An A320 autopilot flew a 3,300 ft/min descent into a French ridge, killing 87

On the evening of 20 January 1992, an Airbus A320 operated by the French domestic carrier Air Inter descended toward Strasbourg-Entzheim at about 3,300 feet per minute, roughly four times the rate the published approach required, and flew into a wooded ridge in the Vosges at an elevation of about 2,620 feet. Eighty-seven of the 96 people aboard were killed. The French commission of investigation never established with certainty why that descent rate was commanded, but it judged it quite probable that the crew had set a vertical speed where they intended a flight path angle, using an autopilot control panel in which both quantities shared one knob and one two-digit display window. The case became the canonical example of automation mode confusion: a control system executing its instruction faithfully while the humans supervising it held a different mental model of what it was doing.

What happened

Flight 148 left Lyon-Satolas for Strasbourg on a routine domestic evening service with 90 passengers and six crew aboard, according to the Federal Aviation Administration's accident study of the flight. The crew had programmed and briefed an instrument landing system approach to runway 23, followed by a visual circuit to land on runway 05. Told by the approach controller that this would cost them a delay behind departing traffic, they accepted instead the full VOR-DME procedure to runway 05, accepted radar vectors to shorten it, and reconfigured their plan late and quickly.

The captain, flying the approach with autopilot and autothrottle engaged throughout, briefed a descent path equivalent to 3.3 degrees. When the descent began about 11 nautical miles from the Strasbourg beacon, the aircraft instead went down at 3,300 feet per minute. Some 42 seconds later the captain remarked on the need to watch the descent and began retracting the speed brakes; the radio altimeter called "two hundred" about a second before impact. The commission's report puts the accident at 18:20 UTC, which was 19:20 local time on the day, and records that the wreckage lay 0.8 nautical miles left of the final approach course and 10.5 nautical miles from the runway threshold. The Aviation Safety Network database entry records 87 fatalities among 96 occupants, with the aircraft destroyed. Eight passengers and one cabin crew member survived, most of them seated in the rear of the cabin.

One window, two meanings

The A320's flight control unit, mounted on the glareshield, let the crew command the vertical path either as a rate of climb or descent in feet per minute (vertical speed, or VS mode) or as an angle in degrees (flight path angle, or FPA mode). A pushbutton toggled between the two; rotating the same knob set the target value, which appeared in the same small window. In VS mode the value was abbreviated to hundreds of feet per minute, so a 3,300 ft/min descent read as "-33". In FPA mode a 3.3 degree path read as "-3.3". The only visual distinction between an ordinary approach path and a rate more than four times too steep was a decimal point and a small mode legend printed at a fraction of the height of the digits themselves.

The commission's analysis of that design is unusually blunt for an accident report. It found the control sensitivity differed by a factor of more than three between the two modes, that abbreviating vertical speed to two digits removed any reliable way to tell the two quantities apart by format, and that the probability of confusing 33 with 3.3 was high, particularly for a crew with limited hours on type. Once made, it concluded, such an error was practically undetectable from the display alone.

What the investigation could and could not establish

The commission of investigation, whose report was adopted on 26 November 1993 and is published by France's Bureau d'Enquetes et d'Analyses, was explicit that it could not demonstrate a single scenario to the exclusion of all others. It retained two "quite probable" hypotheses, both involving an unintentional command by the crew: either they believed FPA mode was active when it was not, or they deliberately remained in vertical speed mode and entered "33" because that was the number from the briefing. A third hypothesis, a malfunction of the flight control unit itself or of the path carrying the selected value to the autopilot computer, was judged very improbable. Recorded data showed the autopilot itself was tracking a constant vertical speed target of 3,300 ft/min exactly as commanded.

The pivotal event in the sequence leading to the accident was therefore putting the aircraft into descent mode at the correct distance specified by the procedure, but at an abnormally high rate of 3,300 ft/mn instead of approximately 800 ft/mn, and the fact that this abnormal rate was not corrected by the crew.

Commission of Investigation final report, English translation published by the FAA

The single element common to every surviving hypothesis was that nobody on the flight deck noticed the resulting flight path anomaly, despite a vertical speed four times the reference value, a nose-down attitude and increasing speed. The report attributed that to a cluster of factors including weak crew cross-checking, omitted procedural callouts, a strained working relationship between two pilots who had never flown together, a late change of approach strategy, and attention absorbed by lateral navigation while vertical navigation was handed entirely to the automation. Among the listed contributors it named the display design itself:

the ergonomics of presenting control parameters for the vertical flight path, appropriate for normal situations, but not possessing a warning capability sufficient for a crew in a situation where there is a display error

Commission of Investigation final report, English translation published by the FAA

The missing warning, and a four-hour wait

The aircraft carried no ground proximity warning system. The FAA study sets out the regulatory history: after United States mandates in the mid-1970s and an ICAO standard adopted in 1979, roughly 95 percent of the qualifying world fleet carried GPWS by the time of the crash, but France, citing its own flight-test experience with nuisance alerts, had treated the equipment as a recommendation rather than a requirement. Air Inter, which had taken part in those trials, had not fitted GPWS to any of its aircraft and had begun acquiring equipment for its A320s without installing it. The commission listed the absence of a GPWS and an accompanying usage protocol among the reasons the crew lost their last chance of a warning.

The emergency locator transmitter was destroyed on impact and played no part in the search. In poor weather and darkness, ground teams took hours to find the wreck; an able-bodied survivor reached a road and pointed rescuers to it, and a mobile gendarmerie group arrived at the site more than four hours after the crash. Survivors quoted by the Associated Press the following day described more than four hours in freezing cold beside burning wreckage, hearing people they could not reach, before help arrived; more than 1,000 rescuers were on the mountain by the next day. The commission devoted a section of its findings to the length and difficulty of the search, which it said undermined the assumption that the wreck of a large transport aircraft is easy to locate, and to coordination problems that kept specialist trauma teams off the site.

Reported timings differ slightly between sources because the report expresses everything in UTC while contemporaneous news accounts used French local time, one hour ahead; the FAA study labels the report's UTC timings as local. The underlying sequence is consistent across all of them.

What changed afterwards

Change began before the report was finished. On 20 February 1992 the commission endorsed immediate steps by the French civil aviation authority to warn operators about the risk of confusing the vertical speed and flight path angle modes and to have them check their own procedures, documentation and crew knowledge. In its final recommendations the commission called for the selected VS or FPA target to be shown on the primary flight display, and for the flight control unit display to be changed to an unambiguous expression in the actual units. The flight control unit was subsequently modified so that a vertical speed of 3,300 feet per minute reads as "-3300" rather than "-33", a change documented with photographs in the FAA study.

The commission went further than the A320. It recommended that authorities and industry bodies work internationally on standardised improvements to how autopilot modes are presented across all new-generation aircraft, noting that they broadly share the same technique of annunciating modes in small alphanumeric characters that must be read in central vision and cognitively decoded. It also criticised the lack of uniform interpretation of certification rules on flight deck ergonomics. In 1996 the FAA published a human factors team report on the interfaces between flight crews and modern flight deck systems, which the agency links directly from its account of this accident.

Why it moves the needle

This is not a story about a system that malfunctioned. Every recorded parameter indicates the autopilot did precisely what it had been told to do, and the investigation ranked equipment failure as very improbable. The harm came from the gap between what the automation was doing and what its supervisors believed it was doing, opened by an interface that encoded two very different commands into visually near-identical forms, and left unclosed because no independent monitor, human or machine, caught the divergence in the minute or so available.

That failure mode has outlived the hardware that produced it. Any system that accepts a terse operator instruction, acts on it autonomously, and reports its own state in a compressed form that the operator must decode correctly is exposed to the same class of failure, and the commission said as much when it extended its recommendations to every new-generation flight deck rather than to the A320 alone. The accident is a durable argument that safety in supervised automation depends less on whether the machine executes correctly than on whether a human can tell, quickly and unambiguously, which of several plausible things the machine is currently doing.