,正值美国午夜,Keller经常半夜被电话叫醒,那边的系统什么都坏了。全组通宵加班,周末无休。

Eric当时常驻卢旺达。他去拜访客户,自以为会听到一堆关于无人机的产品建议,结果医生和检验技师的头号反馈是:人生病不分上下班,你们凭什么一天只营业12小时?

「产品还不怎么样,客户的主要反馈却是想要更多服务。这是个好信号,说明滩头市场选对了。」Eric后来总结。

一年之内,他们改成24小时营业。现在是24/7/365,圣诞节当天Keller会挨个给各地分发中心打电话致谢。服务规模从1家医院到20家、500家,如今是8个国家的5000家医院和医疗机构。宾夕法尼亚大学发表的研究显示,Zipline覆盖地区的孕产妇死亡率下降了51%。合作伙伴估计,这套系统每年挽救1万到1.2万条生命。

回头看第一年的混乱,Keller把它归结为一个判断错误:他们以为那台酷的飞行器就是方案的主体。实际上,飞行器只占整个方案复杂度的15%。剩下85%是维护体系、库存管理、订单与需求管理、与国家民航局的对接、与医疗系统的对接,外加一堆辅助软件。缺任何一块,所谓「像魔法一样的即时传送」都转不起来。

这个15%,值得所有做实体机器人的人写在工位上:你造的那台机器,只是冰山露出水面的部分。

把波音的安全作业,抄到手机零件的价格

聊到安全,Eric讲得最细的是计算冗余。飞机上有两台飞行计算机,像两个都以为自己握着操纵杆的飞行员:都接收全部传感器数据,都向电机和舵面发指令。中间还有第三台小电脑当裁判,盯着两台的健康状况,告诉机上其他节点此刻该听谁的。那裁判自己坏了呢?就让原本那台主机继续飞,任务照常。

几周前刚发生过一次真实切换:送完件,主飞行计算机出了毛病,系统切到备份,飞机自己飞回家、降落,一切正常。故障原因可能是软件,可能是接插件,也可能是太阳辐射引起的比特翻转。

这套双机互备的思路,波音777上也有,差别在价格。777的飞行计算机以百万美元计,Zipline用手机供应链的元件,把接近传统航空的安全水平做到几十、几百美元的成本,迭代速度快100倍。作为对照,波音做一次软件更新大约要三年。把系统从头到尾设计得皮实可靠,才换得来250万次配送、1.4亿英里、零事故。

真实世界还会出一些办公室里想不到的考题,比如太空天气。太阳耀斑爆发时,辐射会扰动电离层,让GPS信号的传播速度偏离预期,导航精度直接降级。Zipline的对策有两条:把GNSS设计得足够皮实,耀斑活跃期也保持厘米级定位;同时在GNSS之外准备冗余方案,情况再糟也能安全飞。

测试端全是笨功夫。整机700个独有部件全部自研,43个主要子装配。元件级做HALT高加速寿命测试,电机一边运转一边被淋雨、加热、加湿、喷腐蚀液、照紫外线。整机进振动台、风洞、能走进去的温箱,温度范围从49摄氏度到零下25摄氏度,前者是凤凰城的夏天,他们真在那个温度下飞,后者对应美国北部。Eric的原则是,别只问「够不够好」,要弄清「它怎么坏的」,把东西测到坏,才知道边界在哪。

早期他们冒过不少险。救命的件,天气再差也飞,摔了就拉降落伞,把飞机轻轻放回地面,这是最后手段。头几年降落伞用得很勤,现在极少触发。

安全目标还被人当面怼过。公司原目标是比人类司机安全10倍,董事会上Alfred直接说这目标太水,要比Waymo安全2倍,毕竟Waymo大约已经是普通车的10倍。Eric回去就把年底目标改了。

还有个数字,专治「无人机很娇气」的印象:商业机队里,有单机累计飞超过100万商业自动驾驶英里的。Keller现场发问:在座各位,谁家的汽车跑过100万英里?

从天而降的小罐子

Pat Grady看投递视频,以为无人机在100英尺高度放包裹。Eric纠正:是100米,难度更高。

流程是这样的。飞机在100米高空悬停,先算风向,往上风处偏移,然后放下一根缆绳,吊着配送舱往下送。定位靠实时动态GNSS,精度厘米级。但没人测绘过住户后院那张桌子的坐标,所以最后的落点由配送舱自己决定:它装着一块NVIDIA GPU,跑自己的自主栈,下降途中实时识别地面,判断哪里适合放包裹。桌上摆着一排饮料?那就绕开,放旁边的地上。它还能主动控制自己的水平位置,跟阵风较劲,夜里照样干活。触地、开舱、收回、爬升,一气呵成。

这个架构还有个副产品:安静。多数无人机的噪声非常刺耳,Zipline专门养了一支气动、气动声学和控制的团队,整机每一处都为降噪设计,目标是不超过树叶被风吹动的响声。而真正靠近住户、住户的孩子和宠物的,只有那个被Keller形容为「可爱的拟人化泡沫小罐」的配送舱,主机始终待在100米高处。

一个人管100架飞机

无人机之外的那85%,很大一块是运营网络:充电点、几百架飞机、云端调度系统,实时平衡需求、运力、天气和晚餐高峰。人没有消失,但角色变了。受过训练的航空专业人员监控整个网络,头衔叫「舰队指挥官」,灵感来自《安德的游戏》,连FAA的文件里都白纸黑字写着「舰队指挥官应当如何如何」。

这个岗位的演进曲线很能说明问题。刚进美国时,监管要求1个人盯1架飞机,单位经济性很难看。后来是1比3、1比6、1比20、1比40,现在是1个人管100架,还打算继续往上走。Keller的说法:机器人让人类升级了,人不再亲自干活,改为指挥机器人。

进入美国的路走了近十年。他们在海外验证了六到九年,2020年前后才开始跟FAA实质性接触,把各国攒下的经验带进去,跟监管一起把路趟出来。新一代家庭配送服务2025年1月才上线,如今在达拉斯已经大规模运转。

规模再往上,会撞上整个空管体系。美国最大的航空公司一天大约5000个航班,Zipline下个月就会超过这个数;等做到每天100万单,它在美国空域的航班量将是所有航空公司总和的40到80倍。而现在的空管系统是1950年代用铅笔、纸片和卡片设计的,50%的空管员超过45岁,20%即将退休,年轻人不入行。他们的方向:飞机之间直接通话,自动发现冲突,协商「你上我下」,监管和标准组织跟上。Keller顺嘴提了句,美国有好几家做空管软件的上市公司市值超过100亿美元,而Zipline内部就养着这样的团队,因为当年在各国都得从零给民航局写监控软件。

顺便说下美国政府的态度。去年12月,Zipline和美国国务院签了5.5亿美元的合作。USAID关停后,美国想换个方式跟这些国家打交道,他们管这叫「商业外交」:让发展中国家的基础设施建立在美国的AI和机器人技术上。Keller说,这些国家受够了NGO免费但低质的援助,他们想要高薪工作、创业机会和技术。

垂直整合是被逼出来的

Keller的办公桌上立着一面旗,写着:「We do this not because it is easy, but because we thought that it would be easy.」大意是,干这个,纯粹因为当初以为它简单。

Zipline早期跟特斯拉Roadster的路数一样:外购底盘、外购部件,拼起来。Roadster用了Lotus Elise的底盘,亏了很多钱,可靠性也差,但它是通向Model S的台阶。Zipline当年全靠供应商,结果在试飞场一架接一架地摔飞机。摔着摔着想明白了,开始一个部件一个部件地撕掉重做:电机控制器自己写,GPS模块自己造,导航系统自己搞,连电机都从零设计,因为需要的推重比市面上买不到。整机700个独有部件,就是这么攒出来的。

理由很朴素:DJI的消费级四轴,和2000万美元一架的捕食者无人机,可靠性和单位经济性都撑不起「跟汽车、摩托车抢生意」这件事。汽车有一百年时间把可靠性磨上去、把成本磨下来,要跟它比,就得拿出汽车级的可靠、汽车级的便宜。

组织形态跟着走。Zipline的办公室挤得像沙丁鱼罐头,固件工程师挨着机械工程师,挨着自主系统、云基础设施、气动、气动声学、制造,工厂离办公室3分钟车程,试飞场也在附近。东西坏了,直接走到那个人的桌前:今晚我俩通宵。Keller拿波音做对比:787的电池出问题,流程是起诉供应商,花两年时间扯皮谁的责任,中间隔着三层采购关系。

Eric补充,跨学科协作其实不难,前提是所有人同向划桨,而且没有「这是IP不能给你看」这回事。测试挂了,走过去坐下,拉出代码一起看:你这个假设跟我的设计对不上,来,查。

方法论上有两条被反复强调。第一条来自SpaceX那套算法:质疑每一个需求,需求往往是蠢的,有时得往下挖两层才发现它蠢在哪。第二条是删零件:飞机上最可靠的零件,是被你删掉、根本没装上去的那个。Keller让人去看Raptor 1、2、3三代发动机摆在一起的样子,也让人去看Zipline的EV1、EV2、EV3三代机,关键词就是删、删、删。删东西需要勇气,删错了丢人,但对物理和系统性能有真信心,才敢下手。

Eric举了个例子。早期Platform One飞机靠一个1米长的可收放尾钩配合地面拦阻索降落,结构复杂。他们想把复杂度挪到地面,让一个机器人上去抓住飞机。下一代飞机开造时,新方案还没验证,摆在面前的问题:装1米的尾钩,还是赌一把,只留2厘米的钩?一屋子人拍板:删。接下来几周是一轮接一轮的通宵,最后那批飞机真的被抓稳、降落了。

300美元降到12美元,一个没人报道的拐点

给硬件创始人的建议,Keller只给了一条:你说成本是X,那就按10倍做规划,「我们是有教训的」。

2016年签约时,他们按30美元一单的成本给卢旺达送血,80到100英里的航程,账面说得通。系统上线,实际成本300美元一单,10倍。Alfred当时出奇地淡定,Keller说,行吧,活儿来了。之后一年降到120,再一年75,再40、28、18,现在海外长途技术是12美元。

今年夏天发生的事,Keller认为重要性被严重低估:把整机、运维、网络全算进去的单件成本,正在跌破用汽车送货的成本。用机器人做物流,比雇人开车便宜了。这件事没上报纸头条,但它会改变社区的声音、路上的车流,以及普通人点一杯奶茶的方式。

需求侧的数字更夸张。美国每年有55亿次「即时配送」,全靠4000磅的燃油车,平均30到60分钟送到,超过一半的配送员承认过去一个月偷吃过顾客的餐。而把达拉斯用户的购买行为外推到全美,这个市场是550亿次。Keller拿Uber做类比:当年所有人按出租车市场给Uber算估值,算出个150亿美元的公司,结果Uber做到了出租车市场的10倍。更好用、更便宜的东西,人们会用得多得多。他前几天遇到一位80岁的老奶奶,一年在Zipline下了350单;养老院已经是需求大户。

运力曲线:现在一天近5000班,年底要超过3万班,目标是尽快做到每天100万单,未来四个月再开4个都会区。多个大客户最近每家都在谈每天100万单的采购量,Keller的原话很妙:我们的运营计划成了我们的销售单位。工厂原按年产2万架设计,现在发现市场比这大得多。南旧金山的工厂很快会做到飞机直接从产线飞进商业运营,需要保养就自己飞去维修库,像特斯拉那些自己开到客户家门口的车。

Pat问出那个自然的问题:以后送不送人?Keller答得很克制:给地球造一层新的物流基础设施,让包裹像互联网传输信息一样高效移动,这会是地球上最大的公司之一,前提是对难度保持谦卑和偏执。

客户的头号反馈是什么?「不用给小费」,后面跟着三个感叹号。不用纠结给多少、不用有心理负担,价格透明,这条排在所有炫酷技术之前。

最后收个尾,几条明天就能用的东西。

  • 评估硬件项目,把对方报的成本和工期先乘以10,再看这门生意还成不成立。Zipline的300美元,就是从30美元的预估里长出来的。
  • 审视自己的产品,逐条问「这个需求删掉会怎样」。最可靠的零件是不装上去的那个,最便宜的功能是没做的那个。
  • 判断市场有没有找对,看客户的主要抱怨是什么。当头号反馈变成「你们开门时间太短」,说明滩头阵地已经拿下了。
  • 做现实世界的AI产品,先想清楚那85%:维护、库存、监管、运营。产品本体只是冰山露出水面的15%。

Keller在结尾引用了《蝙蝠侠》里贝恩的台词:「你们接纳了黑暗,而我生于黑暗。」别人投SaaS、投高毛利的那些年,他们做了十年没人待见的硬件公司。他还提到红杉内部一份备忘录,主题是硬件公司为什么将对人类最重要,却最难拿到融资。最后那个细节留给他:给金门大桥装防自杀网花的钱,比当年建这座桥还多。他的结论是,得重新学会造东西,学会造基础设施,敢相信科幻小说里承诺过的那种未来。

文稿来源:sequoiacap.com;机器转写可能有识别错误,人名与数字请以音频为准。
id="podcast-transcript" data-framer-component-type="RichTextContainer" style="transform:none">IntroEric Watson: I remember being in Rwanda early days, and going out and meeting with some of the doctors and lab techs that we were serving and asking them, how’s it going? What do you think? What’s your feedback? Here I am, kind of an up-and-coming learning engineer thinking they’re going to say something about the drone or some of these things. And the main piece of feedback that I received was people get sick 24/7. Why are you guys only open 12 hours a day? Right? Alfred Lin: Especially when you’re delivering life-saving blood. Eric Watson: Yeah, exactly. And so that was a really key insight for me where it’s like, man, we have found product-market fit in a market where yeah, our product wasn’t great yet, but it was solving a real need. And so having that really beachhead market where there’s a real problem being solved, and when your customer is telling you that their main feedback is they want more of your service, it’s like, that’s a good sign. Main conversationAlfred Lin: Welcome, Keller and Eric, to the show. You guys have been working at Zipline for a long period of time. Keller’s the co-founder, and Eric, you are in charge of systems engineering and safety. And we got lots of things to talk about in this whole world of drones, drone systems, and how you guys started in this hardware space before LLMs even started. So we have lots of questions. Keller Rinaudo Cliffton: Awesome. Alfred Lin: But you don’t like Zipline being described as a drone company, even though you’re probably the largest autonomous drone company in the world right now. Keller Rinaudo Cliffton: I mean, we’ve always wanted to be an extremely customer-obsessed company, and the reality is none of our customers care at all about drones. Our goal was always to build an automated logistics system for Earth and to approximate teleportation. And all the customers who are living on Zipline today, they really don’t care how—they don’t care about the technology operating behind the curtain. What they care about is their ability to download an app, open it up, see a huge number of different brands and amazing restaurants that they want to shop with, and then click a button and have it delivered to them five minutes later. So we’ve always really tried to focus on the experience rather than on the specific technology. Alfred Lin: Well, this show is about technology. [laughs] Keller Rinaudo Cliffton: We’re excited about that. Alfred Lin: This podcast is about technology. What is the underlying technology behind Zipline? You started in 2011, you pivoted in 2014. This is way before anything related to AI or robotics, foundation models, anything related to that. But you were before all of that, and you’re riding the wave of all of the things that have come afterward as well. Keller Rinaudo Cliffton: Yeah, this was when starting a robotics company was the dumbest thing you could possibly do. You’re talking to an investor in that time about—I mean, it wasn’t easy, and it was particularly hard because so many of those conversations—I mean, I was 23, 24, Eric joined the company around that time, and we were starting to describe this vision of an autonomous logistics system for Earth that would be 10 times as fast, half the cost, zero emission. One of the biggest problems when we were trying to raise money for that vision was investors would say, “Isn’t this illegal in the US?” In fact, I think that that’s a question you asked me when we started talking about this. Alfred Lin: We weren’t allowed to fly beyond visual line of sight. Keller Rinaudo Cliffton: We weren’t allowed to fly at all, really. But yeah. And so the answer was yes, it’s illegal. And then most investors would be like, “Well, we don’t invest in illegal things. So we’re not going to invest.” But for weird reasons, this is what basically took Zipline down this path of well, if it’s illegal in the US, then we can launch in other parts of the world where the value of the service would be extremely high. Zipline decided to launch in Rwanda in 2016, delivering blood transfusions directly to hospitals and primary care facilities. This enabled us to have a use case that was so powerful that a government would work very closely with us to make it happen. Eric Watson: Make it legal. Keller Rinaudo Cliffton: And to make it legal, or at least make an exemption to their existing regulatory framework. And then the other thing when it comes to how to think about Zipline as a company, when we launched in 2016, we were like, we have this really cool drone. We put all this work into designing this really cool aircraft, and it has all these great fundamental features. And when we launched, it was a total disaster, because the reality, what we learned in that first year—for the first eight—we’d signed a contract to serve 21 hospitals, and we served one hospital for the first nine months. And Eric in particular, how much did you sleep during those nine months? Eric Watson: I spent a lot of time in Rwanda and didn’t sleep a lot. Keller Rinaudo Cliffton: And then when you’re in the US, we’d get woken up at like midnight because that’s when the distribution center was turning on and everything would be broken. Nothing was working. It was totally desperate. Constant all-nighters and working through the weekends, because we had made this big error, which was thinking that the cool vehicle was the majority of the solution. What we learned during that first year is that the drone is 15 percent of the complexity of the solution. Alfred Lin: The physical drone, the hardware of it is only 15 percent. Keller Rinaudo Cliffton: Yeah. We had to build so many auxiliary software systems, maintenance systems. How do we hold the inventory and do inventory management? How do we integrate with a national civil aviation authority—which we’ll talk more about? How do we integrate with a national healthcare system? How do we do ordering and demand management? We had to build out all of these other parts of the overall logistics system. So this is the reason I think a lot of people might look at Zipline and be like, wow, it’s a cool drone company, or they built a cool aircraft. The reality is the aircraft is like 15 percent of the solution that’s required to build something that just feels like magical, reliable teleportation 24/7/365 to the now hundreds of millions of people who depend on the service. Eric Watson: Speaking of 24/7, I remember being in Rwanda early days, and going out and meeting with some of the doctors and lab techs that we were serving and asking them, how’s it going? What do you think? What’s your feedback? Just really being customer obsessed and wanting to optimize the product. And here I am, kind of an up-and-coming learning engineer thinking they’re going to say something about the drone or some of these things. And the main piece of feedback that I received was people get sick 24/7. Why are you guys only open 12 hours a day? Right? Alfred Lin: Especially when you’re delivering life-saving blood. Eric Watson: Yeah, exactly. And so you gotta start somewhere, right? So we started being open 12 hours a day and trying to expand and grow from there. And so that was a really key insight for me where it’s like, man, we have found product market fit in a market where yeah, our product wasn’t great yet, but it was solving a real need. And so having that really beachhead market where there’s a real problem being solved, and when your customer is telling you that their main feedback is they want more of your service, it’s like, that’s a good sign. Keller Rinaudo Cliffton: Yeah, we were 24/7 within the first year. Eric Watson: So we went 24/7. Keller Rinaudo Cliffton: We’re now 24/7/365. I mean, on Christmas Day, I usually call all of our different distribution centers to thank them and check in with them. So there is no day when these facilities don’t depend on—we went from serving 1 to 20 to 500, now to 5,000 hospitals and health facilities across the world, across eight countries that are served by the system. It’s become the largest commercial autonomous system on Earth. Alfred Lin: Can you size that for us? The largest system on Earth? Keller Rinaudo Cliffton: We just crossed 140 million commercial autonomous miles, which I mean, how many times is that? I think that that’s, like, to the sun and back or … Eric Watson: One of the things that I like is every road in the United States—there’s a lot of roads in the United States—driving on every single road more than 30 times. Alfred Lin: Wow! Pat Grady: That’s a good stat. Keller Rinaudo Cliffton: That’s a lot. Eric Watson: Just to put it in perspective. Keller Rinaudo Cliffton: You know, seeing the impact that that system is now having across all these eight countries, I mean, the University of Pennsylvania just published a study showing a 51 percent reduction in maternal mortality thanks to Zipline. So half as many moms losing their lives in childbirth. We have, across all of the different use cases that Zipline serves, some of our partners estimate that we’re saving between 10,000 and 12,000 lives a year. And that impact is growing exponentially as we’re now expanding, especially as a result of this new partnership we have with the US State Department. Alfred Lin: What is that partnership with the State Department? Keller Rinaudo Cliffton: In December, we announced a $550-million partnership with the US State Department to expand the impact of Zipline’s life-saving service across a lot of the countries where we’re already operating. So with USAID being shut down, the US was really seeking new ways of engaging in these countries and helping save lives in these countries. But they wanted to do it in a way that would accelerate the economies of these countries and help the US economically. And so the new strategy they’re calling “commercial diplomacy.” The idea is that we want all of the developing world should be built on top of US AI and robotics technology. We should be going and economically helping. We should be bringing the best that the US has to offer. The interesting thing is when you talk to these countries about what they want, they’ll tell you they are sick of low-quality aid provided by NGOs for free, because these services engender dependence and prevent economic growth in the countries. What they want is high-paying jobs, entrepreneurship, technology. And so the US is going through a big strategic shift where it’s like, well, we have that, we have those things. So let’s basically go out and incentivize these countries to adopt that kind of infrastructure, make sure that as these countries are accelerating, they’re doing it using US robotics and AI technology. And this is something that will be great for those countries. It saves lives, it saves them money, but it also means that it will make it possible for the US to secure our lead in manufacturing and robotics over the decades to come. Pat Grady: I’m curious about you guys, because you now run the largest autonomous system in the world and you launched it 10 years ago at this point, so you’ve been in production for 10 years, you’ve learned a lot of stuff that your average engineer sitting behind a computer screen has no idea they’re going to run into when they try to deploy AI into the real world. And so I’m curious what some of those lessons learned are. And maybe one way to ask the question is: What popped up over the last 10 years that you never would have guessed you needed to be good at when you first started launching these systems in 2016? Eric Watson: Yeah, we started off delivering life-saving products, right? And our customers need life-saving products all the time, in all weather conditions. And you would think it’s wind, these things, but one of the weirdest things is actually solar weather. So there’s solar flares that happen on the sun, so they’re basically big explosions that send radiation to the Earth. They can mess with the ionosphere, and that can cause basically the RF signals coming from GPS satellites to be faster or slower than you expect. And that can lead to degradation and challenges in navigation systems. And so here’s one example that, when we were starting off, we didn’t think that this was going to be something we have to figure out. But we actually have gone pretty deep in this space. And really, it’s two things. One is designing our navigation system and our GNSS systems to be robust to these conditions to ensure that we can still know where our aircraft are with centimeter-level precision in those conditions, in those challenging solar flare times, as well as designing the system to have redundancy beyond GNSS such that if things get really bad, we can still safely operate. Alfred Lin: Eric, you’re in charge of safety. Tell us about what you’ve learned about safety today, and specifically about the compute failover system that you have. Eric Watson: Yeah. Yeah, absolutely. I mean, there’s so many things that we’ve learned over the last decade of operating the system in the real world. One of the things that we’re proud of is how we’ve developed, to your point, compute failover. So there’s a flight computer, flies the aircraft, lots of sensors come into this computer. And that basically does a lot of math and sends commands to actuators, right? So motors, control surfaces, these things. So this is the brain that flies the aircraft, right? One of the things that we’ve learned is you need to assume that any part of the system can have a fault, can have a hiccup, something can go wrong. Alfred Lin: Yep. Eric Watson: And that’s how you really design something to be robust, reliable and safe. So what do we do if this flight computer has a challenge? It could be a software challenge, it could be a connector challenge, could be these different things. Keller Rinaudo Cliffton: Bit flip due to solar radiation. Eric Watson: All kinds of things, right? And so what we’ve done is we have two flight computers, and both of these flight computers think that they’re flying the aircraft at any given point in time. They all are receiving all the information from the sensors, they’re all sending commands to the actuators, and there’s kind of a third arbiter, a little computer that is monitoring the health of those two and telling everyone, every other node on the aircraft, who to listen to, who’s actually in charge. Pat Grady: What if the arbiter fails? Eric Watson: Yeah, if the arbiter fails, then the primary computer that was flying just keeps flying, right? So one’s in charge, and if the thing that’s monitoring its health fails, then now we say, okay, now we’re just going to keep flying on the thing that was good. And we’re going to keep flying the mission. Alfred Lin: Two heads are better than one. [laughs] Eric Watson: Yeah, it’s something that we’re really proud of. We actually had one of these events happen a couple weeks ago. After a delivery, we delivered the package to the customer, and then we had a hiccup on the main flight computer, and we switched over to the backup. The aircraft flew itself home, landed, everything was totally fine. So just designing the systems to be robust and reliable through and through is how you get to 2.5 million deliveries and 140 million miles flown with no safety incidents. Keller Rinaudo Cliffton: And a lot of what Zipline’s doing, it’s not like, oh, this is totally revolutionary, no one has ever thought about having a secondary flight computer. That’s how a Boeing 777 works. But the cost of a flight computer on a Boeing 777 is in the millions of dollars. And so a lot of what Zipline’s having to do is take a lot of the best ideas that you can see in aerospace safety … Eric Watson: Best practices from aerospace. Keller Rinaudo Cliffton: … best practices. And then you’ve got to figure out how to build that using components coming out of the smartphone supply chain. Eric Watson: Yeah. Keller Rinaudo Cliffton: So you can do it for tens of dollars or hundreds of dollars, you can achieve similar levels of safety to traditional aerospace, but you can move 100 times as fast, at 1/100th of the cost. Eric Watson: Yeah. Alfred Lin: So you mentioned that the aircraft is only 15 percent. Describe the other 85 percent in layers, and maybe go down deep in some of your systems that are really, really sophisticated. Like, I know this because of being a board member, but like the detect and avoid systems. Keller Rinaudo Cliffton: HITL is a good example. HITL stands for Hardware-In-The-Loop simulation. Pat Grady: Okay. Eric Watson: Yeah. I mean, there’s … Keller Rinaudo Cliffton: Why do we test? [laughs] Eric Watson: Yeah, sure. Keller Rinaudo Cliffton: Because why can’t we just put it into the real world, Eric? Why doesn’t it work? [CROSSTALK] Keller Rinaudo Cliffton: I feel like if we were good at engineering … Eric Watson: Yeah, just get it right the first time, right? Keller Rinaudo Cliffton: Exactly. Eric Watson: I mean, people make mistakes, right? Especially when you’re integrating hundreds of people’s efforts in these complex systems, then oftentimes what we’re finding through testing is not what I would consider a person’s mistake. It’s like, oh wow, an interesting interaction, right? So how do we test? Why do we test? Really, the way I think about it is maybe first of all, we’re not a software company, right? We’re a real-world AI robotics company, and so there’s electromechanical systems out in the real world. So there’s hardware test aspects, there’s software test aspects, and there’s the integrated system test aspects. We have a lot of different environments that we test, a lot of different approaches. I’ll name a few of them. On the hardware side, we do a lot of component-level testing, HALT testing—highly accelerated lifetime testing—where we’re taking components—maybe it’s a motor, these kinds of things—and we’re putting them through hell, right? We’re putting them through all kinds of challenging conditions, making it rain, making it hot, making it humid, making it corrosive, all of these things while we’re exercising, while we’re spinning the motor, while we’re moving things, all of the things, right? UV, you name it. Keller Rinaudo Cliffton: And just to give a context for scale, I mean, there are 700 unique components on the aircraft designed from scratch by Zipline. We are designing not just the flight computer from scratch, the power distribution board, the motor controllers, the battery, the battery management system. The pod is the smaller robot that we’re using to actually make deliveries to people’s homes. There’s an entire NVIDIA GPU-powered flight computer on the pod. We’re building the electronics that go into the docking station where the Zip is flying in and out of. All of that, even the electric motor being designed from scratch by Zipline, because we need a thrust-to-weight ratio that is not available in off-the-shelf electric motors. So you have to design something from scratch. So 700 unique components, 43 major sub-assemblies on the aircraft, all then coming together on the manufacturing line that you both have gotten to visit and getting assembled into one overall aircraft. But anyway, that’s the scope. So for each of those components … Eric Watson: Yeah, right. Going through this type of testing. And thinking about other industries, oftentimes when I talk to people from maybe automotive or aerospace and some of these, it’s like, hey, how do you think about reliability challenges? And a common answer is like, well, I asked the supplier what the reliability of the part is. Pat Grady: Yeah. Eric Watson: And I’m like, okay, cool. What if we’re the supplier, you know? Anyway, that vertical integration is a huge opportunity. Keller Rinaudo Cliffton: Also, how long does it take Boeing to do a software update? Eric Watson: Yeah, a lot longer than Zipline. Keller Rinaudo Cliffton: It’s about three years. Eric Watson: Okay. Yeah. Pat Grady: Wow! Eric Watson: And so anyway, so where we have component testing on the ground, we have system testing on the ground where we’re taking full aircraft as well as other parts of the system and putting them through vibration tables, wind tunnels, thermal chambers that you can walk into, all of these things, in order to understand is how is this gonna break, right? More than just is it good enough, like, we want to know how it’s gonna break and then we can understand, okay, cool. Let’s make it better. Or maybe it’s like, oh, that’s not too worrisome. Great. We didn’t break in any of the ways we’re worried about. It broke in that way. Fantastic. So we don’t just want to say we ran the test campaign and nothing failed, we’re done. It’s like, no, no, let’s take this thing to failure. Right? Let’s see where the limits are. Keller Rinaudo Cliffton: At 49 degrees Celsius, which is very hot. Eric Watson: Hot. Keller Rinaudo Cliffton: Down to negative 25 degrees Celsius, which is very cold. Eric Watson: All the things, yeah. Alfred Lin: You don’t fly anywhere at 49 degrees. Keller Rinaudo Cliffton: We do. Alfred Lin: You do? Keller Rinaudo Cliffton: We wouldn’t test at 49 if we’re not worried about … Alfred Lin: Where are you flying at 49? Keller Rinaudo Cliffton: I think Phoenix during the summer. Eric Watson: Phoenix during the summer, yeah. Alfred Lin: And then where’s -25? Eric Watson: It’s northern parts of the United States. Pat Grady: Actually, can I ask you guys how you think about that? Like, I could imagine a different version of the world where you guys are like, hey, look, if it’s too hot, we’re just not going to fly. Keller Rinaudo Cliffton: Totally. Pat Grady: And if it’s too cold, we’re just not going to fly. If it’s raining too hard, we’re just not going to fly. Eric Watson: Yeah. Pat Grady: And there are trade-offs to be made, and obviously your customers would prefer that you fly at all times. Eric Watson: That’s right. Pat Grady: But how do you think about those trade-offs? Keller Rinaudo Cliffton: The easiest way to think about the trade-off was because of the use cases that Zipline started with. Eric Watson: That’s right. Pat Grady: That makes sense. Keller Rinaudo Cliffton: Which was basically … Alfred Lin: Saving lives. Keller Rinaudo Cliffton: Yeah, you can count on us with your life and the lives of your loved ones—as long as the sun is shining. Alfred Lin: [laughs] [CROSSTALK] Pat Grady: So basically you developed the capability because you had to for the initial use case. Keller Rinaudo Cliffton: And Zipline would fly—and in fact, I mean, for the first couple years, we took a lot of risk. I mean, we would basically fly. We were like, look, if it’s a lifesaving delivery happening and there’s someone whose life is on the line, we’re gonna go for it. And we had a civil aviation authority that was generally a great partner with us on that front. We took a lot of risk. We learned a lot, and almost always it worked out in favor of, like, we saved the person’s life. And the worst thing that could happen was we had a paraland, which is the kind of Zipline safety mechanism of last resort is we can pull a parachute on the aircraft and bring it gently to the ground. Alfred Lin: How often does this happen? Keller Rinaudo Cliffton: It happened very often in the first few years. Very, very rare today. I mean, to put it into perspective, our original goal was to be 10 times safer than cars. Actually, Alfred was the one pushing in our last board meeting. He’s like, “That’s a BS goal. We need to be two times safer than Waymo.” And so Eric literally went and reset the goal. And now we’re like, the Zipline’s target for the end of this year is to be two times safer than Waymo. He’s like, “Cars? That’s like archaic technology.” Pat Grady: Waymo’s like, 14X or something? Keller Rinaudo Cliffton: Waymo, I think, is about 10x, right? They’re about 10x cars. Eric Watson: 10, 12. Keller Rinaudo Cliffton: So our goal is to be 2x safer than Waymo. Pat Grady: Yeah. Alfred Lin: It’s not the right comparison. You’re flying. You have to be safe in the air, not safe on the road. Keller Rinaudo Cliffton: I think it depends. We’re substituting something that’s typically going in cars, so it’s debatable. But suffice it to say, we now have 140 million commercial autonomous miles and zero safety incidents. Alfred Lin: Zero. Keller Rinaudo Cliffton: If you were to drive 140 million miles, you would have 600 accidents, 100 injuries and somewhere between two and six fatalities, depending on what country you’re talking about. And this is why we really pride ourselves on picking the right use cases. It’s life-saving, and it really makes a lot of sense to go do it. And also, we’re going to be—by God, we’re going to be as safe as humanly possible from an engineering and testing and validation perspective. We really take that—that’s a deep part of the DNA of the company. One last point, you know, what is the outcome of all of that testing that Eric is talking about? The outcome of all that testing is we have individual aircraft in the commercial fleet that have flown more than a million commercial autonomous miles. And so I think just from an intuition perspective, a lot of people look at this and they’re like, wow, it kind of seems maybe exquisite or fragile, probably very sensitive to extreme conditions or weather. I mean, raise your hand if you have a car that has a million miles on it. Pat Grady: It’s pretty impressive. Keller Rinaudo Cliffton: These systems are already way more rugged and durable and robust than people necessarily think. Pat Grady: Can I ask you about the precision? One of the things that blew my mind when I saw some of the—I haven’t had a chance to experience in person a delivery. Keller Rinaudo Cliffton: You gotta come, Pat. Pat Grady: I know, I gotta go experience it. But just in watching the videos, the drone’s 100 feet up, and it drops the package. It lowers the package to, I don’t know, a circle that’s got an 18-inch radius or whatever it is, right? How do you guys achieve such precision even when it’s windy, even when it’s raining? How do you pull that off? Eric Watson: First of all, the aircraft’s about 100 meters up. Pat Grady: 100 meters up? Okay. Yeah, there you go. Eric Watson: So it makes it harder. And there’s multiple layers. There’s the delivery pod that comes down. Pat Grady: Yeah. Eric Watson: Right? So the delivery pod comes down. That’s really the delivery and pickup precision part of it, right? So the drone is hovering above. It knows where the target is. Maybe let’s say it’s this coffee table, for example, if there wasn’t a roof above us. So it’s this coffee table. And so the aircraft is going to hover above, but it actually needs to consider what the wind conditions are. Pat Grady: Yeah. Eric Watson: Right? So if the wind’s blowing in one direction, then the aircraft’s going to kind of be shifted upwind, right? So it’s going to shift in the direction to help with those wind conditions. And then it’s going to lower that delivery pod down. As Keller mentioned, we do take advantage of GNSS, so real-time kinematic GNSS. That gives you centimeter-level confidence of where you are. But the thing is we don’t know the GPS coordinates of this table, right? It’s not like someone came and surveyed the middle of the table and sent us the coordinates, right? No one wants to do that. So what we have to do is we kind of—that we use that to kind of get close, right? We’re like, okay, here’s the backyard, here’s where we kind of know things roughly are. And then the job of this delivery pod is to be lowered down, fight the wind conditions, fight these different things, and be able to use its onboard perception and autonomy systems to identify where’s the best place for me to leave the package. If there’s a little table and there’s a whole bunch of drinks, probably I shouldn’t try and drop down on top of these drinks and make a mess. Maybe I should go to the ground right next to the table, right? And so it has these autonomous onboard real-time compute to be able to identify what am I looking at, what am I seeing, and how can I find the best place to leave the package? And then come down, touch the ground, opens its doors, gets retracted back up, and there you go. The package is left on the ground and the delivery pod comes back up, stows, and the aircraft flies back home. Keller Rinaudo Cliffton: A couple big advantages. I mean, just to be specific, so that pod, it not only has its own NVIDIA GPU running its own AI autonomy stack, so it can survey and know exactly where it’s delivering even at night, but it’s also controlling its own position in the X and Y axis. So it can not just know, but then move. And the advantage of that architecture, which you can probably guess, but there are two huge advantages of doing it in this way. One is it’s quiet. People have this perception of—I mean, first of all, most drones are really freaking annoying. Like, the sound is just—it’s basically the most grating, annoying sound that you could possibly subject a human to. And so Zipline has a big team of aerodynamics, aeroacoustics and controls experts. Every part of the vehicle is designed with sound in mind for the vehicle to be as quiet as humanly possible. We want it to be no louder than the sound of, like, gentle leaves moving in trees. And when the pod is delivering, we’re keeping the main aircraft 100 meters in the air. Pat Grady: Yeah. Keller Rinaudo Cliffton: So it’s like the thing that is creating noise is really far away. That’s also a huge benefit from a safety perspective, because the only thing that is coming anywhere close to you, your family, your pets, your kids is something that is super cute and safe. Pat Grady: [laughs] Keller Rinaudo Cliffton: And it’s really like a Styrofoam—kind of like a cute anthropomorphic Styrofoam … Pat Grady: Tub? Keller Rinaudo Cliffton: Tub. Pat Grady: [laughs] Yeah. Alfred Lin: How long was the technology tested outside the United States before you came to the United States? And what was the path to getting into the US? Now that you’re flying in Dallas and delivering packages there? Keller Rinaudo Cliffton: We spent eight years, I think, right? About eight years. I mean, depending how you measure it, maybe, like, six to eight years. And then it was—I mean, we launched in Rwanda in 2016, our commercial service, and we really launched this kind of next generation home delivery service, the thing that’s now in insane hyperscaling mode, that only launched January of last year. So depending on how you measured it, you could even say it was like almost nine years. Alfred Lin: And then when you got to the US, was it just smooth sailing? What was the sort of regulatory path that you had to go through? Eric Watson: Yeah, I mean, we really started, I would say, meaningfully engaging with US FAA and other regulators in the US around 2020 or so. So we didn’t show up in 2025 and everything was smooth sailing. It was really a partnership of working through, as you mentioned, in kind of 2016, a lot of this stuff was—there was no pathways, it was kind of illegal, as we joked earlier. And so yeah, it really was a partnership to identify hey, we have shared goals, right? Our shared goals are safe and efficient airspace integration. And so while we have experience doing that successfully in different countries, we can bring some of that experience in. We have opinions on how this should work. The regulators had opinions on maybe how they thought it should work. And so it was a partnership over the course of a couple of years to identify what those paths looked like and how we could converge and align before we were able to execute on that. Alfred Lin: And you had to show your ability to manage all these aircraft that are flying. So you wrote systems, you built systems. Eric Watson: Yeah, I think it’s a huge part of—you know, Keller’s mentioning that the drone is only a part of the overall system, the overall complexity. What we’re really building is an infrastructure layer, right? We’re building an infrastructure layer that can enable instant access to products. And you don’t do that with one aircraft flying from one place to another place. You do that with a network of charging locations, hundreds of aircraft spread across an area with the autonomous systems in the cloud that can understand where am I having demand, where do I have supply, where do I have aircraft, what’s coming up, is it about to be the dinner rush, what’s the weather at these different locations, how can I kind of self-balance these things, as well as how do I efficiently pull in people when needed, right? So these aircraft are autonomous, they’re operating, they don’t require human intervention through these flights, but there are times in which it makes sense to alert a person that hey, maybe there’s an issue here, or the weather is a little bit—the wind is climbing in this area, right? So there are humans, trained aviation professionals that are monitoring our network, I would call it. Alfred Lin: They’re fleet commanders. Eric Watson: Fleet commanders, that’s right. Keller Rinaudo Cliffton: We used to call them pilots, because when we originally launched in the US, the first regulatory permission we got was to fly one-to-one. So that meant that we had one pilot sitting in an office. Eric Watson: Remote pilot in command. Keller Rinaudo Cliffton: Remote pilot in command who was sitting in an office basically just observing an aircraft do its thing. And again, it’s exceedingly rare that a human should ever have to issue any kind of a command to a vehicle, but we would have one human watching one aircraft. Not great for unit economics. But as Zipline proved out these systems, we went from 1 to 1 to 1 to 3, 1 to 6, 1 to 20, 1 to 40. We’re now operating 1 to 100 and have plans to go well beyond that. Alfred Lin: One pilot manning … Keller Rinaudo Cliffton: Well, one fleet commander now. So yeah, we technically changed the name because we think “pilot” is confusing. So we’re inspired by Ender’s Game. We now call this team of people at Zipline, we call them “fleet commanders.” And it actually says that in the FAA documentation. We say “Fleet commanders shall do the following.” And yeah, they are overseeing a group of 100 aircraft. And to me, this is the exciting, cool thing about technology, because people think about well, what about how humans used to solve this problem? It’s cool how robots enable humans to uplevel, right? Like, the human is still getting to strategically manage the system. It’s just the human is now maintaining and commanding robots rather than doing the actual work herself. Pat Grady: Now that you guys are kind of in hyperscale mode, you’ve solved so many problems in the last 10 or 15 years, what new problems are you running into? Eric Watson: Yeah. I mean, what I would say thematically, I mentioned earlier that getting to 2.5 million deliveries, the, “Oh, it only happens every couple years,” “It’s kind of a one in a million chances,” these things start to matter, right? We’re on the path towards a million deliveries every day. And if you have a one in a million situation, it’s going to happen every single day. Keller Rinaudo Cliffton: Yeah. Can I just—to really make that clear. So it took Zipline from 2014, when we started building the original version of the technology, to 2024 to do our first million deliveries. Was it the end of 2024? Maybe it was even early 2025 actually that we had done a million deliveries in the cumulative history of the company. Pat Grady: Yeah. Keller Rinaudo Cliffton: So it was almost a decade, maybe say about a decade to do a million deliveries. Zipline is now in the very near future going to be doing a million deliveries a day. And so that is definitely humbling. It’s like, wow! Okay, everything about the way we’ve been solving the problem is going to break. The bar goes way, way up. Eric Watson: Yeah. Keller Rinaudo Cliffton: And I mean, one specific example: maintenance becomes really hard. The scale of the problems, the number of vehicles that you’re managing in the fleet, the cost of a screw-up, or if a certain process is operating in very inefficient ways becomes extremely high. And so there’s just a high degree of criticality for all these systems. One interesting point, though, there are a lot of ways that these systems operate that I think people don’t yet appreciate the advantages of autonomy. One good example is that the system wants to operate 24/7. Pat Grady: Yeah. Keller Rinaudo Cliffton: And it does operate 24/7. So I think people are used to logistics as generally being like, well, here are the hours when humans are driving trucks. That’s not how these systems operate. They want to operate 24/7. They can be fully utilized. They can be as happily delivering at 2:00 am and 3:00 am, delivering something so it’s, like, ready for you on your doorstep or in your backyard when you wake up at 6:00 am before you go to work, as they are delivering at 2:00 pm. They can deliver in five minutes. They are available 100 percent of the time. We are soon gonna be flying vehicles straight out of our factory in South San Francisco into commercial operation. If you’ve seen Tesla Model 3s and Model Ys delivering themselves to customers … Pat Grady: Yeah. Keller Rinaudo Cliffton: … Zipline aircraft will fly straight from the factory into operation. It’s a huge advantage from a maintenance perspective, that as soon as a vehicle needs to go through some kind of proactive maintenance, it will fly itself to the maintenance depot. So the human can then quickly do whatever process necessary, and then the vehicle flies itself back into operations. We can also dynamically assign capacity in a metro based on what the system is seeing. There’s no set home for a vehicle. It can go to wherever it’s needed. Eric Watson: Yeah, I think to your question about getting to a million a day and what are the new challenges? I think Keller hit on some of them. To the previous thought about the drone is only 15 percent of the problem, really it’s the way that we currently manufacture aircraft, maintain aircraft, support all these things, troubleshoot problems. Like, the way that we do it today isn’t going to work when we’re at a million deliveries a day. And so okay, we need better tools, we need better software systems, we need better processes, we need better all these things. So it’s like Elon talks about designing the machine that builds the machine. And so this is really one of the things that I see Zipline tackling over the coming couple years is we are going to be investing much more in the machines that build and run the machines. Pat Grady: Hmm. Keller Rinaudo Cliffton: I mean, from a scale perspective, I think the largest airline in the US is doing about 5,000 flights a day. Pat Grady: Yeah. Keller Rinaudo Cliffton: Zipline is going to surpass that in the next month. And when we get to a million deliveries a day, Zipline will be doing somewhere between, I don’t know, 40 and 80 times as many flights in the US in commercial airspace as all other airlines combined. Pat Grady: Yeah. Keller Rinaudo Cliffton: And so it’s obviously a different class—it’s a completely different class of aircraft. It’s a totally different kind of problem, but the reality is when you look at air traffic control, they don’t make a distinction. And so there’s also, when you talk about all the auxiliary systems that have to be built, there is a huge transformation that’s going to have to happen in air traffic control as we start to realize that—you know, people are really excited about electrification of vehicles, people are excited about autonomous vehicles. The reality is, as those transformations occur, there are going to be 10 times as many autonomous vehicles in the air as there are using these teeny, archaic, constrained things that we call “roads.” And so the sky is a big place. It makes sense to utilize it. You can give Earth back to humans. You can make neighborhoods quieter, safer, less pollution, less traffic. You can make huge improvements to Earth if we can more effectively utilize the sky. This is going to require a huge transformation of how we think about air traffic control in the US. And it means that we need to design it with AI and autonomy in mind rather than the way it was designed, which was in 1950 using pencils and paper and note cards and a human looking out trying to watch the airplane. Alfred Lin: Are you helping the FAA design that? Eric Watson: Yeah. I mean, what needs to happen is collaborative innovation is one way to put it, right? It’s like one company solving this problem for themselves is not going to solve the problem for the industry. And so we are heavily involved in—I mean, first of all, a key part of the solution, we believe, is aircraft should be talking to each other. They should be telling each other where they are. They should be automatically detecting that hey, there’s a conflict on the horizon here. And so therefore, we’re going to—you go up, I go down, right? These kinds of things. And our aircraft do that. And we’re working with other kind of new entrants into the airspace with autonomous aircraft and autonomous drones to do the same thing, to make sure that our systems can talk to their systems and we can all collaborate to make sure it’s efficient and safe usage of the airspace. Pat Grady: Yeah. Eric Watson: We’re also, to your point, Alfred, working with regulators, working with standards bodies to take some of these best practices and innovations that we and others have developed and try and make them broadly accepted and utilized so that we can all collaborate and we can all safely and efficiently use the airspace. Alfred Lin: Because you guys have developed a really successful way to tackle some of those issues. Keller Rinaudo Cliffton: Yeah, because when we were launching in all these other countries, we had to build something from scratch. And so we built the thing from scratch. We provided all this software to the civil aviation authorities so that they could use it to monitor this entirely new class of autonomous vehicles in the airspace. Interestingly, there are multiple public companies in the United States that build air traffic control software that are worth more than $10 billion. So it’s like, I often look at that—I mean, I think there are many companies inside Zipline that are likely, if it’s like, oh, that’s a public company inside Zipline, it’s just having to get built from scratch. We’re building it because every part of the ecosystem we sort of had to build from scratch to enable the overall technology to flourish. Air traffic control is an interesting—like, the more you learn, the more disturbing it is. I mean, we’re starting to see the impact. You read about a plane crashing into a helicopter in DC a few months ago. You read about two planes colliding, I think, on a taxiway in an airport—I don’t remember where that was—a month ago. You’re like, wow, why are all these accidents happening? Turns out 50 percent of air traffic controllers are over the age of 45. 20 percent are about to retire, and nobody is going into air traffic control as a career path right now in the US. And so there’s actually a huge labor crisis around these kinds of jobs. And so you have pressure coming from different angles where, like, transformation is required. We cannot use a system that was designed for airspace in the 1950s. The labor isn’t available to do it even if we wanted to. And also, there is this giant influx of new technology—AI and autonomous vehicles—that are going to require us to transform how these systems work. Alfred Lin: So you’re a hardware company and a software company. You build, you design your own parts. Keller Rinaudo Cliffton: Operations, manufacturing. Alfred Lin: You design your own parts, you build your own aircraft, you write your own software, you do your own operations. It’s a pretty vertically integrated company. Talk about the benefits of complete vertical integration versus buying component parts or buying component software and putting it all together. Pat Grady: And how you get people who come from such different disciplines and domains to see eye to eye and work together collaboratively. Keller Rinaudo Cliffton: Yeah. I mean, I think that interestingly, doing it is such an incredible pain in the butt that you would never do it. I have this flag over my desk that says, “We do this not because it is easy, but because we thought that it would be easy.” Pat Grady: [laughs] Keller Rinaudo Cliffton: And this is definitely the definition of Zipline, you know? And it’s such a pain in the butt actually that it’s almost, if you look at the history of all these hardware companies, they all try to not do it first. You can look at the Roadster, right? They’re like, we’re going to use a Lotus Elise chassis. We’re going to buy the battery pack from a secondary supplier, and we’re just going to put the two together and it’s going to be awesome. Roadster lost a lot of money and wasn’t very reliable, right? But it was an important part of getting to the Model S. Zipline, when we started, Eric knows well, we were buying everything from suppliers. We were paying people to design different parts of the system for us or trying to buy off-the-shelf stuff. And we crashed airplanes at test sites. And we just crashed and we crashed and we realized, wow, this stuff is super expensive and it’s also totally unreliable. And so part by part, you’re like, all right, well, rip that out. We’ll design the motor controller from scratch. Okay, rip that out. We’re going to have to design the GPS module from scratch. Eric Watson: Navigation system. Keller Rinaudo Cliffton: Navigation system. So part by part, you sort of rip it out. And I think there’s a fundamental realization, probably similar to the realization that happened that made the Model S possible, is like, hey, if we want to build a really great specific product in this totally new area of technology, we are going to have to design every single one of these components from scratch to meet the specific requirements of this new area. You might think, oh, drones. I mean, there are already lots of drones because DJI makes plastic quadcopters and they make millions of them, and the US buys $20 million Predator aircraft that can fly a hundred miles. The reality is actually both of these systems are very unreliable, and nothing is in a level of reliability and safety at unit economics that would work for this new industry that Zipline was trying to pioneer. And so we realized we had to go build, like, an automotive-grade solution. It has to be super reliable, and it has to be extremely cost-effective, because you’re competing against cars and motorcycles, which are actually really cost-effective. I mean, we’ve had a hundred years to make them reliable and cheap. So you never do it, I think, intentionally. You just slowly freak out, and through desperation realize, like, wow, we got to tear all this shit out, and we got to build it all from scratch. The advantage of doing it from scratch is speed and integration. And so our offices—you guys know because you’ve been, but when you visit Zipline’s offices, I mean, we are all absolutely packed like sardines into this small building where you have firmware engineers sitting next to mechanical engineers sitting next to autonomy engineers sitting next to cloud infra sitting next to aero, aeroacoustics, guidance navigation controls, systems engineering, manufacturing, everything, all everywhere in one place. And then our factory is a three-minute drive away. And so our team is on the factory floor working, seeing parts get integrated into the overall system. And then we have our test sites, which are just a short drive away. So you can go to the test sites, watch the vehicles flying, observe how the system is performing. Combining all these things together means that stuff is always breaking, stuff’s always going wrong, as Eric described. The advantage is when the thing goes wrong, we can basically go straight to the person’s desk and be like, you and I are pulling an all-nighter tonight. Pat Grady: Hmm. Keller Rinaudo Cliffton: Whereas if you’re Boeing and something’s going wrong with the battery on the 787, you’re going and suing a supplier and taking two years to try to figure out whose fault it is. And it’s three layers deep in the rat’s nest cluster of how these procurement deals and supply chains work for aerospace. This is why it’s so broken. Eric Watson: Yeah. I think, Pat, to your kind of question there about getting these different discipline folks to work together, I honestly think it’s quite easy. It’s easy when you have set up the way that Keller just mentioned, right? First of all, everyone’s rowing in the same direction. We all have the same goals. And when you can ground it in reality and it’s tangible, then we’re all just here to solve the same problems, right? Pat Grady: Yeah. Eric Watson: So we actually, with the vertical integration, with having a very diverse team, we actually cut through a lot of the stuff, a lot of the things that happen where oh, that engineer won’t tell me what the actual source code does because they said it’s IP. And so we don’t actually know what the fault detection looks like. And you don’t have any of that. You just literally go walk over, sit next to the person’s desk and be like, “Hey, we failed that test. Tell me about how this part of the system works. Oh, cool. Pull up the code. Great, let’s look through it. Oh, interesting. You’re making that assumption. That’s not how I designed it. Cool. Let’s get to the bottom of it.” And so this idea of just rapid collaboration where the manufacturing team, the operations team, the engineering team are all just really together is the way to solve these problems. And I have found that it’s actually not that hard. When you have those ingredients, it actually makes it pretty fast and efficient. Keller Rinaudo Cliffton: And two, Eric saying that, it really makes you realize when you build these, like, complex AI and robotic systems that combine hardware and software, you really appreciate the deep religious truth of how dumb requirements usually are. Question every requirement, which is the number one part of Elon’s algorithm they talk about at SpaceX. Question every requirement is so profoundly and deeply true. You must have every team question every requirement. The requirement is always stupid. And you’re like, you go to this team, that team, often you have to dig two levels deep to realize this is—but questioning every requirement is a fundamental part of getting through this. And then, the other thing is delete the part. The most reliable part on an aircraft is the part that is not on the aircraft at all because you deleted it in the last design. That part will never fail. And you take a lot of inspiration from looking at the Raptor 1, Raptor 2, Raptor 3. I’m sure you’ve seen those engines next to each other. Pat Grady: Yeah. Keller Rinaudo Cliffton: And actually a lot of people who come to the factory now and get to see, like, the EV3 aircraft, you can see the EV2 aircraft, the EV1 aircraft, plus the 10 different hardware versions that we built on the first version of Zipline’s technology. You would just delete, delete, delete. There’s a huge amount of—it’s really hard to delete things. Pat Grady: Yeah. Keller Rinaudo Cliffton: It’s an act of courage. No one wants to delete the thing. You look like an idiot if you delete the thing and then the system can’t perform or doesn’t work because you deleted the thing. But true confidence in the physics and the performance of the system enables you to start deleting things. It’s a big advantage of having, like, full stack integrated control of all of these systems. It makes it possible to question every requirement. It makes it possible to delete parts. Eric Watson: Yeah, I think first principles thinking is a huge part of that. I remember the Platform One aircraft, early days it had a deployable tailhook is how it landed. So it had this big hook, it’s like a meter long, that would come down from the aircraft, and we had a line that would catch that and slow the airplane down. It was this kind of complicated contraption. And we had this idea that we should be able to move that complexity to the ground systems. Pat Grady: Yeah. Eric Watson: And have the recovery system, the landing system, more like an aircraft carrier, grab the airplane, right? We can put the actuation on basically a robot that goes up and grabs the airplane. And we’re like, man, that’s gonna make the aircraft so much simpler, so much lighter, so much more reliable. We didn’t have it working yet, and it was time to build that next generation of the aircraft. And we’re like, so we’re building these next week. Do we build them with the meter-long tailhook, or do we delete the tailhook and put the two-centimeter-long tailhook on the back and bet that we can get this thing working? We got in a room, and we’re like, delete it, right? Let’s do this thing. And so, like, from first principles, it should work. We can make it work. We haven’t done it yet, but we can do it. And the next couple weeks looked like—myself included—a lot of people pulling a lot of late nights getting that thing working. And sure enough, those first aircraft came and we caught them and landed them. So it’s a lot of courage, but really being grounded in first principles thinking with a tight integrated team is how you do that. Pat Grady: Is there a version of the future in which instead of delivering life-saving medicine and cheeseburgers, you’re delivering human beings? Eric Watson: [laughs] Alfred Lin: Uh-oh. Hey, I’m the board member that has to control their costs. Keller Rinaudo Cliffton: [laughs] Pat Grady: I mean, you know, safe, reliable, battle-tested. I don’t know. Seems like if we’re going to liberate ourselves from the tyranny of streets, it’s a pretty decent solution. Keller Rinaudo Cliffton: Gosh, I think I agree with you. I think that … Alfred Lin: He’s going to come to you and ask for another billion dollars. Eric Watson: [laughs] Keller Rinaudo Cliffton: I think, you know, a couple of thoughts. One is that I think Alfred knows I’m measured in the way I answer that question, because to be clear, building a new infrastructure layer for the planet that can deliver packages as efficiently as the internet moves information is going to be one of the biggest companies on Earth. Like, it’s a huge opportunity, and we definitely want to stay humble and paranoid about how super hard that’s going to be, the level of execution for us to scale the way we want to scale over the next couple years. And to put into perspective, I described this goal of getting to a million deliveries a day in the very near future. We now have many partners who are each asking to buy a million deliveries a day of capacity from Zipline in the last few months. And so our operating plan has now become our unit of sale. That’s a pretty crazy realization. And it’s leading us—we had originally built the—we had sized the entire factory to build 20,000 aircraft a year. That was about what was required for a million deliveries a day. All of this is kind of being thrown—we’re realizing the market is way bigger. And one thing, when you look at this totally hyperbolic curve that I think I showed you only a few months ago of what our total daily flight volumes have done over the last 16 months, the level of complexity of all the different systems that are required to basically stay on that track is quite high. Pat Grady: Yeah. Keller Rinaudo Cliffton: But there are 5.5 billion instant deliveries being done by humans in the United States every year, and we’re using a 4,000-pound gas combustion vehicle. Alfred Lin: It’s not really instant. It’s like half an hour to an hour. Keller Rinaudo Cliffton: Exactly. It’s good marketing that it’s called instant, but yeah, exactly, 30 minutes, 45 minutes, an hour. A significant percentage of the drivers report eating some of the food that they’ve delivered in the last month, like, more than 50 percent. There are significant safety concerns associated with these kinds of deliveries. But 5.5 billion instant deliveries, what we’re realizing when you look, Zipline is now at massive scale in Dallas and we’re now launching four more metros in the next four months. When you just look at Dallas, if you were to extend the buying behavior that we’re observing from Zipline customers in Dallas to the rest of the United States, there would be 55 billion instant deliveries happening, not 5. Pat Grady: Wow. Alfred Lin: 55 billion. Keller Rinaudo Cliffton: Yeah. There’s a huge market expansion. I think it’s similar to how people looked at Uber when they were launching in San Francisco, and they’re like, oh, even if Uber gets to be 33 percent of the taxi market in San Francisco, it’s only going to be a $15 billion company. And obviously what they missed is, like, Uber’s now 10 times the size of the taxi market. If you make something more convenient and less expensive and a better product experience, people are gonna consume a lot more of it. We are clearly seeing customer behavior where customers order every day rather than a couple times a month. I mean, I met a grandma the other day who’s ordered 350 times from Zipline in the last year. She’s 80 years old. Alfred Lin: Amazing. Keller Rinaudo Cliffton: Actually, nursing homes are big demand centers for Zipline. Pat Grady: It’s probably pretty fun if you’re in a nursing home. Keller Rinaudo Cliffton: It makes sense. And actually it’s funny, people perceive, I think, old people as maybe being not capable of using technology. They’re all living on their iPhones. They’re probably doom scrolling actually, which is maybe not a good thing, but they are very comfortable using Apple ID, Apple Pay, Face ID, Apple Pay, and just ordering and having it delivered directly to them. So there are definitely not enough humans in the United States to do 55 billion deliveries. Pat Grady: Yeah. Keller Rinaudo Cliffton: The only way we’re going to be able to serve this kind of demand is with automated systems. And there’s definitely not enough roads. When you look at traffic in most of our major cities, you’re like, oh, can we just maybe double the number of cars on the road so that we can do way more deliveries? It obviously doesn’t work. We actually need to be taking cars off the roads if we want to enable human growth and flourishing. And so I think this change is inevitable. Alfred Lin: So how many flights are you doing a day now and how many will you do in a month? Keller Rinaudo Cliffton: So Zipline is now doing almost 5,000 flights a day, and we’re anticipating exiting this year at above 30,000 flights a day. And our goal is to get to a million flights a day as fast as humanly possible, which we expect to achieve in the very near future. All of the supply chain manufacturing capacity decisions we’re making right now are designed not just to get us to a million deliveries a day, but also accelerate past that. The things that are interesting to think about on the unit economics front is like, whenever we meet hardware companies, and you always talk to them about how much do you think the system is going to cost? And they’re always like, it’s going to cost X. And you’re like, cool, it’s going to cost 10x, just so you know. When you build it, it’s going to cost 10x. Alfred Lin: That’s your advice to founders. Keller Rinaudo Cliffton: That’s my advice to founders is for hardware companies—because I try to be a good seed investor and pay it forward and stuff. And you’re always meeting these founders and they’re always like, it’s going to cost this much. I’m like, cool, just assume it’s going to cost 10 times that. Does it work? And what would you do if it cost 10 times that? And we’re speaking from experience. When we launched our system in 2016, we were charging $30 a delivery to deliver a blood transfusion over 80 to 100 miles. And that was cost comparable. And so that’s what we signed the contract for. And we thought that we were going to launch a system that cost about $30 a delivery. How much do you think it cost when we launched? Alfred Lin: $300. Keller Rinaudo Cliffton: Yeah, it cost $300 a delivery. And Alfred was surprisingly chill about it. And we were like, all right, we got work to do. And so the next year we got it to $120, and then the next year we got it to $75, then the next year we got it to $40, then we got it to $28, then we got it to $18. It’s now $12 for the long-range technology that we operate outside the US. Right now, what’s happening this summer is the fully burdened unit economics of these systems is just now in the process of falling below the cost of using cars to deliver things. And so I think it is a cool moment that I think most people don’t really realize. It’s happening quietly. Like, you’re not reading about this in the New York Times or whatever, but I think that this thing is happening in the next month or two that is going to have a big impact on the world and how the world looks and how most normal people even live their lives, because it is now more cost-effective to use a robot in logistics than it is to use a human. And that’s really good news for the environment. It’s really good news for neighborhoods that are going to get quieter and safer and less traffic, less pollution. And it’s really good news for customers, because you can get things way faster and more reliably and for less expensive. Our customers love—there are obviously so many cool things about the system that you can talk about and that you see customers taking advantage of, but no tip, exclamation point, exclamation point, exclamation point is a big—that’s probably the number one comment. I think that customers love not having to feel guilty, and being able to just have a system that they know how much it’s going to cost. Alfred Lin: Well, thank you, Keller and Eric, for being here with us. I thought you were going to say it takes longer than you thought, not 10x more than it costs. But anyway, that’s a great, great way to end. Keller Rinaudo Cliffton: It does also take a lot longer. I mean, I think, you know, the memo that Shaun wrote here at Sequoia a few years ago, I think, is deeply true. I don’t know if he’ll ever publish that publicly or if it’ll be allowed, but I do think, suffice it to say, there is an internal Sequoia memo that has had a big impact on me talking about, A) why hardware companies are going to be some of the most impactful companies for humanity’s progress over the coming decades; and B) why it’s super hard to get those companies off the ground and fundraise for them; and C) how investors should think about funding those kinds of. It’s interesting when you look at the world today to see, I mean, wow, how fast the world changes. Because think about it, we spent 10 years being the freaking black sheep hardware company? No, thank you. Let’s invest in SaaS. Let’s invest in margins. This is where the whole future was, and iPhone apps, blah, blah, blah. So I don’t know. I guess I feel like .. Alfred Lin: Now you’re cool. Keller Rinaudo Cliffton: Remember Bane in Batman? What does he say? “You adopted the darkness, I was born in it.” And we built a robotics company for 10 years before building a robotics company was a cool thing to do. But I do think that especially important for US competitiveness and just for our ability to build the future that we’d be really proud to hand to our kids and to our grandkids and to build the sci-fi version of the future that we were all promised, we got to get good at building stuff again. And we got to get good at building not just vehicles and hardware. We got to get good at building infrastructure. Like, we’re depending on the crumbling infrastructure that our grandparents built for us. I read the other day—you know, we just installed these anti-suicide nets on the Golden Gate Bridge. Have you guys heard about that project? It cost more to install those nets than it cost our grandparents to build that bridge. Pat Grady: I believe it. Keller Rinaudo Cliffton: So anyway, we get really excited, just we think the future, promising futures. We should be able to build infrastructure. We have to be interested in it, and I think people have to have the stomach for it, and we have to learn how to manufacture and run complex supply chains again, and we have to be bold and believe in sci-fi versions of the future if we’re going to build them. Pat Grady: Awesome. Alfred Lin: Let’s end it at that. Believe in the sci-fi future. Thank you guys for being with us. Eric Watson: Thank you. Thanks for having us. Keller Rinaudo Cliffton: Thank you for inviting us. <div class="framer-mcvrsd" id="

The largest commercial autonomous system on earth isn't a robotaxi fleet — it's Zipline, which has flown 140 million autonomous miles with zero safety incidents. Co-founder Keller Rinaudo Cliffton and Eric Watson, who leads systems engineering and safety, explain why the drone itself is only 15% of the solution. The rest spans inventory management, air traffic integration, and engineering systems such as a dual flight computer failover protocol that recently saved a delivery mid-flight. They trace Zipline's path from launching blood delivery in Rwanda in 2016 (when drone delivery was illegal in the US) to a 51% reduction in maternal mortality in that country, a $550 million commercial diplomacy partnership with the State Department, and a cost curve that fell from $300 per delivery to $12. Zipline is now racing toward a million deliveries a day, and a quiet inflection point when autonomous delivery becomes cheaper than sending a car.

Hosted by Alfred Lin and Pat Grady, Sequoia Capital

本集资源与出处