Malaysia Airlines Flight MH370 departed Kuala Lumpur for Beijing on the night of 8 March 2014 and disappeared. At 01:21 MYT, its transponder stopped transmitting. Malaysian military radar tracked it turning back across the Malay Peninsula, then flying northwest before leaving radar coverage entirely. The aircraft flew for approximately six more hours — tracked only by satellite handshake data that indicated it was alive but provided no position — before, most likely, descending into the southern Indian Ocean.
MH370 is the accident that revealed a surveillance gap of extraordinary proportions: in 2014, a Boeing 777 on a scheduled commercial flight could fly for six hours with its transponder off, beyond radar coverage, with no one in any system able to determine where it was or whether it was under control.
This is not a case study in how an accident happened. It is a case study in what a surveillance architecture that depends on aircraft cooperation looks like when that cooperation is withdrawn.
MH370 proved that in 2014, a commercial aircraft could become invisible. Not through a technical failure. Through the deliberate or accidental deactivation of a system whose operation was entirely at the discretion of whoever was on the flight deck.
Date | 8 March 2014 |
Flight | MH 370 |
Aircraft | Boeing 777-200ER |
Operator | Malaysia Airlines |
Fatalities | 239 — all on board (presumed) |
Category | Surveillance Gap / Transponder Deactivation / Oceanic Tracking / Airspace Monitoring |
Location | Southern Indian Ocean (presumed) |
The Event
- 8 March 2014: MH370 departs Kuala Lumpur International Airport for Beijing at 00:41 MYT
- At 01:07 the ACARS system makes its last scheduled transmission
- At 01:19 the crew makes their last ATC transmission: ‘Good night, Malaysian Three Seven Zero’
- At 01:21 the transponder stops transmitting — it has been switched off, or has failed
- Malaysian military radar tracks the aircraft turning and flying northwest across the Malay Peninsula
- The aircraft crosses Malaysian airspace and moves beyond radar coverage
- Inmarsat satellite handshakes confirm the aircraft is still flying — but provide no position, only a range arc
- At approximately 08:19 MYT — nearly seven hours after departure — the last satellite handshake is recorded
- Analysis of Doppler shift data from the handshakes places the final position in the southern Indian Ocean
- The aircraft is never found; extensive debris, including flaperon and wing fragments, is recovered on shores over 18 months
The MH370 investigation is the most extensive search operation in aviation history. The seabed search covered approximately 120,000 km² of the southern Indian Ocean at depths of up to 6,000 metres. The main wreckage has not been found. The cause of the disappearance has not been definitively established.
Systems Engineering Perspective
From a systems engineering perspective, MH370 revealed the cooperative architecture limitation of global civil aviation surveillance: the entire real-time tracking system depends on the aircraft transmitting its position or being within range of ground-based radar. When both conditions fail — transponder off, beyond radar — the aircraft is invisible.
The aviation surveillance system of 2014 was designed for aircraft that cooperate with tracking. MH370 demonstrated that it had no response to an aircraft that stopped cooperating — whether through deliberate action, electrical failure, or any other cause.
Cooperative vs Independent Surveillance
Civil aviation tracking relies on cooperative surveillance — the aircraft transmits its identity and position (via ADS-B and Mode C transponders), and ground stations receive these transmissions. When the aircraft is cooperative, its position is known with high accuracy and low latency. When it is not cooperative — transponder off or failed — the aircraft exists only if it is within range of primary radar, which has limited coverage over oceanic routes.
MH370 flew beyond the range of primary radar coverage within approximately 90 minutes of its transponder deactivation. After that point, no cooperative or primary surveillance system had any information about its position.
Cooperative surveillance provides excellent position information for cooperative aircraft. It provides zero information for non-cooperative ones. In 2014, no independent, tamper-resistant tracking requirement existed for commercial aircraft.
Satellite Handshakes — Position From Geometry
The Inmarsat satellite used by MH370’s ACARS system made periodic handshakes with the aircraft — routine link-layer communications that did not contain position data but that contained enough Doppler shift information to allow analysis of the aircraft’s approximate distance and velocity relative to the satellite.
This post-hoc analysis — conducted weeks after the disappearance by Inmarsat engineers — produced the search arc in the southern Indian Ocean. It was the only information available about the aircraft’s position after it left radar coverage. It was not a designed tracking capability. It was a forensic inference from incidental data.
The ATC Handoff Gap
At 01:19, Malaysian ATC received the final crew transmission. At 01:21, the transponder was deactivated. At some point between these two events, the aircraft crossed the boundary from Malaysian into Vietnamese ATC airspace. The handoff procedure — in which Malaysian ATC would notify Vietnamese ATC of the aircraft’s position — was not completed in a way that triggered any alert when MH370 failed to appear on Vietnamese radar.
The handoff gap between two ATC regions created a window in which the aircraft’s non-appearance on Vietnamese radar produced no alert for approximately 18 minutes. By then, the aircraft had turned away from its filed route.
Human Factors Perspective
The human factors dimension of MH370 is unusual: the cause of the disappearance — whether deliberate action, incapacitation, or unknown — has not been established. The human factors analysis that is possible is at the systemic level: how does an aviation safety system respond to an aircraft that has gone silent and whose location is unknown?
The ATC Response — Alert Thresholds That Were Too High
When an aircraft fails to make a scheduled position report or fails to appear on radar after a handoff, ATC has defined procedures for declaring uncertainty, alert, and distress phases — INCERFA, ALERFA, and DETRESFA. The transition between these phases depends on elapsed time thresholds.
In MH370’s case, the time elapsed before the aircraft’s non-appearance produced a coordinated search response was longer than it should have been. The alert thresholds and inter-agency communication protocols were insufficient for the rate at which MH370 was moving away from its filed route.
Alert thresholds designed for slowly-developing navigation deviations are inadequate for a scenario where an aircraft is actively moving away from its route at 500 knots. Speed of response must be calibrated to the speed of the scenario.
The Design of Trackability
MH370 showed that trackability of commercial aircraft should be a design requirement, not an operational assumption. The assumption that a commercial aircraft crew would always cooperate with tracking — because they had no reason not to — was a design assumption with no technical enforcement. MH370 removed that assumption.
System Interaction Breakdown
1. Transponder Deactivation — No Tamper-Resistant Tracking
The transponder could be deactivated from the flight deck. No independent, tamper-resistant tracking system existed.
2. Beyond Primary Radar Coverage
Oceanic routes have no primary radar coverage. An aircraft with a deactivated transponder over the ocean is invisible.
3. ATC Handoff Gap
The handoff procedure between Malaysian and Vietnamese ATC did not produce a timely alert when MH370 failed to appear on Vietnamese radar.
Significance in Aviation Risk
1. GADSS — Global Aeronautical Distress and Safety System
ICAO mandated the Global Aeronautical Distress and Safety System (GADSS) from November 2018, requiring commercial aircraft to report position every 15 minutes, using systems that cannot be deactivated from the flight deck.
2. Autonomous Distress Tracking
Autonomous Distress Tracking (ADT) was mandated for new aircraft from 2021 — requiring a position reporting system that activates automatically when distress conditions are detected and cannot be switched off by the flight crew.
3. ATC Handoff Protocol Revision
The gap between KL ATC and Ho Chi Minh ATC in the MH370 handoff was identified as a systemic weakness requiring procedural revision.
Related Aviation Risk Lab Content
Pillar Pages
Systems Engineering: Systems Engineering
Risk Assessment: Risk Assessment
ATC and Communications: Atc And Communications
Related Case Studies
Case Study 44: MH17 — Airspace, Conflict and the Unasked Question: Mh17
Case Study 22: Germanwings 9525 — The System That Couldn’t See: Germanwings 9525
Case Study 34: TWA 514 — CFIT and the Clearance: Twa 514
Closing Perspective
MH370 is the case that proved that ‘we can always find a commercial aircraft’ was not true in 2014. A 777 with 239 people on board could fly for seven hours with its transponder off and disappear. The surveillance architecture that governed global civil aviation had no response to a non-cooperative aircraft beyond the range of primary radar.
GADSS and ADT are the engineering responses: independent, tamper-resistant position reporting that provides aircraft position every 15 minutes regardless of what is happening on the flight deck. These systems exist because 239 people disappeared over the Indian Ocean and the world could not find them.
Whether MH370 was a deliberate act, a mechanical failure, or something else, will perhaps never be definitively known. What is known — and what has been acted upon — is that a commercial aircraft must be trackable at all times, regardless of what the people inside it do with the transponder. That requirement now exists. It did not in 2014.
MH370 is the accident that created GADSS. The requirement that a commercial aircraft must always be findable now exists in international law. In 2014, it did not. MH370 is the reason it does now.
Related Posts
