The SDU Re-logon: A Small Detail That Tells Us So Much About the Fate of MH370

MCS 6000

The Honeywell/Thales MCS6000 Satellite Data Unit is the middle of the three boxes shown here.

 

One of the peculiarities of the MH370 mystery is that, while we have only a very small handful of clues about the fate of the plane, some of them often get overlooked due to their highly technical nature. Today I’d like to revisit a topic that I’ve touched on before but which I feel continues to be get short shrift: the re-logon of the  MH370 Satellite Data Unit, or SDU. Just on its own, this little data point tells us a great deal about what happened to the missing plane.

First, some basic background. Flight MH370 took off from Kuala Lumpur International airport at 16:42 UTC on March 7, 2014 bound for Beijing. At 17:07:29, the plane sent an ACARS report via its satcom. At 17:20:36, five seconds after passing waypoint IGARI and a minute after the last radio transmission, the transponder shut off. For the next hour, MH370 was electronically dark. The next ACARS transmission, scheduled for 17:37, did not take place. At 18:03 Inmarsat attempted to forward an ACARS text message and received no response, suggesting that the satcom system was turned off or otherwise out of service. At 18:22, MH370 vanished from primary radar coverage over the Malacca Strait. Three minutes later the satcom system connected with Inmarsat satellite 3F-1 over the Indian Ocean and inititated a logon at 18:25:27.

The question is, by what mechanisms could MH370’s satcom have become inactive, then active again?

Logging on and off the satcom is not something airline pilots are trained to do. A pilot can deselect the satcom as a mode of transmission for ACARS messages so that they go out over the radio instead, but this is not what seems to have happened in the case of MH370. According to the ATSB report issued in June of 2014,

A log-on request in the middle of a flight is not common and can occur for only a few reasons. These include a power interruption to the aircraft satellite data unit (SDU), a software failure, loss of critical systems providing input to the SDU or a loss of the link due to aircraft attitude. An analysis was performed which determined that the characteristics and timing of the logon requests were best matched as resulting from power interruption to the SDU.

Like most of us, I’d never heard of an SDU before MH370 happened.

It’s a piece of equipment which processes the signals that are transmitted and received between the plane and the satellite network. The SDU lives above the ceiling of the passenger cabin, toward the back of the airplane, near the rear emergency exit. The reason it’s there is that in order for it to work efficiently, it needs to be located as close as possible to the satellite antennae, which protrude from the top of the airplane just above it. Imagine an electronic version of an old-timey ham radio operator sitting underneath a radio tower. Bear in mind that the SDU doesn’t generate information per se; it’s just providing the link between the aircraft and the satellite. A useful analogy is to think of your smart phone. When you turn it on, it connects to the cell network, but it doesn’t communicate with anyone until you send a text message, make a phone call, or activate an app.

The SDU is a very important piece of equipment in the MH370 saga because the seven pairs of BTO and BFO values, which together comprise all that we know about the final six hours of the flight, depend on computations carried out in the SDU.

How could the SDU power interruption have occurred? For one thing, it couldn’t have happened accidentally. Independent researchers have spent months trying to figure out a way that the SDU could have logged off and back on again without human intervention, without success. So it must have been intentional. However, there is no on/off switch for the SDU in a 777 cockpit. A person wanting to turn the SDU off has two options. The first is to descend into the electronics and equipment bay (E/E bay) through a hatch at the front of the first-class cabin and flip three circuit breakers located there. I call this the “easy way.” The second method, which can be accomplished directly from the cockpit, is to isolate the portion of the plane’s electrical system which feeds the SDU, the left AC bus. I call this the “hard way.” Since it’s quite complicated, I’d like to discuss it in greater detail.

According to IG member Barry Martin, the left main AC bus can receive its electrical power from any one of four sources:

  • left main engine IDG via a left generator circuit breaker
  • right main AC bus via both left and right bus tie breakers
  • auxiliary power unit generator via an auxiliary power breaker and the left bus tie breaker
  • backup generator converter which connects to the left transfer bus via a left converter circuit breaker, and the left transfer bus connects to the left main AC via a left transfer bus breaker.

In order to prevent any of these from supplying electrical power, Martin writes, a multi-step process is required:

The left IDG can be disconnected in a couple of ways via the flight deck electrical power system control panel. The preferred method would be via the left generator control switch. The second method is by use of the guarded drive disconnect switch, which permanently disconnects the IDG and the connection can only be remade on the ground. The L GEN CONT switch will open the left generator circuit breaker, but the left bus tie breaker would then automatically close to re-energise the left main bus so the left BTB must be switched to ISLN on the electrical control panel before attempting to disconnect the IDG.

The left main bus can still be powered from the left transfer bus which picks up power from a solid-state variable-speed constant-frequency backup generator converter. The easiest method of preventing this is by simply opening the left transfer bus breaker, which allows the left transfer bus to remain energised to ensure the left transformer rectifier unit stays powered. However, I don’t see an option on the flight deck control panel to manually open the left transfer bus breaker. A second option would be opening the left converter circuit breaker, connecting the left transfer bus to the backup generator. Again, there’s no L CCB switch on the panel. Therefore the third option is to switch both backup generators off, which is possible via the panel.

This explanation is somewhat above my paygrade but my takeaway is that isolating the left AC bus requires some technical savvy—indeed, technical savvy beyond the ambit of 777 pilots. When I asked Patrick Smith, a 777 pilot who is one of the most well-regarded aviation commentators in the US, about the SDU reboot, he replied, “The what?” After I explained, he answered: “There isn’t a 777 pilot alive, I’ll bet you, who has the remotest clue as to what the SDU is.” I’ve brought up the topic with many other 777 pilots I respect and have gotten essentially the same response.

I would add that while it seems clearly possible to power the SDU on and off my isolating and then reconnecting the left AC bus, to do so would be a risky undertaking. In a fascinating blog post on Flight.org an airline pilot who goes by the handle “Ken” describes going through a simulated left AC bus failure in the course of a training session. He notes that among the systems lost were Window Heat (Left) and a Primary Hydraulic Pump (Left). “No biggie,” he writes, but adds that in addition:

…there are a whole host of ancillary services lost. Many of these are reflected by the amber lights on the overhead panel. Having looked at the roof – you later discover even then that it’s not the whole story. In this particular scenario we decided to return to KLAX. Part of the return process was fuel jettison down to maximum landing weight. Guess what? Without the Left Bus – the main tank jettison pumps are failed. You’ll be advised of this… when you start the fuel jettison. I didn’t give this a second thought… but the discussion we had afterwards that included a talk about this little quirk of the Boeing EICAS/ECL was interesting. There are no EICAS/STATUS messages to advise you of everything you’ve lost, and in many cases, until you attempt to use something that’s failed – you won’t know about it. Older aircraft used to publish a Bus Distribution List (Electrical and Hydraulic) so that you’d know exactly what you’d lost with a particular electrical bus failure – but not on the 777. My fellow pilots were vaguely disturbed by the lack of information.

It’s not impossible to imagine that one of the pilots cooked up a plan that involved switching off the satcom by isolating the left AC bus, but to do so they would have had to do intensive research into the issue, without any way of knowing if their research was complete. “ It can be difficult to find out just what equipment is powered by a particular bus,” says Smith, “so if you start isolating buses you’ll likely wind up shutting down things you don’t mean to or expect to.” All told, this would be a complicated and risky strategy.

And to what end? Why would anyone want to depower the SDU anyway?

One might imagine that the SDU was powered down for the same reason that the other forms of electronic communication were shut down around the time MH370 reached IGARI: to slip away from ATC surveillance in order to pull a 180 and slip away undetected. One doesn’t need to depower the SDU to go dark, however.  If the satcom was deselected for ACARS and the IFE was switched off (both of which are easily accomplished from the cockpit) then there would be no reason for a pilot to fear that the satellite would give away his position.

Some have raised the possibility that whoever took MH370 didn’t want to turn off the SDU per se, but wanted to turn something else that was on the left AC bus and wound up taking the SDU along with it as an uintended consequence. If so, the crucial question then becomes: What else is powered by the left AC bus? It wasn’t easy to find out, but after months of painstaking digging, a number of independent researchers were able to collectively determine that some of the other systems fed by the AC bus are:

  • TCAS (Traffic Collision Avoidance System)
  • Cockpit door lock
  • The centre tank override and jettison pumps
  • Some galley equipment
  • IFE (in-flight entertainment system, which includes passenger satellite phone service)
  • One of the high-frequency radios
  • The main passenger cabin lighting system (the night, cabin and cross-aisle lights remain powered)
  • The Cockpit Voice Recorder (CVR)

There is only one piece of equipment on this list that someone who is in the process of stealing a plane might be strongly motivated to shut off, and that is the cockpit voice recorder. Recall that in December, 1997, the pilot of Silkair Flight 185 apparently got up out of his seat and pulled the circuit breakers for the CVR before returning to the cockpit and flying the plane into the ground. Because the CVR wasn’t working, investigators couldn’t tell exactly what happened in the cockpit in the moments before the crash, so the pilot’s guilt was impossible to establish conclusively. Which presumably was the point.

The idea that MH370’s pilot isolated the left AC bus in order to shut down the CVR is problematic, however. For one thing, it would be far simpler to depower the CVR the “easy way,” by going down into the E/E bay and pulling the circuit breakers. But maybe the pilot had locked the co-pilot out of the cockpit, and so wasn’t free to leave to go down into the E/E bay? In that case, isolating the left AC bus would have had the reverse of the desired consequences. Anyone savvy enough to know how to depower the left AC bus would also understand that the CVR over-writes itself every two hours. Therefore cutting power to the CVR would result in the preservation of the recording of whatever was said and done when the pilot talked the copilot out of the cockpit and locked the door.

Of course, if the pilot planned to fly the plane six hours into the middle of the southern Indian Ocean, he’d have no reason to shut down the CVR anyway, since its contents would be come erased during the long flight into oblivion.

To sum up, the fact that the SDU logged back on with Inmarsat three minutes after leaving primary radar coverage is one of the most significant clues that we have to the fate of MH370. By itself, it rules out the possibility that MH370 went dark due to fire or electrical malfunction (which remains a popular theory despite being impossible for several other reasons as well) and it strongly suggests that the plane was not hijacked by one of its own pilots for the purposes of committing suicide (another popular theory). Instead, the SDU re-logon suggests the plane was taken over by a passenger or passengers with a sophisticated knowledge of aircraft electrical systems.

This may well be one of the reasons that the French judicial authorities are treating MH370 as a terrorist investigation.