Various Thoughts on MH370

March is typically my busiest month, as I always have papers to furiously finish at the last minute for one, often two conferences in the US. This year is no different; I’m in Chicago doing the MPSA for a few nights in a little over a week, and while I don’t have a paper at the WPSA this year, I’m going to crash the meeting anyway, being from Seattle and all. By meeting, I of course mean any of the panels being held in a bar.[*] Nonetheless, I have been paying perhaps too much attention to MH370, and as I’ve been busy to the point where I can barely keep up with LGM, let alone comment threads, I apologise if any of this was discussed in the comments to the two (?) posts about MH370 that appeared here earlier.

I have an irrational fear of flying, which makes the annual 50K+ I clock up every year in the air a bit ironic. I assuage that fear partially by paying close attention to the occasional accident, and over the years I’ve built up a near encyclopedic knowledge of various disasters (the other means of fear mitigation is the airport bar). Since 1999, pprune has been informative in this area, with active airline pilots, ATC controllers, engineers, etc. providing ample evidence that plays into my statistics and probability training. Typically, the professionals active on the site (and previously, rec. travel.air on old Usenet) will point out the path-dependent chain of extremely low probability events required to bring down the aircraft in any given accident. Those flying for a living weren’t concerned, citing the overall low probability of any single event. Of course, one of the few times this approach failed was AF447, when the attitude of the pilots seemed to be “thank god it wasn’t me up there” and I was introduced to the term “coffin corner”.  That dialogue was well in the front of my mind when nine months later I was in an AF A330 over Greenland and we hit some pretty rough turbulence for an hour. It being AF, I had a nice stash of wine and brandy, so I got through it just fine. Typically discussion on pprune is technical and informative, and interesting to the curious and / or geeky.

The pprune thread on MH370 has, I believe, set a record in terms of sheer volume. As it’s gained attention (something over 10 million hits), the signal:noise ratio has predictably declined, but perseverance pays off. While there’s plenty of borderline crackpot theories being aggressively pursued by some, the nature of natural peer reviewing dismisses the unbelievable and impossible out of hand. However, given the nature of this case, there’s still plenty of scenarios with some measurable probability, however small. Attempting to understand what happened hasn’t been helped by the Malaysian government’s inconsistent handling of the matter. On several occasions, facts have been rejected before being accepted several days later, or stated as fact before being rejected later. On the latter, I’m specifically thinking about how the turn left immediately following the cutoff of the transponder was programmed into the flight computer and transmitted to ground via ACARS, which was subsequently withdrawn by Malaysian authorities.

It’s useful to focus on the few facts we do know with reasonable certainty (cribbed from pprune) before moving on to the where, and of ultimate interest, the why.

Official Confirmed

01:07 Last routine engine data transmission
XX:XX ACARS disabled
01:17 Sign off Subang ATC
01:21 Transponder switched off (near IGARI)
01:21 Malasian military PSR picks up MH370 at IGARI
XX:XX MH370 moves towards VAMPI and then towards GIVAL
02:15 MH370 turns towards IGREX and is lost on Malasian military PSR
08:11 Last ACARS handshake signal detected

The latter point is critical — it indicates that the aircraft flew for hours following whatever event occurred along its normal flight path over the Gulf of Thailand / South China Sea.  Furthermore, the consensus on pprune suggests that the continuation of the flight for hours after leaving the general Malaysia / Indonesia area was intentional. Regardless of motivation (fire / sudden decompression / unauthorised incursion into the cockpit / some motivation of the pilot to do something inconsistent with a normal flight or safe landing during a problem on board) the aircraft took a meandering route under the direction of somebody at the controls. To quote a contributor to the forum:

I think that many of us who fly the 777 for a living agree with you. The AP is going to follow a limited number of lateral inputs–LNAV, HDG HOLD, HDG SEL, TRK, or LOC. Plus, for LNAV we know that it is a three-step process of selecting the waypoint, executing it, and then selecting LNAV on the MCP. How many times have we had that drilled into us about “Execute then LNAV?”

At the very least, the initial turn off course and the entering and/or selection of new waypoints reveals very deliberate actions–by whom I will leave open pending further discovery and investigation. I think however, that many posters have overlooked just how deliberate those actions need to be and that they were most likely not the result of a happenstance case of hypoxia or fire brigade duties…

Initially, in the first 48 hours or so after the aircraft went missing, the working assumptions were that there had to be some swift, cataclysmic event that would disable the transponder, ACARS, and prevent the flight crew from so much as communicating. Sudden decompression or fire were favorites.  Lacking any debris field or ELT transmissions within a few days of the disappearance over a patch of ocean known for being shallow and heavily populated by both fishing boats and oil rigs, these hypotheses were in doubt. Malaysia’s confirmation that military primary radar picked up what they believe to be the 777 in question flying to the west introduced further confusion. This led to several now well known theories, including this one, discussed here on LGM. That (or any fire theory) has been through consensus regarded as very low probability on pprune. Palau Langkawi airport has a one-way runway pointed in the wrong direction for the approach, there were airports somewhat closer and more convenient if you’re flying a 777 that is on fire, and of course the knowledge that the aircraft remained in cursory communication via hourly pings to the Inmarsat satellite for six to seven hours later:

(Diversion to Palau Langkawi airport) even though it was closed, a very dark place to land even when the lights are on, and a one direction runway for approaches (the opposite direction he was heading), Penang was closer (and open 24/7) with approaches on both runways, and full firefighting support. Both pilots had flown into and out of both of these airfields many times, and both knew one was closed one was open.

Any fire theory would require a fire strong enough to disable the pilots and the overwhelming majority of electrics on the aircraft (the transponder, ACARS via VHF, communication), but subtle enough to burn itself out while leaving the control surfaces and airframe integrity in tact for a zombie journey until fuel exhaustion. In most (if not all) mid-air fire cases (e.g. SR111, SA295, AC797, ValueJet 592, Asiana991) the pilots have had an opportunity to communicate with ATC before, in most cases, the fire damage resulted in loss of control of the aircraft. A fire scenario for MH370 would have had to immediately disable several redundant communication systems, ultimately overcome the crew (who have and are trained to use their backup oxygen supply) yet leave the 777 in an airworthy state to fly itself. While not an impossible scenario, the probability is quite low. To again quote a pprune contributor:

If you had followed this thread you would have read the factors that make the fire in flight scenario a less than likely option. Fire cannot deselect transponders, nor call up menu options to shut down ACARS systematically, let alone preselect route 2 waypoints on the FMS.

(a) the fire had to burn such it disabled the power to certain electrical components and not other electrical components despite the fact that these electrical components are on the same power circuit.

(b) that this fire was hot and heavy enough to result in the incapacitation of the pilots yet light enough to burn itself out before effecting any of the control surfaces, cabling, etc so the plane could fly for five more hours.

The sudden decompression / hypoxia theory received a lot of attention early on, especially once it was established that the plane continued on in possibly zombie fashion for hours, bringing up memories of Payne Stewart’s (final) Learjet flight and Helios522 in 2005. Again, this is a scenario that is not impossible, but considering what we do know, highly unlikely. In the time period immediately following loss of contact, the aircraft was under pilot control, heading west for roughly an hour, then turns to the south (or north).  Given the aircraft was under control, the pilots would have been using their own oxygen source, but failed to communicate; whatever caused the immediate decompression would have likewise had to disable the several means of communication that we do know ceased functioning.

The theory that the plane flew, controlled, on the tail of one of the many flights in the air corridor heading west across the Malay peninsula has also been questioned. According to contributors to the thread on pprune, military radar can distinguish targets 300 feet apart, even 1960s technology was capable of 600 feet separation. Flying that close, at cruising speed, is difficult in the best of circumstances.  This was at night, while your aircraft is essentially flying dark (no communications, no TCAS as no transponder, etc.). It’s possible, of course, but it would be very challenging, and with 300-600 feet of separation nearly impossible, it would assume that every radar observer consciously or subconsciously rejected two valid blips where there should only be one as a fault.

A more fanciful theory, initially pitched (and still occasionally claimed) is a new take on terrorism. This theory has the flight crew disabled, and the 777 essentially stolen, to be flown off to some hidden runway for future malevolent use. If I’m running a terrorist operation, and I need a new weapon, I’m not going to hijack a 777 on a scheduled route with 230+ pax, just to store it somewhere. Loads of people will be, you know, looking for me and my Boeing as it’s sat on some highly visible 7000 foot runway somewhere (not to mention the initial Oceans-11 level of sophistication operation to get it there). Rather, I’m going to set up some shell freight company and go buy a fleet of beaters hanging out in the Tucson desert — there are still some sweet NW DC-10s there (many of which I probably flew on once). Given the sheer number of people searching for this thing, the resources at their disposal, and the finite (and known) number of runways capable of both landing, and critically for a scheme requiring re-use, successfully allowing the departure of a T7, the chances that it was stolen and landed somewhere are slim. Not zero, but awfully damned slim. Unless, of course, they also built their own new secret runway somewhere as part of this elaborate master plan.

Given the data on pinging to the satellites as part of the ACARS infrastructure, we know the two broad arcs where it was last. Since it had anywhere from 0 to 59 minutes of fuel remaining at the time, there’s a lot of territory expanding out from those arcs. As it a) hasn’t been spotted on the ground, and b) there’s thus far zero reports of it showing up on any other primary radar (between Thailand and Kazakhstan), especially given some of the borders on the northern arc are well observed by air defence radars, my guess is that the probability of it heading north to be quite low. Of course, it’s not in the interests of any of those countries on the northern arc to admit that possibly in the middle of the night their air defence radars were not switched on for budgetary considerations, understaffed as it was late at night heading into the weekend, or inadequately staffed, but my guess is that something would have been released or leaked by now.

The southern arc includes a lot of territory over the Indian Ocean that is both very deep, and relatively free of busy shipping lanes. While it’s *possible* that it landed at some hitherto unknown airfield or ex-WWII grass strip somewhere, it’s highly improbable (and would likely have been observed by now). It’s more likely it’s somewhere in the Indian Ocean, under a hell of a lot of water. Whereas with AF447 there was a really good idea in what patch of ocean it went down in, this one doesn’t have that advantage.

We have precious scant factual evidence of the what, we have a probabilistic guess as to the where, but the why will likely remain unknown. The FDR, if found (it took two years to locate AF447’s), will provide ample evidence of the aircrafts systems, but the CVR only records on a two hour loop, so that’s unlikely to provide much from the cockpit, and will not provide anything from the key time period immediately following the loss of contact. Of course, it’s also possible that the smart fire which disabled most of the communications systems also took out the sensors and / or power to both the FDR and CVR.

I’ll close this out with a quote from a 777 pilot:

I am a 777 pilot and have waded painfully through all these pages.

Just a few points:

To be pedantic the 777 transponder cannot be turned off in flight from the flight deck. ie depowered with digits blank. There is no off switch, however there is a standy position which will stop it radiating. You would have to pull the circuit breaker to totally depower it. In flight on the 777 you never go to standby if you are given a change of squawk.

As to who made the last radio call. If the Captain is handling pilot the copilot would normally make the radio calls. However for various reasons i.e. the copilot out of the flight deck, copilot on the intercom to cabin crew , the Captain may have made the call. So role is not definitive proof.

In the event of a fire you do not climb to snuff out flames.

Can a 777 get to FL450? In true mythbuster spirit we put this to the test in a 777-2 simulator. A 777 with a full load of passengers has a zero fuel weight of between 170 and 180 tonnes, say 175 tonnes. 8 hours of fuel is approximately 52 tonnes. So a takeoff weight of approx 227 tonnes minus a bit of taxi fuel. At that weight the FMS says Max Alt FL409. The plane will climb easily to FL410.

Now it gets interesting. At FL410 There is a very small gap on the airspeed tape between the VMO and the yellow which is minimum manoeuvring speed. If you disconnect the autothrottle and firewall the thrust levers, then wait until the speed is about to trigger the VMO warning and then disconnect the autopilot and raise the nose you can do a zoom climb. Although into the yellow pretty quickly there is still a long way before you get to the red digits on the airspeed which is the point at which the stick shaker activates.. The elevator gets incredibly heavy as it is made artificially heavier as the Boeing 777 really doesn’t want you to do this. With P2 pulling with all his might he still could not raise the nose to anywhere near 10 degrees. Putting the flight controls into direct mode made it easier. We got it to FL 443 at which point the stick shaker activated and P2 gratefully reduced the back pressure. This sim had GE engines. RR are a bit more powerful and if they had used an hour more fuel than our simulation I think it would have been feasible. Interestingly at FL440 the cabin alt was still at 8000 feet as per normal, so it must have used a higher diff than normal but still had not reached the max diff where the relief valve opens.

As regards the possibilities:

I believe the event probably started with the flight deck door opening and either a pilot exiting or someone else entering. I suspect someone with knowledge then deliberately disabled transponder, acars and satcom.

As for the gradual depressurisation theory. I cannot buy that because the normal cabin alt is 8000, if it gently depressurised it might not be noticed but at 10,000 feet cabin alt there is a very loud horn and red “cabin Alt” warning. No pilot should be unconscious by this point, the passenger masks don’t even drop until a cabin altitude of 14000 feet so they would have seen the warning at 10,000 feet and taken action.

The rapid depressurisation theory and the pilots unconscious due to either failing to put masks on or failure of the oxygen system. This might have been a possibility except the transponder stopped radiating. In an emergency descent you do not touch the knob of the transponder switch. I have never put a 777 transponder to sby in flight and it would be totally alien. The transponder selector knob is not part of the emergency descent checklist.

A massive electrical failure or smoke in the flight deck? Possible but extremely unlikely for it to all happen at once with no chance to get even a radio call out. Also flying for 5 more hours. Would it not be better to head for land then circle and get attention?

A great mystery.

[*] Yes, I’m looking forward to next month, not having had the time to so much as have a single alcoholic beverage in over three weeks. Of course, my first leg across the Atlantic is on a 777, an airliner that has perhaps the best safety record in history, with prior to MH370 only three hull losses, one of those being non-operational, and only three lives lost. Of course, the return TATL leg is on a 787, which is made out of plastic and catches on fire for fun.