Safety Investigation Report 2018:1 Factual Information/1.6

SAFETY INVESTIGATION REPORT MH370 (9M-MRO)

1.6 AIRCRAFT INFORMATION

1.6.1 Airframe

Manufacturer	Boeing Company
Model	777-2H6ER
Serial Number	28420
Manufacturer’s Line No.	404
Variable No.	WB175
Registration	9M-MRO
Date of manufacture	29 May 2002
Date of delivery to MAS	Delivered new on 31 May 2002
Certificate of Airworthiness	M.0938 valid to 02 June 2014
Certificate of registration	M.1124 issued 23 August 2006. Replacement of Certificate issued on 17 June 2002
Last Maintenance check	A1 Check on 23 February 2014 at 53,301:17 hours and 7,494 cycles
Total airframe hours/cycles	53,471.6 hours/7,526 cycles (as of 07 March 2014)

1.6.2 Engine

Manufacturer	Rolls-Royce
Model	RB211 Trent 892B-17
Engine 1 (Left)
Serial Number	51463
Date of Construction	November 2004
Date Installed	08 May 2013
Last Shop Visit	06 September 2010 to 21 November 2010
Time in Service	40,779 hours, 5,574 cycles (as of 07 March 2014)
Engine 2 (Right)
Serial Number	51462
Date of Construction	October 2004
Date Installed	15 June 2010
Last Shop Visit	05 February 2010 to 14 April 2010
Time in Service	40,046 hours, 5,508 cycles (as of 07 March 2014)

1.6.3 Auxiliary Power Unit

Manufacturer	Allied Signal
Model	GTCP 331-500B
Serial Number	P1196
APU Hours	22,093 (as of 07 March 2014)

1.6.4 Airworthiness and Maintenance

The aircraft, Serial Number 28420, was issued with a Federal Aviation Administration (FAA) Export Certificate of Airworthiness No: E370249 on 29 May 2002 and placed on the Malaysian aircraft register as 9M-MRO on 03 June 2002. Ownership of the aircraft, as stated on the Certification of Registration (C of R), was Malaysian Airline System Berhad. The ownership was subsequently changed to Aircraft Business Malaysia Sdn. Bhd., as the lessor, and leased and operated by MAS. A new C of R to reflect the new owner was issued on 17 June 2002.

A Certificate of Airworthiness (C of A) in the ‘PRIVATE’ category was initially issued on 03 June 2002. The aircraft was then flown to Kuala Lumpur, Malaysia where a C of A in ‘TRANSPORT PASSENGER’ category was issued by the DCA Malaysia on 12 June 2002 after the pre-service modifications were accomplished.

The C of A was subjected to annual renewal by DCA Malaysia and its renewal was subjected to compliance to the DCA Malaysia Airworthiness Notice No. 2 - Certificate of Airworthiness Renewal Procedure. The operator was required to declare the aircraft, engine, APU and equipment maintenance status as per the approved Maintenance Schedule, and that they complied with all the mandatory inspections and modifications originating from the State of Manufacture and State of Registry. The Quality Assurance Department of MAS was required to submit an ‘Aircraft Physical Inspection for the Purpose of C of A Issue/Renewal’ prior to the expiry of the C of A. An ‘Aircraft Survey Report for Certificate of Airworthiness’ will be issued by the DCA Inspector after a satisfactory physical inspection on the aircraft has been carried out. At times, the physical aircraft inspection has to coincide with the aircraft scheduled check at base or line maintenance.

The last C of A document review by DCA Inspector was carried out on 15 May 2013 for the C of A renewal and the aircraft physical inspection was carried out by MAS Quality Assurance Engineer (QAE) on 12 April 2013. The only inspection defect noted was a torn left hand flaperon inboard seal which was subsequently replaced. The aircraft C of A was renewed with no airworthiness issues identified.

1) Aircraft Maintenance Schedule

Brief description of the sections follows:

a) Section 1

The definition and introduction of the routine check types. Check intervals and limitations at which the maintenance tasks are to be carried out.

b) Section 2

Task Maintenance Requirements relating to on-wing tasks or tasks to be performed on parts after removal from the aircraft, their intervals and control in the routine maintenance check or independently.

c) Section 3

Component Maintenance Requirements on tasks to be performed on components, their intervals and controlled independently.

d) Section 4

Registers all the applicable job cards which are tied up to the maintenance Checks or Phases of inspections or tasks. The job cards/task cards cover the system, power plants, structural and zonal tasks.

The Master document of the approved Maintenance Schedule is stored in the Engineering Maintenance System (EMS) computer system bank and subject to regular revisions.

In addition to the Maintenance Schedule, a Supplementary Maintenance Schedule covered MAS’ own generated tasks, non-mandatory manufacturer/vendor recommended tasks and non-airworthiness items.

The Maintenance check cycles are translated into the routine Transit Check, Stayover Check, Equalised ‘A’ Check, ‘C’ Check, ‘C Extended’ Check and ‘D’ Check. Table 1.6A (below) summarises the maintenance check intervals.

Transit	Stay-over	A Check	C Check	CX (Extended Check)	D Check
Whenever aircraft is on transit	6 hours planned or 12 hours unplanned	In 4 parts A1 thru A4 A1 to A2 = 550 hours A2 to A3 = 550 hours A3 to A4 = 550 hours A4 to A1 = 550 hours	In 2 parts C1 and C2 C1 to C2 = 13 months C2 to C1 = 13 months	52 months	8 years

Table 1.6A - Maintenance Check Intervals

No.	Type of Aircraft Checks	Date of Aircraft Checks	Airframe Hours	Landing Cycles
1	A1	23 February 2014	53,301:17	7,494
2	A4	14-16 January 2014	52,785:37	7,422
3	A3	13 December 2013	52,323:00	7,359
4	A2	04 November 2013	51,766:29	7,282
5	C1 and A1	29 August - 26 September 2013	51,270:15	7,208
6	A4	24-25 July 2013	50,810:19	7,132
7	A3	19 June 2013	50,372:07	7,069
8	A2	14 May 2013	49,840:28	6,994
9	A1	04 April 2013	49,331:52	6,910
10	A4	19-20 February 2013	48,836:23	6,840
11	A3	10 January 2013	48,291:37	6,766
12	A2	03 December 2012	47,749:39	6,693
13	A1	25 October 2012	47,214:27	6,617
14	A1, A4 and C2	06-22 July 2012	46,727:16	6,552
15	A4,C2, CX and D	25 May - 26 June 2010	37,014:15	5,304

Table 1.6B Recent Aircraft Checks

A review of the maintenance records for 9M-MRO revealed the following sequence of recent checks (Table 1.6B [above]) carried out by MAS prior to the disappearance of the aircraft on the 08 March 2014. No significant defects were noted during the checks including the turn-around transit checks.

The Maintenance Schedule incorporated the Structural Inspection Programme based on the B777 Maintenance Review Board Report and B777 Maintenance Planning Document, which are categorised as Structural Inspection Items, Corrosion Prevention and Control Items and Fatigue Related Inspection Items. Inspection findings would be evaluated by the MAS Reliability Section of the Technical Services Department and the department would recommend any follow-up actions as necessary and report to Boeing Company of all significant structural discrepancies.

The Maintenance Schedule also included compliance procedures for Airworthiness Directives⁵, Airworthiness Limitations (AWL)⁶ and Structural Inspections with Provisions for Damage Tolerance Rating. It also included Certification Maintenance Requirement Compliance to the Extended Twin Engine Operations (ETOPS)⁷ operational approval, which was obtained from DCA Malaysia. The MAS B777 ETOPS Maintenance Manual specified the maintenance policies, procedures and requirements for ETOPS operations. A policy to prevent the same personnel to perform or certify certain tasks on multiple similar systems at the same downtime is stipulated. ETOPS task intervals cannot be exceeded. If a concession is given for a check that contains ETOPS task or for individual ETOPS task, the aircraft must be downgraded to non-ETOPS status. 9M-MRO was approved and had no limitations for ETOPS operations at the time of departure from Kuala Lumpur to Beijing. It was not on an ETOPS flight plan. MAS and its fleet of B777 were approved for Reduced Vertical Separation Minimum (RVSM) operation.

__________________________________

⁵An AD is a notification to owners and operators of certified aircraft that a known safety deficiency with a particular model of aircraft, engine, avionics or other system exists and must be corrected. It is mandatory in nature.

⁶AWLs are items that the Certificate process has defined as critical from a fatigue or damage tolerance assessment.

⁷ ETOPS is an aviation rule that allows twin-engine airliners to fly long distance routes that were previously off- limits to twin-engine aircraft.

2) Major Repair

There was an entry in the Aircraft Log Book on 09 August 2012 that the aircraft right wing tip was damaged during taxiing at Pudong, Shanghai Airport. The aircraft collided with a China Eastern Airlines A340-600, registered B-6050. The right wing tip of 9M-MRO ran into the left horizontal stabilizer of B-6050. Part of the aircraft wing tip was ruptured and stuck at the left elevator of the B-6050. Figures 1.6A and 1.6B (below) show the wing tip damages.

Figure 1.6A - Right Wing Tip Damage

Figure 1.6B - Damaged Wing Tip

Boeing produced an Aircraft Survey Report reference WB175/W8134/LN404 on 15 August 2012 and the repair was carried out by Boeing Aircraft-On-Ground (AOG) Team at Pudong, Boeing Shanghai facility from 22 September to 03 October 2012. The Boeing repair scheme was approved under DCA Malaysia’s Statement of Compliance (SOC) Reference Number SC/2012/081 issued on 03 September 2012. At the time of the incident, the recorded airframe hours were at 46,975:43 and landing cycles at 6,585.

There was a requirement for damage tolerance⁸ information to be incorporated in the aircraft maintenance programme within 24 months from 02 October 2012 as stated in the FAA Form - Organization Designation Authorization (ODA). This damage tolerance information was not yet included in the maintenance programme for the aircraft at the time of the occurrence.

3) Cabin Configuration Change

The fleet of B777 of MAS went through a cabin interior retrofit programme which converted the configuration from 12 First Class seats/33 Business Class seats/233 Economy Class seats to 35 Business Class and 247 Economy Class seats. On 9M-MRO, this re- configuration started on 17 August 2006 and was completed on 08 September 2006. The modification was approved under FAA Supplemental Type Certificate (STC) No. STO1493SE dated 24 January 2005 and DCA’s SOC No. SC2004/98.

4) Mandatory Occurrence Reports

A A review of the Mandatory Occurrence Reports (MORs) for the B777 fleet raised by the Engineering & Maintenance Quality Assurance Department of MAS revealed that only one was raised for 9M-MRO, and this was related to the right wing tip damage stated above. A total of 77 MORs were raised for the MAS fleet of 17 B777 aircraft. MORs raised by the Quality Assurance department are primarily related to technical issues with the fleet. The average age of the B777 fleet as of 01 March 2014 was 14.35 years. 9M-MRO was 11.75 years old.

____________________________

⁸ Damage tolerance means that the structure has been evaluated to ensure that should serious fatigue, corrosion or accidental damage occurs within the operational life of the aircraft, the remaining structure can withstand reasonable loads without failure or excessive structural deformation until the damage is detected.

5) Airworthiness Directives

Maintenance and Inspection records provided by MAS indicated that at the time the aircraft 9M-MRO went missing, the aircraft and engines were fully compliant with all applicable Airworthiness Directives (AD).

The most recent AD, which was accomplished on 17 January 2014, was FAA AD 2012-13-05 which made mandatory the accomplishment of Boeing Service Bulletin 777-35A0027 which requires replacement of low pressure oxygen hoses in the cockpit. The changes provided in the service bulletin are to prevent damage to the low pressure oxygen hoses that may be subjected to electrical current. An electrical current condition in the low pressure oxygen hose can cause the low pressure oxygen hose to melt or burn. This could result in smoke and/or fire in the flight compartment. An operator (not MAS) reported that a fire originated near the first officer's area which caused extensive damage to the cockpit. One scenario of the causes being considered is that an electrical fault or short circuit resulted in electrical heating of the low pressure oxygen hoses in the flight crew oxygen system. This service bulletin is to replace low pressure oxygen hoses with non-conductive low pressure oxygen hoses located in the cockpit. The replacement of the low pressure oxygen hoses will prevent electrical current from passing through the low pressure oxygen hose internal anti-collapse spring which can cause the low pressure oxygen hose to melt or burn.

An FAA AD 2014-05-03 was issued and became effective on 09 April 2014. This AD made mandatory the accomplishment of Boeing Service Bulletin 777-53A0068 which addresses a crack in the fuselage skin under the SATCOM antenna adapter. The Service Bulletin was issued on 12 June 2013. The AD was issued to detect and correct cracking and corrosion in the fuselage skin, which could lead to rapid decompression and loss of structural integrity of the aircraft. However, this AD was not applicable to 9M-MRO as the location and configuration of the antenna on the aircraft, as delivered by Boeing ex- production, were different and not affected by the issues highlighted in the Service Bulletin.

6) Technical Log

a) MR1 and MR2

The MAS Technical Log Book was divided into Maintenance Report 1 (MR1) and Maintenance Report 2 (MR2). The MR1 has provision for the flight crew to enter any aircraft defects for each flight phase. It can also be used to enter maintenance required and rectifications by the Licenced Aircraft Maintenance Engineers (LAME) or Approval Holders, or defer defects within the Minimum Equipment List (MEL) procedures to the Maintenance Report 2 (MR2) section.

A review of the Technical Log entries for 9M-MRO since the last D check in June 2010 did not reveal any significant defects or trend.

The most recent entries made in the Technical Log Book for 9M-MRO are listed in Appendix 1.6A.

b) Oxygen System Replenishment

A Technical Log entry of interest, made on 07 March 2014, is the replenishment of crew oxygen system. This replenishment was reviewed in detail together with information gathered from the interview of the LAME who performed the task. Replenishment (servicing) of the crew oxygen system is a routine procedure, carried out before the minimum pressure required for departure is reached, usually carried out during a Stayover check. The minimum pressure for despatch as per the MAS Minimum Equipment List (MEL) is 310 psi at 35°C for 2-man crew and with a 2-cylinder configuration (as installed on MAS B777 fleet).

It has been the practice of the airline to service the oxygen system whenever time permits, even if the pressure is above the minimum required for despatch.

During the Stayover check on 07 March 2014, the servicing on 9M-MRO was performed by the LAME with the assistance of a mechanic, as the pressure reading was 1120 psi. The servicing was normal and nothing unusual was noticed. There was no leak in the oxygen system and the decay in pressure from the nominal value of 1850 psi was not unusual. The system was topped up to 1800 psi. Before this servicing, maintenance records showed that the system was last serviced on 14 January 2014 during an A4 check.

A small amount of oxygen is normally expended during pre-departure checks of the oxygen masks by the flight crew.

Oxygen pressure is also dissipated by a bleed valve in the system for a few seconds during engine start following the end of a flight.

7) Deferred Defects (Maintenance Report 2)

A review of the aircraft records from the MAS Maintenance Control Centre (MCC) showed that the following defects were outstanding on 9M-MRO and deferred to the Deferred Defect Log (Table 1.6C, [below]). The hole found on the right engine acoustic panel, mentioned below in item 7, was of dimension of approximately 1 inch by 1 inch and is allowed to be deferred by the B777 Maintenance Manual until permanent repair is carried out within 500 flight hours. This minor damage is considered normal wear and tear of the engine nacelles and does not pose any hazard to the engine.

No.	Deferred Date	Defect
1	25 Sep 2013	To carry out installation test for aft water quantity gauge.
2	31 Oct 2013	In-Flight Entertainment (IFE) Airshow does not show arrival time/time to destination logged time & problem still persists.
3	07 Nov 2013	FrFrom Daily Engineering Operations Report (DEOR) - Right engine consumes average 1.5T more fuel per/hour compared to left engine
4	21 Jan 2014	Toilet 3F-1L mirror light lens broken
5	30 Jan 2014	Pre-departure F/O seat power adjustment (fwd/aft) found inoperative.
6	05 Mar 2014	Please check alignment for left runway turn/off light.
7	05 Mar 2014	Hole found at 6 o'clock position of the right engine acoustic panel.

Table 1.6C - Deferred Defects

8) Engine Health Monitoring

Engine Health Monitoring (EHM) was contracted out to Rolls Royce, the engine manufacturer. Engine data ‘snapshot’ reports were generated by the Aircraft Condition Monitoring System (ACMS) and transmitted via ACARS to MAS, who then submitted them to Rolls Royce for analysis on its behalf. The transmitted engine parameters primarily used to assess engine health are:

Turbine Gas Temperature
Shaft Speeds
Shaft Vibration (Low Pressure, Intermediate Pressure and High Pressure)
Oil Pressure
Oil Temperature

The EHM system trend reports over the last 3 months which covered ‘snapshot’ data points gathered at take-off, climb and cruise received through the ACMS show no evidence of unusual engine behaviour for both engines. On the occurrence flight, 2 EHM reports were transmitted; the first was a Take-off report generated at 1641:58 UTC, 07 March 2014 [0041:58 MYT, 08 March 2014] and the second was a Climb report at 1652:21 UTC, 07 March 2014 [0052:21 MYT, 08 March 2014]. Reports are transmitted by ACARS at convenient times during the flight (not necessarily at the time of generation/data capture). Both reports did not show any unusual engine behaviour. The data transmitted on these reports are shown in Appendix 1.6B - Engine Health Monitoring Decoded Data for Take-off and Climb Reports. The ACMS will also generate other pre-defined engine reports including engine parameters’ exceedance reports. However, no such EHM reports were received during the flight. Position reports are also transmitted, via ACARS, every 30 minutes. Refer to Section 1.9.4 for further details.

9) Central Maintenance Computing System

The Central Maintenance Computing System (CMCS) collects and stores information from most of the aircraft systems. It can store fault histories as well as monitor and conduct tests on the various systems. The fault history contains details of warnings, cautions and maintenance messages.

At regular intervals, during flight, the CMCS transmits any recorded fault messages, via the ACARS, to the Maintenance Control Centre (MCC) of MAS. This helps in the planning and preparation for the rectification of any potential aircraft defects at the main base or line stations.

The traffic log of maintenance messages transmitted for the last 10 flights on 9M-MRO were reviewed. There were messages transmitted, indicating that the CMCS was functioning prior to the occurrence flight. However, no maintenance messages were transmitted during the occurrence flight. These messages are transmitted in real time that is, as the faults occur.

Maintenance messages are not displayed on the Engine Indicating and Crew Alerting System (EICAS) in the cockpit and they are not used to determine the airworthiness of the aircraft. They provide diagnostic information useful in troubleshooting or maintenance planning. Only maintenance messages which trigger EICAS Alert messages require maintenance action (including deferment, if allowable) prior to despatch.

1.6.5 Weight and Balance

The aircraft underwent a scheduled reweighing on 28 April 2009 at the MAS maintenance facility at KLIA. The next aircraft re-weighing was due on or before 27 April 2014. The aircraft Weight Schedule dated 12 June 2009 was reviewed with the following pertinent details (also refer to Table 1.6D [below]):

Basic Empty Weight (BEW) of 138,918.7 kg
Centre of Gravity (C of G) position of 1,248.8 Inches
Index of 60.07 I.U.
C of G of 26.7 % Mean Aerodynamic Chord (MAC) Dry Operating Weight (DOW) of 145,150 kg and Index 61.13

The maximum authorised take-off weight was 286,897 kg. On the occurrence flight, the aircraft departed with a calculated take-off weight of 223,469 kg. This take-off weight was broken down as follows:

	Actual (kg)	Maximum (kg)
Take-off Weight (TOW)	223,469	286,897
Zero Fuel Weight (ZFW)	174,369	195,044
Take-off Fuel	49,100
Landing Weight (LDW)	186,269	208,652
Trip Fuel	37,200
Total Traffic Load	31,086
Total Payload (Load in compartment)	14,296
Passenger & Luggage	16,790
Dry Operating Weight (DOW)	143,283

Table 1.6D Aircraft Weight

The balance corresponding to the aircraft take-off weight and shown on the final loadsheet (after Last Minute Changes) was 33.78% of the Mean Aerodynamic Chord (MAC) which was within limits.

During take-off, the aircraft Basic Empty Weight (BEW) was 138,918.7 kg and the C of G position was 1,248.8 inches (C of G MAC was 26.7%). Total moment was 173,478,288.65 kg in. This indicates the planned weight and balance of the aircraft was within the allowable limits. The planned cargo weight (load in compartment) of 14,296 kg and distribution matched the recorded cargo weight and distribution.

Based on the available data, the aircraft weight and balance for the take-off from Kuala Lumpur was found to be normal and within the allowable limits.

1.6.6 Fuel

The aircraft used Jet A-1 fuel. Following the previous flight, as per records in the Transit Check and Fuel Log, the total remaining fuel before refuelling as per the cockpit indication was 8,200 kg (Left Tank was 3,700 kg and Right Tank was 4,500 kg). Total departure fuel after refuelling was 49,700 kg (Left Tank was 24,900 kg and Right Tank was 24,800 kg) as indicated in the cockpit.

The fuel weight on board corresponded to a planned trip-fuel of 37,200 kg. Based on MH370 ATC flight plan dated 07 March 2014, the take-off fuel recorded was 49,100 kg. This figure differed slightly from the take-off fuel figure of 49,200 kg generated by the Aircraft Condition Monitoring System (ACMS) and transmitted by Aircraft Communications Addressing and Reporting System (ACARS). The difference was due to the actual time the fuel figure was taken from the aircraft fuel quantity indication system, by Operations for the load sheet, and by the ACMS for the ACARS report, considering fluctuations in the fuel quantity indication. The investigation estimated that the aircraft would have had 41,500 kg fuel remaining after 41 minutes flying from KLIA to IGARI.

The last position report transmitted via ACARS at 1707:29 UTC, 07 March 2014 [0107:29 MYT, 08 March 2014] recorded remaining fuel of 43,800 kg at 35,004 ft altitude.

ATC flight plan forecast recorded remaining fuel of 11,900 kg at landing, including 7,700 kg of diversion fuel. The first alternate airport, Jinan Yaoqiang International Airport (China), was estimated to be 46 minutes from the diversion point with 4,800 kg fuel required and the second alternate airport, Hangzhou Xiaoshan International Airport (China) was estimated to be 1 hour 45 minutes with 10,700 kg fuel required.

The fuel carried on board for the flight met the regulatory requirements on the minimum required, taking into account the use of possible diversion airports. There was also no evidence that more than the reasonable amount required was carried.

1.6.7 Emergency Locator Transmitter

An emergency locator transmitter (ELT) is a radio beacon that when activated will transmit digital distress signals. These signals can be tracked in order to aid the detection and localisation of an aircraft in distress.

The Fixed and Portable ELT radio beacons interface worldwide with the international Cospas-Sarsat satellite system for Search and Rescue (SAR). When activated and under satellite coverage, such beacons send out a distress signal which can be detected by satellites. The satellite receivers send this information to ground stations. This signal is transmitted to Mission Control Centres (MCC) located in six regions worldwide. The MCC covering the Indian Ocean is managed by the Australian Maritime Safety Authority based in Canberra, Australia.

ELTs are mandatory safety items carried on board the aircraft. The cabin and the technical crew attend compulsory safety emergency procedure (SEP) training and have to remain current by attending refresher SEP courses. Operation and functioning of the ELT is part of the SEP training module.

The specifications for the ELT are contained in FAA Technical Standard Orders TSO-C126 and TSO-C91A.

The ELT is a radio beacon; like all other radio equipment installed on-board, its usage is approved by the Malaysian Communications and Multimedia Commission through the Aircraft Radio Licence.

Appendix 1.6C - Copy of the Radio Licence issued for 9M-MRO.

9M-MRO had four ELTs installed. They were located as follows:

One FIXED ELT located above ceiling of the aft passenger cabin at STA 1880.

The aircraft was delivered without a fixed ELT; this component was added by MAS later (between December 2004 and July 2005). This unit is mounted to aircraft structure at the aft passenger cabin at STA 1880.
A control switch installed in the cockpit (flight deck) aft overhead panel provides the command signal. This switch is guarded in the ARMED position. If required, the flight crew can select the ELT to ON by moving the guarded switch from ARMED to ON.

The fixed ELT is manufactured by ELTA FRANCE and is of the 406 series, part number is 01N65900. The unit is connected to an Omni- directional, triple frequency blade antenna located at the rear fuselage forward of the vertical stabilizer at station 1881. The ELT will activate upon a sudden deceleration force per the Technical Standard Order.

This ELT has the provision to operate on the satellite frequency of 406 MHz when activated. The transmission includes the ELT identifier, aircraft nationality and registration markings. It will also transmit on 121.5 MHz and 243 MHz when activated and these signals may be detected by air, sea or ground receivers. Transmissions on VHF frequency (121.5/243 MHz) are line of sight and effective only in close proximity (about 20 km radius).
The battery expiry date for the FIXED ELT was November 2014.
One PORTABLE ELT located in the forward cabin right hand coat closet.

This closet is used by the cabin crew.

This unit is bracket-mounted to the inside of the coat closet door. A label fixed on the coat closet door identifies the ELT. The installation allows quick removal. The Portable ELT is manufactured by ELTA FRANCE and is of the 406 series. It is identical to the fixed ELT except that this unit has its own foldable antenna. The operations and function are the same. The manufacturer part number is 01N65910.

The portable ELT has a control switch on the front face. It is normally in the OFF position. When needed, the switch can be selected to the ON position to activate the ELT transmission.
The battery expiry date for the PORTABLE ELT was November 2014.
Two SLIDE RAFT mounted ELTs located at Door 1 Left and Door 4 Right (packed within the slide raft assembly).

The slide raft mounted ELT will only be available when the slide rafts at doors 1 Left or 4 Right are deployed. The ELT transmission is not satellite enabled. The transmission signal is on 121.5 MHz and 243 MHz which may be monitored with air, sea and ground-based receivers. The slide raft ELT is automatically armed when the slide raft is deployed and inflated. Once armed the ELT is automatically activated by a water sensor coming in contact with water. This ELT is not activated by deceleration. The slide raft ELTs (Part No.: P3-03- 0029-10) are manufactured by DME Corporation and the battery expiry dates are as follows:
- Door 1 Left - August 2016

- Door 4 Right - May 2017
No relevant ELT beacon signals from the aircraft were reported from the responsible Search and Rescue agencies or any other aircraft.

1) Review of Effectiveness of Emergency Locator Transmitters

In general, Emergency Locator Transmitters (ELT) are intended for use on land or on the surface of water, and neither portable nor fixed ELT signals are detectable when the ELT is submerged in deep water. Portable ELT is equipped with a floatation device and can be activated by immersion in water. For effective signal transmission, the antenna of the ELT must remain above water. Damage to an ELT or its associated wiring and antenna, or shielding by aircraft wreckage or terrain, may also prevent or degrade transmission. If the portable ELT is activated within a closed aircraft the shielding effect of the aircraft structure may degrade the transmission.

a) A review of ICAO accident records over the last 30 years indicates that of the 114 accidents in which the status of ELTs was known, only 39 cases recorded effective ELT activation.

This implies that of the total accidents in which ELTs were carried, only about 34% of the ELTs operated effectively (Appendix 1.6D).
b) The Cospas-Sarsat system has been helpful for search and rescue teams in numerous aircraft accidents on a world-wide basis. Despite these successes, the detection of ELT signals after an aircraft crash remains problematic. Several reports have identified malfunctions of the beacon triggering system, disconnection of the beacon from its antenna or destruction of the beacon as a result of accidents where aircraft was destroyed or substantially damaged. Even when the beacon and its antenna are functioning properly, signals may not be adequately transmitted to the Cospas-Sarsat satellites because of physical blockage from aircraft debris obstructing the beacon antenna or when the antenna is under water.

Source: Global Aeronautical Distress and Safety System (GADSS document)

Note:

In the aftermath of the disappearance of MH370, following a multi-disciplinary meeting in May 2014, ICAO formed an Ad- hoc Working Group on Flight Tracking with the mandate to develop a Concept of Operation on the sequence of events before and after the occurrence of an accident which should include all identified phases of such a sequence including detection of an abnormal situation, alert phase, distress phase, and search and rescue activities. This Concept of Operation is GADSS.
c) ELT can be activated automatically by shock typically encountered during aircraft crashes or manually. It is possible for Flight Crew to manually activate the ELT; however existing flight operating procedures do not call for activation of the ELT until the incident has occurred.
d) The Cospas-Sarsat system does not provide a complete coverage of the earth at all times. As a consequence, beacons located outside the areas covered by these satellites at a given moment cannot be immediately detected and must continue to transmit until a satellite passes overhead.
e) The global distress beacon detection system, Cospas-Sarsat, no longer detects 121.5 MHz distress signals. Only 406 MHz digital distress beacons are now capable of detection by satellite. Analogue beacon signals may be received by other aircraft within VHF range but there may not be such aircraft within range at the time of beacon transmission and monitoring 121.5 MHz.

1.6.8 Aircraft Systems Description

Most of the electronic equipment on the aircraft are mounted on equipment racks in the various equipment centres.

The Main Equipment Centre (MEC) contains most of the electronics equipment on the aircraft. The MEC is below the passenger cabin, rear of the nose wheel well and forward of the forward cargo compartment. Access to the MEC is possible on ground or in flight. The equipment in the MEC includes electronics for these functions:

Information Management
Generator Control
Transformer Rectifier
Flight control and autopilot
Environmental control
Recording
Navigation
Communication
Cabin Management
Weight and balance
Air data
Inertial data
Warning
Proximity sensing
Engine control
Electrical Load Management.

The Forward Equipment Centre is forward of the nose wheel well and contains the two weather radar receiver/transmitters. Access to the Forward Equipment Centre is through the access door forward of the nose landing gear or through the MEC.

The passenger compartment above the Door 3 cross-aisle at station 1530 on the left of the aircraft centre line contains the satellite communication equipment.

A rack in the passenger compartment above the rear galley at station 2100 on the right side of the aircraft contains the flight recorders.

There are also equipment racks adjacent to the forward, aft and bulk cargo doors. The forward cargo racks contain the primary flight control, actuator control, radio altitude, fuel quantity and cargo handling electronics. The aft cargo racks contain the HF communication, brake and tire and main gear steering electronics. The bulk cargo racks contain the APU battery and charger.

1) Air Conditioning and Pressurisation

The aircraft has two air conditioning systems divided into left pack and right pack. Engine bleed air provides the pneumatic source for air conditioning and pressurisation.

There are two electronic Controllers, each of which can provide both pack and zone control. Each Controller has two channels that alternate command cycle. Cockpit and cabin temperature selection is monitored, and the Air cycle machine and temperature control valves will be commanded to deliver temperature conditioned air to the various cabin zones.

Conditioned air is also used for electronic equipment cooling. This is supplied through a series of pneumatic valves with supply and exhaust fans. Exhaust air from the equipment cooling flow is routed to the forward cargo and used for forward cargo compartment heating.

Two cabin pressure Controllers regulate the aircraft pressurisation and command the pneumatic system. System operation is automatic and works in conjunction with the forward and aft outflow valves that are used for pressurisation. The outflow valves can also be manually operated from the cockpit by switches on the overhead panel.

Loss of cabin pressure will be indicated to the flight crew by a Cabin Altitude warning message on the Engine Indicating and Crew Alerting System (EICAS) display together with the associated aural warning.

2) Autopilot Flight Director System

The autopilot is engaged by operation of either of two A/P pushbutton switches on the Mode Control Panel (MCP) located on the glareshield panel (Figure 1.6C [below]). Once engaged the autopilot can control the aircraft in various modes selected on the MCP. Normal autopilot disengagement is through either control wheel autopilot disengage switch. The autopilot can disengage if the flight crew override an autopilot command through the use of the control column, control wheel or rudder pedals (when the yaw axis is engaged for approach).

Figure 1.6C - Autopilot Mode Control Panel

The autopilot can also be disengaged by pulling down on the A/P Disengage Bar on the MCP. The autopilot will also disengage automatically for failures of systems on which it relies upon for specific operations. The Autopilot Flight Director System (AFDS) consists of three Autopilot Flight Director Computers (AFDCs), one MCP, and six backdrive actuators (one each for the Captain’s and First Officer’s control column, control wheel, and rudder pedals). The left and right 28V DC buses power the left and right AFDCs, respectively and the MCP while the 28V DC battery bus powers the centre AFDC.

Emergency power from the Ram Air Turbine (RAT) generator does not power these busses and as a result the autopilot will not function with RAT electrical power.

a) Take-off Mode

The Take-off (TO/GA) mode controls roll and pitch during take-off. Also, the Thrust Management Computing Function (TMCF) controls thrust during take-off. Turning a flight director on while the aircraft is on the ground, or activating either TO/GA switch while on the ground, will engage Take-off mode.
b) Roll Modes

The following AFDS roll modes are available during climb, cruise and descent (Figure 1.6D [below]):
1. i) Lateral Navigation
  
  Pushing the Lateral Navigation (LNAV) switch arms or disarms the LNAV mode. The commands come from the active Flight Management Computing Function (FMCF) when there is a valid navigation data base and an active flight plan.
2. ii) Heading Hold/Track Hold
  
  Pushing the Heading Hold (HDG HOLD)/Track hold (TRK HOLD) switch selects Heading or Track hold. In this mode, the aircraft holds either heading (HDG) or track (TRK). If the HDG/TRK display on the MCP shows TRK, the aircraft holds track. If the HDG/TRK display on the MCP shows HDG, the aircraft holds heading.
  
  Figure 1.6D - Lateral Mode Switches and Indicators
3. iii) Heading Select/Track Select
  
  Pushing the Heading Select (HDG SEL)/Track Select (TRK SEL) switch (inner) selects Heading Select or Track Select modes. In this mode, the aircraft turns to the heading or track that shows in the heading/track window. Pushing the Heading/Track (HDG/TRK) Reference switch alternately changes the heading/track reference between heading and track. Rotating the Heading/Track selector (middle) sets the heading or track in the heading/track window. If the HDG/TRK display shows HDG, the aircraft goes to and holds the heading that shows in the heading/track window. If the HDG/TRK display shows TRK, the aircraft goes to and holds the track that shows in the heading/track window. Rotating the Bank Limit selector (outer) sets the bank limit when in the Heading Select or Track Select modes. In the AUTO position, the limit varies between 15 - 25°, depending on True Airspeed. When the other detented positions are selected, the value is the maximum, regardless of airspeed.
4. iv) Roll Attitude Hold
  
  The Roll Attitude Hold mode is used to hold the roll attitude that exists at the time the flight director is first turned on, or the autopilot is first engaged. The Roll Attitude Hold mode is activated, and ATT annunciated, if the bank angle is greater than 5 degrees when either:
  - A flight director is turned on with the autopilot not engaged; or
  - The autopilot is initially engaged with no flight director on.
c) Pitch Modes

The following AFDS pitch modes are available during climb, cruise and descent (Figure 1.6E [below]):
1. i) Vertical Navigation
  
  Pushing the vertical navigation (VNAV) switch arms or disarms the VNAV mode. In this mode, the AFDS uses vertical steering commands provided by the Flight Management Computer Function (FMCF). The FMCF vertical steering commands come from the active FMCF based on the navigation data and the active flight plan.
2. ii) Vertical Speed/Flight Path Angle
  
  Pushing the Vertical Speed/Flight Path Angle (V/S-FPA) switch selects the V/S or FPA mode. Rotating the V/S-FPA selector Up or Down sets the vertical speed or flight path angle in the vertical speed/flight path angle window. Pushing the V/S-FPA Reference switch alternately changes vertical speed/flight path angle window references between vertical speed and flight path angle. The vertical speed or flight path angle command is an elevator command. The pilot uses this mode to change flight levels. The pilot must set the engine thrust necessary to hold the vertical speed or flight path angle command. When the V/S/FPA display shows V/S, the aircraft goes to and holds the vertical speed that shows on the vertical speed/flight path angle window.
  
  Figure 1.6E - Vertical Mode Switches and Indicators
3. iii) Flight Level Change
  
  Pushing the Flight Level Change (FLCH) switch selects the FLCH mode. In this mode, the AFDS will control to the speed target in the IAS/MACH window, providing climb and descent guidance and control. FLCH mode may be used with autothrottles, or with manual throttle control. When the IAS/MACH display shows IAS, the elevator command holds the speed that shows on the IAS/MACH window. When the IAS/MACH display shows MACH, the elevator command holds the MACH that shows on the IAS/MACH window. Rotating the IAS/MACH selector sets the speed in the IAS/MACH window. Pushing the IAS/MACH Reference switch alternately changes the IAS/MACH window between IAS and MACH. The Thrust Management Computing Function (TMCF) supplies the engine thrust commands.
4. iv) Altitude Hold
  
  Pushing the Altitude Hold (ALT) switch selects the Altitude hold mode. In this mode, the aircraft holds the barometric altitude present when the pilot pushes the altitude HOLD switch. Altitude Capture and Hold can also be engaged from a climb or descent as the aircraft approaches the altitude that is selected and displayed in the altitude window.
d) Landing Modes

The following AFDS functions are available for landing:
1. i) Localizer
  The Localizer (LOC) mode captures and holds the aircraft to a localizer flight path.
2. ii) Glideslope
  The Glideslope (G/S) mode captures and holds the aircraft to a vertical descent flight path.
3. iii) Flare
  The flare (FLARE) mode controls the aircraft to a smooth touchdown at a point past the glideslope antenna. This is a computed command and is not part of the glideslope mode.
4. iv) Runway Alignment
  In crosswind conditions, the runway alignment mode supplies roll and yaw control to decrease the aircraft crab angle for touchdown. The runway alignment mode also includes roll and yaw control for an engine failure in approach during autoland.
5. v) Rollout
  After touchdown, the rollout (ROLLOUT) mode controls the aircraft to the runway centre line. Aircraft deviation from the localizer centre line supplies rudder and nose wheel steering signals.
6. vi) Go-Around
  The go-around (TO/GA) mode controls roll and pitch after an aborted approach. Also, the TMCF controls thrust during go- around.
  Pushing the LOC switch arms or disarms the localizer as roll mode. Pushing the Approach (APP) switch arms or disarms the localizer as roll mode and G/S as pitch mode (Figure 1.6F [below]).
  
  Figure 1.6F - Approach Mode Switches
e) Autothrottle (Thrust Management Computing Function)

The autothrottle (A/T) commands the thrust levers to achieve an engine thrust setting, or a selected airspeed. The A/T is armed by raising one or both A/T Arm switches, and is engaged by a pushbutton switch on the MCP (Figure 1.6G [below]).

During normal flight operations, the flight crew uses the Thrust Management Computing Function (TMCF) to perform several routine or normal operations and tasks. These operations or tasks relate to autothrottle modes. The A/T modes operate in these flight phases:

Figure 1.6G - Autothrottle Switches
- Take-off (TO)
- Climb (CLB)
- Cruise (CRZ)
- Descent (DES)
- Approach (APP)
- Go-around (GA)
Autothrottle thrust mode annunciations relate to pitch mode annunciations on the Primary Flight Display (PFD).
f) Autothrottle Modes
1. i) Take-off
  
  In take-off (TO), the autothrottle controls thrust to the TO thrust limit. The autothrottle mode annunciation on the PFD is thrust reference (THR REF). At a threshold air speed, the autothrottle mode annunciation on the PFD changes to HOLD.
2. ii) Climb
  
  These are the three autothrottle mode selections in climb (CLB):
  - Vertical navigation (VNAV)
  - Flight level change (FLCH)
  - Autothrottle (MCP) speed mode or thrust mode.
  These are the autothrottle mode annunciations for these modes:
  - THR REF when VNAV engages
  - THR when FLCH engages
  - SPD or THR REF when autothrottle mode engages.
  The autothrottle speed mode only engages when VNAV, FLCH, and TO/GA are not active, and the aircraft is in the air.
3. iii) Cruise
  
  In cruise, the pitch mode could be VNAV PTH, VNAV ALT or MCP ALT; the corresponding A/T mode is SPD.
4. iv) Descent
  
  These are the three autothrottle modes in descent (DES):
  - VNAV
  - FLCH
  - Autothrottle speed mode
  These are the autothrottle mode annunciations in descent:
  - IDLE, THR, SPD or HOLD shows for VNAV
  - THR, or HOLD shows for FLCH
  - SPD shows for V/S, FPA or no AFDS mode
5. v) Approach
  
  SPD is normal mode in approach with glideslope active or in a manual approach (APP).
  - Go-Around
    A go-around (GA) mode request causes the autothrottle mode to change to THR. A second GA request causes the autothrottle mode to change to THR REF. The TO/GA switch must be pushed to request GA.
  - Flare Retard
    Flare retard occurs when a specified altitude threshold has been achieved when in SPD mode, or during an Autoland approach with a command from the autopilot flight director system (AFDS). The autothrottle mode changes to IDLE during a flare retard.
6. vi) Autothrottle Disconnect
  
  The autothrottle disconnects when there is a manual autothrottle disconnect or when there is thrust reverser application. This occurs after initial touchdown during rollout. The autothrottle will disconnect automatically for certain system faults.

3) Electrical Power

The electrical system generates and distributes AC and DC power to other aircraft systems, and is comprised of: main AC power, backup power, DC power, standby power, and flight controls power. System operation is automatic. Electrical faults are automatically detected and isolated. The AC electrical system is the main source for aircraft electrical power. Figure 1.6H (below) shows the cockpit electrical panel where electrical switching can be made. It also shows the associated lights.

As the various aircraft systems rely on electrical power, failure of the electrical buses will affect the systems operation which will in turn trigger the corresponding fault messages. These messages are collected by the CMCS which will transmit the messages, via the ACARS, to the Maintenance Control Centre (MCC).

Note: Diagram not included
Electrical Power Panel Switches/Lights
1.	Battery Switch	11.	Backup Generator OFF Lights
2.	Battery OFF Light	12.	Backup Generator (BACKUP GEN) Switches
3.	APU Generator (APU GEN) Switch	13.	External Power AVAIL Lights
4.	APU Generator OFF Light	14.	External Power ON Lights
5.	BUS TIE Switches	15.	External Power (EXT PWR) Switches
6.	BUS Isolation (ISLN) Lights	16.	CABIN/UTILITY Power OFF Light
7.	Generator Control (GEN CTRL) Switches	17.	Cabin/Utility (CABIN/UTILITY) Power Switch
8.	Generator OFF Lights	18.	IFE/PASS SEATS OFF Light
9.	Drive Disconnect Switches	19.	In Flight Entertainment System/ Passenger Seats (IFE/PASS SEATS) Power Switch
10.	Generator DRIVE Lights	19.

Figure 1.6H - Electrical Power Panel Switches/Lights

a) Electrical Load Management System

The Electrical Load Management System (ELMS) provides load management and protection to ensure power is available to critical and essential equipment. If the electrical loads exceed the power available (aircraft or external), ELMS automatically shed AC loads by priority until the loads are within the capacity of the aircraft or ground power generators. The load shedding is non-essential equipment first, then utility busses. Utility busses are followed by individual equipment items powered by the main AC busses. When an additional power source becomes available or the loads decrease, ELMS restores power to shed systems (in the reverse order). The message LOAD SHED displays on the electrical synoptic when load shed conditions exist.
b) Alternating Current Electrical System Power Sources

The entire aircraft alternating current (AC) electrical load can be supplied by any two main AC power sources. The main AC electrical power sources are:
- left and right engine integrated drive generators (IDGs)
- APU generator
- primary and secondary external power
The power sources normally operate isolated from one another. During power source transfers on the ground (such as switching from the APU generator to an engine generator) operating sources are momentarily paralleled to prevent power interruption.
c) Integrated Drive Generators

Each engine has an Integrated Drive Generator (IDG). Each IDG has automatic control and system protection functions. When an engine starts, with the GENERATOR CONTROL switch selected ON, the IDG automatically powers the respective main bus. The previous power source is disconnected from that bus.

The IDG can be electrically disconnected from the busses by pushing the GENERATOR CONTROL switch to OFF. The IDG can also be electrically disconnected from its respective bus by selecting an available external power source prior to engine shutdown. The DRIVE light illuminates and the EICAS message ELEC GEN DRIVE L or R displays when low oil pressure is detected in an IDG. The IDG drive can be disconnected from the engine by pushing the respective DRIVE DISCONNECT switch. The IDG cannot be reconnected by the flight crew. High drive temperature causes the IDG to disconnect automatically.
d) Auxiliary Power Unit Generator

The Auxiliary Power Unit (APU) generator is electrically identical to the IDG generators. The APU generator can power either or both main busses and may be used in flight as a replacement to an IDG source. If no other power source is available when the APU generator becomes available, the APU generator automatically connects to both main AC busses. If the primary external source is powering both main busses, the APU powers the left main bus, and the primary external source continues to power the right main bus. If the primary external source is powering the right main bus, and the secondary external source is powering the left main bus, the APU then powers the left main bus and the primary external source continues to power the right main bus. If the secondary external source is powering both main busses, the APU then powers both main busses.

The APU generator OFF light illuminates when the APU is operating and the APU generator breaker is open because of a fault or the APU GENERATOR switch is selected OFF. When the APU GENERATOR switch is ON and a fault is detected, the APU generator cannot connect to the busses.

In flight, when both transfer busses are unpowered, the APU starts automatically, regardless of APU selector position.
e) Alternating Current Electrical Power Distribution

The AC power is distributed through the left and right main busses and the ground service bus. The right IDG normally powers the right main bus and the left IDG normally powers the left main bus. The APU normally powers both main busses when they are not powered by any other source.

Bus tie relays, controlled by BUS TIE switches, isolate or parallel the right and left main busses. When both BUS TIE switches are set to AUTO, the bus tie system operates automatically to maintain power to both main busses.

Power transfers are made without interruption when the aircraft is on the ground, except when switching between primary and secondary external power sources. The source order for powering left and right main busses in flight is the:
- respective IDG
- APU generator
- opposite IDG
f) Autoland

During autoland, the busses isolate to allow three independent sources to power the three autopilots:
- the left IDG powers the left AC transfer bus, the left main DC bus, and the captain’s flight instrument bus;
- the right IDG powers the battery bus and AC standby bus through the main battery charger; and
- the back-up system powers the right AC transfer bus, the right DC bus, and the first officer’s flight instrument bus.
g) Backup Alternating Current Electrical System

The electrical system is highly reconfigurable to accommodate multiple failures. The electrical system is designed to automatically provide power to selected aircraft systems. The electrical system automatically powers one or both transfer busses when:
- only one main AC generator (includes APU) is available;
- power to one or both of the main AC busses is lost;
- approach (APP) mode is selected for autoland; and
- the system is automatically tested after engine starts
The system automatically transfers power without interruption.
h) Backup Generators

Backup power is provided by one variable speed, variable frequency generator mounted on each engine. A frequency converter converts the generator frequency to a constant 400 Hz. Only one backup generator can power the converter at a time.

Each backup generator contains two permanent magnet generators (PMGs) that supply power to the flight control DC electrical system (refer to DC Electrical System). If both IDGs and the APU generator are inoperative, a backup generator powers essential aircraft equipment. To reduce electrical loading on the backup generator, the following systems are inoperative:
- TCAS
- SATCOM
- Right HF radio
i) Direct Current Electrical System

The direct current (DC) electrical system includes the main DC electrical system and the flight control DC electrical system. The main DC electrical system uses four transformer-rectifier units (TRUs) to produce DC power. The TRUs are powered by the AC transfer busses.

TRU DC electrical power is distributed to various DC busses as follows:
1. (1) The left TRU powers the left main DC bus, which provides a second DC power source for:
  - left flight control power supply assembly (PSA)
  - right main DC bus.
2. (2) The right TRU powers the right main DC bus, which provides a second DC power source for:
  - right flight control PSA
  - left main DC bus.
3. (3) The C1 TRU powers the captain’s flight instrument bus and the battery bus. The captain’s flight instrument bus provides a second DC power source for:
  - centre flight control PSA
  - first officer’s flight instrument bus
  The C2 TRU powers the first officer’s flight instrument bus, which provides a second DC power source for the captain’s instrument bus.
j) Batteries

The main battery is connected directly to the hot battery bus and provides standby power to other busses. The main battery charger normally powers the hot battery bus and maintains the main battery fully charged.

The APU battery is connected directly to the APU battery bus and provides dedicated power to the APU electric starter, which is used when sufficient bleed air duct pressure is unavailable for the APU air turbine starter. The APU battery charger normally powers the APU battery bus and maintains the APU battery fully charged.
k) Flight Control Direct Current Electrical System

The flight control DC electrical system is a dedicated power source for the primary flight control system. Primary power for the flight control DC electrical system comes from permanent magnet generators (PMGs) housed within each backup generator. Variable frequency PMG AC power is used by individual power supply assemblies (PSAs) to provide DC power to the three flight control DC busses. To ensure a high level of system reliability, each PSA also has multiple DC power sources. If primary PMG AC power is not available, secondary power for the left and right PSAs is provided by the related main DC bus. Secondary power for the centre PSA is provided by the captain’s flight instrument bus. The hot battery bus provides additional backup power for the left and centre PSAs only. Each PSA also uses a dedicated battery to prevent power interruptions to the related flight control DC bus. The batteries have limited capacity and are incorporated to supply power for brief periods during PSA power source transfers.
l) Standby Electrical System

The standby electrical system can supply AC and DC power to selected flight instruments, communications and navigation systems, and the flight control system, if there are primary electrical power system failures. The standby electrical system consists of:
- the main battery
- the standby inverter
- the RAT generator and its associated generator control unit
- the C1 and C2 TRUs
1. (1) Main Battery
  
  The main battery provides standby power to the:
  - hot battery bus
  - battery bus
  - captain’s flight instrument bus
  - left and centre flight control PSAs
  - standby inverter.
  Note:
  
  The main battery can power the standby system for a minimum of 10 minutes.
2. (2) Standby Inverter
  
  The standby inverter converts DC power to AC power. The inverter powers the AC standby bus if the left transfer bus is not powered.
3. (3) Ram Air Turbine Generator
  
  The ram air turbine (RAT) generator provides standby power to the C1 and C2 TRUs. The RAT can supply electrical and hydraulic power simultaneously. If the RAT is unable to maintain RPM, the RAT generator electrical load is shed until RPM is satisfactory. Power for standby electrical loads is provided by the main battery during deployment of the RAT and when RAT generator loads are shed. The RAT is deployed automatically if both AC transfer busses lose power in flight. The RAT can be manually deployed by using the RAM AIR TURBINE switch on the overhead panel.
4. (4) Cabin Systems and Utility Power
  
  Electrical power to some cabin and utility systems are controlled from the cockpit. The IFE/PASS SEATS Power switch controls power to the IFE and passenger seats. The CABIN/UTILITY Power switch controls power to cabin and utility systems.

4) Cabin and Cargo Compartments

The aircraft, 9M-MRO was configured to 35 business class and 247 economy class seats. The business class and economy class seats were procured from BE Aerospace. An approved Lay Out of Passenger Accommodation (LOPA) determines the cabin interior configuration. Safety and emergency equipment are fitted and positioned throughout the cabin.

There is one crew rest area in the forward cabin behind the cockpit. There is a cabin crew rest area in the aft cabin lower lobe. Access is through a compartment door adjacent to Door 3R.

The cockpit door provides selective entry to the cockpit and is resistant to ballistic penetration. When closed, the door locks when electrical power is available and unlocks when electrical power is removed. A viewing lens in the door allows observation of the cabin. The door can be manually opened from the cockpit by turning the door handle.

An emergency access code is used to gain access to the cockpit in case of pilot incapacitation. Access is provided by the use of a Keypad Access System which consists of a numeric keypad outside the cockpit area and a chime module and electric strike that is not accessible from outside the cockpit. The chime module provides an audible alert to the pilots that the correct code has been entered into the keypad. There is also an indicator light in the cockpit and a Light Emitting Diode (LED) on the keypad that indicates that the correct code has been entered.

The pilots have a 3-position switch by which they can open the door lock, close the door lock, or permanently lock the door for a specified amount of time to prevent access by anyone regardless if the correct code is entered into the keypad.

The door has blowout panels that will open in the event of a rapid decompression of the passenger compartment. A pressure sensor controls an electric strike and allows the door to open inward in the event of a rapid decompression in the cockpit. These features serve to equalise the pressure between the passenger compartment and the cockpit in case of decompression either side of the door.

The aircraft is also fitted with a Flight Deck Entry Video Surveillance System (FDEVSS) which provides the pilots surveillance capability of the cockpit doorway and the forward galley areas. This allows the pilots to see the person who wants to access the cockpit before they allow entry.

There are four Type A passenger and service doors on each side of the aircraft. Each door has a window. The passenger compartment has windows along both sides of the passenger compartment. Each exit is fitted with a slide raft system for emergency use.

The overhead passenger cabin is fitted with Passenger Service Units (PSU) above each seat row. They are hinged and secured by a magnetic latch that is electrically controlled. In the event of cabin depressurisation, the PSU magnetic latch will be electrically released and allow the oxygen masks to drop for passenger use.

The aircraft cabin lighting system comprises of ceiling lights, sidewall lights, entry lights and emergency lights. The cabin management system (CMS) controls the passenger cabin lighting.

The lower section of the fuselage houses forward, aft and bulk cargo compartments. A cargo handling system is fitted for the forward and aft cargo to command power drive units (PDU) to move cargo containers laterally and longitudinally.

Cargo compartment sidewalls, ceilings and walkways are constructed of fire resistant materials. There is a smoke detection warning system and fire extinguishing system installed to contain any smoke or fire eventualities.

5) Flight Controls

The flight control system is an electronic fly by wire system. It is divided into two separate systems to control the aircraft in flight.

Primary Flight control system (PFCS) is a modern three axis, fly by wire system. It controls the roll, yaw and pitch commands using the ailerons, flaperons, spoilers, elevators, rudder and horizontal stabilizer. The high lift control system (HLCS) comprises of inboard and outboard trailing edge flaps, leading edge flaps and Kruger flaps. It supplies increased lift at lower speeds for take-off and landing.

The PFCS and HLCS use 3 dedicated ARINC 629⁹ Flight Control digital busses to transmit data signals to command the flight controls. Mechanical control is available to two spoilers and horizontal stabilizers.

The PFCS has three operational modes of command - Normal mode, Secondary mode and Direct mode. The PFCS command signals are computed by three redundant Primary Flight Computers (PFCs) in Normal and Secondary modes and directed through four Actuator Control Electronic (ACE) units. In Direct mode, the control surface command signals are computed by the ACEs without reliance on the PFCs.

The PFC also receives airspeed, altitude and inertial reference data from Airplane Information Management System (AIMS), Air Data Inertial Reference Unit (ADIRU) and Secondary Attitude and Air Data Reference unit (SAARU). The PFCs calculate the flight control commands based on control laws, augmentation and envelop protections. The digital command signals from the PFCs go to the ACEs that will change the digital signal to analogue format and send to the power control units (PCU) that will command the control surface movement.

The HLCS operates in three modes, primary, secondary and alternate. Command signals are transmitted from the flap lever to two Flap Slat Electronic Units (FSEU).

The FSEU process the flap command and control the sequence of flaps and slats operation. It also commands auto slat, load relief and asymmetry protection.

Two spoilers and the horizontal stabilizer receive mechanical control signals from pilots input.

_________________

⁹ Aeronautical Radio, Incorporated (ARINC) 629 is an aeronautical standard which specifies multi- transmitter data bus protocol where up to 128 units can share the same bus.

6) Fuel System

The fuel system has three fuel tanks, two integral wing tanks and one centre tank. The tanks are part of the wing structure and have many fuel system components located inside the tanks and on the rear spar. The fuel tanks are vented through channels in the wing to allow near ambient pressure during all phases of flight.

An integrated refuel panel (IRP) on the lower left wing and two refuel receptacles on each wing allows rapid pressure refueling of the aircraft. The refueling operation is automatic with fuel load selection on the IRP. Fuel quantity indicating system (FQIS) processor unit controls all fueling operations and measuring of fuel quantity.

Several enhanced features were incorporated in the design to include the following:

Ultrasonic Fuel Quantity Indicating system
Automatic centre tank scavenge system
Ultrasonic water detection system
Densitometers
Jettison system

Fuel quantity is displayed on the fuel synoptic page and the upper EICAS fuel block.

a) Engine Fuel Feed System

There are two boost pumps for each main tank and two override/ jettison pumps in the center tank to supply fuel to the engines. The fuel flows through the crossfeed manifold to the engines. Redundant crossfeed valves isolate the left and right sides of the manifold.

At the start of a flight, when all the tanks are full, the normal procedure is to turn on all the fuel pumps. The override/jettison pumps supply center tank fuel to both engines. This occurs because the override/jettison pumps have a higher output pressure than the main tank boost pumps. When the override/jettison pump output pressure decreases because of low fuel quantity in the center tank, the boost pumps automatically supply fuel to both engines from the main tanks.
b) Auxiliary Power Unit Fuel Feed System

The Auxiliary Power Unit (APU) can receive fuel from any tank. A DC pump supplies fuel from the left main tank if no AC power is available. APU fuel is supplied from the left fuel manifold. APU fuel can be provided by any AC fuel pump supplying fuel to the left fuel manifold or by the left main tank DC fuel pump. On the ground, with the APU switch ON and no AC power available, the DC pump runs automatically. With AC power available, the left forward AC fuel pump operates automatically, regardless of fuel pump switch position, and the DC fuel pump turns off. In flight, the DC fuel pump operates automatically for quick left engine relight with the loss of both engines and all AC power. Figure 1.6I (below) shows the Engine and APU Fuel Feed System.

Figure 1.6I - Engine and APU Fuel Feed

(Copyright © Boeing. Reprinted with permission of The Boeing Company )
c) Fuel Inlets

The fuel intake inlet for the APU (in the left main tank) is located lower than that for the engine. As the fuel level drops below the engine fuel intake level the engine will be starved of fuel, however fuel will still be available for the APU as its fuel intake is lower. This difference in level between the engine and APU fuel intakes, accounts for approximately 30 pounds of fuel in a standard flight attitude (1° pitch). The APU is estimated to consume (when electrically loaded) approximately 2 pounds of fuel in 55 seconds which will amount to a maximum APU run time of 13 minutes and 45 seconds. The pitch attitude and in-flight accelerations can affect the actual amount available for the APU.

7) Hydraulics

There are three independent hydraulic systems using electrical, pneumatics or engine driven power source. They are identified as Left, Centre and Right. Each hydraulic system can independently operate the flight controls for safe flight and landing.

Each hydraulic system uses a Hydraulic Interface Module Electronics Card (HYDIM) for automatic control and indications. The three systems operate independently at 3000 psi nominal pressure.

The left system is powered by an engine driven pump (EDP) and an electric motor pump (ACMP). The right system is also powered by an EDP and ACMP. The centre system has two ACMP and two air driven pumps (ADP) and a ram air turbine (RAT) pump.

Hydraulic pumps control and indication are on the P5 overhead panel. During normal operation the flight crew will select the switches to the auto position before flight. The pressure and quantity indication is provided on the hydraulic synoptic page and the status page.

The primary pumps are the EDPs in the left and right system and the ACMPs for the centre system. These pumps operate continuously. The demand pumps are the ACMPs for the left and right systems and the ADPs for the centre system. These pumps normally operate only during heavy system demands. The operation logic is controlled and monitored by the HYDIM cards.

The RAT deploys automatically during flight when both engines are shutdown or for loss of all three hydraulic power. The RAT hydraulic pump supplies hydraulic power to some of the center hydraulic system flight controls. When the aircraft is operating on RAT power only, the flap drive hydraulic motor is isolated from the center hydraulic system and as a result the flaps will not respond to the cockpit flap handle inputs.

8) Instrumentation

The flight instruments and displays supply information to the flight crew on six flat panel liquid crystal display units:

Captain and First Officer Primary Flight Display (PFD)
Captain and First Officer Navigation Display (ND)
Engine Indication and Crew Alerting System (EICAS)
the Multifunction Display (MFD)

Standby Flight Instruments provide information on separate indicators. Clocks display Airplane Information Management System (AIMS) generated UTC time and date, or manually set time and date.

a) Primary Flight Display

The Primary Flight Display (PFD) presents a dynamic color display of all the parameters necessary for flight path control. The PFDs provide the following information:
- flight mode annunciation
- airspeed
- altitude
- vertical speed
- attitude
- steering information
- radio altitude
- instrument landing system display
- approach minimums
- heading/track indications, engine fail, Ground Proximity Warning System (GPWS), and Predictive Windshear (PWS) alerts.
Failure flags are displayed for aircraft system failures. Displayed information is removed or replaced by dashes if no valid information is available to the display system (because of out-of- range or malfunctioning navigation aids). Displays are removed when a source fails or when no system source information is available.
b) Navigation Display

The navigation displays (ND) provide a mode-selectable color flight progress display. The modes are:
- MAP
- VOR
- APP (approach)
- PLN (plan)
The MAP, VOR, and APP modes can be switched between an expanded mode with a partial compass rose and a centered mode with a full compass rose.
c) Engine Indication and Crew Alerting System

The Engine Indication and Crew Alerting System (EICAS) consolidates engine and aircraft system indications and is the primary means of displaying system indications and alerts to the flight crew. The most important indications are displayed on EICAS which is normally displayed on the upper centre display.
1. i) System Alert Level Definitions
  1. (1) Time Critical Warnings
    
    Time critical warnings alert the crew of a non-normal operational condition requiring immediate crew awareness and corrective action to maintain safe flight. Master warning lights, voice alerts, and ADI indications or stick shakers announce time critical conditions.
  2. (2) Warnings
    
    Warnings alert the crew to a non-normal operational or system condition requiring immediate crew awareness and corrective action.
  3. (3) Cautions
    
    Cautions alert the crew to a non-normal operational or system condition requiring immediate crew awareness. Corrective action may be required.
  4. (4) Advisories
    
    Advisories alert the crew to a non-normal operational or system condition requiring routine crew awareness. Corrective action may be required.
  5. (5) Engine Indication and Crew Alerting System Messages
    
    Systems conditions and configuration information are provided to the crew by four types of EICAS messages:
    - EICAS alert messages are the primary method to alert the crew to non-normal conditions.
    - EICAS communication messages direct the crew to normal communication conditions and messages.
    - EICAS memo messages are crew reminders of certain flight crew selected normal conditions.
    - EICAS status messages indicate equipment faults which may affect aircraft capability.
    An EICAS alert, communications, or memo message is no longer displayed when the respective condition no longer exists.
d) Multifunction Display

The electronic checklist (ECL) system shows normal and non- normal checklists on a multifunction display (MFD). The electronic checklist system is not required for, and a paper checklist or other approved backup checklist must be available in the cockpit.

The checklist display switch on the display select panel opens the electronic checklist. The flight crew operates the checklist with the cursor control devices (CCDs).

The MFD has also communications functions which are used to control data link features. Data link messages not processed by the Flight Management Computer (FMC) are received, accepted, rejected, reviewed, composed, sent, and printed using communications functions on the MFD. ACARS and data link radio management functions are provided through communications management menus. The COMM display switch, located on the display select panel, displays the communications main menu on the selected MFD.

Communications functions are selected using the cursor control device. Message text entry is accomplished by entering data into the Control Display Unit (CDU) scratchpad and transferring it to the appropriate area. Messages can be printed on the cockpit printer. Incoming message traffic is annunciated by EICAS communications messages.
e) Standby Flight Instruments

The standby flight instruments include:
- standby attitude indicator
- standby airspeed indicator
- standby altimeter
- standby magnetic compass
An external Power Supply Assembly supplies power to the standby attitude and airspeed indicators and the standby altimeter. The standby magnetic compass does not require any electrical power except for its lighting.
1. (1) Standby Attitude Indicator
  
  The Standby Attitude Indicator displays Secondary Attitude Air Data Reference Unit (SAARU) attitude. A bank indicator and pitch scale are provided.
2. (2) Standby Airspeed Indicator
  
  The Standby Airspeed Indicator displays airspeed calculated from two standby air data modules (one pitot and one static). It provides current airspeed in knots as a digital readout box with an airspeed pointer.
3. (3) Standby Altimeter
  
  The standby altimeter displays altitude from the standby (static) air data module. Current altitude is displayed digitally. A pointer indicates altitude in hundreds of feet. The pointer makes one complete revolution at appropriate intervals.
4. (4) Standby Magnetic Compass
  
  A standard liquid–damped magnetic standby compass is provided. A card located near the compass provides heading correction factors.
f) Clock

A clock is located on each forward panel. Each clock displays Airplane Information Management System (AIMS) generated UTC time and date, or manually set time and date. The AIMS UTC time comes from the global positioning system (GPS). In addition to time, the clocks also provide alternating day-month and year, elapsed time, and chronograph functions.

9) Airplane Information Management System

The Airplane Information Management System (AIMS) collects and calculates large quantities of data. The AIMS manages this data for several integrated avionics systems. These systems are the:

Primary display system (PDS)
Central maintenance computing system (CMCS)
Airplane condition monitoring system (ACMS)
Flight data recorder system (FDRS)
Data communication management system (DCMS) - including ACARS datalink
Flight management computing system (FMCS)
Thrust management computing system (TMCS)

The AIMS has software functions that do the calculation for each of these avionics systems. The AIMS supplies one other software function that many aircraft systems use. It is the data conversion gateway function (DCGF).

The AIMS has two cabinets, for redundancy, which do the calculations for other avionic systems. The Left cabinet is located in the forward rack of the Main Equipment Centre (MEC) while the Right cabinet is located in rear rack of the MEC. To do these calculations, each AIMS cabinet has the following:

A cabinet chassis
Four Input/output modules (IOM)
Four Core processor modules (CPM)

The IOMs and CPMs are considered Line Replaceable Modules (LRM). The IOM transfers data between the software functions in the AIMS CPMs and external signal sources. The CPMs supply the software and hardware to do the calculations for several avionic systems. The software is called functions. To keep a necessary separation between the functions, each function is partitioned. The partitions permit multiple functions to use the same hardware and be in the same CPM.

The Left AIMS cabinet gets electrical power from the 28V DC Capt Flight Instrument bus and the 28V DC F/O Flight Instrument bus. The Right AIMS cabinet gets electrical power from the 28V DC Left bus and the 28V DC Right bus. Each cabinet receives the power from four 28V DC circuit breakers in the overhead circuit breaker panel. The four 28V DC bus inputs are known as power 1 through power 4. Power 1 and power 2 enter the cabinet through a connector on the left side of the cabinet and therefore they are considered as left power. Power 3 and power 4 enter the cabinet through a connector on the right side of the cabinet and are considered as right power.

Each LRM receives power from four sources, two for main power and two for monitor power. The main circuitry uses the main power. Special circuits that monitor the condition of the power supply in the LRM use the monitor power. The two main and two monitor sources of power for each LRM come from different power sources.

Each AIMS cabinet also receives power through one hot battery bus circuit breaker in the standby power management panel. The connection to the hot battery bus keeps the LRMs internal memories active. The hot battery bus also makes the AIMS cabinet less likely to have faults due to power transients.

10) Navigation Systems

The Navigation systems of interest include Global Positioning System (GPS), Air Data Inertial Reference System (ADIRS) and the Flight Management System (FMS).

a) Global Positioning System

The Left and right GPS receivers are independent and use navigation satellites to supply very accurate position data to the FMC. One is powered by the 115V AC Standby bus and the other by the 115V AC Transfer bus. They pass data to aircraft systems including the ADIRS via the AIMS. GPS tuning is automatic. If the Air Data Inertial Reference Unit (ADIRU) becomes inoperative during flight, the EICAS displays the message NAV ADIRU INERTIAL and the FMC uses only GPS data to navigate.
b) Inertial System

The ADIRS calculates aircraft altitude, airspeed, attitude, heading, and position data for the displays, flight management system, flight controls, engine controls, and other systems. The major components of ADIRS are the ADIRU, Secondary Attitude and Air Data Reference Unit (SAARU), and air data modules. The ADIRU supplies primary flight data, inertial reference, and air data. The ADIRU is fault-tolerant and fully redundant. The SAARU is a secondary source of critical flight data for displays, flight control systems, and other systems. If the ADIRU fails, the SAARU automatically supplies attitude, heading, and air data. SAARU heading must be manually set to the standby compass magnetic heading periodically. The ADIRU and SAARU receive air data from the same three sources. The ADIRU and SAARU validate the air data before it may be used for navigation. The three air data sources are the left, centre, and right pitot and static systems.
c) Flight Management System

The FMS aids the flight crew with navigation, in-flight performance optimisation, automatic fuel monitoring, and cockpit displays. Automatic flight functions manage the aircraft lateral flight path (LNAV) and vertical flight path (VNAV). The displays include a map for aircraft orientation and command markers on the airspeed, altitude, and thrust indicators to help in flying efficient profiles. The flight crew enters the applicable route and flight data into the CDUs. The FMS then uses the navigation database, aircraft position, and supporting system data to calculate commands for manual and automatic flight path control. The FMS tunes the navigation radios and sets courses. The FMS navigation database supplies the necessary data to fly routes, SIDs, STARs, holding patterns, and procedure turns. Cruise altitudes and crossing altitude restrictions are used to calculate VNAV commands. Lateral offsets from the programmed route can be calculated and commanded.

The basis of the flight management system is the flight management computer function. Under normal conditions, one Flight Management Computer (FMC) accomplishes the flight management tasks while the other FMC monitors. The second FMC is ready to replace the first FMC if system faults occur. The FMC uses flight crew-entered flight plan data, aircraft systems data, and data from the FMC navigation database to calculate aircraft present position and pitch, roll, and thrust commands necessary to fly an optimum flight profile. The FMC sends these commands to the autothrottle, autopilot, and flight director. Map and route data are sent to the NDs. The EFIS control panels select the necessary data for the ND. The mode control panel selects the autothrottle, autopilot, and flight director operating modes.

Crew Procedure on the operations and programming of the Flight Management System safeguards and protects against incorrect execution of erroneous Information for the Navigation and Performance Data Input. Different levels of verification and cross checking between the Captain and Co-Pilot ensure that any error would be captured and corrected during the crew preparation.

In addition, system logics will also prevent the crew against selection of the wrong co-ordinates from the stored Navigation Database if a particular waypoint code happens to be used by many different places worldwide.

11) Oxygen Systems

a) Flight Crew Oxygen System

The flight crew oxygen system provides oxygen to the flight crew for emergencies and other procedures which make its use necessary. The oxygen is supplied by two cylinders located in the left side of the main equipment centre. Each cylinder is made of composite material and holds 115 cubic feet (3,256 litres) of oxygen at 1,850 psi. The oxygen is supplied, through regulators, to four oxygen masks in the cockpit, one each for the Captain, the First Officer, the First Observer and the Second Observer. The mask has a dilution control which is normally set at ‘Normal’ position. In this position the oxygen is diluted with ambient air according to the pressure altitude in the cockpit. It can also be selected to ‘100%’, in which case 100% oxygen will be supplied. Table 1.6E (below) shows the expected duration of oxygen supply from the two cylinders with the dilution control in ‘Normal’ position.

AIRCRAFT ALTITUDE: 36,000 ft
Cabin Altitude: 8,000 ft.		Cabin Altitude: 36,000 ft.
No. of Crew Members	Expected Duration (hour)	No. of Crew Members	Expected Duration (hour)
1	42	1	27
2	21	2	13
3	14	3	9
4	10.5	4	6.5

Table 1.6E - Expected Duration of Crew Oxygen

Aircraft altitude is assumed to be 36,000 ft. A cabin altitude of 8,000 ft. would indicate a normally pressurised cabin and a cabin altitude of 36,000 ft. would indicate an unpressurised cabin. At this cabin altitude of 36,000 ft, 100% oxygen will be supplied even with the dilution control in the ‘Normal’ position.

b) Passenger Oxygen System

The passenger oxygen system is supplied by separate and individual chemical oxygen generators. The oxygen system provides oxygen to:
- passenger seats
- attendant stations
- lower crew rest compartment
- lavatory service units
The passenger oxygen masks and chemical oxygen generators are located in passenger service units (PSUs). A door with an electrically operated latch keeps the masks in a box until the oxygen deployment circuit operates. The deployment circuit operates, and the masks automatically drop from the PSUs if cabin altitude exceeds approximately 13,500 feet. The passenger masks can be manually deployed from the cockpit by pushing the overhead panel PASSENGER OXYGEN switch to the ON position. Oxygen flows from a PSU generator when any mask hanging from that PSU is pulled. Oxygen is available for approximately 22 minutes. The electrical power to the latch is supplied through a circuit breaker located in the Main Equipment Centre. It is not possible to deactivate automatic deployment of the masks from the cockpit.
c) Portable Oxygen

Portable oxygen cylinder lets the flight attendants move in the aircraft when oxygen is in use. It is also a gaseous oxygen supply for medical emergencies. The bottle is fitted with disposable mask. 15 cylinders are located throughout the passenger cabin. Each cylinder is of 11 cubic ft (310 litres) capacity. The flow of oxygen can be controlled by an ‘Off-On’ knob which can be rotated to control the flow from 0 to 20 litres per minute. Therefore, the minimum time for the portable oxygen supply from full is 15.5 minutes.

12) Central Maintenance Computing System

The Central Maintenance Computing System (CMCS) collects and stores information from most of the aircraft systems. It can store fault histories as well as monitor and conduct tests on the various systems. The fault history contains details of warnings, cautions and maintenance messages.

At regular intervals, during flight, the CMCS transmits any recorded fault messages, via the Aircraft Communications Addressing and Reporting System (ACARS), to the Maintenance Control Centre (MCC) of Malaysia Airlines. This helps in the planning and preparation for the rectification of any potential aircraft defects at the main base or line stations. Refer also to Section 1.6.4 para. 9).

13) Engines

The aircraft is fitted with two engines (Model: RB211 TRENT 892B- 17) manufactured by Rolls-Royce. The RB211 TRENT 892B-17 engine is a high bypass turbofan (bypass ratio of 6.4:1 at a typical cruise thrust) axial flow, three-rotor with a single low pressure fan driven by a five-stage, low-pressure turbine.

The engine has an eight-stage intermediate pressure compressor driven by a single-stage turbine and a six-stage high pressure compressor driven by a single-stage turbine.

The engine take-off thrust is 92,800 lb and weighing approximately 15,700 lb (7,136 kg). The engines are certified in accordance with the US FAA Type Certificate E00050EN.

The FAA Type Certificate Data Sheet certifies that the engines meet the smoke and gaseous emission requirements of the US FAR 34. The engine is certified under FAR Part 36 Stage 3 Noise regulation.

The engine is fitted with a digital Electronic Engine Fuel Control System and it interfaces with many systems and components in the form of primary analogue or ARINC 629 buses.

The following analogue engine fuel and control system interfaces and correlates with the other systems for supply and feedback:

Engine ignition - ignition unit power
Engine air - actuator and valves
Engine controls - resolver excitation and position
Engine indicating - engine parameter data
Engine exhaust - thrust reverser operations
Engine oil - oil cooling and indications
Engine starting - auto-start and manual start
Electrical power - aircraft power from the Electrical Load Management System (ELMS)

The following ARINC 629 engine fuel and control system interfaces and correlates with other systems for supply, control and indication data:

AIMS - indication, air data and flight management control
Cockpit controls - switch position and indication
Flap Slat Electronic Unit (FSEU) - Flap indication
Proximity Switch Electronic Unit (PSEU) - Landing gear lever position
Air Supply Cabin Pressure Controller (ASCPC) - Pneumatic system demand

The RB211 TRENT 892B-17 engine Electronic Engine Control (EEC) serves as the primary component of the engine fuel control system and uses data from the engine sensors and aircraft systems to control the engine operations. The EEC controls most of the engine components and receives feedback from them. These digital data go to the Engine Data Interface Unit (EDIU) and send the signal to the AIMS. The AIMS transmits and receives a large amount of data to and from the EEC. These include:

Engine bleed status - EEC thrust limit calculations
Air data - EEC thrust limit calculations
Engine data – system requirements
Autothrottle Engine Pressure Ratio (EPR) trim - thrust balancing
Condition monitoring - performance tracking
Maintenance data - trouble shooting
Primary display system data - indication.

14) Auxiliary Power Unit

The aircraft is fitted with an Auxiliary Power Unit (APU) - Model: GTCP 331-500 - manufactured by Allied Signal. The Allied Signal GTCP 331-500 gas turbine APU is a two-stage centrifugal flow compressor, a reverse flow annular combustion chamber and a three-stage axial flow turbine. It supplies the auxiliary power system for the aircraft pneumatic and electrical power. This permits independent operations from the ground external power sources or the main engines.

The APU generator supplies 120 KVA electrical power at any altitude. The APU can start at all altitudes up to the service ceiling of the aircraft (43,100 ft/13,100 m). Electrical power is available up to the service ceiling and pneumatic power is available up to 22,000 ft (6,700 m).

The ELMS contains the APU autostart logic and sends signal to the APU Controller (APUC).

The APU Controller serves to control the APU functions for:

Starting and ignition
Fuel metering
Surge control
Inlet guide vane (IGV) control
Data storage
Protective shutdown
BITE/Fault reporting
APU indication

The APU is designed to automatically start when certain logic conditions are met when the aircraft is in the air or electrical power removed from left and right transfer buses from respective No. 1 and No. 2 engine generators.

15) Communications

For Communications Systems description, refer to Section 1.9.

1.6.9 Aircraft Performance

The detailed Boeing Performance analysis of the aircraft is provided in Appendix 1.6E. This section summarises the aircraft performance and range capability of MH370.

The following data were available to help analyse the possible flight paths of the aircraft: ACARS data, radar data, and satellite data. Wind data were incorporated along the paths to determine the true airspeed which was incorporated into the performance fuel burn and range analysis.

The ACARS data provided the quantity of fuel on board after approximately 25 minutes of flight following take-off from KUL.

The radar data provided information about the flight path and ground speed after the last ACARS transmission and captured the left turn off of the scheduled route until the data ended over the Straits of Malacca. The analysis of the radar data allowed for an estimation of the fuel burn during that portion of the flight. However, that estimation was built on many assumptions, including flying at constant altitude and constant airspeed during each flight segment.

The satellite data provided evidence that the satellite was in communication with the aircraft until the last transmission at time 0019:29.42 UTC, approximately 7 hours and 37 minutes after take-off from KUL. Refer to Section 1.9.5.

The performance range capability of the aircraft, along with the satellite data, allowed for the creation of multiple flight path profiles that demonstrate that the aircraft had the range capability to reach the 7th Arc¹⁰.

Many assumptions were also made during the flight path profile creation, including but not limited to, constant altitude and constant speed from Arc 1 to Arc 7, with the restriction that there were no course changes between the arcs. Additional analyses were conducted in Boeing and MAS simulators that continued the analysis after fuel exhaustion and assumed no intervention in the cockpit.

The results of the simulator session showed that the aircraft would roll gently to the left due to residual rudder deflection commanded by the Thrust Asymmetry Compensation (TAC) with the end of flight occurring within a 100 nm2 box that extended 10 nm beyond fuel exhaustion and 10 nm to the left of the flight path. The maximum range after dual engine flame-out would have been achieved through driftdown, with manual control keeping the aircraft in wings level flight, and would extend the range of the aircraft by approximately 120 nm beyond the location of the dual engine flame-out.

_________________

¹⁰Arcs - Lines created along the earth representing a set of possible aircraft positions at the time of satellite communication based on Burst Timing Offset (BTO). Refer to Appendix 1.6E for further details.

1.6.10 Boeing Patent on Remote Control Take-over of Aircraft

There have been speculations that MH370 could have been taken over control remotely in order to foil a hijack attempt. Some of these speculations have mentioned a US patent that Boeing filed for in February 2003 and received (US 7,142,971 B2) in November 2006 for a system that, once activated, would remove all controls from pilots and automatically fly and land the aircraft at a predetermined location.

According to the patent, existing preventative measures such as bullet- proof doors and the carriage of air marshals on board may have vulnerabilities. The flight crew could decide to open a lockable bullet-proof cockpit door [refer to Section 1.6.8, para. 4)] and air marshals, if used, might be over-powered. In light of the potential that unauthorised persons might be able to access the flight controls of an aircraft, the inventors conceived of a technique to avoid this risk by removing any form of human decision process that may be influenced by the circumstances of the situation, including threats or violence on-board.

The ‘uninterruptible’ autopilot envisioned by the patent could be activated, either by pilots, on-board sensors or remotely via radio or satellite links by the airline or government agencies if there were attempts to forcibly gain control of the cockpit. This system once activated would disallow pilot inputs and prevent anyone on-board from interrupting the automatic take- over. Thus, the personnel on-board could not be forced into carrying out the demands of any unauthorised person(s). To make it fully independent, the system described in the patent would have its own power supply, inaccessible in-flight, so that it could not be disengaged by tripping circuit breakers accessible on-board the aircraft. The aircraft would remain in automatic mode until after landing when ground crew working in conjunction with authorised personnel would be called to disengage the system.

Boeing has confirmed that it has not implemented the patented system or any other technology to remotely pilot a commercial aircraft and is not aware of any Boeing commercial aircraft that has incorporated such technology. The technology was never installed on an aircraft.

It should also be noted that the aircraft 9M-MRO was delivered in May 2002 to MAS before the patent was issued in 2006. The aircraft was under the control of MAS for the entire time after delivery except for a short duration at Pudong, Shanghai Airport, China in August 2012, when it underwent wing tip repair by Boeing [refer to Section 1.6.4, para. 2)]. Even then the repair was under the oversight of MAS engineers. Aircraft modification installation data do not indicate that any systems like that described in the patent were installed on the aircraft post delivery and during in-service. Airworthiness protocols require that all modifications are approved for installation and a record kept of each modification incorporated. There is no reason to believe any systems like that described in the patent either were or could have been incorporated without the knowledge of MAS.

From the foregoing, there is no evidence to support the belief that control of the aircraft 9M-MRO (operating as MH370) could have been or was taken over remotely as the technology was not implemented on commercial aircraft.

Safety Investigation Report 2018:1 Factual Information/1.6

Contents

SAFETY INVESTIGATION REPORT MH370 (9M-MRO)

1.6 AIRCRAFT INFORMATION

1.6.1 Airframe

1.6.2 Engine

1.6.3 Auxiliary Power Unit

1.6.4 Airworthiness and Maintenance

1.6.5 Weight and Balance

1.6.6 Fuel

1.6.7 Emergency Locator Transmitter

1.6.8 Aircraft Systems Description

1) Air Conditioning and Pressurisation

2) Autopilot Flight Director System

3) Electrical Power

4) Cabin and Cargo Compartments

5) Flight Controls

6) Fuel System

7) Hydraulics

8) Instrumentation

9) Airplane Information Management System

10) Navigation Systems

11) Oxygen Systems

12) Central Maintenance Computing System

13) Engines

14) Auxiliary Power Unit

15) Communications

1.6.9 Aircraft Performance

1.6.10 Boeing Patent on Remote Control Take-over of Aircraft

Navigation menu