Air Inter Flight 148 When the interface made two different actions look the same

Air Inter Flight 148 struck Mont Sainte-Odile at 2,620 feet while on a night approach to Strasbourg Airport, killing 87 of the 96 people on board. The aircraft was on the correct lateral track. It was descending far too steeply. The crew had entered a value into the Flight Management System guidance panel that they believed commanded a 3.3-degree flight path angle. The FMS interpreted the same entry as a 3,300 feet per minute vertical speed — a descent rate more than three times steeper.

The two modes — flight path angle (FPA) and vertical speed (V/S) — were selected using the same knob, displayed in the same window, with no visual differentiation between the two. A 3.3-degree flight path angle descent and a 3,300 feet per minute vertical speed produce completely different results. The cockpit display treated them as interchangeable.

Air Inter 148 is the founding case study in mode confusion through interface ambiguity — the failure mode where two operationally distinct system states are presented to the crew through an interface that provides no effective means of distinguishing between them.

The crew entered 3.3. They meant 3.3 degrees. The system applied 3,300 feet per minute. The interface was identically displaying two completely different quantities in the same window. Twenty-three degrees of difference. Eighty-seven deaths.

Date	20 January 1992
Flight	IT 148
Aircraft	Airbus A320-111
Operator	Air Inter
Fatalities	87 of 96 on board
Category	Human-Machine Interface / Mode Confusion / CFIT / FMS Design
Location	Mont Sainte-Odile, Alsace, France

The Event

Air Inter 148 departs Lyon for Strasbourg on a scheduled evening service
In IMC over the Vosges Mountains, the crew conducts a VOR/DME approach to Strasbourg Runway 23
The autopilot guidance panel has a combined V/S and FPA mode — selected by the same rotary knob
The crew intend to set a 3.3-degree flight path angle for the approach
The mode is in V/S, not FPA — and 3.3 is interpreted as 3,300 feet per minute vertical speed
The aircraft descends at approximately 3,300 fpm — well below the prescribed approach path
No terrain proximity warning activates — the A320 of this variant does not have EGPWS
At 20:20, the aircraft strikes a ridge on Mont Sainte-Odile at 2,620 feet
87 people die; 9 survive

The area around Strasbourg Airport is mountainous. The approved approach procedure required adherence to specific step-down altitudes. The aircraft struck terrain approximately 15 miles from the runway. The approach was not survivable at the descent rate achieved.

Systems Engineering Perspective

From a systems engineering perspective, Air Inter 148 is the foundational case study in HMI mode confusion — the design failure in which two functionally distinct system modes are accessible through the same physical interface with insufficient visual differentiation between them.

An interface that presents two operationally distinct modes — 3.3 degrees vs 3,300 feet per minute — in the same display window, with no persistent indication of which mode is active, is not an interface that supports safe operation. It is an interface that makes fatal misidentification predictable.

The V/S and FPA Mode — Same Window, Completely Different Physics

The Airbus A320’s FCU (Flight Control Unit) guidance panel used a single display window and a single rotary knob for both Vertical Speed mode and Flight Path Angle mode. When in V/S mode, the displayed value was in hundreds of feet per minute (so ‘-33’ meant -3,300 fpm). When in FPA mode, the displayed value was in tenths of a degree (so ‘-33’ meant -3.3 degrees).

The mode was indicated by a small indicator on the panel — visible but not prominent. In the task of setting up the approach, the crew did not verify that the mode was in FPA before entering the desired descent angle. They were in V/S. The entry of 3.3 (tenths of a degree, intended) was interpreted as 33 (hundreds of feet per minute, resulting in -3,300 fpm).

This is a design-induced error: the interface design made an extremely consequential error — selecting the wrong mode — achievable through a single omission in a high-workload environment.

An interface where a single mode-selection omission can produce a 10-fold change in the effective descent rate is not a safety-critical interface. It is an accident mechanism.

No EGPWS — The Missing Safety Net

The A320 variant operated by Air Inter on this flight did not have Enhanced Ground Proximity Warning Systems with a terrain database. The standard GPWS fitted had terrain proximity alerting based on radio altimeter and rate of descent — it could not provide look-ahead warnings for terrain ahead on the approach path.

The combination of a high descent rate, mountainous terrain, and no look-ahead terrain warning removed the last independent safety barrier. An EGPWS would have generated a warning approximately 60 seconds before impact — sufficient time for a missed approach. Its absence was a direct contributing factor.

EGPWS was available in 1992. It was not fitted to this aircraft. The terrain database warning that would have prevented this accident existed — it was simply not installed.

Approach Design in Mountainous Terrain

The VOR/DME approach to Strasbourg Runway 23 required navigation through mountainous terrain with minimum safe altitudes significantly higher than the terrain in the area. A crew executing this approach at the wrong descent angle would have negligible margin for error before terrain contact.

Human Factors Perspective

The human factors analysis centres on the specific mode confusion failure mode created by the FCU interface design and on the operational workload environment in which the error occurred.

Mode Selection Without Verification — The Error-Latent Task

The procedure for setting the desired descent on the FCU required: selecting the correct mode (FPA or V/S), then entering the desired value. If the mode was not verified before value entry, the wrong mode would silently apply the entered value with completely different physical meaning.

In a busy approach environment at night, over mountainous terrain, with the cognitive demands of navigation and cockpit preparation, mode verification is a task that can be displaced. The interface design provided no compelling prompt to verify mode before value entry. The error was not careless — it was predictable in the operational context.

Error-latent designs are designs in which a specific, predictable omission under operational conditions produces a serious safety consequence. The FCU’s V/S/FPA selector was an error-latent design in the most direct sense.

The Post-Accident Standard — EGPWS and Mode Display

Following Air Inter 148, the Airbus A320 FCU mode display design was reviewed. The flight path angle mode was made more clearly distinct from vertical speed mode in subsequent production variants. More significantly, the accident accelerated the mandating of EGPWS with terrain databases on transport aircraft — providing the independent safety layer that the interface design had failed to provide.

System Interaction Breakdown

1. Mode Ambiguity — V/S and FPA in Same Display

The FCU’s combined display for V/S and FPA modes with identical-format values provided no effective visual distinction between two modes with radically different physical consequences.

When two modes produce values that look identical but mean completely different things, the interface must make mode identity visually unambiguous. Non-ambiguous mode indication is not a usability preference — it is a safety requirement.

2. No Terrain Look-Ahead Warning

The absence of EGPWS with a terrain database removed the last safety barrier against terrain impact on an approach that placed the aircraft in close proximity to high terrain.

3. High Descent Rate in Mountainous Terrain

A 3,300 fpm descent rate in the Vosges Mountains provided no terrain clearance margin at the aircraft’s position when the mode error occurred.

Significance in Aviation Risk

1. FCU Mode Display Design Revision

The Airbus A320 FCU interface was reviewed and revised in subsequent production variants to make the V/S/FPA mode selection more clearly distinguishable. The accident established that mode identity must be unambiguous in safety-critical flight guidance interfaces.

2. EGPWS Mandate Accelerated

Air Inter 148 contributed to the international mandate for EGPWS with terrain database on all commercial transport aircraft. The terrain look-ahead capability that would have prevented this accident became a universal requirement.

3. Mode Confusion as a Distinct Failure Category

Air Inter 148 established mode confusion — the misidentification of an active FMS or autopilot mode — as a distinct, named failure category in aviation human factors, requiring specific training and interface design standards.

Closing Perspective

Air Inter 148 killed 87 people because two operationally distinct guidance modes were presented through an interface that made their difference functionally invisible in the conditions of actual operation. The crew did not make an error in the abstract. They made an error that the interface design made predictable.

The distinction between 3.3 degrees and 3,300 feet per minute is not subtle in concept. In a combined FCU display window at night on a busy approach to a mountainous airport, it was invisible. The interface had failed at its most fundamental task: making the system state visible to the operators who depended on it.

Mode confusion is now a named, trained, and interface-regulated failure category because of what happened on Mont Sainte-Odile. Every mode indication standard in modern fly-by-wire aircraft design carries the influence of Air Inter 148.

Air Inter 148 is the case that established that interface ambiguity between modes with different physical consequences is a safety hazard, not a usability issue. The 87 deaths were the price of a display that showed 3.3 when it meant 3,300.