61

Structure
The Boeing 777 is a conventional design transport aeroplane that makes use of lightweight
structural materials to lessen the overall mass of the aeroplane. Such materials include
aluminium alloys (e.g. Alloy 7055 made up of aluminium, zinc (ca. 8%), magnesium (ca. 2%)
and copper (ca. 2%) among other elements) and composites such as carbon fbre.
The fuselage structure is semi-monocoque and has a near circular cross-section giving
the fuselage a width of about 5.6 metres over most of its length. A pressurised section of
fuselage between the forward and aft bulkhead includes both the passenger deck and
lower baggage / cargo holds.
The aluminium skin is supported by frames, stringers and beams. A non-structural nose
radome, tail cone and wing-to-body fairings complete the fuselage. Dividing the fuselage
along its length is a metal / composite floor. The metal components are generally riveted
together using countersunk rivets, whilst the composite parts are glued together. Skin
panels are riveted and glued.
When referencing the location of structural parts, Boeing has sub-divided the fuselage
into seven sections. See Abbreviations and Defnitions.
The wing-to-body fairings are made of composite panels with a honeycomb core.
The wings are made up of an aluminium structure covered with aluminium skin panels.
The horizontal and vertical tail structures are composed of aluminium boxes covered with
a solid laminate carbon fbre reinforced plastic. Leading edges are aluminium covered.
Engines
The Rolls-Royce Trent 800 engine type was frst certifed by the European Aviation Safety
Agency (EASA) in 1997 under EASA type certifcate number E.047. The front fan is made
up of 26 wide chord hollow titanium blades. The fan has a diameter of 2.79 m.
Engine Health Monitoring (EHM)
The condition of the engine is monitored by measuring engine system temperatures and
vibrations, engine oil pressure and the three shaft speeds. These parameters values are
compared to validated values of a performance model to verify margins with ‘worst case’
values. This data (albeit not continuous but ‘snap shot’ data) from flights during the
preceding two weeks was also reviewed by Rolls-Royce to analyse engine trend
performance and health. It is noted by Rolls-Royce that for the accident flight, only
take-off and climb data reports were received; the cruise data having not been sent via
the data link to the operator prior to the crash. The data is transmitted by the Aircraft
Communication Addressing and Reporting System (ACARS) from time to time during the
flight, but not necessarily at the time of data capture. Once received by the operator,
Malaysia Airlines, it is forwarded to Rolls-Royce for analysis.
Based upon Rolls-Royce’s Engine Health Monitoring analysis it was concluded that no
parameter limits were exceeded. The left engine showed, since 4 July 2014, an increase
in vibration for take-off and cruise, although this was still within limits. This was followed
by corrective action taken by the operator to re-lubricate the blade roots. Rolls-Royce

63

The low pressure and intermediate shaft of the left engine had fractured and the evidence
suggests it was the result from tension due to impact on the ground. As the fan blades and
the intermediate compressor blades of the left engine showed little evidence of any rotation
at impact, it assumes that at the moment of impact the engine was not under power.
The intermediate pressure compressor and the front of the high pressure compressor of
both the left and the right engines showed evidence of unknown foreign material damage
that was consistent with a running engine. As this would most likely result in a surge,
which has not been recorded at the Flight Data Recorder, it would have occurred after
the recording ceased. The ingested material likely caused damage to the compressors
and further released material from the compressor in both engines.
Pressurisation and oxygen
General
Accidents in the past show that an in-flight break-up can occur following the sudden
failure of a pressurised cabin. Therefore, information relating to the functioning of the
pressure cabin has been reviewed. This includes the possible response of the oxygen
supply system when the cabin suddenly depressurises.
Flight Data Recorder data shows that up to and including the end of recording at 13.20:03
(15.20:03 CET), there were no warnings recorded that related to the pressurisation system
or cabin altitude.
The aeroplane’s pneumatic system uses, in flight, engine air primarily for cabin
pressurisation, air conditioning, equipment bay and cargo bay heating and cooling and
anti-icing purposes. The description here is related to the way that the pneumatic system
interfaces with the air conditioning and pressurisation system.
In normal operation, the pressurisation system functions automatically to maintain the
cabin pressure at cruise altitudes at a maximum of approximately 4,800 feet and/or have
a maximum pressure differential with ambient air. The oxygen content of air pressurised
to 4,800 feet is suffcient for breathing during flight. The system also ensures that the
aeroplane is de-pressurised on landing. The pressurisation system is controlled, in normal
operation, automatically by two cabin pressure controllers. Shut-off valves are used to
maintain pressure and air flow rates.
As the pneumatic system normally supplies a greater than required quantity of air for the
air conditioning system, outflow valves in the forward and aft areas of the fuselage
control the amount of air that flows out of the aeroplane, keeping the cabin air pressure
within limits when at altitude.
Emergency oxygen for the flight crew is stored in oxygen bottles installed below the
cockpit. When a flight crew member dons a mask, oxygen will flow. As flight crew
members usually test the oxygen system prior to each flight, the oxygen pressure in the

65

The aeroplane has two GPS antennas and receivers, both of which are tuned automatically.
Due to its great accuracy, the GPS data has priority in the navigation system over the
inertial system.
The air data inertial reference system calculates the aeroplane’s altitude, airspeed,
attitude, heading and position for use on the flight crew displays, Flight Management
System, flight and engine controls as well as other systems. The air data inertial reference
system is supplied with air data from the left, centre and right pitot and static systems.
Air data is considered valid by the air data inertial reference system when at least two of
the sources provide identical data. The air data sources are supplemented by data from
the two angle of attack vanes and a dual air temperature probe.
The ground based navigation aids are normally tuned for use automatically by the Flight
Management Computer, but they may be tuned manually by the flight crew, if required.
The navigation data in the Flight Management Computer is updated every 28 days as
per the usual navigation chart revision cycle; the so-called AIRAC-cycle.
The aeroplane’s weather radar consists of a receiver-transmitter unit, an antenna and a
cockpit control panel. The weather radar collects data from different scans and merges
this data to produce a total weather image for the flight crew. The software eliminates
‘clutter’ created by terrain to allow weather up to 320 NM ahead to be viewed. In
addition, the software allows data from thunderstorms with tops within 5,000 feet of the
aeroplane’s level to be displayed. Turbulence is sensed by the weather radar based on
precipitation. Therefore, clear air turbulence cannot be detected.
The Flight Management System assists the flight crew with the flight’s navigation and
optimizing the flight’s effciency. After the flight crew have entered a route into the Flight
Management System, prior to departure, the Flight Management System uses the navigation
database to calculate commands for the aeroplane’s flight path control, both vertically and
laterally (the vertical and horizontal profles). These Flight Management System calculated
commands may be overridden or otherwise changed by the flight crew during flight.
Other systems
As a potential source of high-energy objects, the Ram Air Turbine was reviewed during
the investigation. The Ram Air Turbine is a small electrical generator that can be used in
the case of a total electrical failure. It contains a propeller that is deployed into the
airflow. Deployment is automatic in the case of a major electrical failure but it can be
deployed by the flight crew on demand. It is located on the right side of the aeroplane
behind the wing. The Ram Air Turbine was severely damaged and could not be examined.
The fxed Emergency Locator Transmitter had been tested in the week prior to the crash
as part of routine maintenance during a routine maintenance check on 11 July 2014 and
no faults were identifed.

67

Table 13. Maintenance data for the aeroplane.
Prior to the check in 2013, the previous D-check was completed on 9 September 2005.
Using a 3,000-day limit, the D-check that was completed on 15 November 2013 was due
by 26 November 2013. The D-check was combined with a number of A and C-checks. The
last scheduled maintenance prior to the crash was an A-check, conducted on 28 May 2014.
The Malaysian Department of Civil Aviation does not issue Airworthiness Directives for
large foreign-built aircraft. Instead, Malaysian operators are required to apply the
directives of the State of Manufacture. For the Boeing 777, this means that US Federal
Aviation Administration Airworthiness Directives apply. For the engines, built by RollsRoyce, European Aviation Safety Agency directives are applicable. The means for
identifying and implementing such directives was reviewed. The company’s Technical
Services department produces a document for each Airworthiness Directive, identifying
its applicability, implementation timescale and how the task shall be accomplished.
A similar administrative process exists for Service Bulletins. As these are not automatically
applicable, Malaysia Airlines performs a technical and fnancial analysis on each Service
Bulletin with a view to determining the need to implement it.
The procedure in use for evaluating and determining the need to implement both
Airworthiness Directives and Service Bulletins is considered by the Dutch Safety Board to
be complete and correct.
Maintenance history
The investigation reviewed the aeroplane’s maintenance history by taking the D-check
that ended on 15 November 2013 as a baseline for serviceability. For the following cases,
the baseline is different:
• engines: from installation date, and
• structural items relating to pressure hull: from hour zero.

69

Repairs to seals of the two windows and the passenger door were made. The lower crew
rest compartment problems were rectifed with the replacement of an electronic control
card.
Three defciencies were open as deferred items on flight MH17. These were:
• the cockpit Voice Recorder microphone cap in the cockpit was missing;
• a complaint about the condition of two cabin overhead bins, and
• a 1 x 3 inch damage of the left engine acoustic lining.
The Federal Aviation Administration issued Airworthiness Directive 2014-05-03 regarding
the possibility of cracking in the fuselage skin underneath the satellite communication
(SATCOM) antenna adapter, (see also Boeing Service Bulletin 777-53A0068). The
Airworthiness Directive was issued to detect and correct cracking and corrosion in the
fuselage skin, which could lead to rapid decompression and loss of structural integrity of
the aeroplane.
For the aeroplane that crashed, various codes and numbers exist for production,
operation and certifcation. The aeroplane’s registration was 9M-MRD. In addition to the
serial number, 28411, the variable number WB 164 is also used. Service Bulletin 777-
53A0068 showed a list of variable numbers for aeroplanes to which the Service Bulletin
applied. Variable number WB 164 was not on this list. The Airworthiness Directive and
Service Bulletin did not apply to the aeroplane that crashed.
Furthermore, Malaysia Airlines provided a list with mandatory occurrence reports for the
aeroplane reflecting the period between October 2002 and November 2013. The reports
were sent to the Malaysian Department of Civil Aviation and described occurrences
which had no relation to the functioning of the pressure cabin or the engines.
Malaysia Airlines reported that only one structural repair had been made to the aeroplane
as the result of damage found. A minor repair was made to the left wing spar web at
STA1308 near body line 122.45. The repair was made during a C-check in October 2007
as per the Boeing Structural Repair Manual.

71

It should be noted that in equation 1 the acceleration equals zero along the Z-axis when
the terminal velocity is reached. The terminal velocity is defned as the velocity at which
aerodynamic drag equals the weight of the ballistic object.

73

Ballistic Coeffcient will asymptotically follow the wind drift. Thus, for pieces with higher
Ballistic Coeffcient, the trajectory matching to the recovery location will be more
accurate as lighter (low Ballistic Coeffcient pieces are influenced more by the wind).
When running this simulation it has the advantage that it creates a representative (locus)
line including wind errors but without estimation errors for specifc wreckage pieces
characteristics (mass, surface area etc). In essence this simulation creates a baseline of
expected position after break-up given the initial conditions.
Ballistic Coeffcient calculation
During the investigation a video showing falling debris from flight MH17 was published
on the internet by unknown persons. By research it was determined that this debris was
in fact textile rolls transported as cargo aboard flight MH17. A number of these (partly
and fully unrolled) textile rolls were recovered en transported to the Netherlands. Based
on the textile retrieved, the full length wound on one roll was estimated at 100 meters.
Analysing the video footage a probable location where the video was taken was
established. From this location and the known heading of the aircraft fve textile rolls
were found and identifed on satellite imagery in wreckage site 4.

Figure 15: Video showing falling debris (5 white textile rolls) from MH17, the black smoke in the background is
                from site 6. Image transmitted by various media organisations. (Source: unknown)
The video was further analysed to determine if the Ballistic Coeffcient of these textile
rolls could be calculated. Several assumptions were made for this calculation:
• The textile roll is fully unrolled (100 metres long);
• The beginning or end of the textile roll is fully visible, and
• Static camera position (no (little) camera movement).
Images from the video were extracted to create an overlay for analyses purposes. For the
textile roll #1 images were taken which were 11 seconds apart. The shed roof was used
as reference. The drop distance was extracted using image pixels. The length of the

75

Figure 17: Wind profle used in the ballistic trajectory analysis. (Source: UK Met Offce)

77

Shear failure
Pure shear failure is not very common. Figure 19 shows an example.

Figure 19: Pure shear failure, fracture in circumferential joint. (Source: Dutch Safety Board)

Combination of shear and tension failure
Most fractures in mechanical joints are caused by a combination of tension and shear
loading. In this type of fractures the orientation of the fracture is perpendicular to the
resultant of the loading. Hence under an angle. In this type of failure, cracks link-up
between fastener holes after cracking along an angle (see Figure 20). This is also valid for
the paint cracks (see Figure 21).

Figure 20: Typical failure under tension and shear, cracks link-up between fastener holes after growing along
                an angle. Continuation of crack under angle away from fastener row indicates direction of crack
                growth downward. (Source: Dutch Safety Board)

79

Figure 23: Typical case of longitudinal joint failure by peeling, in the right part of the fgure. (Source: Dutch
                Safety Board)
Bending and peeling
Isolated bending/peeling refers to the presence of a distinct bend-line resulting from the
fnal separation of one piece of wreckage from another. The separation of the pieces of
wreckage causes one piece to peel away from the other, producing the localised bending
deformation in the wreckage. See Figure 24.

Figure 24: Example of bending/peeling at a fracture line associated with the fnal separation between two
               pieces of wreckage. (Source: Dutch Safety Board)
Skin/sub-structure separation
Skin/sub-structure separation refers to an area of a wreckage piece where the skin has
torn away from the underlying stringer and frame sub-structure (See Figure 25). The
lower stiffness of the skin relative to the substructure indicates that the flap of unreinforced
skin must have been torn from the substructure. The location of this feature also indicates
a convergence point for developing fractures as it typically indicates the last point of
connection between two pieces of wreckage.

81

APPENDIX M

AGREEMENT REGARDING UKRAINIAN ATC DATA

83

APPENDIX N

BACKGROUND TO OCCUPANTS EXPOSURE
Due to the missile exploding, the occupants were exposed to:
Metal fragments from warhead and missile
Metal fragments struck the aeroplane at a speed of 4,500 - 9,000 km/h, tearing off part
of the cockpit. Not only did the warhead fragments perforate the aeroplane’s fuselage,
they also struck the crew members in the cockpit. Due to the high speed and the large
number of fragments, this impact was instantly fatal. There were no missile fragments
found in the bodies of the other occupants.
Effects of the pressure wave
A pressure wave of hot air immediately followed the impact (blast). This pressure wave
originated outside the aeroplane, above and to the left of the cockpit, and lasted just a
few milliseconds. The pressure wave travelled across the aeroplane extremely quickly
and greatly decreased in force with distance.9 Given the damage pattern on the
aeroplane, it was established that the pressure wave only penetrated the cockpit. As a
result, the crew were directly exposed to the pressure wave, the other occupants were
not.10 This does not detract from the fact that when it hit the aeroplane, the pressure
wave caused a shock that may have been felt through the entire aeroplane.
Noise
The pressure wave caused by the missile exploding is accompanied by a deafening sound
wave. This loud and abnormal sound must have been audible to everyone on board.
Due to the aeroplane breaking up, the occupants were exposed to the following factors:
Deceleration and acceleration
The aeroplane was flying at cruising altitude and at a constant speed. The separating of
the front section of the aeroplane caused a sudden deceleration, which changed into an
acceleration as a result of the aeroplane falling down. This sudden deceleration and the
subsequent acceleration exerted forces on the occupants’ bodies. It may have caused
dizziness, nausea and loss of consciousness.11,12 Powerful deceleration or acceleration
could have resulted in (serious) injury due to contact with hard objects (for example,

9 From a point 12.5 metres from the nose of the aeroplane, the exterior of the aeroplane showed no visible damage
caused by the pressure wave.
10 Additional information from TNO taken from the investigation into the cause of the crash (11 May 2015).
11 Van Lieshout E.J., J.J. Van Lieshout, J. Krol, M. Simons, J.M. Karemaker, ‘Maximal Tolerance to High-g in the
Human Centrifuge is Not Set by Neural Cardiovascular Control’, Pflugers Archiv-418, R148, 1991 (Abstract).
12 Van Lieshout J.J., W. Wieling, J.M. Karemaker, N.H. Secher, ‘Syncope, Cerebral Perfusion, and Oxygenation’,
Journal of Applied Physiology, 94, 2003, 833-848

85

leads to an increased respiratory rate (hyperventilation) with a decreasing level of carbon
dioxide in the blood, and corresponding decrease in blood flow to the brain.20,21 This can
lead to dizziness and reduced consciousness.22,23
Airflow
When an aeroplane breaks up, the people on board are exposed to the airflow caused
by the speed of the aeroplane. In this case, there was an airflow with a speed of roughly
900 km/h (480-490 knots). By comparison, the winds accompanying hurricane Katrina24
had a maximum speed of 282 km/h.25, 26 A human being can withstand this kind of airflow,
but will have diffculty breathing and moving and is entirely caught up by the powerful
airflow.27 Injuries may be caused as parts of the body are caught by the airflow. In addition
to possible injuries, the extreme airflow also causes further loss of body heat (wind chill
effect).
Detached aeroplane parts, luggage and occupants who were walking around in the
cabin may have been caught by the airflow. The airflow was strongest at the fracture
edges, decreasing towards the rear section of the aeroplane because of the obstacles in
the interior. The airflow created by the rapid descent caused a noise comparable to that
of a very severe storm. This could have contributed to possible startle reactions and
disorientation.
From photographs by journalists and eyewitness accounts it appears that several
passengers were found at the scene of the crash without any clothes. This fnding concurs
with previous aeroplane crashes. The explanation is that the powerful airflow ripped off
the light holiday clothes many people were wearing.
Impact on the ground
All occupants were exposed to the force associated with falling to the ground from an
altitude of 10 kilometres. Regardless of the exact speed, the impact on the ground after
a fall from this altitude is regarded as non-survivable.

20 Mantoni T., B. Belhage B. L.M. Pedersen LM, F.C. Pott, ‘Reduced Cerebral Perfusion on Sudden Immersion in Ice
Water: A Possible Cause of Drowning,’ Aviation, Space, and Environmental Medicine, 78, 2007, 374-376.
21 Mantoni T., J.H. Rasmussen J.H., B. Belhage, F.C. Pott, ‘Voluntary Respiratory Control and Cerebral Blood Flow
Velocity Upon Ice-Water Immersion’, Aviation, Space, and Environmental Medicine, 79, 2008, 765-768.
22 Hida W, Y. Kikuchi, S. Okabe, H. Miki, H. Kurosawa, K. Shirato k. ‘CO2 Response for the Brain Stem Artery Blood
Flow Velocity in Man’, Respiration Physiology, 104, 1996, 71-75.
23 Immink R.V., F.C. Pott, N.H. Secher, J.J. van Lieshout, ‘Hyperventilation, Cerebral Perfusion, and Syncope’, Journal
of Applied Physiology 116, 2014, 844-851.
24 New Orleans, USA, 2005.
25 In comparison: a hurricane of 12 BF has wind speeds exceeding 117 km/h, http://www.knmi.nl/cms/content/25772/
orkaan, consulted on 6 May 2015.
26 National Hurricane Center, http://nhc.noaa.gov.
27 Information from CML.

87

APPENDICES PART B:

FLYING OVER CONFLICT ZONES

Appendices O Participants in the investigation (Part B)                                      88
Appendices P Developments relevant to the investigation                                  90
Appendices Q Laws and regulations                                                                 92
Appendices R Operators that flew over the eastern part of Ukraine                   104
Appendices S Precedents: Accidents involving civil aviation over
conflict zones                                                                                               113
Appendices T Report of the Dutch review committee for the intelligence and
security services                                                                                           115
Appendices U  Flying over conflict zones - risk assessment                               150