MH17: ?

, ! .


» MH17: ? »  DSB JIT »  DSB 13.10.15: MH17 Crash Appendices A-U


DSB 13.10.15: MH17 Crash Appendices A-U

61 90 177

61

60

APPENDIX J


AEROPLANE SYSTEMS AND ENGINES INFORMATION

Aeroplane and engine - general information
General
The Boeing 777 is built by The Boeing Company and the type was frst certifed in 1995
under Federal Aviation Administration type certifcate number T00001SE. Since entry
into service, over 1,000 Boeing 777 aeroplanes have been built. Three main models of
the Boeing 777 exist; the original -200 series, the longer -300 series and the cargo
version of the aeroplane.
In the case of the accident aeroplane, it was a -200 variant of the type, powered by RollsRoyce Trent 892B engines. The data relating to the accident aeroplane is summarised as
follows:

Item

Details

Manufacturer

The Boeing Company

Type / Model

Boeing 777-200 / 777-2H6

Year of construction

1997

Registration

9M-MRD

Serial number

28411

Total flight hours / cycles

76,322.10 / 11,434

Maximum take-off mass

286,897 kg

Engine type

Rolls-Royce Trent 892B

Table 11: Summary of aeroplane information.
The aeroplanes general characteristics are as follows:

Length:

63.73 m

Wingspan:

60.93 m

Height:

18.76 m (when unloaded; this decreases when loaded to no less than 18.42 m

62

61

Structure
The Boeing 777 is a conventional design transport aeroplane that makes use of lightweight
structural materials to lessen the overall mass of the aeroplane. Such materials include
aluminium alloys (e.g. Alloy 7055 made up of aluminium, zinc (ca. 8%), magnesium (ca. 2%)
and copper (ca. 2%) among other elements) and composites such as carbon fbre.
The fuselage structure is semi-monocoque and has a near circular cross-section giving
the fuselage a width of about 5.6 metres over most of its length. A pressurised section of
fuselage between the forward and aft bulkhead includes both the passenger deck and
lower baggage / cargo holds.
The aluminium skin is supported by frames, stringers and beams. A non-structural nose
radome, tail cone and wing-to-body fairings complete the fuselage. Dividing the fuselage
along its length is a metal / composite floor. The metal components are generally riveted
together using countersunk rivets, whilst the composite parts are glued together. Skin
panels are riveted and glued.
When referencing the location of structural parts, Boeing has sub-divided the fuselage
into seven sections. See Abbreviations and Defnitions.
The wing-to-body fairings are made of composite panels with a honeycomb core.
The wings are made up of an aluminium structure covered with aluminium skin panels.
The horizontal and vertical tail structures are composed of aluminium boxes covered with
a solid laminate carbon fbre reinforced plastic. Leading edges are aluminium covered.
Engines
The Rolls-Royce Trent 800 engine type was frst certifed by the European Aviation Safety
Agency (EASA) in 1997 under EASA type certifcate number E.047. The front fan is made
up of 26 wide chord hollow titanium blades. The fan has a diameter of 2.79 m.
Engine Health Monitoring (EHM)
The condition of the engine is monitored by measuring engine system temperatures and
vibrations, engine oil pressure and the three shaft speeds. These parameters values are
compared to validated values of a performance model to verify margins with worst case
values. This data (albeit not continuous but snap shot data) from flights during the
preceding two weeks was also reviewed by Rolls-Royce to analyse engine trend
performance and health. It is noted by Rolls-Royce that for the accident flight, only
take-off and climb data reports were received; the cruise data having not been sent via
the data link to the operator prior to the crash. The data is transmitted by the Aircraft
Communication Addressing and Reporting System (ACARS) from time to time during the
flight, but not necessarily at the time of data capture. Once received by the operator,
Malaysia Airlines, it is forwarded to Rolls-Royce for analysis.
Based upon Rolls-Royces Engine Health Monitoring analysis it was concluded that no
parameter limits were exceeded. The left engine showed, since 4 July 2014, an increase
in vibration for take-off and cruise, although this was still within limits. This was followed
by corrective action taken by the operator to re-lubricate the blade roots. Rolls-Royce

63

62

reported the following to the Dutch Safety Board regarding the engines: From the
available data for the accident flight and for the preceding two weeks of operation of the
engines installed on the aeroplane, there is no evidence of any unusual engine behaviour
or trend with the engines that is outside of Rolls-Royces experience or expectation for
any Trent 800 engines with similar service lives.
Other engine data
Each engine is controlled by its own Electronic Engine Controller located on the engine
fan casing. The Electronic Engine Controller, which is normally powered by the electrical
system of the aeroplane, has a separate electrical generator system supplying its own
back-up power as soon as the engine rotates.
Therefore, it is believed that engine data may still have been recorded in the non volatile
memories of the Electronic Engine Controllers after the abrupt stop of Flight Data
Recorder and Cockpit Voice Recorder recordings due to the failure of the normal
aeroplane power supply. As both Electronic Engine Controllers were lost in the event, no
additional data could be retrieved to support the reconstruction of the flight after
Cockpit Voice Recorder and Flight Data Recorder stopped recording.
Aeroplane technical log entries
The history of engine maintenance details back to November 2013, as found in the
aeroplanes technical log, were reviewed. The entries show primarily engine systems
status messages and a small number of occurrences of minor damage to the acoustic
liner material followed by satisfactory systems checks and repairs. Rolls-Royce reported
that the acoustic liners are prone to damage over time and that limits are quoted in the
engine section of the Aeroplane Maintenance Manual for which approved repair
techniques are available. Furthermore, Rolls-Royce stated that multiple repairs to the
acoustic liners are common on engines with high service lives.
During the turnaround at Schiphol, engine oil was added to the left engine. Technical log
records show that the recent oil consumption was within limits. No technical complaints
about the engine were reported on the day of the accident flight.
Rolls-Royce engine feld investigation at Gilze-Rijen Air Force Base
The examination of the wreckage of the engines by the Dutch Safety Board and RollsRoyce showed that both engines impacted the ground in an inverted attitude. Both fans
were found detached in a manner consistent with ground impact and the fan blade roots
of both engines remained in place in their discs. Not all of the aerofoil material was present.
The main core of the right engine was relatively intact and the main core of the left engine
had split into two sections between the rear of the intermediate casing and the front of the
high pressure compressor. No evidence was found that any major event such as a disc loss,
turbine loss or flame breakout had occurred prior to the ground impact.

64

63

The low pressure and intermediate shaft of the left engine had fractured and the evidence
suggests it was the result from tension due to impact on the ground. As the fan blades and
the intermediate compressor blades of the left engine showed little evidence of any rotation
at impact, it assumes that at the moment of impact the engine was not under power.
The intermediate pressure compressor and the front of the high pressure compressor of
both the left and the right engines showed evidence of unknown foreign material damage
that was consistent with a running engine. As this would most likely result in a surge,
which has not been recorded at the Flight Data Recorder, it would have occurred after
the recording ceased. The ingested material likely caused damage to the compressors
and further released material from the compressor in both engines.
Pressurisation and oxygen
General
Accidents in the past show that an in-flight break-up can occur following the sudden
failure of a pressurised cabin. Therefore, information relating to the functioning of the
pressure cabin has been reviewed. This includes the possible response of the oxygen
supply system when the cabin suddenly depressurises.
Flight Data Recorder data shows that up to and including the end of recording at 13.20:03
(15.20:03 CET), there were no warnings recorded that related to the pressurisation system
or cabin altitude.
The aeroplanes pneumatic system uses, in flight, engine air primarily for cabin
pressurisation, air conditioning, equipment bay and cargo bay heating and cooling and
anti-icing purposes. The description here is related to the way that the pneumatic system
interfaces with the air conditioning and pressurisation system.
In normal operation, the pressurisation system functions automatically to maintain the
cabin pressure at cruise altitudes at a maximum of approximately 4,800 feet and/or have
a maximum pressure differential with ambient air. The oxygen content of air pressurised
to 4,800 feet is suffcient for breathing during flight. The system also ensures that the
aeroplane is de-pressurised on landing. The pressurisation system is controlled, in normal
operation, automatically by two cabin pressure controllers. Shut-off valves are used to
maintain pressure and air flow rates.
As the pneumatic system normally supplies a greater than required quantity of air for the
air conditioning system, outflow valves in the forward and aft areas of the fuselage
control the amount of air that flows out of the aeroplane, keeping the cabin air pressure
within limits when at altitude.
Emergency oxygen for the flight crew is stored in oxygen bottles installed below the
cockpit. When a flight crew member dons a mask, oxygen will flow. As flight crew
members usually test the oxygen system prior to each flight, the oxygen pressure in the

65

64

bottle decreases. Entries in the aeroplanes Technical Log made by ground engineers
from Malaysia Airlines demonstrates that the oxygen bottles were reflled on a regular
basis in line with standard maintenance practices.
The negative pressure relief valves
The Boeing 777 has four negative pressure relief valves, two on each side. Their purpose
is to open when the pressure outside the aircraft is higher than inside, to prevent damage
to the fuselage. This is essential, because the fuselage is a pressure cabin and has a
differential pressure over the fuselage skin and is designed to withstand a force working
from inside to the outside (positive differential pressure). A negative pressure difference
normally builds up gradually and as consequence a fully opened valve is practically
impossible. The valve has a spring loaded door which keeps the valve closed when the
differential pressure is zero and opens when the differential is 0.2 psi.
Landing gear
The aeroplane has a tricycle landing gear arrangement; two main landing gear legs,
located mid-fuselage, and a nose landing gear leg. The nose gear is a two-wheel unit
that is steerable. The main landing gear legs each have six wheels; two per axle. The rear
axle of each leg is steerable.
The primary method of operating the landing gear is by means of the hydraulic system.
The normal operation of the landing gear, when extending, is a combination of gravity
(lowering without hydraulic assistance) combined with a hydraulically operated locking
mechanism. Hydraulic actuation ensures that down locks are engaged, that the landing
gear doors close and that the landing gear is tilted to a pre-determined position. In the
case of malfunction, the landing gear may be extended by means of an alternate system.
The retraction mechanism is wholly actuated by the hydraulic system. As evidenced by
the recovered main landing gear assemblies there were no intact lock links to secure the
side/drag braces; both were sheared off. In addition, in an in-flight break-up, air loads
from the fall, collision with other debris, ground impact and disturbance during recovery/
transportation, could all randomise the motion of unsecured side/drag braces.
Flight Data Recorder information shows that the landing gear was in the up position
until the end of recording. It is likely that landing gear extension of one of the gears is a
result of the in-flight break-up and/or the following ground impact.
Navigation systems
The aeroplanes navigation systems include Global Positioning System (GPS), air data
inertial reference system, instruments for receiving traditional ground based navigational
aids,7 air traffc control transponder, weather radar and the Flight Management System.


7 These include such equipment as VOR, DME and ILS.

66

65

The aeroplane has two GPS antennas and receivers, both of which are tuned automatically.
Due to its great accuracy, the GPS data has priority in the navigation system over the
inertial system.
The air data inertial reference system calculates the aeroplanes altitude, airspeed,
attitude, heading and position for use on the flight crew displays, Flight Management
System, flight and engine controls as well as other systems. The air data inertial reference
system is supplied with air data from the left, centre and right pitot and static systems.
Air data is considered valid by the air data inertial reference system when at least two of
the sources provide identical data. The air data sources are supplemented by data from
the two angle of attack vanes and a dual air temperature probe.
The ground based navigation aids are normally tuned for use automatically by the Flight
Management Computer, but they may be tuned manually by the flight crew, if required.
The navigation data in the Flight Management Computer is updated every 28 days as
per the usual navigation chart revision cycle; the so-called AIRAC-cycle.
The aeroplanes weather radar consists of a receiver-transmitter unit, an antenna and a
cockpit control panel. The weather radar collects data from different scans and merges
this data to produce a total weather image for the flight crew. The software eliminates
clutter created by terrain to allow weather up to 320 NM ahead to be viewed. In
addition, the software allows data from thunderstorms with tops within 5,000 feet of the
aeroplanes level to be displayed. Turbulence is sensed by the weather radar based on
precipitation. Therefore, clear air turbulence cannot be detected.
The Flight Management System assists the flight crew with the flights navigation and
optimizing the flights effciency. After the flight crew have entered a route into the Flight
Management System, prior to departure, the Flight Management System uses the navigation
database to calculate commands for the aeroplanes flight path control, both vertically and
laterally (the vertical and horizontal profles). These Flight Management System calculated
commands may be overridden or otherwise changed by the flight crew during flight.
Other systems
As a potential source of high-energy objects, the Ram Air Turbine was reviewed during
the investigation. The Ram Air Turbine is a small electrical generator that can be used in
the case of a total electrical failure. It contains a propeller that is deployed into the
airflow. Deployment is automatic in the case of a major electrical failure but it can be
deployed by the flight crew on demand. It is located on the right side of the aeroplane
behind the wing. The Ram Air Turbine was severely damaged and could not be examined.
The fxed Emergency Locator Transmitter had been tested in the week prior to the crash
as part of routine maintenance during a routine maintenance check on 11 July 2014 and
no faults were identifed.

67

66

Maintenance information
General
An investigation was held into the airworthiness of the aeroplane using documents
provided by Malaysia Airlines. In addition, interviews were held with staff from the
operators maintenance department.
The maintenance programme is built up of routine maintenance inputs named A, C and
D, based on their complexity and frequency with A being the most simple and D being
the most complex. The A-check is split into four parts (A1 to A4) with each part being
performed on a 600 flight hour cycle; a so-called equalised maintenance concept. A
similar approach is applied to the C-check; 2 checks each 750 days.
Aeroplane Maintenance Schedule
The operators Maintenance Schedule for the Boeing 777-200 is based on the
Maintenance Planning Document produced by Boeing for the Boeing 777-200. The
resulting schedule of maintenance check cycles is shown in Table 12

Check type

Details

Transit and Stay-over

Aeroplane in transit between flights

A-check

A1 - 550 flight hours
A2 - 550 flight hours
A3 - 550 flight hours
A4 - 550 flight hours

C-check

C1 - 750 days
C2 - 750 days

D-check

D - 3,000 days

Table 12: Maintenance check intervals.
A review of the maintenance records for the accident aeroplane revealed a sequence of
checks as indicated in Table 13.

68

67

https://c.radikal.ru/c22/1907/bc/de1b402cf566.png
Table 13. Maintenance data for the aeroplane.
Prior to the check in 2013, the previous D-check was completed on 9 September 2005.
Using a 3,000-day limit, the D-check that was completed on 15 November 2013 was due
by 26 November 2013. The D-check was combined with a number of A and C-checks. The
last scheduled maintenance prior to the crash was an A-check, conducted on 28 May 2014.
The Malaysian Department of Civil Aviation does not issue Airworthiness Directives for
large foreign-built aircraft. Instead, Malaysian operators are required to apply the
directives of the State of Manufacture. For the Boeing 777, this means that US Federal
Aviation Administration Airworthiness Directives apply. For the engines, built by RollsRoyce, European Aviation Safety Agency directives are applicable. The means for
identifying and implementing such directives was reviewed. The companys Technical
Services department produces a document for each Airworthiness Directive, identifying
its applicability, implementation timescale and how the task shall be accomplished.
A similar administrative process exists for Service Bulletins. As these are not automatically
applicable, Malaysia Airlines performs a technical and fnancial analysis on each Service
Bulletin with a view to determining the need to implement it.
The procedure in use for evaluating and determining the need to implement both
Airworthiness Directives and Service Bulletins is considered by the Dutch Safety Board to
be complete and correct.
Maintenance history
The investigation reviewed the aeroplanes maintenance history by taking the D-check
that ended on 15 November 2013 as a baseline for serviceability. For the following cases,
the baseline is different:
engines: from installation date, and
structural items relating to pressure hull: from hour zero.

69

68

https://c.radikal.ru/c10/1907/5f/d0b80f81a701.png
Table 14: Airframe, engines and APU data.
A review of the Malaysia Airlines maintenance database for planned maintenance showed
that the aeroplane underwent a D-check between 18 September and 15 November 2013.
The frst flight following that maintenance was on 15 November from the maintenance
base at Sultan Abdul Aziz Shah Airport at Subang to Kuala Lumpur.
The maintenance records were reviewed to identify any maintenance tasks that had not
been completed as per the planned schedule. None were found for those tasks or parts
limited by time, flight hours or flight cycles. No items were discovered in the analysis of
the maintenance documentation that showed exeedances with the planned or life limits.
In addition, repeat defects are of interest. In the investigations review of Technical Log
entries for the period from November 2013 to July 2014, a number of cabin pressure
related items were noted:
The left two flight deck windows were reported to be making buzzing or whistling
noises repeatedly between November 2013 and January 2014;
The left two flight deck windows were reported to be making hissing or whistling
noises several times in April and May 2014;
In November 2013, several reports were made about a noise coming from passenger
door 3L, and
The lower crew rest compartment had repeated problems with its heating and airflow.

70

69

Repairs to seals of the two windows and the passenger door were made. The lower crew
rest compartment problems were rectifed with the replacement of an electronic control
card.
Three defciencies were open as deferred items on flight MH17. These were:
the cockpit Voice Recorder microphone cap in the cockpit was missing;
a complaint about the condition of two cabin overhead bins, and
a 1 x 3 inch damage of the left engine acoustic lining.
The Federal Aviation Administration issued Airworthiness Directive 2014-05-03 regarding
the possibility of cracking in the fuselage skin underneath the satellite communication
(SATCOM) antenna adapter, (see also Boeing Service Bulletin 777-53A0068). The
Airworthiness Directive was issued to detect and correct cracking and corrosion in the
fuselage skin, which could lead to rapid decompression and loss of structural integrity of
the aeroplane.
For the aeroplane that crashed, various codes and numbers exist for production,
operation and certifcation. The aeroplanes registration was 9M-MRD. In addition to the
serial number, 28411, the variable number WB 164 is also used. Service Bulletin 777-
53A0068 showed a list of variable numbers for aeroplanes to which the Service Bulletin
applied. Variable number WB 164 was not on this list. The Airworthiness Directive and
Service Bulletin did not apply to the aeroplane that crashed.
Furthermore, Malaysia Airlines provided a list with mandatory occurrence reports for the
aeroplane reflecting the period between October 2002 and November 2013. The reports
were sent to the Malaysian Department of Civil Aviation and described occurrences
which had no relation to the functioning of the pressure cabin or the engines.
Malaysia Airlines reported that only one structural repair had been made to the aeroplane
as the result of damage found. A minor repair was made to the left wing spar web at
STA1308 near body line 122.45. The repair was made during a C-check in October 2007
as per the Boeing Structural Repair Manual.

71

70
APPENDIX K


BALLISTIC TRAJECTORY ANALYSIS METHODS

Ballistic trajectory analysis can be applied to selected wreckage pieces to assist in the
determination of the breakup sequence. The ballistic trajectory of a wreckage piece can
be calculated based on its mass and aerodynamic characteristics, or the Ballistic
Coeffcient. The Ballistic Coeffcient is a function of an objects weight, aerodynamic drag
coeffcient, and its effective cross sectional area. It should be noted that it is diffcult to
estimate the attitude of the wreckage pieces during descent. Also, the attitude of the
object, relative to the air stream, affects the objects effective cross-sectional area. It is
assumed for this analysis that the Ballistic Coeffcient for an object is constant. Thus, the
ballistic analysis can only be used as reference information to support the flight MH17s
break-up sequence analysis.
Dynamic model of the ballistic trajectory
Given an object with mass (M) and velocity (V). Its flight path is in the XZ-plane, making
an angle (Y) with the direction on the x-axis.

https://a.radikal.ru/a29/1907/94/6676d58b67ff.png
Figure 14: Schematic overview of the effect on the flight path and fnal position of an object for a high and
                a low value of the Ballistic Coeffcient (BC). The wind is coming along the y-axis in this example.
               (Source: Dutch Safety Board)
Applying Newtons law, F = M*a, the accelerations in the directions of the axes, X, Y and
Z can be written as:

72

71

https://c.radikal.ru/c36/1907/9b/56df6de7b690.png
And for the components of the velocity (V) in the directions of the axes:
https://a.radikal.ru/a32/1907/ef/06cc10e2f2f3.png
Where:
γ : flight path angle in the XZ- plane
Ψ : flight path angle in the XY- plane
ΨW(h): Angle between x-axis and wind velocity, function of the height above sea level
ρ : air density
ax, ay, and az: longitudinal, lateral and vertical un-modelled accelerations along the
three axes X, Y and Z, respectively. These un-modelled accelerations are assumed to
be zero for this study
CD: zero-lift drag coeffcient
D : aerodynamic drag of the object
M : mass of object
S : reference area of a ballistic object
V: velocity of the object
Vx, Vy and Vz: components of the velocity along the axes X, Y and Z, respectively
VW: wind velocity, function of the height above sea level
W: weight of the object (M*g)

It should be noted that in equation 1 the acceleration equals zero along the Z-axis when
the terminal velocity is reached. The terminal velocity is defned as the velocity at which
aerodynamic drag equals the weight of the ballistic object.

73

72

Method 1; trajectory analysis selected wreckage piece
The frst method is to calculate the wreckage piece trajectory with a time step simulation
from its initial conditions to the ground. The initial condition is described with six
parameters: positions (East, North, and altitude), airspeed, flight path angle and heading.
After integrating equation 1 in time with the wreckage Ballistic Coeffcient and inputting
the wind profle, the three axes position variables in equation 2 can be obtained.
Applying the initial position and integrating equation 2, the ballistic trajectory of the
wreckage piece can be obtained.
For a ballistic trajectory simulation the last recorded altitude, airspeed, and heading
parameter values by the Flight Data Recorder are used as the known initial conditions of
the simulation. A computer program then outputs a three-dimensional trajectory of the
specifc wreckage object when it hits the ground. This position is then compared to the
wreckage position where it was found.
There are several sources of error in the ballistic trajectory analysis that should be taken
into account when interpreting the results. These error sources are not limited to
uncertainties in the estimation of:
the wreckage mass;
aerodynamic drag coeffcient, and
the wind profle.
The ballistic trajectory analysis assumes that the wreckage pieces fell with a constant
Ballistic Coeffcient from the moment of separation from the aircraft main body. In fact,
wreckage orientation during descent is very diffcult to predict. During initial separation,
dynamic forces on the wreckage would result in an initial separation condition from a
pure ballistic trajectory for a period, which could induce an error in the fnal descent
point. Furthermore, the ballistic trajectory generated does not consider the possible
sub-separations of the wreckage pieces. Ballistic trajectory analysis also assumes that
wreckage objects separated from the main fuselage at an initial airspeed and with a
heading equal to the last recorded flight condition. The accuracy of wind profles would
also impact the accuracy of the results. The wind profle would affect the initial positions
of the wreckage items, and may also affect their sequence of separation during the rapid
descent.
It is also possible to inverse method 1 and use the wreckage position as the initial
condition, hereby calculating the altitude of break-up. In this calculation the errors
mentioned previously will also affect this calculation.
Method 2: Ballistic Coeffcient locus line
Another way of applying the ballistic simulation is to calculate the ground positions for
multiple Ballistic Coeffcients thereby creating a locus line. A locus is a shape created by
the set of points whose position satisfes a given set of rules. The locus line represents
the projected positions of wreckage pieces after break-up given an initial position.
The trajectory of an object with a high Ballistic Coeffcient will asymptotically approach
its initial heading when the break-up occurres. The trajectory of an object with a low

74

73

Ballistic Coeffcient will asymptotically follow the wind drift. Thus, for pieces with higher
Ballistic Coeffcient, the trajectory matching to the recovery location will be more
accurate as lighter (low Ballistic Coeffcient pieces are influenced more by the wind).
When running this simulation it has the advantage that it creates a representative (locus)
line including wind errors but without estimation errors for specifc wreckage pieces
characteristics (mass, surface area etc). In essence this simulation creates a baseline of
expected position after break-up given the initial conditions.
Ballistic Coeffcient calculation
During the investigation a video showing falling debris from flight MH17 was published
on the internet by unknown persons. By research it was determined that this debris was
in fact textile rolls transported as cargo aboard flight MH17. A number of these (partly
and fully unrolled) textile rolls were recovered en transported to the Netherlands. Based
on the textile retrieved, the full length wound on one roll was estimated at 100 meters.
Analysing the video footage a probable location where the video was taken was
established. From this location and the known heading of the aircraft fve textile rolls
were found and identifed on satellite imagery in wreckage site 4.
https://d.radikal.ru/d14/1907/8a/5cf8155e7a12.png
Figure 15: Video showing falling debris (5 white textile rolls) from MH17, the black smoke in the background is
                from site 6. Image transmitted by various media organisations. (Source: unknown)
The video was further analysed to determine if the Ballistic Coeffcient of these textile
rolls could be calculated. Several assumptions were made for this calculation:
The textile roll is fully unrolled (100 metres long);
The beginning or end of the textile roll is fully visible, and
Static camera position (no (little) camera movement).
Images from the video were extracted to create an overlay for analyses purposes. For the
textile roll #1 images were taken which were 11 seconds apart. The shed roof was used
as reference. The drop distance was extracted using image pixels. The length of the

75

74

textile roll (100 metres) was also defned in pixels. The result was a drop speed of
5.2 metres/second. Another textile roll was calculated defned as roll #5.
Calculation of the drop speed was done using six images. This yielded a result of
4.1 metres/second. For calculation a range of drop speeds were taken between 4 and
5.5 metres per second which resulted in a Ballistic Coeffcient between 0.252 and 0.363.

https://d.radikal.ru/d19/1907/63/d2d54b1afd2a.png
Figure 16: Video image overlay of frst and last frame to determine the drop speed of the textile roll. Image
                transmitted by various media organisations. (Source: unknown)
Wind profle
The wind profle of weather balloon measurements from Rostov on Don Airport was used
as input for the trajectory analysis calculations. The last recorded wind on the Flight Data
Recorder was 219 degrees at 36 knots

76

75

https://b.radikal.ru/b43/1907/08/a8668e644d6d.png
Figure 17: Wind profle used in the ballistic trajectory analysis. (Source: UK Met Offce)

77

76

APPENDIX L


TYPICAL FRACTURE MODES

In current metallic thin-walled aeroplane structures, static overloading will cause fractures
in the components. In such type of structure the following types of overload failures can
be expected:
tension failure;
shear failure;
compression failure;
bending and peeling, and
skin/sub-structure separation.
During the investigation of the break-up of the aeroplane these main types of structural
overload fractures were analysed.
Tension failure
Tension overload failure refers to failure of the skin due to excessive tensile loading. The
nature of this failure mode results in a relatively clean and straight fracture line along a
natural weak-point in a structure such as a riveted joint or coupling. Examples of a pure
tension failure include straight cracks in net-sections,8 paint cracks aligned with skin
cracks and stiffener failures at the frst fastener. See Figure 18. It should be noted that
paint cracks are parallel to the fracture.
https://a.radikal.ru/a03/1907/c4/47b903831458.png
Figure 18: Typical case of net section failure, straight cracks in net section, paint cracks aligned with skin crack,
stiffener failure perpendicular to its axis, at frst fastener. (Source: Dutch Safety Board)


8 Location where the material is weakened by drilled holes for the purpose of the construction.

78

77

Shear failure
Pure shear failure is not very common. Figure 19 shows an example.

https://c.radikal.ru/c32/1907/2d/6330b17a0fcc.png
Figure 19: Pure shear failure, fracture in circumferential joint. (Source: Dutch Safety Board)

Combination of shear and tension failure
Most fractures in mechanical joints are caused by a combination of tension and shear
loading. In this type of fractures the orientation of the fracture is perpendicular to the
resultant of the loading. Hence under an angle. In this type of failure, cracks link-up
between fastener holes after cracking along an angle (see Figure 20). This is also valid for
the paint cracks (see Figure 21).
https://a.radikal.ru/a32/1907/06/a78ce56910f6.png
Figure 20: Typical failure under tension and shear, cracks link-up between fastener holes after growing along
                an angle. Continuation of crack under angle away from fastener row indicates direction of crack
                growth downward. (Source: Dutch Safety Board)

79

78

https://d.radikal.ru/d08/1907/44/94b7adcc651a.png
Figure 21: Paint cracks indicating a combination of tension and shear loading. Net-section failure with
                indication of tension and shear, the paint cracks perpendicular to the resulting loading. (Source:
                Dutch Safety Board)
Compressive failure
Compressive failure can either be buckling of a skin or plate panel or buckling of a
stringer. The phenomenon of stringer buckling in the wreckage was in general very local.
Figure 22 shows examples of (local) buckling of stringers.
https://c.radikal.ru/c20/1907/f2/5ceee0845ba4.png
Figure 22: Illustration of stringer buckling, see red arrows, indicating compression. (Source: Dutch Safety
                Board)
Peeling of a mechanical joint
In this case one of the skins is pulled away, out of plane, from the other skin. See Figure 23.

80

79

https://d.radikal.ru/d10/1907/49/8a705b0617d9.png
Figure 23: Typical case of longitudinal joint failure by peeling, in the right part of the fgure. (Source: Dutch
                Safety Board)
Bending and peeling
Isolated bending/peeling refers to the presence of a distinct bend-line resulting from the
fnal separation of one piece of wreckage from another. The separation of the pieces of
wreckage causes one piece to peel away from the other, producing the localised bending
deformation in the wreckage. See Figure 24.
https://a.radikal.ru/a12/1907/df/c764d64fcd95.png
Figure 24: Example of bending/peeling at a fracture line associated with the fnal separation between two
               pieces of wreckage. (Source: Dutch Safety Board)
Skin/sub-structure separation
Skin/sub-structure separation refers to an area of a wreckage piece where the skin has
torn away from the underlying stringer and frame sub-structure (See Figure 25). The
lower stiffness of the skin relative to the substructure indicates that the flap of unreinforced
skin must have been torn from the substructure. The location of this feature also indicates
a convergence point for developing fractures as it typically indicates the last point of
connection between two pieces of wreckage.

81

80

https://a.radikal.ru/a35/1907/35/82cdf678d176.png
Figure 25: Typical case of skin/sub-structure separation. The skin has been pulled away from stringers and
                frames. (Source: Dutch Safety Board)

82

81

APPENDIX M


AGREEMENT REGARDING UKRAINIAN ATC DATA

https://d.radikal.ru/d26/1907/25/1af1da88972f.png

83

82

https://a.radikal.ru/a25/1907/40/8fff3ca7d7cc.png

N.B. For privacy reasons, names of individuals, their signatures and some contact details have been blanked
       out in this document.

84

83

APPENDIX N


BACKGROUND TO OCCUPANTS EXPOSURE
Due to the missile exploding, the occupants were exposed to:
Metal fragments from warhead and missile
Metal fragments struck the aeroplane at a speed of 4,500 - 9,000 km/h, tearing off part
of the cockpit. Not only did the warhead fragments perforate the aeroplanes fuselage,
they also struck the crew members in the cockpit. Due to the high speed and the large
number of fragments, this impact was instantly fatal. There were no missile fragments
found in the bodies of the other occupants.
Effects of the pressure wave
A pressure wave of hot air immediately followed the impact (blast). This pressure wave
originated outside the aeroplane, above and to the left of the cockpit, and lasted just a
few milliseconds. The pressure wave travelled across the aeroplane extremely quickly
and greatly decreased in force with distance.9 Given the damage pattern on the
aeroplane, it was established that the pressure wave only penetrated the cockpit. As a
result, the crew were directly exposed to the pressure wave, the other occupants were
not.10 This does not detract from the fact that when it hit the aeroplane, the pressure
wave caused a shock that may have been felt through the entire aeroplane.
Noise
The pressure wave caused by the missile exploding is accompanied by a deafening sound
wave. This loud and abnormal sound must have been audible to everyone on board.
Due to the aeroplane breaking up, the occupants were exposed to the following factors:
Deceleration and acceleration
The aeroplane was flying at cruising altitude and at a constant speed. The separating of
the front section of the aeroplane caused a sudden deceleration, which changed into an
acceleration as a result of the aeroplane falling down. This sudden deceleration and the
subsequent acceleration exerted forces on the occupants bodies. It may have caused
dizziness, nausea and loss of consciousness.11,12 Powerful deceleration or acceleration
could have resulted in (serious) injury due to contact with hard objects (for example,


9 From a point 12.5 metres from the nose of the aeroplane, the exterior of the aeroplane showed no visible damage
caused by the pressure wave.
10 Additional information from TNO taken from the investigation into the cause of the crash (11 May 2015).
11 Van Lieshout E.J., J.J. Van Lieshout, J. Krol, M. Simons, J.M. Karemaker, Maximal Tolerance to High-g in the
Human Centrifuge is Not Set by Neural Cardiovascular Control, Pflugers Archiv-418, R148, 1991 (Abstract).
12 Van Lieshout J.J., W. Wieling, J.M. Karemaker, N.H. Secher, Syncope, Cerebral Perfusion, and Oxygenation,
Journal of Applied Physiology, 94, 2003, 833-848

85

84

seats or luggage) or due to the seatbelt. Occupants who were not wearing their seatbelt
or were walking around the cabin, risked a greater chance of injury. It is likely that people
were also injured by objects flying around such as hand luggage and parts of the
aeroplane that had torn loose.
Decompression
After the aeroplane was hit by metal fragments, cabin pressure was lost and became
equal to the ambient pressure (decompression).13 The sudden decrease in air pressure
causes acute expansion of the chest and can lead to (serious internal) injury.14,15
Decompression in the aeroplane was accompanied by the formation of mist resulting
from the condensation of water vapour present in the cabin. This mist is so dense that it
is often confused with smoke as the result of a fre. Research has revealed that, even
though it soon disappears, this mist can contribute to disorientation.16
Reduced oxygen availability
Loss of cabin pressure also resulted in the oxygen supply being lost. This meant that the
occupants were exposed to thin air with a greatly reduced oxygen level. At an altitude of
10 kilometres, the amount of oxygen available is approximately a quarter compared with
that at sea level.17
A lack of oxygen can result in shortness of breath, dizziness, disorientation, loss of
concentration and eventually to loss of consciousness. The speed at which a person loses
consciousness as a result of oxygen defciency 18 depends on the altitude. At an altitude
of 9 to 10 km (30,000-33,000 feet), the lack of oxygen leads to unconsciousness within
30 seconds to one minute. A rapid descent, as in the case of flight MH17, leads to an
increase in the amount of available oxygen.19
Cold
The outside air temperature at the flight altitude at the time of the impact varied between
-40 C to -50 C. This means that the difference between the temperature inside the
aeroplane and the ambient temperature exceeded 60 C. A sudden exposure to this
temperature difference causes a shock effect and leads to immediate physical reactions,
such as a reduction in skin blood flow. Additionally, acute exposure to extreme cold


13 At the time of the impact, the air pressure in the aeroplane as recorded by the flight data recorder was comparable
to the air pressure at an altitude of 1,463 metres (4,800 feet).
14 This mechanism is comparable to the effects of a diver descending or ascending too rapidly while using
compressed air, especially in the last three metres below the surface. The differences in pressure between the air
in the body cavities and that in the environment then increase quickly. If not compensated for actively (clearing the
ears, exhaling), this results in injury.
15 FAA, Aviation Pilot Handbook, Chapter 16 Aeromedical Factors, fg 16-1. http://www.faa.gov/regulations_policies/
handbooks_manuals/aviation/pilot_handbook/media/PHAK%20-%20Chapter%2016.pdf, consulted on 5 June 2015.
16 Information from CML.
17 The oxygen percentage, compared to other gases, at ground level and at high altitude is similar (approximately
21%), but the number of particles per volume (expressed in partial oxygen pressure or particles per volume unit)
decreases drastically, halving every 5,500 metres - the air becomes thinner.
18 Also known as time of useful consciousness (TUC).
19 Source: FAA, Aviation Pilot Handbook, Chapter 16 Aeromedical Factors, fg 16-1. http://www.faa.gov/regulations_
policies/handbooks_manuals/aviation/pilot_handbook/media/PHAK%20-%20Chapter%2016.pdf, consulted on
5 June 2015

86

85

leads to an increased respiratory rate (hyperventilation) with a decreasing level of carbon
dioxide in the blood, and corresponding decrease in blood flow to the brain.20,21 This can
lead to dizziness and reduced consciousness.22,23
Airflow
When an aeroplane breaks up, the people on board are exposed to the airflow caused
by the speed of the aeroplane. In this case, there was an airflow with a speed of roughly
900 km/h (480-490 knots). By comparison, the winds accompanying hurricane Katrina24
had a maximum speed of 282 km/h.25, 26 A human being can withstand this kind of airflow,
but will have diffculty breathing and moving and is entirely caught up by the powerful
airflow.27 Injuries may be caused as parts of the body are caught by the airflow. In addition
to possible injuries, the extreme airflow also causes further loss of body heat (wind chill
effect).
Detached aeroplane parts, luggage and occupants who were walking around in the
cabin may have been caught by the airflow. The airflow was strongest at the fracture
edges, decreasing towards the rear section of the aeroplane because of the obstacles in
the interior. The airflow created by the rapid descent caused a noise comparable to that
of a very severe storm. This could have contributed to possible startle reactions and
disorientation.
From photographs by journalists and eyewitness accounts it appears that several
passengers were found at the scene of the crash without any clothes. This fnding concurs
with previous aeroplane crashes. The explanation is that the powerful airflow ripped off
the light holiday clothes many people were wearing.
Impact on the ground
All occupants were exposed to the force associated with falling to the ground from an
altitude of 10 kilometres. Regardless of the exact speed, the impact on the ground after
a fall from this altitude is regarded as non-survivable.


20 Mantoni T., B. Belhage B. L.M. Pedersen LM, F.C. Pott, Reduced Cerebral Perfusion on Sudden Immersion in Ice
Water: A Possible Cause of Drowning, Aviation, Space, and Environmental Medicine, 78, 2007, 374-376.
21 Mantoni T., J.H. Rasmussen J.H., B. Belhage, F.C. Pott, Voluntary Respiratory Control and Cerebral Blood Flow
Velocity Upon Ice-Water Immersion, Aviation, Space, and Environmental Medicine, 79, 2008, 765-768.
22 Hida W, Y. Kikuchi, S. Okabe, H. Miki, H. Kurosawa, K. Shirato k. CO2 Response for the Brain Stem Artery Blood
Flow Velocity in Man, Respiration Physiology, 104, 1996, 71-75.
23 Immink R.V., F.C. Pott, N.H. Secher, J.J. van Lieshout, Hyperventilation, Cerebral Perfusion, and Syncope, Journal
of Applied Physiology 116, 2014, 844-851.
24 New Orleans, USA, 2005.
25 In comparison: a hurricane of 12 BF has wind speeds exceeding 117 km/h, http://www.knmi.nl/cms/content/25772/
orkaan, consulted on 6 May 2015.
26 National Hurricane Center, http://nhc.noaa.gov.
27 Information from CML.

87

86

Appendices
part B:
Flying over
conflict zones

88

87

APPENDICES PART B:


FLYING OVER CONFLICT ZONES

Appendices O Participants in the investigation (Part B)                                      88
Appendices P Developments relevant to the investigation                                  90
Appendices Q Laws and regulations                                                                 92
Appendices R Operators that flew over the eastern part of Ukraine                   104
Appendices S Precedents: Accidents involving civil aviation over
conflict zones                                                                                               113
Appendices T Report of the Dutch review committee for the intelligence and
security services                                                                                           115
Appendices U  Flying over conflict zones - risk assessment                               150

89

88

APPENDIX O


PARTICIPANTS IN THE INVESTIGATION (PART B)

Guidance committee
The guidance committee consists of members with expertise that is relevant to the
investigation and advises the Dutch Safety Board on the investigation. Members are
appointed to the committee in a personal capacity. The guidance committee convened
on four occasions: on 23 September 2014, 27 November 2014, 15 April 2015 and
18 August 2015. During the third and fourth meeting, the guidance committee for the
investigation into the crash circumstances of flight MH17 was also present. This was
because parts of this report are also relevant for the investigation of on the crash
circumstances. Some of the members were also consulted about elements of the
investigation when the occasion arose. The guidance committee comprised the following
persons:
M.B.A. van Asselt (chairperson) Board Member of the Dutch Safety Board
M. Beringer Independent Air Traffc Management consultant
R. van Dam President of the International Foundation for Public Aviation
B.A. de Graaf Professor of History of international relations, Utrecht University
P.M.J. Mendes de Leon Professor at Leiden University, Director of the International Institute for Public, Air and Space Law
M.A.G. Peters CEO, NLR
A. Verberk Former CEO, Martinair Holland
B.J.A.M. Welten Associate Member of the Dutch Safety Board

90

89

Project team
The project team consisted of the following persons:
M. Visser Investigation manager
F. Bloemendaal Project manager as of 1 November 2014
D.C. Ipenburg Project manager up to 1 November 2014; then investigator
A. Faas Investigator from 1 October 2014 to 1 April 2015
R.J. Francken Investigator from 25 August 2014 to 1 April 2015
S. van t Klooster Investigator from 7 August 2014 to 1 April 2015
A. van der Kolk Advisor research and development
G. Oomen Investigator
H. van Ruler Investigator
V. Telkamp Investigator
Th.M.H. van der Velden Investigator


» MH17: ? »  DSB JIT »  DSB 13.10.15: MH17 Crash Appendices A-U