Begin with the mission. Prove the whole system works.

Your turn: name stakeholders, the system boundary, three nominal scenarios, and three off-nominal scenarios.

Coaching: stakeholders include patient/recipient, clinic staff, fleet operator, maintainer, owner, aviation and medical regulators, site owner, public, emergency services, cybersecurity, suppliers, and disposal partners. Put the vehicle, payload container, pad, operator station, fleet service, procedures, training, maintenance tools, and support data inside the product-system boundary; map weather, GNSS, communications carrier, airspace service, hospital systems, and people as externals.

ConOps: order → verify package → load and seal → preflight → authorize route → launch → navigate → detect and avoid → land on approved pad → authenticate recipient → release package → return/recharge → log and inspect. Off-nominal cases include link loss, GNSS degradation, unsafe landing pad, low energy, weather excursion, obstacle, recipient absent, and medical-package temperature alarm.

Your turn: propose functional and quality requirements, each with an acceptance criterion.

Coaching examples:

• SYS-MISSION-010: in each controlled acceptance execution that satisfies the configuration-controlled REF-TEST-01 entry conditions, the system shall carry a 2.0 kg payload through REF-MISSION-01 and enter LANDED_SAFE within 25 minutes. This deterministic reference test demonstrates capability; derive a separate statistical service-success requirement from MOE-01 with an evaluation window, eligibility/exclusion rules, minimum sample, and confidence rule.
• SYS-PAYLOAD-011: under the declared environmental and door-open profile, the calibrated payload-chamber reference temperature shall remain from 2.0 °C through 8.0 °C throughout REF-MISSION-01 and the following 30-minute recovery interval.
• SYS-LINK-021: in an airborne mode, after 0.5 s without an authenticated command heartbeat, the vehicle shall declare COMMAND_LINK_LOST within 0.1 s.
• SYS-LINK-022: upon declaration of COMMAND_LINK_LOST, the vehicle shall enter the preflight-selected LINK_LOSS_CONTINGENCY mode within 0.4 s.
• SYS-LINK-023: if the recorded vehicle state satisfies contingency-entry envelope E-LL-01 when COMMAND_LINK_LOST is declared, the vehicle shall, without a remote command, remain inside the associated configuration-controlled contingency corridor and reach the preflight-assigned recovery-site approach gate within the maximum transit time specified for that entry-state bin in RPT-LL-01. Evaluate the entry condition once at declaration; later energy use cannot erase the obligation.
• SYS-LAND-024: after reaching that approach gate in LINK_LOSS_CONTINGENCY, the vehicle shall enter LANDED_SAFE without a remote command within 90 s, with touchdown position, vertical speed, attitude, and post-touchdown output state satisfying the separately configuration-controlled acceptance limits in LAND-ACC-01.
• SYS-RELEASE-025: the payload-release actuator enable shall remain deasserted unless the position, pad-identity, and recipient-authorization predicates all pass under the configuration-controlled release-policy version recorded for the mission.
• Operator-control parent capability—derive before baselining: keep operator tasks and authority in the ConOps, then write separate product-interface requirements for hold, reroute, and flight termination. Each child shall name authentication and authorization, applicable vehicle mode, acceptance/rejection feedback, command-to-response deadline, invalid-command behavior, and the hazard-analysis control that permits the action; do not verify the three commands as one requirement.
• Parent safety objective—derive, do not verify as one compound requirement: no credible single failure in baselined Hazard Analysis HA-001 may cause uncontrolled descent within the approved operating envelope. Derive one atomic requirement per failure class and mode, naming the required outcome (controlled flight or one specific safe state), detection assumption, transition time, envelope, and verification method; trace each child back to HA-001.

Define measurable availability, dispatch success, delivery success, containment, geofence, detect-and-avoid range, navigation accuracy, noise, turnaround, maintainability, cybersecurity, audit, RTO, and data retention targets. Mark every number as confirmed, assumed, derived, or allocated.

Your turn: draw the mission thread and state machine.

Coaching: decompose into manage mission, authenticate actors and payload, assess readiness, contain payload, generate route, sense environment, estimate state, avoid hazards, control motion, manage energy, communicate status, supervise fleet, recover from faults, maintain configuration, and preserve evidence. Define modes such as unpowered, maintenance, charging, standby, armed, takeoff, cruise, approach, landed, degraded, contingency return, alternate landing, and emergency termination.

For every transition, state guard condition, authority, timeout, entry action, feedback, and safe fallback. This prevents nominal flight logic from being mistaken for a whole-system architecture.

Your turn: allocate the critical functions and explain independence boundaries.

Coaching architecture: the air vehicle includes structure, propulsion, battery and power distribution, flight-control computer, independent safety monitor, GNSS/IMU/barometer, detect-and-avoid sensors, communications, payload lock and environment sensors, and flight recorder. Software includes estimation, guidance, control, perception, route/geofence policy, health management, secure update, and mission logging. Ground elements include charging/landing pad, package station, operator console, fleet scheduler, maintenance terminal, key management, maps, and evidence store.

Keep immediate stabilization and contingency behavior onboard. The cloud may optimize routes and fleet utilization but must not be required for millisecond control or safe response to link loss. Separate the independent monitor’s failure path from the primary controller where the safety argument depends on independence.

Your turn: identify five critical interfaces and sketch mass, energy, latency, and communication budgets.

Coaching: critical interfaces include battery–power distribution, flight computer–motor controllers, sensors–estimator, primary controller–safety monitor, vehicle–operator, vehicle–pad, container–vehicle, fleet service–airspace service, and maintainer–configuration system. Specify units, update rates, freshness, authority, timeout, degraded behavior, integrity, and versioning.

Illustrative energy budget for REF-MISSION-01: expected use is 570 Wh = 440 Wh cruise + 90 Wh takeoff/landing + 40 Wh avionics/payload. Add 70 Wh contingency consumption and 80 Wh analysis/growth allowance, giving a full consumption allowance of 720 Wh. Define C_u,ref as deliverable energy from the verified full-charge condition to the operational cutoff at the baselined end-of-life state of health and minimum qualified battery temperature under the mission power profile; it is the reserve denominator, not beginning-of-life nameplate capacity. The physical requirement is R_ref = E_{remaining,ref} ÷ C_u,ref ≥ 20%. Keep the illustrative two-percentage-point one-sided guard band in a separate decision rule: R_result − 2 percentage points ≥ 20%, so the corresponding result/design threshold is 22%. Using that conservative 22% threshold gives C_u,ref ≥ 720 ÷ (1 − 0.22) = 923.1 Wh. At that minimum, 203.1 Wh physically remains, or 22% of C_u,ref, leaving the two-point guard band above the 20% requirement. Over explicit integration limits, compute E_{discharged,ref} [Wh] = ∫_t₀^t_land V(t) × I_discharge(t) dt ÷ 3600 and E_{remaining,ref} = E_initial,ref − E_{discharged,ref}. Only for the verified full-charge entry condition may the worked test substitute E_initial,ref = C_u,ref. If charging or regeneration is possible, integrate signed net battery power instead and declare the sign convention. Validate the separately specified BMS R_indicated result against R_ref across the declared operating domain. Derive the guard band from capacity characterization, sensor calibration, timing, integration, estimator, environmental, repeatability, coverage, and false-accept-risk evidence. Select installed nameplate capacity so qualification still provides at least 923.1 Wh usable at the declared age and temperature; do not apply the same ageing or temperature loss again as margin. Track maximum takeoff mass, center of gravity, peak motor power, thermal dissipation, control-loop deadline, sensor-to-actuator latency, link bandwidth, and maintenance time in the same owned way.

Decision-rule context: NIST decision-rule definition ↗ and NASA measurement decision risk and guard-band guidance ↗.

Your turn: state the decision variables, domains, hard constraints, objectives, and uncertain scenarios for the autonomy and energy architecture. Generate alternatives, identify one infeasible option and one dominated option, then explain what evidence would distinguish two nondominated finalists.

Coaching: use battery-module count, autonomy placement, propulsion/safety architecture, recovery corridor, and cruise policy as variables. Treat the baselined link-loss response, payload/range, takeoff mass, usable-energy reserve, thermal and latency limits, geofence and noise limits, baselined cybersecurity requirements, regulatory limits, and certification-basis constraints as hard constraints—not soft preferences. Track certification effort or evidence burden separately as a lifecycle measure. Keep lifecycle cost and delivery MOE as separate objectives long enough to expose a Pareto set.

Cloud-only is infeasible if immediate safety depends on the unavailable link. A lower-cost candidate with narrow cold/ageing reserve and a higher-cost candidate with broader scenario margin are both finalists; the higher-cost concept is not dominated by the lower-cost concept only when that margin improves a declared objective, such as robust delivery MOE. It belongs to the evaluated nondominated set only when no other evaluated feasible candidate dominates it. A higher-cost candidate is dominated only when a specific feasible comparator is no worse on every modeled objective and strictly better on at least one. Do not declare a winner until you state stakeholder value, sensitivity, uncertainty, and the prototype or test with the highest decision value.

Trade-study handoff: compare only viable finalists. Define measurable criterion anchors or value functions, audit correlated criteria, test break-even weights and scenarios, then record the authority, rationale, residual uncertainty, and reopening trigger.

Your turn: choose three top hazards, trace credible causes, and show how their controls change the architecture or invalidate a finalist.

Coaching: top hazards may include collision with people or aircraft, uncontrolled descent, delivery to an unauthorized person, battery thermal event, and loss of medical-package integrity. Apply elimination and architectural prevention before warning labels or operator procedures.

Analyze propulsion loss, misleading navigation, corrupt commands, stale maps, common power loss, sensor obstruction, link loss, software timing failure, and maintenance error. Each mitigation needs an owner and verification evidence. Re-run feasibility, budgets, and the trade study when a safety control changes mass, power, latency, interfaces, cost, or operating constraints.

Your turn: build an integration sequence and choose evidence for the hardest requirements.

Coaching integration path: models and simulation → software-in-the-loop → processor-in-the-loop → sensor and actuator benches → propulsion and power rigs → hardware-in-the-loop flight-control bench → restrained vehicle tests → controlled field envelope expansion → operational pilot. Use interface simulators early and maintain representative faults, timing, environmental loads, and configuration.

Verification: inspect construction and configuration; analyze structures, reliability, energy, coverage, and thermal limits; test EMC, environment, endurance, braking/landing, navigation, containment, cybersecurity, fault injection, and recovery; demonstrate operator workflows. Validation: conduct representative clinic-to-site missions with actual users, workload, procedures, weather boundaries, package handling, maintenance, and off-nominal decisions. Measure mission effectiveness—not only component compliance.

Strong close: “I chose supervised hybrid autonomy: immediate safety, stabilization, navigation fallback, geofence, and contingency landing remain onboard; ground services schedule the fleet and optimize routes. The design isolates the safety monitor and preserves safe behavior after link loss. Energy reserve, misleading navigation, common power loss, public exposure, package integrity, and operator workload drive the architecture. Before acceptance I would close receiver readiness, training, manuals, facilities, spares, keys, support data, residual-risk authority, and the operational baseline. Field owners monitor mission outcomes, safety events, energy, availability, maintenance and configuration; controlled evidence reopens requirements and hazards. Retirement has an owner for grounding, migration, credential revocation, protected-data disposition, records, batteries, spares and disposal.”

State residual uncertainty: certified operating envelope, population and airspace exposure, detect-and-avoid performance, regulatory basis, communication coverage, battery ageing, environmental qualification, support staffing, and acceptable mission failure rate. Name what evidence resolves each one.