MH370 and Other Investigations

ACARS Message Paths ( From “Analyzing Security Breaches in ACARS”, Smith et al., 2017)

Fellow MH370 Independent Group members Don Thompson and Richard Godfrey have found some anomalies in the message logs that were included in Factual Information (FI) released by Malaysia on March 8, 2015, and the Safety Investigation Report (SIR) released by Malaysia on July 30, 2018. The logs from these two reports document the communication between MAS Operations Dispatch Center (ODC) and service providers that route messages over SATCOM and VHF paths, as part of the Aircraft Communications Addressing and Reporting System (ACARS). The anomalies suggest the traffic logs appearing in the reports are not complete, and what appears in the reports has been modified.

A simplified schematic of the ACARS is shown in the figure. For MAS, the service provider for satellite communications is SITA using the Inmarsat network and the service provider for VHF communications is ARINC using a network of ground stations.

Missing Messages Between 18:15:23 and 18:43:33

According to text in both the FI and the SIR, an urgent message from MAS ODC was submitted at 18:03 and then re-transmitted multiple times:

The first message sent to the aircraft cockpit printer from the MAS ODC was at 1803:23 UTC. The ACARS message requested the crew to contact the HCM ACC immediately. The incoming downlink message at 1803:24 UTC showed the message failed to reach the aircraft. Messages are auto transmitted every 2 minutes and the message was retransmitted until 1843:33 UTC but all messages failed to get a response. Automated downlink message by ACARS showed ‘failed’. 

However, the last message from MAS ODC that was shown in both the FI and SIR traffic logs occurred at 18:15:23, and not the 18:43:33 stated in the text. This means that either the explanatory text is wrong, or the traffic logs do not contain all the message traffic.

VHF Messages Not Included

The missing messages could be explained if they were routed via the VHF link. For the ACARS traffic log in the FI, the filter parameters used to extract the message records included only SATCOM traffic for the time period 12:48:00 to 20:00:00, so that if any VHF messages were exchanged, those messages would not be included in the traffic log. (The filter parameters appear at the top of each page of the traffic log in Appendix 1.9A.)

The facts surrounding the ACARS traffic log in the SIR (also Appendix 1.9A) are more suspicious. For Page 1 of the log, the filter parameters did not limit the messages to only SATCOM messages. In fact, at 15:54:31, there is a message submitted by MAS ODC over the VHF link that requests personnel on the aircraft to re-configure the center VHF radio so that future messages would be exchanged via SATCOM. However, starting with Page 2 of the report, the filter parameters used to generate the remaining pages of the report were changed so that VHF messages, if any occurred, were excluded.

The change in filter parameters after Page 1 is unexplained. Two messages received by MAS ODC at 15:54:41 and 15:54:53 appearing at the bottom of Page 1 are repeated at the top of Page 2. The change in filter parameters and the repeated messages are clear evidence that the traffic log in the SIR is actually two reports that were pieced together and presented as a single report.

Edited Text

As it appears in the ACARS traffic log in the SIR, the text message that was sent by MAS ODC at 18:03:23 is:

URGET [sic] REQUEST
PLS CONTACT HO CHI MING [sic] ATC ASAP
THEY COMPLAIN CANNOT TRACK YOU ON THEIR RADAR
I RECEIVED CALL FROM SUBANG CENTRE
PLS ACK THESE MSG
REGARDS

However, the last line of the message appears to have been edited. By examining the ASCII characters embedded in the PDF version of Appendix 1.9A, the following text can be extracted:

REGARDS
MXXXXX

where MXXXXX is an actual name with six letters beginning with M.

There is also a misplaced © symbol on the bottom of the page that appears after the report page number on Pages 2 and later, but properly appears before the name “SITA” on Page 1. This is yet another indication that the traffic log in the SIR was edited.

Request for Complete, Unmodified ACARS Logs

It is disappointing that more than four years after MH370’s disappearance, we are still asking Malaysia to release withheld data. The military radar data is another example of a data set that has never been released in full despite its significance in providing information about how the aircraft was flown after the diversion from the flight plan.

It is important that Malaysia provide a complete, unmodified log of all ACARS communications on SATCOM, VHF, and HF paths for the period between 12:48 and 20:00 on March 7, 2014. This is particularly significant in light of questions surrounding the delayed response of Malaysian authorities after MH370 went missing.

Update on Sept 4, 2018

The Daily Star reports that it has received a statement from Malaysia Airlines about the anomalies in the traffic data logs that were reported in the article above:

A spokesman told Daily Star Online: “Malaysian Airline System Berhad (Administrator Appointed) (“MAS) is aware of the recent media reports alleging anomalies to the traffic data logs in the Safety Investigation Report published by the Malaysian ICAO Annex 13 Safety Investigation Team for MH370. 

“MAS wishes to state that MAS has provided full cooperation and assistance to all respective authorities on the investigation for MH370, including the submission of relevant documents necessary for the investigation.

MAS will continue to cooperate with the Authorities and if necessary, provide any information to them in line with international requirements and applicable laws.” 

Conspicuously absent is an explanation for the missing messages and the edited logs.

Boeing simulations of MH370 at end-of-flight. (Click on image to enlarge.)

Introduction

With the failure of the recent search by Ocean Infinity to locate the debris field along the 7th arc at latitudes as far north as 25S and at widths equal to or exceeding +/- 22 NM, we consider whether it is possible that with the assumption of uncontrolled flight, the plane could have impacted the ocean farther than 22 NM from the 7th arc, and was missed because the search along the arc was too narrow.

At each phase in the subsea search for MH370, the search area was defined by following parameters:

• A range of latitudes along the 7th arc
• A width inwards and outwards from the 7th arc

The range of latitudes for the search was determined by analysis of the satellite data, aircraft performance, and drift models. Collectively, these data sets constrain the position that MH370 crossed the 7th arc. Unfortunately, due to the imprecise nature of these data sets, official and independent investigators have proposed a fairly large range of latitudes, and this continues to be the subject of debate.

In a parallel effort by the ATSB, the width inwards and outwards from the arc was estimated by the distance the aircraft could have glided after fuel exhaustion. With the assumption that there were no pilot inputs after fuel exhaustion, this distance was determined by end-of-flight simulations conducted by Boeing based on aircraft conditions requested by the ATSB. The simulations were completed in Boeing’s engineering simulator, which offers high fidelity of the aircraft’s performance. Some of the results of these simulations were presented in an ATSB report entitled MH370 Search and Debris Update, released in November 2016.

Simulation Results

Because of the importance of the simulations in establishing the search width, I asked the ATSB for more details about the conditions modeled and the results of the ten simulations. (Because Boeing conducted the simulations based on conditions requested by the ATSB in support of the search, they are an ATSB product.) Although legal restrictions prevent the ATSB from providing specific details about each of the ten simulations (referred to as Cases 1-10), the ATSB did reveal that the initial speeds varied between M0.75 and M0.83, the starting altitudes were either FL350 or FL400, the initial headings were either 178°, 184° or 190°, and turbulence was either light or moderate. Winds at various altitudes were included in the simulations.

In addition to these general descriptions, the ATSB did provide me with numerical results of the ten simulation runs in the form of X, Y, and altitude in one second increments, where X is the E-W position in NM, Y is the N-S position in NM, and the altitude is in feet. (The ATSB deliberately did not include the latitude and longitude values in these files so that there was no association with a particular crossing of the 7th arc.) The ATSB has permitted me to share these results on this blog so that a broader group of investigators can independently analyze the results. To my knowledge, this is the first time these results have been released to the public.

Although not included in the files, derived quantities such as groundspeed, Mach number, track, vertical speed, vertical acceleration, bank angle, and wing loading are all calculable, although some parameters such as Mach number and calibrated airspeed need assumptions about the wind and temperature fields.

A presentation of the detailed technical analyses of all the simulations would be lengthy and not appropriate for a blog post. However, some generalized observations and results are summarized below:

• There were two groups of simulations. In the first group (Cases 1,2,5,7,8,9), the autopilot was lost after the flameout of the second (left) engine, which corresponds to a “normal” configuration of the electrical system.
• In the second group (Cases 3,4,6,10), the electrical configuration was in an “alternate” configuration in which the left generator and left backup generator were isolated with switches in the overhead panel. In this case, when the right engine is running, power is supplied to the left bus from the right bus through the bus tie breaker. However, after the first (right) engine flames out, both main AC busses and both transfer busses lose power, which causes the flight control mode to transition to “secondary” and the autopilot and autothrottle disengage, even as the left engine continues to provide thrust.
• The SATCOM’s log-on request at 00:19 is assumed to occur two minutes after the loss of the autopilot. (The two minute interval assumes the APU would take one minute to start supplying power, and the SDU would subsequently take one minute to power up and request a log-on to the satellite.) The ATSB has adjusted this position in all the simulations so that the two-minute mark occurs at the same X,Y values, and the paths can be compared. The two-minute mark serves as a reference position (labeled with “2 mins” in the figure above).
• For all ten simulations, the paths stay within a distance of 32 NM from the reference position. However, since all paths are curved, the farthest impact point from the 7th arc is only about 15 NM, and depends on the track angle between the initial path and the arc tangent.
• There were five simulations (Cases 3,4,5,6,10) in which the rate of descent exceeded 15,000 fpm and the downward acceleration exceeded 0.67g, which are the values indicated by the two final values of BFO. This included all four cases with the “alternate” electrical configuration, and one with normal configuration. The maximum downward acceleration for these cases ranged between 0.87g and 1.30g.
• For the five simulations (Cases 3,4,5,6,10) with high descent rates, the impact occurs within 14 NM from the reference position, and about the same distance from the 7th arc, depending on the track angle between the initial path and the arc tangent.
• For the five simulations (Cases 3,4,5,6,10) with high descent rates, the descent rate of 15,000 fpm and the downward acceleration of 0.67g occur at different times, and are not predicted to occur at the time of the log-on. If the impact distance is measured from the point at which the descent rate first exceeds 15,000 fpm, the distance ranges between 4.7 NM and 7.9 NM.
• In none of the simulations did the plane fly straight with level wings after the autopilot was disengaged. Ultimately, the magnitude and direction of the bank that develops is the net effect of a many factors, including thrust asymmetry, TAC, manual rudder input, weight imbalance, aerodynamic asymmetry, and turbulence, with the dihedral effect of the wings and center-of-mass tending to restore the bank to zero.

Simulation of Alternate Electrical Configuration

Case 6: A simulated end-of-flight path for the left generators turned off before fuel exhaustion. (Click on image to enlarge.)

The four simulations (Cases 3,4,6,10) with the alternate electrical configuration are interesting because in all cases, the descent rates and downwards accelerations exceeded the values suggested by the final BFOs, and the high speed descent is achieved within minutes of loss of the autopilot. To further illustrate the sequence of events, we consider Case 6, with initial conditions of a groundspeed of 425 knots at an altitude of 35,000 ft, and shown in the figure above.

When there is no more fuel in the right tank, the right engine coasts down and the left engine speed increases to full thrust. The loss of AC power causes a transition to secondary control mode, and the autopilot and the autothrust are disengaged. As the right engine coasts down, the automatic thrust asymmetry compensation (TAC) will apply left rudder, but the amount of rudder does not change after the flight control mode degrades to secondary.

After the right engine flames out, there is a slight turn to the right, which means the rudder position does not completely balance the yaw from the resulting thrust asymmetry. It is possible that the transition to secondary control mode occurs before the TAC can apply sufficient rudder input to fully compensate for the thrust asymmetry of no right engine thrust and full thrust of the left.

At some point, the remaining fuel in the left tank is exhausted, and the left engine shuts down. With both engines producing no thrust, the left rudder position now causes a steep turn to the left, and the plane descends. At the point it reaches 27,000 ft, the descent rate is 15,000 fpm, and it has achieved a downward acceleration of 0.3g over the preceding eight seconds. The plane levels off at about 19,000 ft, and then begins to again rapidly descend, reaching a descent rate of 15,000 fpm at about 18,000 ft, and impacting the sea about 3.3 NM from this point. The impact distance from the earlier point of reaching a descent rate of 15,000 fpm is about 7.9 NM.

Discussion

[Phrases in italics were added on Aug 21, 2018 for clarity.]

If we consider that the end-of-flight Boeing simulations were representative of the actual conditions of MH370, we have three possibilities:

1. If the flight was uncontrolled after fuel exhaustion, and if we ignore the final BFO values, the plane impacted no farther than about 15 NM from the 7th arc.
2. If the flight was uncontrolled after fuel exhaustion, and if the descent rates suggested by the final BFO values are valid, then the aircraft impacted no more than about 8 NM from the 7th arc.
3. If the flight was controlled after fuel exhaustion, an efficient, stable glide starting at about 40,000 ft could have achieved a distance of 120+ NM from the 7th arc.

Possibilities (1) and (2) suggest the next search should occur along the 7th arc north of 25S latitude at a width of about +/-25 NM.  The +/-25 NM is an estimate that includes uncertainty in the simulation models and uncertainty in the final BTO values. 

Because possibility (3) requires pilot inputs after fuel exhaustion, if this occurred, we have to assume that pilot inputs also occurred during the powered part of the flight after 19:41. As such, there would be no reason to believe that paths reconstructed with the assumption of automated flight with no pilot inputs are representative of the path actually flown. The large width (+/- 120 NM) and the difficulty in objectively constraining the crossing latitude of the 7th arc would make it difficult to define a manageable search area without additional information.

Until additional information or insights become available, it will be difficult to establish a new search area.