Making the safety case real

Ground risk and air risk are different cases. A parachute is not a universal answer. Argue procedure and aircraft design in separate columns.

Ground risk and air risk

Two risks dominate a delivery flight, and they are not removed by the same device. Ground risk is the harm if the aircraft, a piece of it, or the package strikes a person, a vehicle, or a critical site. It grows with the number of people, the time spent over them, the energy of the machine, and the chance that a failure is uncontrolled. Air risk is a collision with another aircraft, crewed or uncrewed. It grows near airports, along helicopter routes, and in any low corridor where visual traffic already flies. A parachute does nothing about a mid-air collision. A cooperative radio does little for the person in a garden if the aircraft still arrives there intact and fast.

The operation has to be described specifically enough to think about both risks. "We will fly in the city" is not a description. Altitude, speed, mass, who is under the route by time of day, what shelter exists, where the alternates are, and who else uses the airspace are the description. A mitigation that reduces exposure, such as routing over water or flying when a street is empty, is different from one that reduces the harm of an impact, and different again from one that makes the failure less likely. Adding a label to the aircraft and leaving the route unchanged has not done the work. Write the residual risk in plain words a non-engineer can argue with.

Fail-safe, and why a parachute is not enough

A fail-safe is a defined behaviour for a defined failure, and it has been tested. Loss of propulsion, loss of navigation, loss of the command link, a battery fault, and a runaway control input do not all want the same response. One should end in an immediate landing in a field that was surveyed for that purpose. Another should end in a return. Another should end in a motor shutdown so a live aircraft does not walk across a roof. The wrong pre-programmed response is itself a hazard. The manual says who may override it, and when override is forbidden because the link is no longer telling the truth. Hope is not one of the modes.

A parachute is one way to end a flight. It is not a general shield, and the public record already shows why. Swiss Post's expert report on the Matternet operation describes two Zurich events in 2019. On 25 January a loss of GPS led the flight-termination system to deploy a parachute, and the aircraft descended into the lake. On 9 May the same class of system fired, the parachute cord tore, and the aircraft hit the ground uncontrolled close to children. The programme was suspended. A canopy can be cut by its own aircraft, can drift out of the intended patch, and takes steering away from the pilot once it is open. Energy, descent rate, and whatever is underneath still count.

Geofence, lost link, and flying over people

A geofence can keep a healthy, well-navigated aircraft inside a volume. It does not contain a machine that has lost its position, and it does not stop a parachute from leaving the polygon. Use it as a check that the planned route was loaded, and as a procedural barrier, not as proof that third parties are safe. Test the boundary behaviour. An aircraft that treats the fence as a line on the pilot's screen, and flies through it, does not have a fence. An aircraft that stops in the middle of a road because that is where the polygon ended has a fence and a new ground hazard. The polygon is part of the route design, not a sticker applied after the route was drawn.

Lost link needs a timed behaviour that matches the airspace you are actually in. Hovering over a junction until the battery fails is not the conservative choice. Returning to base through a helicopter approach is not conservative either. The timeout, the path, and the landing site are briefed before launch, in a form a pilot who was not at the sales meeting can fly. The decision to put the route over people is separate from all of these tools. It is a decision that the residual risk, on this aircraft, this day, and this density, is acceptable to the accountable manager. Tools that work only while the aircraft is already healthy are not a reason to accept the overflight. If the healthy case is all you have analysed, you have not analysed the failure.

The safety case: procedure apart from design

A safety case is an argument, with evidence, that the operation is safe enough for the approval being requested. A usable shape is ordinary. Describe the operation and its boundaries. Identify the hazards to people on the ground and to other aircraft. Show the mitigations, and say whether each one lives in the aircraft, in the procedure, or in the surroundings. State the risk that remains and name the person who accepts it. Attach the manual for normal, abnormal, and emergency work, plus training, currency, maintenance, configuration control, weather limits, cargo limits, and how incidents are reported. Evidence is test, analysis, and in-service history. A rendering of the aircraft is not evidence, and neither is a count of flights that excluded bad weather.

Keep aircraft design and operating procedure in separate columns, even when one company does both. Design claims, such as redundancy, a parachute, a termination system, or containment, have to be true of the aircraft as it is maintained, not only of the prototype in the application. Procedure claims, such as a clear pad, a trained receiver, a wind limit, and a person empowered to abort, have to be true on an ordinary shift, not only on the demonstration day when the manufacturer is watching. A strong aircraft does not repair a confused handoff at the hospital. A careful handoff does not repair an untested failure over a crowd. The approval should name both columns, and the audit should sample both. If only one was checked, say so.