Malaysia Airlines Flight 370 satellite communications

Known flight path taken by Flight 370 (red), derived from primary (military) and secondary (ATC) radar data.

Malaysia Airlines Flight 370 departed Kuala Lumpur International Airport at 00:41 Malaysia Standard Time (MYT) on 8 March 2014 (16:41 UTC, 7 March), bound for Beijing Capital International Airport.[3] At 1:19, Malaysian air traffic control (ATC) initiated a hand-off to Ho Chi Minh area ATC. The captain[4]^: 21 responded "Good night Malaysian Three Seven Zero", after which no further communications were made with the pilots.[4]^: 2 At 1:21, the aircraft disappeared from the radar of air traffic control after passing navigational waypoint IGARI (6°56′12″N 103°35′6″E) in the South China Sea between Malaysia and Vietnam.[4]^: 2 The aircraft continued to be tracked by Malaysian military radar, which recorded that Flight 370 deviated from its planned flight path, turning around and crossing the Malay Peninsula. Flight 370 left the range of Malaysian military radar at 2:22 and was last located 200 nmi (370 km; 230 mi) northwest of Penang.[4]^{: 2–3, 7} Flight 370 was expected to arrive in Beijing at 6:30 China Standard Time (CST) on 8 March (06:30 MYT; 22:30 UTC, 7 March). At 7:24 MYT/CST, Malaysia Airlines issued a media statement that Flight 370 was missing.[5]

The datalink for Malaysia Airline's avionics communications at the time of the incident was supplied by SITA, which contracted with Inmarsat to provide a satellite communication link using Inmarsat's Classic Aero service.[4]^: 48[6][7] Aeronautical satellite communication (SATCOM) systems are used to transmit messages from the aircraft cockpit as well as automated messages from on-board systems using the ACARS communications protocol, but may also be used to transmit FANS and ATN messages and provide voice, fax, and data links[8] using other protocols.[6][7][9] An appropriate comparison of ACARS' relationship to the SATCOM system is that of a messaging application to a smartphone; the smartphone functions and will remain registered on a mobile phone network even if the messaging application is closed.[9][10]

The data/messages from the aircraft are transmitted by the aircraft's Satellite Data Unit (SDU)[lower-alpha 2] and relayed via satellite to a ground station,[lower-alpha 3] where they are routed to other communication networks to reach their destination.[11]^: 2[12]^: 17[13] Messages may also be sent to the aircraft, in reverse order. When passing through the satellite, the signals are amplified and translated in frequency—mixed with the signal from an oscillator in the satellite, leaving the satellite at the combined frequency. Transmissions from the aircraft are made on one of several channels (frequencies) near 1.6 GHz, combined with frequency of the satellite's oscillator, and transmitted to the GES at the combined frequency (one of several channels near 3.6 GHz). The ground station then translates the received signal before it reaches equipment to be processed. The ground station keeps a log of transmissions and some data about them.[13][11]^{: 2, 9–11}[12]^: 17–18[14]^: 9–10

A depiction of an Inmarsat-3 series satellite. Flight 370 was in contact with Inmarsat-3 F1 (also known as "IOR" for Indian Ocean Region).

When the SDU tries to connect with the Inmarsat network, it will transmit a log-on request, which the ground station acknowledges.[9][12]^: 17 This is, in part, to determine that the SDU belongs to an active service subscriber and also used to determine how to route messages to the SDU.[9][11]^: 2 After connecting, if a ground station hasn't received any contact from a terminal for one hour,[lower-alpha 4] the ground station will transmit a "Log-on Interrogation" (LOI) message—informally referred to as a "ping";[12]^: 18 an active terminal automatically responds. The entire process of interrogating the terminal is referred to as a "handshake".[13][15]

Equipment at Inmarsat's Perth ground station had been upgraded in 2013 with additional storage capacity and new software to record an expanded data set for transmissions, including the addition of Burst Frequency Offset (BFO) and Burst Timing Offset (BTO) values.[16] Without the additional data values, it would have been impossible to determine the aircraft's distance from the satellite at each handshake.[16] The expanded data values were prompted by Inmarsat's involvement in the search for Air France Flight 447, which disappeared over the Atlantic Ocean in 2009. According to Mark Dickinson, Inmarsat's vice-president of satellite operations, the company did not know what the additional data might be used for, but had a "hunch" and upgraded their hardware.[16]

The aircraft was equipped with four emergency locator transmitters (ELTs):[4]^: 31–32

• a fixed ELT on the aft fuselage which is activated by sudden deceleration,
• a portable ELT in a cabinet located in the front of the aircraft which must be activated by moving a switch, and
• two ELTs attached to slide rafts which are armed when the rafts are inflated and activated by water immersion

Once activated, the ELTs emit a radio signal which can be detected by the satellites of the International Cospas-Sarsat Programme.[4]^: 31 The ELTs are designed to work at or near the water's surface. Damage during a crash, shielding by aircraft wreckage or terrain, and submersion in deep water are all factors which may prevent the signal's detection.[4]^: 32 In a review of accident records maintained by ICAO over the past 30 years, there were 173 accidents involving aircraft over 5,701 kilograms (12,569 lb) equipped with ELTs; of these, an effective ELT detection was made in only 39 accidents.[4]^{: 32–33, Appendix 1.6D} No signals from ELTs aboard Flight 370 were detected.[12]^: 3[17]

Malaysian investigators set up an international working group—the Joint Investigation Team (JIT)—consisting of various agencies with experience in aircraft performance and satellite communications, to further analyse the signals between Flight 370 and the ground station, especially the signal at 08:19.[15][12]^: 1 These included representatives from the UK's Inmarsat, Air Accidents Investigation Branch, and Rolls-Royce; China's Civil Aviation Administration and Aircraft Accident Investigation Department; the US National Transportation Safety Board and Federal Aviation Administration; and Malaysian authorities.[20]

After initial analysis determined that Flight 370's last location was within Australia's Search and Rescue region in the southern Indian Ocean, Australia played a major role in co-ordinating the analysis in conjunction with Malaysia. The Australian Transport Safety Bureau (ATSB)—responsible for the search for Flight 370—brought together a team of experts to determine the location of Flight 370 at the 08:19 communication. The team included the UK's Air Accidents Investigation Branch, Boeing, the Defence Science and Technology Organisation (Australia), Malaysia's Department of Civil Aviation, Inmarsat, the National Transportation Safety Board (US), and Thales.[21]

The analysis of communications from Flight 370 focuses on two key parameters associated with the messages:

• Burst timing offset (BTO) — The time difference between when a message is sent from the ground station and when the response is received. This measure is proportional to twice the distance from the ground station to the satellite to the aircraft. It includes the time between receiving and responding to the message at the aircraft SDU and the time between receiving and processing the response at the ground station, which are constant and can be calculated and removed. This measure can be analysed to determine the distance between the satellite and the aircraft, resulting in a ring on the Earth's surface that is equidistant from the satellite.[11]^: 4–6[12]^: 18
• Burst frequency offset (BFO) – The difference between the expected and received frequency of transmissions. The difference is caused by doppler shift as the signals traveled from the aircraft to the satellite to the ground station; the frequency translations made in the satellite and at the ground station; a small, constant error (bias) in the SDU that results from drift and ageing; and compensation applied by the SDU to counter the Doppler shift on the uplink. This measure can be analysed to determine where along the BTO rings the aircraft was located.[11]^: 9–11[12]^: 18

A few deductions can also be made from the satellite communications. The first deduction that can be made from the satellite communications is that the aircraft remained operational until at least 08:19—seven hours after final contact was made with air traffic control over the South China Sea. The varying BFO values indicate the aircraft was moving at speed. The aircraft's SDU needs location and track information to keep its antenna pointed towards the satellite, so it can also be deduced that the aircraft's navigation system was operational.[11]^: 4

Since the aircraft did not respond to a ping at 09:15, it can be concluded that at some point between 08:19 and 09:15, the aircraft lost the ability to communicate with the ground station.[10][13][15] Malaysia's Department of Civil Aviation noted this time was "consistent with the maximum endurance of the aircraft"[15] and this time is believed to have been the result of the aircraft entering the ocean after fuel starvation. The ATSB is "confident the seventh handshake represents the area where the aircraft ran out of fuel before entering the ocean."[22]

The log-on message sent from the aircraft at 08:19:29 was not immediately well understood.[13][15] The 02:25 handshake was also initiated by the aircraft.[12]^: 22 Only a few reasons that the SDU would transmit a log-on message exist, such as a power interruption, software failure, loss of critical systems providing input to the SDU, or a loss of the link due to aircraft attitude.[12]^: 22 Investigators consider the most likely reason to be that they were sent during power-up after an electrical outage.[12]^: 33 At 08:19, the aircraft had been airborne for 7 h 38 min; the typical Kuala Lumpur-Beijing flight is 51⁄2 hours and fuel exhaustion was likely.[12]^: 33[23] In the event of fuel exhaustion and engine flame-out, the aircraft's ram air turbine would deploy, providing power to various instruments and flight controls, including the SDU.[12]^: 33 Approximately 90 seconds after the 02:25 handshake, communications from the aircraft's inflight entertainment system were recorded in the ground station log. Similar messages would be expected following the 08:19 handshake but none were received, supporting the fuel starvation scenario.[12]^: 22

Relationship of the recorded BTO values to the time slot (top) and the path travelled (bottom).

For system efficacy and reliability, aircraft transmissions made in response to a signal from a satellite are sent in timed slots referenced to the time the signal from the satellite arrived, using the slotted ALOHA protocol.[11]^: 2[12]^: 18 The time that the signal is sent from the ground station begins the time slot. The burst timing offset (BTO) is the time difference between the start of the time slot and the start of the transmission received from the aircraft; it equals twice the distance (for the ground station's signal and the aircraft's response) from the ground station to the satellite to the aircraft plus the time the aircraft's SDU takes between receiving the signal and responding (the SDU bias) and the delay between the time the signal arrives at the ground station and the time it is processed (when the BTO value is logged; the ground station bias). The satellite's location is known, thus the distance from the satellite to the ground station can be calculated, while the combined bias of the SDU and ground station is relatively constant and can be calculated from signals exchanged earlier in the flight while it was on the ground at KLIA, thus leaving the distance between the aircraft and satellite as the only variable.[11]^{: 2, 4–6}[12]^{: 18, 54–55}

The BTO arc of the sixth handshake and a table of elevation angles of transmissions from the plane.

The combined SDU and ground station bias was calculated from 17 signals exchanged between the ground station and the aircraft during a 30-minute period before take-off, when the aircraft's location was known (at Kuala Lumpur International Airport). To establish the accuracy of their calculations, the bias value was used to calculate the distance from the aircraft to the satellite during the time it was on the ground at KLIA, with errors of <1 km-8.85 km (<0.6 mi-5.5 mi). The distance from the satellite to the aircraft was also calculated while the aircraft was in-flight and at a known location shortly after take-off, showing similar accuracy. The distance between the satellite and aircraft could thus be calculated for signals exchanged between 02:25–08:19, after Flight 370 disappeared from radar. However, this could only produce a ring on Earth's surface that is equidistant from the satellite at the calculated value, adjusted to account for the aircraft flying at 10,000 m (33,000 ft). The ring could also be reduced to an arc by taking into consideration the maximum range of the aircraft if it flew at its maximum speed.[12]^: 21[11]^: 5–6

The BTO value was added to the ground station's data set to assist in geo-locating an aircraft following the Air France Flight 447 accident in 2009[12]^: 19[11]^: 2 and the initial BFO analysis—relating the BFO value to the elevation angle between the aircraft and satellite—was based on methods developed during the Flight 447 investigation.[11]^: 4 The first and seventh handshakes gave anomalous results and were excluded from the initial analysis, but the issue was later resolved.[11]^: 4, 7 The initial analysis, accurate to approximately 1°, determined that elevation angle between the aircraft and satellite at the 08:11 handshake was 40°.[11]^: 4 When this was publicly disclosed by Malaysian officials, the arc was broken into two arcs—dubbed the "northern corridor" and "southern corridor."[24] The first and seventh handshakes were later determined to be part of a log-on sequence, as opposed to the other handshakes that were log-on interrogation messages. The bias value during the logon sequence is different and was calculated using historical data for the aircraft's SDU. This allowed the distance between the satellite and aircraft to be determined at these times.[11]^: 7

BFO contributing factors

While the BTO is able to determine the distance between the satellite and the aircraft at the time of each handshake, it was still necessary to determine where along the BTO arcs the aircraft was. To accomplish this, an analysis was performed on another attribute of received signals that was recorded by the ground station: the burst frequency offset (BFO)—the difference between the expected and actual frequencies of the signal received from the aircraft. The BFO is primarily caused by the Doppler shift—a shift in frequency caused by the relative movement of the aircraft, satellite, and ground station—along with several other factors which can be calculated and removed, allowing the Doppler shift between the aircraft and satellite to be isolated. The Doppler shift between the aircraft and satellite indicates the relative motion of the aircraft relative to the satellite, although multiple combinations of aircraft speed and heading exist that match a given Doppler shift value.[12]^: 22–24[11]^: 9–10

Sub-satellite points of Inmarsat-3 F1 during Flight 370 and an indication of its movement.

When the aircraft's SDU responds to messages sent from the ground station, it uses the aircraft's navigation system to determine the aircraft's position, track, and ground speed and adjusts the transmit frequency to compensate for the Doppler shift on the uplink signal, based on the satellite being located in its nominal position in geostationary orbit (35786 km above the equator) at 64.5°E.[12]^: 24[11]^: 11 The initial analysis was calculated with the satellite at its nominal location in geostationary orbit, 35,786 km (22,236 mi) above the equator at 64.5°E longitude. However, the Inmarsat-3F1 satellite was launched in 1996 with an expected life span of 13 years[25] and to extend its lifespan by conserving remaining fuel, it was allowed to drift from its nominal location into a slightly inclined orbit.[16] A map of the sub-satellite points—the location on Earth's surface directly beneath the satellite—shows that the satellite moves counterclockwise in an oval shape between 1.6°S–1.6°N and 64.45–64.58°E.[11]^: 4, 10 As a result, the adjustments made by the SDU only partially compensate for the Doppler shift on the uplink. This error is "immaterial" to the performance of the satellite network, but was crucial to eliminate the northern corridor during the initial analysis.[11]^: 11

As the signal passes through the satellite, it is translated by—added to—a signal generated by an oscillator in the satellite.[12]^: 23 Although the oscillator is housed in a temperature-controlled enclosure, it is subjected to thermal variation throughout the day that results in minor changes in the frequency of the translation signal. The thermal variation results from the rotation of the satellite relative to the sun over a given 24-hour period, including the time the satellite passes through the Earth's shadow (which affected the 3:40 and 4:26 handshakes), and is complicated by the use of heaters that run when the oscillator temperature exits pre-determined limits. The variation in the translation frequency was calculated over several days, including the day of Flight 370's disappearance, and could be factored into the BFO measurement.[11]^: 11, 14

Comparison of predicted BFO values of 1000 flight paths (left) with the actual values from Flight 370 (red dots on graph, right), shows a correlation with a track south into the Indian Ocean.

Additional factors that affect the BFO are a translation made at the ground station between the reception and processing of the signal (which is monitored and can be factored in) and a fixed bias in the aircraft and satellite oscillators due to drift and ageing (which can be calibrated by measures recorded when the aircraft's location and speed were known).[11]^{: 11, 13–14} At 2:40 and 6:14, ground-to-aircraft phone calls were made that were unanswered by the cockpit but acknowledged by the SDU. The signals associated with these calls could not be analysed to generate a BTO value, but BFO values of these signals can be considered in the analysis with the other BTO and BFO data.[11]^: 16

The technique used to analyse the BFO values was validated against 87 aircraft with the same SATCOM equipment operating in the region around the time of Flight 370's disappearance and against 9 previous flights operated by the same aircraft (9M-MRO).[12]^: 31 The sensitivity to error was calculated during the early phase of Flight 370 when the aircraft's location, track, and ground speed were known. This resulted in an uncertainty of ±28° heading and ±9° of latitude.[11]^: 16–17

The BTO analysis determined the distance between the satellite and aircraft, while the BFO analysis estimated the heading and speed of the aircraft, but is sensitive to small changes in input data.[12]^: 42[11]^: 11 To determine the final location of Flight 370, the BTO and BFO analyses were considered in combination with aircraft performance limitations, such as altitude, airspeed, and wind.[12]^: 16 The BFO analysis was able to isolate the Doppler shift between the aircraft and determine the relative motion of the aircraft to the satellite, which is reduced by the limited range of speeds at which the aircraft can fly and thus a limited set of speed/direction combinations exist that correlate with the calculated Doppler shifts.[12]^: 24

The aircraft has three autopilot modes. The standard mode for en-route navigation is LNAV, which navigates along a great circle route between waypoints, adjusting the aircraft's heading to compensate for wind. Other modes will maintain the aircraft's heading—direction the nose is pointed (flight path will be affected by winds)—or the aircraft's track—direction the aircraft travels (flight path in a straight direction). The latter two modes are further affected by whether the aircraft used magnetic (normal reference) or true north (typically only used at high latitudes) as the reference for the autopilot. Since Flight 370 flew near waypoints VAMPI, MEKAR, NILAM, and possibly IGOGU—all along air route N571—while traversing the Malacca Strait, investigators considered whether Flight 370 followed any air routes or intersected any waypoints in the Southern Indian Ocean.[12]^: 37–38 Waypoints MUTMI and RUNUT were considered possible points that Flight 370 may have traversed, but tracks through these waypoints did not correlate well with paths generated from the BTO and BFO analysis.[12]^: 39

Two analysis techniques were used to combine the BTO and BFO results with flight parameters:[12]^: 18[21]^: 10–11

• Data error optimisation – Candidate paths varied speed and heading at each handshake to minimise the error between the calculated BFO of that path versus the actual BFO recorded from Flight 370. These paths were not constrained by the behaviour of the aircraft's autopilot.
• Constrained autopilot dynamics – The aircraft is assumed to be flying under the control of one of the autopilot modes. Candidate paths were generated using each mode. BTO and BFO values of each path were calculated and compared against the recorded values from Flight 370.

Combined analysis results. Refined flight path model that defined the priority search area for the underwater phase of the search. The purple region is the maximum cruise range, based on several possible scenarios. The red lines are candidate paths generated by various autopilot modes and scenarios. Those paths were then broken into segments between each satellite transmission from the aircraft and speed to minimise the difference with the measured BFO. The overlap between the red and green lines represent the most likely flight paths of Flight 370 up to 08:19 MYT (00:19 UTC).

The top 100 constrained autopilot dynamics candidate paths were selected on the basis of their match with the satellite data from Flight 370 and their consistency with autopilot behaviour. The distribution of these paths at the intersection with the 6th handshake was then generated, with some paths outside (south) of the maximum range of the aircraft and which can therefore be eliminated. The candidate paths generated by the data error optimisation method were weighed according to the root mean square of the BFO values at each handshake. The distribution of results from these two methods were charted together, indicating that the total probability areas overlap on the 08:11 arc between approximately 35–39°S. These paths have then been extrapolated to the seventh handshake at 08:19 and constrained by the maximum range, intersecting the seventh arc between approximately 33.5–38.3°S. This is the most likely location of Flight 370 at the time of the seventh handshake.[21]^: 12

Knowing the location at the seventh handshake, investigators then needed to determine an appropriate width of the search area from the seventh arc. The seventh handshake was a 'log-on request' initiated by the aircraft and is believed to be the result of the SDU starting after power failure, resulting from fuel exhaustion and following the deployment of the ram air turbine and restart of the auxiliary power unit. The log-on request would have occurred 3 minutes and 40 seconds after fuel exhaustion—commonly known as flameout in aviation—of the second engine (flameout of both engines would not have occurred simultaneously), at which point the autopilot would have disengaged.[12]^: 33 The BFO value of this handshake indicates the aircraft may have been descending[21]^: 12 and the aircraft was travelling northeast to southwest.[12]^: 35

An analysis of aircraft systems, particularly the electrical system and autopilot, are ongoing. Boeing and Malaysia Airlines have conducted numerous end-of-flight scenarios in their Boeing 777 simulators. The scenarios involve flameout in one engine before the other without any input from the cockpit. This scenario results in the aircraft entering a spiraling low-bank turn with the aircraft entering the water a relatively short distance from the last engine flameout.[21]^: 12 If control inputs were made (i.e. the plane was under the control of a pilot) and depending on the initial altitude, it is possible that the aircraft could glide over 100 nautical miles (190 km; 120 mi). However, investigators believe Flight 370 was most likely uncontrolled at this point. The ATSB cites a previous study conducted for the BEA,[26] which determined that in cases of an upset followed by loss of control all impact points were within 20 nmi (37 km; 23 mi) of the start of the emergency, and in most cases within 10 nmi (19 km; 12 mi). Based on this, the ATSB chose a 50 nmi (93 km; 58 mi) width—20 nmi (37 km; 23 mi) to the west and 30 nmi (56 km; 35 mi) to the east of the arc—for the underwater search in June 2014.[12]^: 34–35 While keeping the 50 nmi width for the priority search area, the ATSB determined that the aircraft most likely entered the ocean close to the seventh arc and the underwater search would be conducted from the seventh arc and progress outwards.[21]^: 12