What Happens in the Two Seconds After the Motors Stop

A multirotor does not glide. When a motor, an ESC, or a battery connection fails, the vehicle does not enter a descent, it enters a tumble, and it reaches terminal velocity in seconds. A 10 lb (4.5 kg) airframe falling from 200 ft hits at roughly 60 mph carrying several hundred foot-pounds of energy. That number is why every regulatory conversation about flying over people comes back to recovery systems.

A parachute recovery system detects loss of controlled flight, cuts motor power, and puts a canopy over the aircraft fast enough to matter. On any aircraft operating near people it is a design input from the first layout sketch, because it consumes 4 to 10 percent of gross weight and needs a clear ejection path straight up.

Detect, Launch, Deploy

Every system is three stages, each with independent failure modes.

  • Detection. An onboard IMU running its own attitude estimate watches for the signature of lost flight: pitch or roll past 60 to 90 degrees, vertical acceleration approaching free fall, or angular rates no commanded maneuver produces. Good logic fires in 100 to 300 ms and does not fire during an aggressive but intentional maneuver.
  • Launch. A coil spring is cheap, reusable, and slow. A compressed-gas cartridge is fast and repeatable. A pyrotechnic charge is fastest and gets the canopy clear of a spinning airframe, at the price of shipping and storage rules. Spring systems typically need 1.5 to 3 times the altitude of a ballistic unit on the same aircraft.
  • Deployment. Line stretch, then inflation. A slider or reefing line keeps opening shock survivable; without one a canopy inflating at 60 mph can generate 10 to 20 g and tear out its attachment points. The bridle attaches above the center of gravity so the aircraft hangs upright and the canopy does not foul an arm.

Motor cutoff belongs in the launch stage, not the descent, because spinning props under a canopy will find the lines. Wire it so the recovery system commands the cut rather than requesting it from the autopilot.

Minimum Deployment Altitude Is the Real Spec

Vendors quote canopy area and descent rate. The number that decides whether the system ever saves an aircraft is minimum safe deployment altitude: the lowest height at which detection, launch, line stretch, and inflation all complete before impact.

Add the stages honestly. Detection is 0.1 to 0.3 s, launch and line stretch 0.2 to 0.5 s, inflation 0.5 to 1.5 s, roughly 0.8 to 2.3 s total while the aircraft accelerates downward. That puts a realistic floor of 50 to 130 ft AGL for a small ballistic system, higher for spring-launched units. An operation that lives at 40 ft, such as close-in inspection, gets no protection from a parachute and needs a different safety argument.

Independence From the Flight Controller

The most common design mistake is hanging the recovery system off the autopilot. If the flight controller is what failed, or the battery it shares has disconnected, the parachute never fires. The system earns its weight only with its own IMU, its own microcontroller, and its own cell good for the full mission plus reserve.

The autopilot should still be able to command deployment and the pilot should still have a manual trigger, but both are additional paths, never the only one. That is the same separation-of-concerns argument governing any embedded safety function, and it shapes how you spec the main controller; see how to choose a drone flight controller.

The Regulatory Payoff: Operations Over People

Under FAA Part 107, routine flight over non-participants is restricted, and the categories that open it up are written in impact energy, not hardware. Category 2 caps transferred kinetic energy at 11 ft-lb and Category 3 at 25 ft-lb, and both forbid exposed rotating parts that can lacerate skin, which is why prop guards and a parachute arrive together.

Run the arithmetic before promising a customer anything. A 4 lb (1.8 kg) aircraft must descend slower than about 12 ft/s to stay inside 11 ft-lb of raw kinetic energy, needing roughly 30 sq ft of canopy, about 6 ft across. A 10 lb aircraft under the same limit needs a canopy so large it becomes a wind sail, which is why most Category 2 declarations sit on light airframes.

The rules do credit energy absorption, so deformable arms, crushable structure, and foam bumpers reduce transferred energy in the impact test even when raw kinetic energy is unchanged. Compliance runs against an accepted means of compliance, and for parachutes the practical standard is ASTM F3322, after which the manufacturer files a declaration for the aircraft-plus-parachute combination. The declaration covers the combination, so bolting a third-party chute onto your airframe inherits nobody else's paperwork. For teams also pursuing extended operations, this runs in parallel with the risk case in BVLOS drone operations.

Testing: Live Launches, Not Simulation

The ASTM regime is built around live deployments, on the order of 45 across the flight envelope, plus false-positive testing to prove the system does not fire during aggressive normal flight. Budget for that volume: each test consumes a cartridge, a repack, and often a damaged airframe.

Stage the campaign. Bench-fire the launcher into a net to measure exit velocity, drop-test from a crane to characterize inflation, then fly the airframe and cut power in the air, starting high and working down toward the claimed minimum. Log deployment altitude, time to full canopy, descent rate, and drift, and treat drift as a real output: a canopy that saves the aircraft and carries it 200 ft downwind into a highway has not solved the problem. The surrounding program looks like any other product's, as covered in reliability testing for a new product.

Weight, Cost, and Whether It Is Worth It

Commercial systems for a 5 to 25 lb aircraft run $1,200 to $6,000 per unit and add 0.5 to 3 lb. Integration engineering, mount and ejection-path design, wiring, and the test campaign typically add $30,000 to $120,000, a real line item against the numbers in what it costs to develop a drone.

The payoff is access to missions. Package delivery over suburban streets, event work, urban inspection, and public safety flights are all gated on operations over people, so the recovery system is not a safety tax but the thing that makes the business case legal. Teams building the aircraft in delivery drone development should treat it as part of the airframe. Teams under the weight limit in sub-250g drone design often find the energy math already works without one.

Get the Recovery System Into the Layout Early

Projects House integrates parachute recovery on new airframes: trigger logic, ejection-path and mount design, energy budget against the Category 2 and 3 limits, and the live-launch test plan. Send your airframe weight and target operation through our contact form.