showstack

The thing to unlearn

Nobody is flying a drone show

The intuition is that a drone show is a very large remote-control problem — that somewhere there is a computer sending steering commands to five hundred aircraft many times a second. It is not, and it could not be.

That design puts every aircraft's safety on one radio link. The link has finite bandwidth, variable latency, and it will occasionally drop. Multiply by hundreds of aircraft and the failure is not a wobble, it is a fleet with no instructions.

What actually happens is the opposite. Before launch, every aircraft is loaded with its own complete flight path — a list of positions, and usually colours, against time. Once airborne, each one flies its own file. The ground station arms, launches, monitors telemetry and can abort — but it does not steer. There is no per-aircraft steering to lose.

The first hard part

Knowing where you are, to centimetres — RTK

Ordinary GNSS is good to a few metres. That is fine for a car. It is nowhere near good enough for aircraft flying a couple of metres apart in a pattern the audience is reading as a picture.

RTK — real-time kinematic — closes the gap using a trick. Put a receiver on a point whose position has been surveyed and is therefore already known exactly. It computes its position from the satellites like any receiver, and gets an answer that is slightly wrong. Because it knows the truth, it knows the error — and the sources of that error (the state of the ionosphere, small discrepancies in satellite clocks and orbits) are very nearly identical for every receiver within a few kilometres.

So the base station broadcasts the correction, every aircraft applies it, and the shared error cancels. What is left is relative position accurate to centimetres. RTK also measures the phase of the carrier wave itself rather than only the coded signal, which is where the last of the precision comes from — and why the receiver reports a float solution while it is still resolving that phase ambiguity, and a fix once it has.

The correction link is a radio or, in a fixed venue, corrections pulled over the internet from a national network. Either way it matters more than it looks: aircraft that lose corrections fall back to metre-level accuracy, which for a formation is a fault, not a degradation.

The second hard part

Everyone agreeing what time it is

GNSS gives every receiver on earth the same time, to well under a microsecond. On a drone fleet that is not a side benefit — it is the coordination mechanism.

Each aircraft is executing an instruction of the form at t = 92.400, be at this point, and be this colour. Every aircraft is doing that independently, from its own file, using its own copy of the same time. There is no inter-drone communication and none is needed. A formation appears because several hundred independent aircraft each arrive at their own assigned point at the same instant.

This is the same principle as the timecode spine on the systems page, and the same principle behind PTP on an audio network. Distribute the time, not the instructions.

The third hard part

Making sure the plan cannot collide with itself

Most show drones cannot see each other. There is no radar, no sense-and-avoid between aircraft, and adding it to hundreds of small airframes would be its own hazard. Safety comes from somewhere else entirely: the choreography is proven collision-free before anything is armed.

The design software checks the full flight, timestep by timestep, for every pair of aircraft — minimum separation, maximum speed and acceleration, climb and descent rates, battery energy against flight duration, and the geofence the whole show must stay inside. A design that violates any of those does not fly; it goes back to the designer.

That is why a drone show cannot be improvised, retimed on the night, or "just held for a minute". The plan is the safety case.

When it does not go to plan

The failsafe ladder

Each aircraft carries rules for what to do when reality departs from the plan, and they escalate. The exact behaviour is a per-system, per-operator configuration — but the shape is consistent.

The other one

Pyro: the same idea, a different failure mode

A pyromusical is built the same way. A script lists cue addresses against times; a controller executes it while following the show's timecode. Nobody is pressing buttons on the beat.

The chain is short and each link is addressed. An initiator sits in the device; it is connected to a firing module that holds many separately addressed outputs; the modules sit on a bus back to the controller — a two-wire serial link in most wired systems, or a licensed, acknowledged radio link in wireless ones. The controller holds the script and the clock.

Before the show, the controller checks continuity on every cue: a tiny test current confirms each circuit is complete. That is how an operator knows a cue is connected, and it is why a pre-show check that reports a missing cue is worth more than any rehearsal.

The detail that surprises people

A firework is fired before you see it

A shell has to get up there. Between the moment it is fired and the moment it bursts there is a lift time, and it is not small — a large shell can take several seconds to reach its height.

So a designer does not program fire times. They program burst times, against the music, and the design software subtracts each item's known lift and delay to work out when the controller must actually fire it. Two shells that burst together on the same beat may have been fired seconds apart.

This is also why a pyromusical cannot be nudged live. By the time you can hear that a cue is early, it was fired several seconds ago.

The part that is not negotiable

Why arming is never on the show network

Everything above is a control-system problem. This is not.

The show network carries timecode, cue triggers and status. It is full of laptops, and laptops are full of software that can be wrong. The firing controller may sit on that network and take its timing from it. What it may not do is take permission from it.

Arming is physical and separate: a key, an arming supply on its own path, and in most operations a person holding an enable. Removing that permission takes the outputs dead no matter what any computer believes. The same logic governs an aerial display: the abort is an operator action on dedicated equipment, not a cue in a show file.

Putting it together

What a finale actually looks like underneath

A stadium finale with music, lighting, video, pyro and a drone fleet has no master controller in the sense people imagine. It has a master clock.

The house reference generates timecode. Playback, lighting, video and the firing controller all follow it, each executing its own list against the same running time. The drone fleet is launched by a single trigger at a known timecode and then free-runs on GNSS time — deliberately, because an airborne fleet must never be able to stall waiting for a network that has gone quiet.

Nothing is steering anything. Every element is reading time and executing a plan it already holds. That is what makes it look effortless, and it is also, precisely, what makes it safe.