A 4 November 2026 account of Arizona State University students' work offers a useful point of entry. Students in ASU's Drone Show Design program created choreography for a 100-drone Mesa holiday performance held on 28 November 2025, while a specialist production company carried out the actual show. That is a retrospective case study, not a report of a new show flown this week. It separates the creative design role from the responsibility to produce and operate a safe fleet.
The distinction matters for RC builders, autopilot developers and event organizers. A convincing animation in a 3D editor says little by itself about the physical safety margin at the show site.
A fleet animation is a set of timed trajectories
A conventional autonomous mission may give one drone a sequence of waypoints and acceptance conditions. A light show demands simultaneous behavior from many aircraft. For each vehicle, the show specification needs its position as a function of time, its lighting state, and how it travels from the launch pad into the first formation and back again.
That is a more demanding contract than a sequence of static pictures. Two drones might be safely separated in successive formations and still cross paths between them. A trajectory optimizer has to examine the transitions as well as the poses the audience sees.
The open-source Skybrush Studio for Blender project illustrates this separation of concerns. Its repository describes a .skyc file containing the trajectories and light programs for all participating aircraft, to be previewed, validated, analyzed and executed with the wider show system. The file format's stated purpose is a time-based program, not merely a list of end-state formation coordinates.
A production design review therefore needs every vehicle's full flight path, velocity profile and takeoff/landing behavior. Reviewing only rendered keyframes misses the segments where proximity may become tightest.
Clock error is a position error
Even when two planned paths never intersect at exactly the same instant, differences in when aircraft execute them can reduce clearance. A vehicle moving at 3 m/s travels 0.3 m during a 100 ms timing error. That is an illustrative calculation, not a measured drone-show synchronization error. If another aircraft is on a nearby moving path, relative timing is a genuine part of the separation budget.
A show-control system must establish a common clock and define how each vehicle interprets the show's start time. It also needs to cope with a drone that boots late, reconnects after an interruption or reports an inconsistent clock. A fleet that begins at different moments is no longer executing the trajectory set that was checked for collisions.
The Skybrush Server architecture documents a dedicated server layer for communications and services including clocks, RTK correction sources and weather providers. Those are separate dependencies. A synchronized clock does not prove good positioning, and a valid RTK correction does not prove that a late vehicle started the correct trajectory.
Operational verification should therefore look at clock consistency, planned-versus-actual start times, and deviations measured along each vehicle's timeline. The fleet needs a defined response when one aircraft cannot meet its start conditions.
Distance between paths is not enough by itself
The nominal minimum separation between two computed paths is an idealized quantity. The actual aircraft occupy volumes, their positioning estimates have uncertainty, and control tracking becomes less exact in wind or during rapid acceleration. A technically defensible clearance limit needs room for those effects.
Consider a deliberately simplified example. Two routes have 5 m of nominal minimum separation. If one aircraft can deviate 1 m toward the other and its neighbor can independently deviate 1 m in the opposite direction, only 3 m remains before accounting for vehicle dimensions and any additional timing error. It would be wrong to present the nominal 5 m as the guaranteed in-flight clearance. The example is geometry, not a suggested regulatory or engineering threshold.
A real check needs to consider the entire swept flight path, including departures, climbs, inter-formation transfers and recovery. It should include the aircraft envelope, uncertainty in surveyed pad locations, position-estimation quality, guidance tracking error and worst credible wind. Not all errors are statistically independent: a GNSS disturbance can affect a large group at once.
The operator also has to protect people and structures below the show. Inter-drone separation is one layer, not the whole containment plan. The appropriate audience buffer, altitude, geofence and obstacle restrictions depend on the particular site, aircraft and aviation authorization.
The launch grid is part of the choreography
A designer may work in a local Cartesian coordinate system while the operator needs actual surveyed launch positions and airspace boundaries. That translation deserves the same rigor as the airborne paths.
If an entire group starts from an offset launch grid, its carefully checked relative geometry may remain intact while the whole show is displaced toward an audience, tree line or restricted area. A rotation error changes every intended bearing. An axis convention mismatch can mirror a formation even though the preview looks reasonable.
Each aircraft also needs an unambiguous identity: the intended trajectory must match the drone placed on its assigned pad. A swapped drone ID can produce an unsafe departure before the artistic portion begins. A sensible preflight process reconciles the physical ID, pad coordinate, battery, firmware and mission checksum against the manifest.
The ASU/Mesa case study describes the producer arranging the 2025 performance relative to the festival's stage and prominent Christmas tree. That is an audience-composition decision with engineering consequences: the same paths must also fit a legally usable volume and a controlled launch-and-recovery area. DRONELIFE's report describes the production arrangement but does not publish an independent safety audit or full trajectory dataset.
A radio link should not become a single point of uncontrolled motion
A light-show command link may handle synchronization, supervision, status and abort instructions. Its exact division of work with onboard trajectory execution depends on the flight stack and show system. It is unsafe to infer from a ground-control display that every vehicle has an unbroken command path.
A reliable system has explicit behavior for missed heartbeats, an aircraft that loses its position fix, low battery, unexpected drift, and a fleet-wide abort. The correct response will depend on the available landing area and the positions of neighboring drones. An immediate descent is not universally safer if it conflicts with another aircraft's recovery path; neither is an automatic return across the formation.
The Skybrush Server source is useful here because it separates the drone communication abstraction from the user-facing show software. It should not be mistaken for proof that any particular hardware/firmware combination has passed a fault-injection campaign. That depends on the implementation, test plan and configuration.
There is also a communications-security dimension. IEEE P1937.15 is an active draft project focused on secure and reliable ground-to-drone links for formation-flying light shows. Its public scope explicitly excludes GNSS positioning and mechanical or choreography safety. That boundary is instructive: protecting a command channel and proving physical separation are distinct assurance tasks. A draft standard is not a published certification for a specific show controller.
The United States has a specific multiple-aircraft constraint
For U.S. commercial small-UAS operations under Part 107, the FAA's waiver guidance identifies 14 CFR 107.35, operation of multiple small UAS by one remote pilot, as a rule that can require a waiver. A 100-aircraft formation is not authorized merely because all aircraft run automated trajectories.
Other permissions depend on the operation. The FAA's Part 107 commercial-operator guidance explains that some night operations are permitted without a waiver when applicable requirements are met. That is different from claiming that a light show has blanket night, over-people or airspace approval. Controlled-airspace authorization, lighting requirements, ground risk and any applicable waiver conditions must be evaluated separately.
The authorization is tied to an actual operating concept, crew, equipment and mitigation measures. A public event also needs coordination with the venue and local authorities. Rules elsewhere are different, so an FAA example cannot stand in for a European, Australian or other national approval.
For a technically curious newcomer, the most consequential distinction is between designing a trajectory and being authorized to fly it with a fleet. The former can be done in a computer lab. The latter requires a documented and approved operation where the local rules demand it.
Rehearse the failures that a rendering cannot show
A credible test plan exercises more than an ideal simulator playback. It must check what happens if a single aircraft fails before takeoff, if a launch is delayed, if correction data drops out, or if a vehicle can no longer follow its assigned trajectory. It should test recovery while other vehicles are still flying, because the fleet's behavior is coupled.
A useful acceptance record would retain the exact show file and software versions, physical flight manifest, surveyed launch-grid coordinates, weather limits, clock checks, positioning status, communications quality and final abort/recovery plan. Any meaningful change to the flight paths or aircraft mix requires revisiting the separation check.
Postflight logs offer a way to compare commanded and actual paths. An audience video is not enough: it can show an attractive formation while hiding a near miss in depth or a vehicle that landed outside the intended area.
There is no single threshold in the public sources above that certifies a drone show as safe at every venue. Any separation number, timing tolerance or wind limit must be justified for the aircraft and site, then tested against the specific operating envelope.
The artwork should be the last thing cleared for flight
Student-designed light shows are a legitimate entry point into trajectory design and aerial robotics. The Mesa example shows that the design role can be separated from professional deployment. The evidence does not establish that the educational program, or any software package mentioned here, automatically validates an entire public operation.
A defensible workflow begins with a controlled site and airspace, reliable aircraft identities and a common timebase. It converts the choreography into bounded flight trajectories, checks separation under credible error, and rehearses degraded operation before accepting the final light animation. After the show, the logs should support a more useful conclusion than 'the picture looked right.'
That is the engineering task behind the spectacle: making the same timed drawing remain safely executable when the physical aircraft do not behave like perfect points in a rendering.