by Ean Higgins
The third key question identified by the ATSB was the analysis of the satellite data. In the time since the satellite handshakes had first become known to exist, the international team responsible for decoding them had also done a lot more work. It was, to say the least, complex; what follows is an attempt to make the gist of it understandable not just to PhD level aerospace engineers and mathematicians, but to mere mortals.
The components of the satellite information system used on flight MH370 consisted of the Inmarsat Classic Aero ground station located at Perth, the Inmarsat Indian Ocean Region (IOR) I-3 satellite and the Inmarsat Classic Aero Mobile Terminal, which is the satellite data unit on the aircraft. It’s a triangular system in which the ground station sends signals to the satellite, which relays them in turn to the aircraft, and vice-versa.
The ground station in turn sends the data to the clients.
From the satellite handshakes the tech heads identified and retrieved two types of metadata: burst timing offset and burst frequency offset.
The burst timing offset is a measure of how long the handshake signals take to go from the satellite to the aircraft and back. By measuring burst timing offset the scientists were able to establish the difference between a ‘nominal’ position of the aircraft if it were directly below the satellite and therefore at its closest possible position, and the ‘actual’ position at the time of each handshake. The longer it took from when the signals were sent from the satellite to reach the aircraft and vice-versa, the farther away it was.
FIGURE 6: TIME DELAYS BETWEEN NOMINAL AND ACTUAL LOCATION OF MH370
© Inmarsat / Australian Transport Safety Bureau
This produced the seven concentric rings associated with each handshake, as MH370 moved initially closer to, then farther away, from the satellite.
The first handshake at 2:25am, just after primary radar coverage was lost at 2:22am, shows MH370 was somewhere on a band which does indeed coincide with the northern end of Sumatra. The second at 3:41am puts it on a band farther west – the innermost band. The third arc, at 4:41am, is slightly to the east of the second, and all other arcs are also to the east and south. That opened up a number of conceivable routes and possible end points on the Seventh Arc, but within a restricted range based on fuel endurance.
By cross-referencing the handshakes from when the aircraft was on the ground, and the last ACARS transmission when MH370 was still over Malaysia and its position known, the investigators were able to determine that the burst timing offset–defined rings would accurately reflect where the aircraft had been along them to within plus or minus 10 kilometres.
The scientists also used a different calculation to calibrate the results: the burst frequency offset. That, hard to believe though it is, was even more complex, but it involved one element which high-school students learn about in science class: the Doppler effect of relative movement and frequency.
The general principle of the Doppler effect is that when two objects are moving towards each other the frequency increases, and when they are moving away from each other the frequency decreases. The classic example cited by science teachers is that when you stand on the edge of a highway and a big truck is coming towards you, the pitch of the noise it makes becomes higher in your ears until it reaches you, then when it passes you, the pitch falls. The scientists used the Doppler principle to make calculations against the satellite data of changes in the frequency of transmissions, which they used to cross-reference against possible flight paths. From that, they derived an indication of the aircraft’s speed, which was put in a range of 375 to 425 knots.
The international team made refinements to the satellite data model to take into account other factors, such as that the satellite, while described as geostationary, actually moves in a bit of an elliptical ring itself, and that at times when it was in the shadow of the earth, it cooled down and this could affect the frequency of transmissions.
To test the accuracy of the model, the team ran various validation and verification tests. Using nine previous flights of the aircraft, 9M-MRO, and 87 other aircraft with the same SATCOM equipment in the air at the same time as MH370, the investigators tested some path prediction analysis techniques. Essentially, they compared what their model of analysis of the satellite data showed would be the track of the aircraft against the tracks actually flown. The path estimations based on the satellite data were verified as very close to the actual paths for most of the flights.
The analysis of the satellite data was an exceptional piece of ground-breaking international scientific and engineering deduction, pushing out the frontier of knowledge and done, by academic standards, very quickly. The aircraft went down in early March with the satellite data being made available a bit thereafter; by late June the work was not just done, but published in a paper.
There was, however, one final decision which had to be made before all the variables and probabilities could be put together to determine a search area: what happened at the end of the flight and, more specifically, was anyone flying the plane?
It was in many respects the most important question of all.
If no-one was flying the plane and it ran out of fuel, when the engines flamed out the autopilot would disconnect, and the aircraft would likely go into a spiral but crash pretty much straight down. If someone were flying it at the point of fuel exhaustion, the ATSB itself determined, from about 35,000 feet which was MH370’s last recorded altitude, he or she could glide it another 100 nautical miles or so farther down the Seventh Arc or, for that matter, another 100 nautical miles off it.
Which way the ATSB decided to fall on this most critical determination had big political and diplomatic implications.
The ATSB, it says in its search strategy report, ‘reviewed three general classes of accidents that were relevant to the cruise phase of flight.’
The first was ‘an in-flight upset’ which it said was generally characterised by ‘normal radio communications’ and ‘normal en route manoeuvring of the aircraft’ up until an ‘upset event’ which could be ‘a stall due to icing, thunderstorm, system failure etc.’. In that case, there would be ‘pilot control inputs’ and a ‘rapid loss of control’. Air France 447 was a good example of an ‘in-flight upset’; everything was normal up until the pitot tubes filled with ice crystals and the autopilot shut off – there were control inputs after that, but the wrong ones, right up until the point the pilots realised ‘F***, we’re dead’.
The second class of accident the ATSB defined was ‘an unresponsive crew/hypoxia event’. Such scenarios, the ATSB said, were generally characterised by ‘failure of the aircraft to pressurise during initial climb, loss of radio communications, long period without any en route manoeuvring of the aircraft, a steadily maintained cruise altitude, fuel exhaustion and descent, no pilot intervention, loss of control.’
There are several known cases of accidents of this type, the classic being Helios Airways Flight 522. The Boeing 737 took off from Larnaca, Cyprus, on a scheduled flight to Athens, Greece, on 14 August 2005. There had been some trouble with icing on one of the doors on the previous flight, and an engineer did some tests requiring him to set the pressurisation mode on the aircraft to ‘manual’. He forgot to switch it back to ‘auto’.
When the plane took off, it failed to pressurise, and though within five minutes an alarm sounded warning of the problem and soon thereafter the oxygen masks dropped, the pilots mistook it for another warning which did not sound that different.
The captain reported a related air conditioning problem, had some discussion with the same engineer on the ground, but quickly became hypoxic, stopped conversing rationally, and then passed out, as did the co-pilot. The aircraft, flying on autopilot on its programmed route, reached its assigned altitude of 34,000 feet, cruised along till it got to the approach to Athens airport, and then automatically started a holding pattern.
Two Greek jet figh
ters scrambled to intercept the aircraft and, peering in through the 737’s windows, their pilots saw a ‘ghost plane’ flying beside them. They saw no-one in the pilot’s seat, the co-pilot slumped over the controls, lifeless passengers, some with oxygen masks on, others with their masks dangling overhead. Incredibly, shortly before the plane went down the pilots saw a flight attendant, who had apparently got his hands on portable oxygen bottles, enter the cockpit and take the pilot’s seat, and wave to them. It was a brave last-minute attempt to save the plane nearly three hours into a ‘ghost flight’.
But while the attendant had some flight training, and attempted two Mayday calls, he was not trained on the 737, and very soon the first engine flamed out, and the aircraft left the holding pattern and started to descend. Ten minutes later the second engine failed, and the aircraft crashed into hills about 40 kilometres from Athens killing all 121 on board.
The third class of accident the ATSB considered was a ‘glide event’, which it said was generally characterised by ‘normal radio communications, normal en route manoeuvring of the aircraft, engine failure/fuel exhaustion event(s), pilot-controlled glide’. There are also plenty of glide events in the history of commercial aviation, the most prominent of which in recent years was the extraordinary successful ditching in January 2009 of US Airways Flight 1549 into the Hudson River in New York after a bird strike took out both engines – this fine piece of airmanship was made into the film Sully: Miracle on the Hudson starring Tom Hanks.
That was a short glide – the longest among airliners was Air Transat Flight 236 which took off from Toronto bound for Lisbon in August 2001, and ran out of fuel over the Atlantic due to an undetected leak. With no power the pilots managed to glide the Airbus A330 for 20 minutes covering 65 nautical miles, or 120 kilometres, to land safely in the Portuguese islands of the Azores.
As it debated which of the three ‘general classes of accident’ to adopt, the ATSB clearly had political sensitivities in mind. It knew that Malaysia was, under the ICAO Annex 13 protocol, in charge of the overall air crash investigation, and had the ultimate responsibility to determine what happened to MH370. The ATSB and Transport Minister Truss knew the Malaysians would not like it if they pre-empted their investigation. So, right after outlining the three ‘general classes of accidents’, and before revealing its conclusion on which one it would go for, in its search definition report the ATSB wrote, in bold face and italics:
‘Note: Given the imprecise nature of the SATCOM data, it was necessary to make some assumptions regarding pilot control inputs in order to define a search area of a practical size. These assumptions were only made for the purposes of defining a search area and there is no suggestion that the investigation authority will make similar assumptions.’
The first of the three ‘general class of accident’ – an ‘in-flight upset’ – was pretty easy to rule out.
That scenario was characterised by normal communication and manoeuvring up until an ‘upset event’. The known facts about the flight of MH370 reflected exactly the opposite – there were not normal radio communications because they were broken off, and the en route manoeuvring of the aircraft was anything but normal: doing radical turns and steering over major airports without landing.
The two remaining options, though, involved a sensitive issue. If the ATSB determined the scenario it would work on was the third one, a ‘glide event’, Dolan and Truss would have to front the media to say the bureau had determined that someone had most likely flown MH370 to the end. That would have represented a conclusion about what happened on MH370 and pre-empted the Malaysian investigation report.
More controversially, since the scenario of pilot hijack was already widely regarded as the most realistic, journalists would have reported Dolan had effectively confirmed the ATSB thought one of the Malaysian pilots had taken 238 passengers and crew on a Malaysian government-owned airliner to their deaths.
The ‘unresponsive crew/hypoxia’ scenario would have avoided this. In that case Dolan could have just told journalists the ATSB did not really know what happened on MH370, but didn’t need to know because that was the Malaysians’ job; the bureau’s sole job was to find the plane. When asked if there was evidence of pilot involvement he could say that was not his business, but add that it looked like no-one was flying the plane at the end. That was exactly what Dolan told journalists. He was able to do so because the ATSB chose to go with the ‘unresponsive crew/hypoxia’ scenario, rather than a ‘glide event’.
In its report, the ATSB noted that despite having ‘multiple redundant communications systems’ no radio communications were received in the last seven hours of the flight. It also said the SATCOM data suggested there were probably no large changes to the aircraft’s track in the last five hours after the turn south.
So, the ATSB chose to conclude:
‘Given these observations, the final stages of the unresponsive crew/hypoxia event type appeared to best fit the available evidence for the final period of MH370’s flight when it was heading in a generally southerly direction.
‘This suggested that, for MH370, it was possible that after a long period of flight under autopilot control, fuel exhaustion would occur followed by a loss of control without any control inputs,’ the report said.
That line was immediately followed by another note; this time not in italics, but still in bold:
‘Note: This suggestion is made for the sole purpose of assisting to define a search area. The determination of the actual factors involved in the loss of MH370 are the responsibility of the accident investigation authority and not the SSWG.’
The ‘note’ again demonstrated how driven the ATSB was about the diplomatic niceties of not saying what happened on MH370. The next line in the report was, when reflected upon, quite extraordinary in terms of the logic of the search strategy, and revealing.
‘Also allowing for the fact that a maximum glide distance of 100+ NM [nautical miles] would result in an impractically large search area, the search team considered that it was reasonable to assume that there were no control inputs following the flame-out of the second engine,’ the ATSB said in its report.
The statement went against all the excellent scientific logic, deduction and methodological rigour which had preceded it. The ATSB was effectively saying it was going to exclude the other main end-of-flight scenario of a controlled glide with a pilot in control because, if it went with that, the search area would be too big against the financial budget available. Better to ‘assume’ there was no-one flying the plane after flame-out, regardless of the evidence, so as to stay within budget.
The day the ATSB released its report on 26 June, Dolan and Truss held a media conference. The journalists immediately probed whether the pair thought MH370 had been hijacked, and were repeatedly told it was not the ATSB’s job to make such a determination, but the Malaysians’ job. The question and answer session began as follows:
Question: Mr Dolan, could I just ask you, since the whole business began, there are massive rumours and speculation that have filled the vacuum, I suppose, but also created enormous confusion about this . . . Can you just address two issues. One is the claim that the transponders in the aircraft must have been physically turned off by the pilots. Could that have actually happened as a result of an accident – a catastrophe, like an explosion or something? And the other is the claim that the aircraft must have been under control and from the course it was taken, as indicated on radar records, and clearly tried to dodge radar.
Dolan: Those are both for the Malaysian investigation, which we are assisting. The focus of the ATSB has been on assembling the flight path of the aircraft across the Indian Ocean so we can determine the most likely place where . . . we will find it . . . questions as to why this occurred are not ones that we needed to address in determining the search area, which has been our focus.
Truss: But it would be fair to comment that it is highl
y, highly likely that the aircraft was on autopilot, otherwise it could not follow the ordinary path that had been identified through the satellite’s findings.
By this time, various elements of the Royal Malaysian Police investigation into the loss of MH370, which had drawn on assistance from the FBI, had started to leak out. Although it was only at the rumour level then, and the rumours themselves were vague, the suggestion was that Zaharie had a fairly sophisticated flight simulator at home, and that it had shown he had ‘flown’ a simulated flight that ended up in the southern Indian Ocean. A journalist put a question to this effect to Truss.
‘Look, again, I – we – I don’t really want to comment on areas which will probably be the responsibility of Malaysia in its investigation,’ Truss said. ‘Although, I’ve heard a number of reports about the pilot simulator, some saying it hasn’t been active for a year, some saying it had certain mapping and so forth on it. But I can’t confirm that that’s accurate or not. And it’s not really relevant to us in seeking to find the evidence.’
In fact, the issue of whether a pilot was flying the plane at the end of the flight was absolutely critical to the search strategy. If the view had been taken that MH370 had not crashed, uncontrolled, pretty much straight down, as the ATSB decided to assume, but had been glided up to 100 nautical miles in any direction, there would have been two logical options.
One would be to seek a huge increase several fold in funds to search a much, much bigger area, to cover the piloted glide scenario.
The other option, if the determination was that those vastly greater funds would not be forthcoming, would be to not search at all, at least until new information more accurately pinpointing MH370’s likely location emerged. Such a decision would have been rational and justifiable on the basis that the narrow search budgeted for was going to be pointless and a waste of taxpayers’ money, because the odds were that a pilot had glided the aircraft outside of it.