Simulator path (red) and recent MH150 flights (colored circles). (Click on image to enlarge.)
Introduction
Within weeks after MH370’s disappearance on March 8, 2014, news stories revealed that Captain Zaharie Shah deleted data from his home flight simulator in the weeks prior to the disappearance, and FBI investigators at Quantico, Virginia, were assisting in recovering the data. Months later, new reports surfaced stating that the captain had used his home simulator to practice flights to the Southern Indian Ocean, and then deleted those flights from his home computer. Despite these reports, there was no official confirmation from Malaysia that suspicious data was found on the captain’s home computer.
We now know that the recovered data sets from the captain’s computer were included in a report compiled by the Royal Malaysian Police (RMP). The report was eventually obtained by several French media organizations, and large portions of the report were later made public.
On August 14, 2016, the MH370 Independent Group (IG) released a preliminary assessment of the simulator data contained in the RMP report. The data sets were created by Microsoft Flight Simulator (MSFS) software, and are in the form of fragments of “flight files”, which a user may create during a simulation session to record the state of the session for future reference or to resume the session at a future time. The particular flight files of interest were among hundreds of others found on the computer on several drives; however, the files of interest were deleted and recovered by investigators from a “volume shadow” on a single drive that was found disconnected from the computer. The grouping of the files in the volume shadow makes the set unique among the all flight files that were found.
The recovered flight files include flight and navigation parameters that are “snapshots in time”, and are associated with six unique coordinates. If these coordinates were all from a single simulation, it suggests that a user simulated a flight of a B777-200LR aircraft with a departure from Kuala Lumpur International Airport (KLIA), a climb and cruise over the Malacca Strait and then the Andaman Sea, followed by a turn to the south, and a termination from fuel exhaustion in the Southern Indian Ocean (SIO) near 45S 104E. The IG found that if a great circle path that connects the final points is extended past the final point, the great circle would cross McMurdo Station, Antarctica. (McMurdo is the largest and most populated research station in Antarctica.) This raises the possibility that McMurdo was used as a final waypoint for navigation with the expectation that fuel would be exhausted in the SIO, well before reaching Antarctica.
The simulator data was found on what the Malaysian investigators refer to as drive MK25, where Microsoft Flight Simulator (MSFS) 2004, also known as FS9, was installed. (The main drive of the computer is referred to as MK26, where Microsoft Flight Simulator X, also known as FSX, was installed.)
The fragments of the flight files were found in a volume shadow dated February 3, 2014. A volume shadow is periodically created by the Windows operating system so that files can be restored to a particular date. This means that the file fragments found in the volume shadow were created on or before February 3, and then over-written on or after February 3.
Of the eight total flight file fragments that were recovered, three were for an aircraft on the ground at Kuala Lumpur International Airport (KLIA), and five were for an aircraft flying. Based on fuel levels and other indicators, the data sets in which the aircraft is flying can be related to one of the data sets for the aircraft at KLIA, i.e., six data sets appeared to be related to a single flight. The remaining two data sets at KLIA show fuel levels that are not consistent with the other data sets. These fuel levels may reflect intermediate values before the final takeoff fuel levels were selected.
There has been much discussion as to whether the six data sets are from a single simulation session, and whether the simulator was functioning normally when the data sets were saved. On November 29, 2016, I co-authored a paper with MSFS expert Yves Guillaume that investigated these and other aspects. To replicate the software used by the captain, Yves and I independently installed FS9 with the B777-LR model upgrade from Phoenix Simulation Software (PSS). After substantial testing, we discovered that:
- The data points in the Andaman Sea share some of the same unique values as the data points in the SIO, suggesting the flight files came from the same simulated flight.
- The parameters related to fuel and flight dynamics show that the position of the aircraft was manually changed along the flight path.
- The data files were manually created and saved after certain parameters were manually changed.
- The simulator appears to have been fully functional, and the rates of climb and other flight parameters after fuel exhaustion can be explained and repeated.
After this paper was published, I created a simulation that was initialized using the recovered values from the data set just after fuel exhaustion. I was able to show that it was possible to manually fly the plane for about 27 seconds and achieve the position, altitude, heading, pitch, and bank that were close to the values contained in the subsequent, final data set. This was further confirmation that the captain’s simulator was properly functioning when the data sets were created. Here’s a video of this short flight.
With the recent release of the ATSB’s report on the operational search, we have learned more about the simulator data found on the captain’s computer. Now three years and seven months after the disappearance, for the first time, the existence of the simulator data has been officially acknowledged in a public document. Although the ATSB does not speculate about whether the captain was responsible for the diversion, the report does reveal that in April 2014, the ATSB considered the simulator data as relevant evidence in defining the search area.
Date and Duration of the Simulator Session
From the ATSB’s report, we learned that on April 19, 2014, the Australian Federal Police provided the ATSB with the recovered simulator data. The report states that The simulator data was a partial reconstruction of a flight simulator session from 2 February 2014. Based on the February 3 date of the volume shadow, we already knew that the simulation was created on or before February 3. However, I was curious to know how the ATSB determined that the exact date of the simulation session was February 2 since the information about date and time was not included in the file fragments that were provided in the RMP report.
After some email exchanges with the ATSB, I was surprised to learn that the ATSB has additional data values from the recovered flight files that were omitted from the data sets that were provided in the RMP report. In particular, there is a section of the flight files in which the date and time of the simulation session are stored. These data values tie the date of the simulation to February 2, 2014. Also, the time values show that the chronological order of the data sets matches a flight departing KLIA, flying over the Malacca Strait, continuing past the Andaman Islands, turning to the south, and exhausting fuel in the SIO, in the same order that the progressively depleting fuel levels suggest. The time values also indicate that the flight session lasted for about one hour. This confirms that the position and fuel levels were modified during the simulation, just as Yves Guillaume and I had concluded in our paper.
The newly released information regarding the date and duration of the simulator session means that it is almost certain that the recovered data sets were from a single flight session.
However, as the signed date of this part of the RMP report is May 15, 2014, it remains a mystery as to why the Malaysians omitted important data values that were already available to the ATSB on April 19, 2014.
Simulated Flight Path
Using our previous notation, we refer to the identification of each data set by its latitude, i.e., as 2N, 3N, 5N, 10N, 45S1, and 45S2. The position of the first four coordinates are shown above in the figure, where the position for data set 2N is Runway 32R at KLIA.
After takeoff, the next coordinate is 3N, which is in the Malacca Strait on airway R467 between waypoints AGOSA and GUNIP. The altitude for 3N is 23,247 ft.
The next is coordinate 5N, which is between GUNIP and TASEK near airway B466. The exact position suggests the aircraft has already left airway B466; the track, which can be calculated from the components of the velocity presented in the 5N data set, is 317 deg, which is exactly towards waypoint VAMPI on N571. (The value for the heading is 315 deg, which differs slightly from the track due to wind.) The altitude at coordinate 5N is 32,246 ft.
The final point for the northwest portion of the path is coordinate 10N, at an altitude of 40,003 ft, and to the west of the Andaman and Nicobar Islands. The plane is at a heading of 256 deg, and is banked at 20 deg and turning left towards the south. The coordinates for 10N place it near airway N877 between waypoints LAGOG and DOTEN. The position suggests that the aircraft left the airway about 30 NM before DOTEN.
The final two coordinates, 45S1 and 45S2, are in the SIO near 45S, 104E, and are separated by a distance of about 2.5 NM. Despite the short distance, the altitudes at 45S1 and 45S2 are 37,561 ft and 4,000 ft, respectively. The data set for 45S2 shows unmistakable evidence that the altitude was manually changed from 37,654 ft to 4,000 ft just before the data set was saved, which is consistent with the large change in altitude over a short distance.
The track of 5N towards VAMPI on N571, and the proximity of 10N to airway N877, together suggest that in the simulation session, after taking off and flying to GUNIP, the aircraft joined N571 and followed the waypoints VAMPI, MEKAR, NILAM, IGOGU, LAGOG, and DOTEN. The great circle alignment of 10N, 45S1, and Pegasus Field (NZPG) at McMurdo Station, Antarctica, means the session might have simulated a great circle path towards McMurdo Station until fuel exhaustion was reached in the SIO. (Aircraft that are flying in LNAV mode follow great circle paths between waypoints.)
Similarities to Flight MH150
We know that the recovered simulator coordinates describe a flight departing KLIA that is not consistent with a flight to Beijing: the initial path of the simulation is to the northwest, flying over the Malacca Strait, and the initial path to Beijing is to the northeast, and flies above the South China Sea. I searched for whether there might be a scheduled flight that better matched the simulation coordinates 2N, 3N, 5N, and 10N. In particular, I searched for scheduled flights that had a departure that followed a route from KLIA to GUNIP, and then to either TASEK or VAMPI, and would require a fuel loading similar to the 68,424 kg that is inferred from data set 2N.
After considering the list of Malaysia Air’s departing flights from Kuala Lumpur, I discovered that MH150, from Kuala Lumpur to Jeddah, Saudi Arabia, met the fuel and path criteria. Next, I checked whether the captain had flown any MH150 flights in that time period. I was surprised to learn that he commanded MH150 on February 4, 2014, which appeared to be very close to the date that the simulation session was created. In November 2016, I privately communicated my findings to other independent investigators, although I thought it was still too speculative and controversial to present in a public forum. Months later, on April 30, 2017, I noted in a blog comment:
The flight might have been a simulation of a flight from KLIA to Jeddah with a diversion, as the fuel loading and SID are consistent with that. Also, Zaharie Shah was scheduled to captain MH150 to Jeddah on Feb 4, 2014. The Shadow Copy Set containing the deleted flight file fragments was dated Feb 3, 2014.
Now that we know that the exact date of the simulation session was February 2, 2014, the link between the simulation session and MH150 is less speculative. The authors of the recent ATSB report had similar thoughts:
On the day the simulation was conducted the PIC was on a rostered day of leave. The following day the PIC was rostered to fly from Kuala Lumpur to Denpasar, Bali and return the same day. On 4 February 2014 the PIC was rostered to fly from Kuala Lumpur to Jeddah, Saudi Arabia. The first three data points recovered from the simulator were consistent with the route from Kuala Lumpur to Jeddah. In the weeks between the Jeddah flight and the accident flight the PIC was rostered to fly return flights from Kuala Lumpur to Denpasar, Beijing, Melbourne and then Denpasar again.
I was curious to see just how close the path suggested by the simulator coordinates resembled previous paths taken by MH150. For the comparison, I used the ADS-B data available from FlightRadar24 for eight consecutive flights between Aug 17, 2017 and Sep 21, 2017. (The available data for all the flights end around waypoint LAGOG, probably due to the range limitations of the receivers in the vicinity.) The MH150 flight paths are plotted above in the figure.
For seven of the eight flights, the aircraft departed KLIA and flew over waypoint GUNIP. For the seven flights that flew over GUNIP, six followed airway N571 towards VAMPI and continued to follow N571 towards LAGOG. One of the six that reached GUNIP, one flew towards TASEK on airway B466, but rejoined N571 near IGOGU. (Some of the flights show deviations from airways, which are probably weather related.). The similarity between typical routes taken by MH150 and the simulator data is evident.
We can only speculate as to why, just two days before he commanded MH150 from Kuala Lumpur to Jeddah, and five weeks before the disappearance of MH370, the captain used his home computer to simulate a flight of MH150 that was diverted to the SIO.
In Part 2, we further investigate the simulator data and how it may give us clues about MH370.
Updates on October 13 and 15, 2017. In the figure, the dates in the legend were corrected so that all refer to year 2017. Also, the label on the airway between LAGOG and DOTEN was corrected to be N877, and the label of the airway between GUNIP and TASEK was corrected to be B466. Thank you to Twitter handle @BKKDiet and blog contributors @Mick Gilbert and @TBill for finding these errors.