"Man, that ain`t rocket science... ein zertrümmertes Fax in einem Erdloch bei Shanksville sendet kein Handshake."
Kesha, administrator 911-archiv.net
The state of affairs
The historical "Operation Northwoods" plot is viewed by many as a paradigmatic blueprint for the 9/11 attacks: the original four planes were replaced by drones and landed at secret locations while the drones were directed into their respective targets. It is possible to reconstruct the flight route of a plane by its radar data, but radio records from air traffic control and ACARS messages are fundamental tools for this purpose, too. Needless to say, these three data sets should coincide 100% in order to exclude a plane swap scenario à la Operation Northwoods. But they don't. For example, controllers were tracking Flight 11 still after the North Tower crash, so we have a contradiction between ATC radio talks and the RADES radar data. And then there's ACARS.
ACARS - Aircraft Communications and Reporting System - enables an airline to track its planes independently from radar, because every message, uplink or downlink, is routed via a certain ground station, and the station is recorded and denoted in the message. So it's possible to determine where the plane has been when the message has been sent, albeit with a pretty uncertainty of up to ca. 70 miles. The ACARS branch of 9/11 investigation has its own history by now. I myself started it in 2009
(1). In 2011 Rob Balsamo of pilotsfor911truth.org published additional corroborative evidence in two articles
(2, 3). In 2012 Italian researchers started a website especially dedicated to ACARS
(4).
The ACARS case was originally based on two documents: a printout of ACARS messages sent by United Airlines to United 93, United 175, and other planes
(5) - from now on referred to as UAL printout - and the comments of Michael Winter, a United dispatcher who perused the messages to United 93 in the course of a FBI interview
(6). These two sources show consistently that the flight path of United 93 followed a route Pittsburgh-Cleveland-Toledo-Champaign/Indiana, which is obviously different from the official route. Moreover, they show that United 93 was still airborne at 10:11. This is being discussed extensively in the mentioned articles.
In response to Balsamo's articles, 9/11 researcher Warren Stutt published another document, obtained by an FOIA request: the ACARS records of ARINC (
Aeronautical Radio Incorporated), the company that manages the communication between the airlines and their aircraft
(7). The file reveals that uplink messages follow a three-step process. When the dispatcher is finished with typing in the message and pushes the "send" button, a ULMSG (Uplink Message) is sent to a certain ARINC ground station via landline (
ground-to-ground). The message is then converted into one or more ULBLK (Uplink Block) and sent to the plane (
ground-to-air). The plane's data processor then checks if the message has been completely and correctly received. If so, the plane acknowledges the receipt of the message with sending a DLBLK (Downlink Block) to the ground (
air-to-ground).
Despite the lacking data for United 175, the file looks authentic and matches nearly perfectly the UAL printout and the FBI/Winter interview regarding Flight 93 - with a few remarkable exceptions. I have expressed my objections in my last blog entry
(8). So we have four official sources with diverging position data for United 93:
Time
|
Official Version |
FBI/Winter Interview |
UAL Printout |
Stutt ARINC File |
|---|
| 9:22 |
Pittsburgh |
Pittsburgh |
Pittsburgh |
Pittsburgh |
| 9:32 |
Canton/Akron |
Canton/Akron |
Canton/Akron |
Pittsburgh |
| 9:36 |
Cleveland |
Cleveland |
Cleveland |
Pittsburgh |
| 9:50 |
Pittsburgh |
Toledo |
Toledo |
Pittsburgh |
| 10:11 |
crashed |
Champaign |
Champaign |
Pittsburgh |
The publishing of the ARINC file ignited a fierce debate on diverse forums
(9, 10, 11, 12). Stutt's bottom line is that the ARINC file refutes the findings of Balsamo, Sergio and myself. But it doesn't - the case is a little bit more complicated.
1 - The ULMSG's in the ARINC file correspond nearly one-to-one to the messages of the UAL printout. Stutt states correctly that the position data in the printout are no direct proof that United 93 was in the vicinity of the respective ground station because the ULMSGs are only ground-to-ground transmissions. Stutt goes so far as to claim that the position data reflect the plane's predetermined flight plan only and are not adjusted when the plane changes its route, i.e. there is no correlation at all between the position in the printout and the plane's actual position. But this is an unproven claim.
2 - Unlike the UAL printout, the FBI/Winter Interview deals with ground-to air and air-to-ground messages. The table shows fundamental discrepancies between the ARINC file and Winter's testimony after 9:30. Stutt declares Winter to be in error, which is a bold step considering the dispatcher's professional expertise and the fact that David Knerr, United dispatch manager, was present during the interview and provided confirmation.
3 - The table also reveals fundamental discrepancies between the ARINC file and the official story between 9:30 and 9:40 when United 93 made its U-turn over Cleveland. According to the ARINC position data, the plane ceased flying westwards and instead circled over Pittsburgh after 9:23. Stutt tries to explain away this problem by claiming that the Cleveland and Canton/Akron ground stations were not tuned to the proper frequency, but this assertion doesn't stand a critical examination
(13).
4 - Regarding the crucial messages to United 93 after the Shanksville "crash", Stutt states that the plane didn't receive them because they were not acknowledged: "
Also the file shows that there are no type DLBLK blocks and therefore no ACARS messages received from UAL93 after the official time of the crash."
(9, post #85
) Mr. Stutt seems to believe that every received uplink is inevitably acknowledged by the aircraft, so if a message is not acknowledged, it has not been received. This, however, is not true. A plane may receive an uplink, while ground control doesn't receive the acknowledging downlink.
This article will concentrate on point 4.
The last seven messages for United 93
This is what United Airlines dispatcher Winter told the FBI regarding the last seven messages - all of them sent long after the alleged crash at Shanksville
(6 - scroll down to the end
):
Here are the relevant details for messages #18 to #24 from the Stutt ARINC file in an edited form. For convenience, the list omits all non-relevant data and features only the type of message and the time it was generated:
All seven messages are not acknowledged and end up in error reports (ICPUL="Intercept Protocol Uplink"). But for #18 and #19 there are nine ULBLKs, re-sent every 10 seconds due to the missing acknowledgment while messages #20 to #24 were rejected outright - no uplink at all. Also #18 and #19 have a different error reason code (ICPUL 311) than #20 to #24 (ICPUL 231). ICPUL 231 indicates an immediate rejection, whereas ICPUL 311 is only generated after nine unacknowledged uplinks.
For some reason Winter seemed to know that ULBLKs are aired only if the addressed plane is within radio range - i.e. that a sent ULBLK implies a received ULBLK. This is confirmed by his colleague, United dispatch manager David Knerr, who was present during the interview. Two weeks later, Knerr himself was interviewed by the FBI - obviously the investigators had still some pending questions regarding the last messages of United 93
(14):
Knerr explained the uplink and downlink references on an ACARS message. DLBLK refers to downlink while ULBLK refers to uplink. These references also identify that a ACARS message has been received by its sender, either ground communications or the aircraft.
The first thing to note here is the paradox phrase "received by its sender". The second thing is that Knerr is cited indirectly and certainly did not use this formulation word by word. It's so strikingly nonsensical that an ordinary interrogator would have reacted with "what did you say?" or "what do you mean by that?", giving Knerr the opportunity to correct or clarify the statement. Finally the writer of the the summary must have overlooked the phrase. Such three-fold blunders don't use to happen in the real word. Knerr certainly did not say verbatim "received by its sender". But what did he say then?
Without the "by its sender", the sentence makes perfectly sense:
These references also identify that a ACARS message has been received. In other words: a sent ULBLK/DLBLK is always a received ULBLK/DLBLK. Other interpretations of the errant phrase are hard to envisage. Maybe the significance of Knerr's account was so explosive that someone inside the FBI felt the need to obfuscate it by inserting the illogical addendum.
Nigel J. Lee, Boeing avionics engineer, corroborates Winter and Knerr in an appendix to the ARINC 618 Air-Ground-Protocol
(15, p. 133
):
According to Lee the MU (the aircraft's ACARS Management Unit) is able to determine whether the plane is out of radio range or something else is the reason for the missing acknowledgment. This is only possible if the downlink message is preceded by some kind of "link test" - is there radio contact to the ground? - and only sent if the test turns out positive. If it turns out negative, the MU instantly determines a NO COMM situation. If the link persists, but the downlink is not acknowledged, the system retries to downlink the message up to six times before it generates the NO COMM error message. So the routine for a no-radio situation differs from the routine for other unacknowledged messages.
ACARS 618 is written for manufacturers of avionics equipment and generally describes the downlink routines. But it is emphasized several times that the same rules also apply to uplinks. So it's safe to say that uplinks have such a preceding link test too, and this is why Winter and Knerr knew that a sent ULBLK is always received by the plane: it has successfully passed the link test. Without passing the link test, no ULBLK is sent.
The elucidations of these three experts justify postulating a link test which precedes the transmission of the actual message. We now have to consider the technical side of ACARS transmissions. The link test exists, and it has a name. Communication engineers colloquially call it a "handshake".
The ACARS handshake
ACARS is, like Telefax, an offspring of the old Telex system. Each Telex transmission is initiated by a so-called handshake: a synchronization process between sender and receiver to enable and optimize the transmission of the actual message. This requires an exchange of data between sender and receiver
before dispatching the message. The designers of ACARS have adopted this principle
(16): "
Upon receiving a message, the DSP ((ground system)) 'handshakes' with the aircraft Communications Management function according to the ACARS air-ground protocol."
The handshake is exactly the kind of link test we're looking for. If the plane is out of radio range, the handshake will fail, and the uplink message cannot be sent. Conversely: a sent ULBLK implies a successful handshake; a successful handshake implies a good VHF connection; a good VHF connection implies that the plane is within line-of sight or at least almost line-of sight of the ground station; and a line-of-sight condition implies that the plane is airborne (exception: the plane is grounded at the airport where the sender is sited - but this was not the case for United 93 at 10:11). This causal chain is hard as diamond. A crashed smouldering plane is certainly not able to response with a handshake when it is contacted by ground control.
The ARINC 618 protocol provides technical details. ACARS is a "
halfduplex" protocol
(15, p. 139
): ground system and plane communicate via a two-way radio channel, i.e both of them can send and receive, but not at the same time. Every ACARS message, uplink or downlink, is initiated by a so-called preamble. The preamble
is the ACARS handshake. It consists of three parts - pre-key, bit synchronization, and character synchronization (p. 21). The data link is established using a technique called Minimum Shift Keying (MSK) (p.22):
In other words: during the pre-key phase, sender and receiver create in a two-way process the physical preconditions (phase coherence) for the data transmission. The synchronization is then refined during the bit sync and character sync phases. Avionics people jestingly say that ground and airborne system "play ping-pong"
(2).
So if the sender of an ACARS message, uplink or downlink, doesn't receive a handshaking response from the addressee, the system knows that there is no radio contact and it's hopeless to send the message. The transmission process is aborted. ARINC 618 describes what happens in the case of a failed downlink handshake - the MU goes into NO COMM status (p. 26):
To sum it up: ARINC 618 provides first hand evidence that ULBLKs are only sent when the preceding handshake is successful, which proves that United 93 physically received the last 18 uplinks. I'm using the term
physically received here in the sense that the
begin of the message - the handshake - has been received as distinct from
contentually received for a message that has been received
in its entirety. This distinction is important, and I will get back to it in the appendix. The first definition is weaker than the latter, but for our reasoning it's absolutely sufficient. If United 93 has received the 18 uplinks physically, it was airborne, even if it hasn't received them contentually because they were corrupted by interfering signals or something else.
Warren Stutt's assertion that these 18 uplinks were not received physically because they were not acknowledged is simply wrong. This raises the question
why they were not acknowledged. As important as an answer to this problem certainly is, it's not mandatory for the basic result of my argumentation: a sent ULBLK indicates that the addressed plane is airborne. Therefore I will postpone the answer and propose a lucid solution in the appendix.
The key: Source authenticity
When it comes to the question whether United 93 has received messages #18 and #19, the Stutt ARINC file not only confirms Winter's statement and the UAL printout, but even grants a better insight thanks to the myriads of detailed data. It is even able to explain why message #20 looks different than message #24 in the UAL printout: message #20 was stuck in the output buffer for over two minutes, because it had to wait for the repeated uplinking of message #19. In contrast to that, messages #21 to #24 were rejected outright because the output buffer was empty.
This positive finding is encountered by the strange flight path of United 93 as documented in the ARINC file. It is not only in conflict with Winter and the UAL printout on the one hand and with the official story on the other hand. It also makes us believe that United 93 circled over the Pittsburgh area since 9:23 for at least 50 minutes. This scenario is not only utterly unrealistic, there's also not the least hint for it in the many published ATC radio correspondences either. Certainly the file has no good cards here. Moreover, the missing data for United 175 raise grave suspicion. An excellent article of Sergio
(17) delivers some lucid reasons why the data were not released.
Given these ambiguous conditions, what value has the Stutt ARINC file for solving the criminal case of 9/11? Should it be discarded, or should it be taken at face value? Objectively, there are three possible modes to deal with it:
1 - The Stutt ARINC file is 100% genuine. Warren Stutt himself abstains from commenting its authenticity on his website, but from the efforts he's undertaken to bring it to the people and diverse comments on diverse forums, this seems to be his position. But then he has to admit that the file is in conflict with the official story regarding United 93's whereabouts around 9:35 and also that it received 18 uplinks ten minutes after the official crash time, wherever it was flying around.
2 - The Stutt ARINC file is completely manipulated, and it makes no sense to try to gain information out of it. Proponents of this position don't take account of its authentic character however (correct ACARS syntax etc.), as well as the deep correspondence with other well-known and unquestionable sources. Thereby they squander a powerful tool to clarify the fate of United 93, American 11 and American 77. They have also to explain why the fakers took the trouble to "invent" the 18 ULBLKs sent to United 93 after its alleged crash.
3 - The Stutt ARINC file is in part manipulated; apart from the obviously forged position data of United 93 after 9:23 however, no other irregularities have been detected so far.
In my opinion 3 is definitely the most rational choice. The Stutt ARINC file has a paramount historical significance despite its flaws and should enjoy top priority if a reinvestigation of 9/11 once sees the light of day. The dispatchers Ed Ballinger, Michael Winter and David Knerr should be among the very first people to consult.
Sources
1 - United Airlines tracked a different Flight 93 than the FAA (Woody Box)
17 -
Ed Ballinger and the uplink sent to United 175 at 9:51 EDT (Sergio)
Appendix: CSMA and the hidden transmitter problem
Warren Stutt's assertion that United 93 did not receive the last 18 uplinks is not tenable. But what happened to them - why have they not been acknowledged? I've already stressed that an answer to this question is not requisite for the main thesis. Nevertheless I will now propose a simple solution without claiming to have found final proof.
CSMA (Carrier Sense Multiple Access) is a technique used in communication technologies dealing with the situation that one single data carrier (or data bus/data channel) is shared by several users to exchange messages, but is only able to convey one message at one time because two simultaneous messages disrupt each other. Therefore a user must check ("sense") if the channel is clear, i.e. no transmission is occurring, before dispatching a message. If it's not clear, the user has to wait a couple of milliseconds before checking the channel again. This procedure is repeated until the user finally senses a free channel and thus gets the okay to send the message.
This is the basic CSMA algorithm. There are more sophisticated versions like CSMA with Collison Avoidance and CSMA with Collision Detection but "Plain Old ACARS", which was in effect on 9/11, uses basic CSMA. The carrier is a "very high frequency" (VHF), and the users are, of course, ground stations and planes. If a ground station senses that the channel is occupied, it waits for a randomly chosen time (between 30 and 300 milliseconds according to ARINC 618) before trying again.
Basic CSMA suffers from a fundamental hitch with a sizeable impact on ACARS, making it even slower than it is already. It's called the
hidden transmitter (or hidden node/hidden station/hidden terminal) problem.
Diagram 1 illustrates this situation: two ground stations A and B are separated by a mountain. If A wants to send a message and checks the frequency while B has already started a transmission, A will not sense B's transmission: B is a hidden transmitter. The system will conclude that the channel is free and A transmits the message. This will result in a collision of the two transmissions and corrupt at least one, if not both of them, depending on the relative strength of the signals. The addressed plane will not send an acknowledgment to A because it did not receive the complete message. After 10 seconds, A will try to resend the uplink, check the frequency, and so on.
 |
| Diagram 1 |
Hidden transmitters generate corrupted messages, and corrupted messages are not acknowledged. So they might well have been the reason for the 18 unacknowledged ULBLKs. We have to discern two cases: the ULBLK was corrupted and the plane didn't send an acknowledging DLBLK, or the acknowledging DLBLK was corrupted. In the first case UA 93 didn't receive the ULBLK contentually, in the second case it did. But in both cases it received the ULBLK physically, making both of them toxic for the official UA 93 version.
If a plane is flying high, at cruising altitude, it is certainly within line of sight of all ground stations and planes in the vicinity, so downlinks can't bump into transmissions from hidden transmitters, but uplinks are prone to them. This case is shown in Diagram 1.
A statistical analysis of the Stutt ARINC file (comprising all three planes) shows that as much as 32% of all ULBLKs based on an ULMSG had to be resent after 10 seconds because they were not acknowledged. I factored in all ULSMGs from 15 minutes after take-off until the first error messages (exclusively), so in most cases the plane was certainly flying at cruising altitude. Here's the result:
Overall number of ULMSG:
29
ULBLK acknowledged at 1st attempt:
18
ULBLK acknowledged at 2nd attempt:
9
ULBLK acknowledged at 3rd attempt:
1
ULBLK acknowledged at 4th attempt:
1
Overall number of ULBLK:
43
Overall number of unacknowledged ULBLK:
14
This shows that hidden ground stations jamming uplinks is a common, inherent flaw of Plain Old ACARS.
 |
| Diagram 2 |
Diagram 2 shows that the situation changes drastically when the plane is flying low. The lower the altitude, the bigger the probability that the line-of-sight to any ground station is blocked by terrain. So this situation generates hidden transmitters for downlinks. Conversely the probability that uplinks suffer from hidden transmitters decreases. This is because at low altitude, the line-of-sight between the plane and a potential hidden transmitter for the sending ground station may be blocked. The hidden transmitter turns into a "no transmitter" and is no gadfly for the station anymore. In the extreme case that the plane is in radio contact with only one ground station, this station has a 100% chance of success to uplink a message, while the chances of success for a downlink is very small due to the potential big number of ground stations functioning as hidden transmitters.
Besides of message #18 and #19 for United 93 there are five more messages in the Stutt ARINC file ending up in an ICPUL 311 NO ACK message after a sequence of several (usually 9) unacknowledged ULBLKs: one for American 77, and four for American 11. Interestingly, the first two ICPUL 311 (after 9 resp.10 repeated ULBLKs) for American 11 occurred when the plane was idling at the gate, between 7:30 and 7:35. Here's an outprint of the second one. - note the similarity to the ICPUL 311 at the beginning, which belongs to message #18 for United 93.
Apart from Boston, it was certainly out of line-of sight of any other (potentially jamming) ground station. So an ULBLK sent from Boston to the plane had probably a 100% chance to come through. This makes corrupted DLBLKs the best explanation for the missing acknowledgments. In all probability
another plane idling at a distant corner of the airport and blocked by several buildings jammed American 11's DLBLKs. Does this case help explain what happened to messages #18 and #19 for United 93?
Another odd quote from David Knerr gives a valuable hint: "
In the final moments, at 10:12 AM EST, of UA Flight 93's flight, ACARS messages were being sent from ground communications but were not being received. This was causing the ACARS messages to be rejected. Knerr advised that Flight 93's low altitude may have caused this dilemma or the fact that Flight 93 had already crashed at the time messages were sent."
The crash at 10:03 was viewed as a fact. There's absolutely no need to mention the alternative possibility that United 93 was flying low - why is it mentioned then? Again we have to read between the lines. The fact that the "low altitude" remark made it into the final FBI report makes only sense if Knerr, the ACARS expert, professed himself unable to explain messages #18 and #19 by a crash and proposed a better solution: the plane's low altitude. Which fits perfectly the model of Diagram 2.
Knerr's statement together with the similar appearance of the grounded Flight 11 suggests that the 18 ULBLKs were correctly received by United 93, but the acknowledging DLBLKs were corrupted by hidden transmitters as a consequence of the low altitude.
The following diagram is based on ARINC 618 and the Stutt ARINC file and is, with one exception, able to explain the flow of all uplink messages including the rejections. The exception is the ULMSG for Flight 11 which ended up int the above outprinted ICUL 311 at 7:35 - this ICPUL 311 was not generated after 9 ULBLKs, but 10, presumably due to a glitch of the VGC counter.
A few explanations:
When the dispatcher releases the ULMSG, it is first checked if the last downlink from the plane happened more than 10 minutes ago. In this case the DSP doesn't know which ground station it has to use for the uplink and generates a ICPUL 231. This doesn't mean that the plane is out of radio range, but it's impossible for the DSP to establish contact because "time has run out".
If the message has taken this hurdle, the CSMA check is performed. In the diagram the check is omitted and it's presumed that the channel is clear.
VGC1 is a transmission counter. It is incremented by 1 each time the ULBLK is sent or resent, i.e. it counts the attempts to transmit it. After 9 futile attempts, the loop is aborted and a ICPUL 311 generated.
After a successful handshake, the ULBLK is sent, and VGT1, the "NO ACK timer" is started or reset.
"ULBLK received" must be understood as received
physically.
If the ULBLK is not jammed by a hidden transmitter, the plane's MU initiates an ACK-DLBLK. If this DLBLK is not jammed either, the message routine has been succesfully conducted.
If the DSP doesn't receive an ACK within 10 seconds, measured by the VGT1 timer, a new uplink attempt is initiated.
After the sixth attempt, the transmitting ground station is changed, and after three more attempts, the system generates a ICPUL 311.
Every new uplink attempt requires a new handshake. In case it fails because the plane has moved out of radio meanwhile, the cycle is interrupted and an ICPUL 311 is generated. This apparently happened with the ULMSG of Flight 77 sent at 10:41. It was uplinked only two times.
