Begin with the mission. Prove the whole system works.

Your turn: name stakeholders, the system boundary, three nominal scenarios, and three off-nominal scenarios.

Coaching: stakeholders include patient/recipient, clinic staff, fleet operator, maintainer, owner, aviation and medical regulators, site owner, public, emergency services, cybersecurity, suppliers, and disposal partners. Put the vehicle, payload container, pad, operator station, fleet service, procedures, training, maintenance tools, and support data inside the product-system boundary; map weather, GNSS, communications carrier, airspace service, hospital systems, and people as externals.

ConOps: order → verify package → load and seal → preflight → authorize route → launch → navigate → detect and avoid → land on approved pad → authenticate recipient → release package → return/recharge → log and inspect. Off-nominal cases include link loss, GNSS degradation, unsafe landing pad, low energy, weather excursion, obstacle, recipient absent, and medical-package temperature alarm.

Your turn: propose functional and quality requirements, each with an acceptance criterion.

Coaching examples:

• The system shall transport a 2 kg payload over a 10 km reference mission within 25 minutes under the defined wind and temperature envelope.
• The containment subsystem shall keep the payload between its specified temperature limits for the complete mission plus a 30-minute recovery interval.
• After command-link loss, the vehicle shall continue an independently safe contingency plan without requiring remote commands.
• The system shall prevent release unless vehicle position, pad identity, and recipient authorization all satisfy policy.
• The operator shall be able to command hold, reroute to an approved site, or safe termination within the defined authority and latency constraints.
• Parent safety objective—derive, do not verify as one compound requirement: no credible single failure in baselined Hazard Analysis HA-001 may cause uncontrolled descent within the approved operating envelope. Derive one atomic requirement per failure class and mode, naming the required outcome (controlled flight or one specific safe state), detection assumption, transition time, envelope, and verification method; trace each child back to HA-001.

Define measurable availability, dispatch success, delivery success, containment, geofence, detect-and-avoid range, navigation accuracy, noise, turnaround, maintainability, cybersecurity, audit, RTO, and data retention targets. Mark every number as confirmed, assumed, derived, or allocated.

Your turn: draw the mission thread and state machine.

Coaching: decompose into manage mission, authenticate actors and payload, assess readiness, contain payload, generate route, sense environment, estimate state, avoid hazards, control motion, manage energy, communicate status, supervise fleet, recover from faults, maintain configuration, and preserve evidence. Define modes such as unpowered, maintenance, charging, standby, armed, takeoff, cruise, approach, landed, degraded, contingency return, alternate landing, and emergency termination.

For every transition, state guard condition, authority, timeout, entry action, feedback, and safe fallback. This prevents nominal flight logic from being mistaken for a whole-system architecture.

Your turn: allocate the critical functions and explain independence boundaries.

Coaching architecture: the air vehicle includes structure, propulsion, battery and power distribution, flight-control computer, independent safety monitor, GNSS/IMU/barometer, detect-and-avoid sensors, communications, payload lock and environment sensors, and flight recorder. Software includes estimation, guidance, control, perception, route/geofence policy, health management, secure update, and mission logging. Ground elements include charging/landing pad, package station, operator console, fleet scheduler, maintenance terminal, key management, maps, and evidence store.

Keep immediate stabilization and contingency behavior onboard. The cloud may optimize routes and fleet utilization but must not be required for millisecond control or safe response to link loss. Separate the independent monitor’s failure path from the primary controller where the safety argument depends on independence.

Your turn: identify five critical interfaces and sketch mass, energy, latency, and communication budgets.

Coaching: critical interfaces include battery–power distribution, flight computer–motor controllers, sensors–estimator, primary controller–safety monitor, vehicle–operator, vehicle–pad, container–vehicle, fleet service–airspace service, and maintainer–configuration system. Specify units, update rates, freshness, authority, timeout, degraded behavior, integrity, and versioning.

Illustrative energy budget: expected use is 570 Wh = 440 Wh cruise + 90 Wh takeoff/landing + 40 Wh avionics/payload. Add 70 Wh contingency consumption and 80 Wh analysis/growth allowance, giving a full consumption allowance of 720 Wh. Define C_u as deliverable energy from full charge to the operational cutoff at the baselined end-of-life state of health and minimum qualified battery temperature under the mission power profile; the reserve denominator is C_u, not beginning-of-life nameplate capacity. For a 20% acceptance lower bound and an illustrative 2-percentage-point combined BMS-estimator/test tolerance, design to an indicated 22% reserve: C_u ≥ 720 ÷ (1 − 0.22) = 923.1 Wh. At that minimum, 203.1 Wh remains, or 22% of C_u; subtracting the 2-point tolerance leaves the required 20% lower bound. Verify the configuration-controlled BMS remaining-energy estimate against calibrated voltage-and-current integration during the time-resolved mission profile. Select installed nameplate capacity so qualification evidence still provides at least 923.1 Wh usable at the declared age and temperature; do not apply the same ageing or temperature loss again as margin. Track maximum takeoff mass, center of gravity, peak motor power, thermal dissipation, control-loop deadline, sensor-to-actuator latency, link bandwidth, and maintenance time in the same owned way.

Your turn: compare onboard-only, cloud-assisted, and hybrid autonomy; then choose three top hazards.

Coaching: use safe operation without link, mission performance, energy, lifecycle cost, updateability, cybersecurity exposure, verification burden, and regulatory clarity as criteria. A hybrid can keep safety-critical control onboard while using ground services for fleet optimization, but it adds interfaces and configuration states. Confirm that the result remains stable as weights change.

Top hazards may include collision with people or aircraft, uncontrolled descent, delivery to an unauthorized person, battery thermal event, and loss of medical-package integrity. Apply elimination and architectural prevention before warning labels or operator procedures. Analyze propulsion loss, misleading navigation, corrupt commands, stale maps, common power loss, sensor obstruction, link loss, software timing failure, and maintenance error. Each mitigation needs an owner and verification evidence.

Your turn: build an integration sequence and choose evidence for the hardest requirements.

Coaching integration path: models and simulation → software-in-the-loop → processor-in-the-loop → sensor and actuator benches → propulsion and power rigs → hardware-in-the-loop flight-control bench → restrained vehicle tests → controlled field envelope expansion → operational pilot. Use interface simulators early and maintain representative faults, timing, environmental loads, and configuration.

Verification: inspect construction and configuration; analyze structures, reliability, energy, coverage, and thermal limits; test EMC, environment, endurance, braking/landing, navigation, containment, cybersecurity, fault injection, and recovery; demonstrate operator workflows. Validation: conduct representative clinic-to-site missions with actual users, workload, procedures, weather boundaries, package handling, maintenance, and off-nominal decisions. Measure mission effectiveness—not only component compliance.

Strong close: “I chose supervised hybrid autonomy: immediate safety, stabilization, navigation fallback, geofence, and contingency landing remain onboard; ground services schedule the fleet and optimize routes. The design isolates the safety monitor and preserves safe behavior after link loss. Energy reserve, misleading navigation, common power loss, public exposure, package integrity, and operator workload drive the architecture. I would next prototype the energy profile and degraded navigation, complete the safety analysis, close external interfaces with regulators and sites, and validate assumptions with clinic operators.”

State residual uncertainty: certified operating envelope, population and airspace exposure, detect-and-avoid performance, regulatory basis, communication coverage, battery ageing, environmental qualification, support staffing, and acceptable mission failure rate. Name what evidence resolves each one.