The Event
On 20 January 1992, an Airbus A320 operated by Air Inter was descending toward Strasbourg during a night approach.
The aircraft deviated from its intended path and impacted terrain in the Vosges mountains.
There was no loss of control.
No structural failure.
No external threat.
The aircraft flew a controlled path—
into the ground.
What Happened (Surface Explanation)
During the descent, the crew selected a vertical descent mode using the Flight Control Unit (FCU).
The system allowed two similar but fundamentally different inputs:
- Vertical Speed (VS) → descent rate (feet per minute)
- Flight Path Angle (FPA) → descent angle (degrees)
The interface displayed both using similar formats.
A value of “3.3” could represent:
- –3.3° (normal descent angle), or
- –3300 ft/min (very high descent rate)
The aircraft descended far more steeply than intended.
The System’s Perspective
From the system’s point of view:
- A descent value was entered
- The value was valid
- The mode was active
There was no contradiction.
The system did not misinterpret the input.
It executed it precisely.
Where the Situation Became Dangerous
The issue was not incorrect data.
It was how the system allowed ambiguity to exist.
1. Mode ambiguity
- VS and FPA were selectable through the same interface
- The distinction between them was not strongly emphasised
2. Similar numeric representation
- Both modes displayed values in a similar format
- The difference between “angle” and “rate” was not visually dominant
3. Weak feedback
- Once selected, the system did not clearly reinforce which mode was active
- The aircraft responded smoothly, without signalling abnormality
The result:
Two very different actions could appear the same at the point of input.
Why the Crew Didn’t Detect It
From the cockpit:
- The aircraft was descending as commanded
- There were no immediate warnings
- The path change was gradual
The cues available were:
- Subtle
- Indirect
- Easy to interpret as normal variation
This created a condition where:
The system could follow an incorrect path without appearing incorrect.
The Critical Transition
The descent rate increased beyond what was appropriate for the approach.
But the aircraft remained:
- Stable
- Controlled
- Predictable
There was no sudden failure to trigger immediate reassessment.
By the time the situation became clearly unsafe:
- Terrain proximity was critical
- Time for correction was limited
The Deeper Pattern
This was not a failure of execution.
It was a failure of representation:
- The system allowed two modes with different meanings
- The interface did not clearly differentiate them
- The consequences of selection were not immediately visible
The system did exactly what it was told.
But what it was told depended on how the interface was interpreted.
What This Case Actually Shows
Air Inter 148 demonstrates that:
1. Interfaces shape decisions, not just actions
2. Ambiguity at input leads to precision in the wrong direction
3. Systems can be correct and still produce unsafe outcomes
4. Gradual deviations are harder to detect than abrupt failures
The Core Insight
The aircraft did not descend incorrectly by itself.
It followed:
- A valid input
- In a valid mode
- Executed correctly
The problem was that:
The system made two different intentions look the same.
Final Framing
This was not a breakdown of control.
It was a breakdown of clarity:
- The interface allowed ambiguity
- The system executed without question
- And the aircraft followed a path that appeared reasonable
Until it wasn’t.
The aircraft did not fail.
It did exactly what the system allowed it to do.
Related Posts
