Here's an article by Peter Ladkin on the A330 crash:
"...The A330 preliminary accident report singles out lack of pitch protection with the autopilot in ALT* mode as a determining factor.
According to the report by Casamayou in Air et Cosmos 1480 (11-16 July), the copilot rotated to 28deg to hold 150kts of speed (the airplane actually went to 29deg), and the autopilot was engaged by Warner, who also retarded the left engine and cut the left hydraulic pump to simulate an engine failure: `As planned, the pitch of the aircraft started to diminish and passed from 29deg to 25deg, the [pitch] limit authorised by the [flight] envelope protection system FMGES (flight management guidance and envelope system).'
It is presumed that the pilots were expecting that the autopilot was to remain in SRS mode (`Speed Reference System') under which there is automatic pitch protection. However, because the altitude was set too low (2000ft) in the flight director (FCU), the autopilot reverted almost immediately to ALT* mode, under which there is no pitch protection. However, it was non-obvious for the pilots to know they were in ALT* mode since it wasn't displayed on the PFD under those flight conditions - mode info disappears from the PFD at 25deg, **the same point to which pitch is protected by the FMGES**.
The preliminary report noted the lack of PFD display of mode as a contributing factor, but not a cause. Bernard Ziegler, technical director of Airbus, singled out in interviews the action of achieving 25deg of pitch as one of his main contributing factors, also the specific figure of 25deg, a `particularly high pitch angle' is found in Flight International, 17-23 Aug 1994, p4]. (The other two factors mentioned in the Speigel interview were the 2000ft altitude setting and that the pilots waited too long to recover.)
However, if you want to test pitch protection it follows you have to put the airplane into more than 25deg of pitch, which is what the pilots did. But this is a flight condition such that you can't tell on the PFD what AP mode you're in, and hence whether pitch is actually protected! This info might be available, but it is not displayed on the PFD.
Contributory factors that were also noted by the report: the full-aft center of gravity, and the TOGA thrust on the engines. However, the airplane may be legally loaded to full-aft CG, and if a go-around is needed on an automatic landing, that's what TOGA thrust is for. TOGA conditions are statistically the most likely conditions under which there is an engine failure.
All of the above is a matter of record, or of common knowledge. I'd like to add a few comments and questions of my own.
Firstly, the report implies that autopilot mode confusion played a role in the late reaction of the pilots to the flight condition. They were expecting SRS mode and got ALT* (for whatever reason) - they were expecting pitch protection when there was none - they were waiting for something that wouldn't happen, and they couldn't tell from the PFD. Pete Mellor, in his article `CAD: Computer Aided Disaster' and Robert Dorsett have noted that mode- or control-law-confusion seems to have played a role in many of the A320 accidents as well.
Secondly, this airplane was loaded to within legal limits and was using thrust appropriate to a go-around situation. There are US airports at which commercial flights take place at which the missed-approach procedure requires one to climb-and-maintain altitudes in the region of 2000ft. So, one might consider the possibility that these three of the identified `causes' of the accident were plausible, although maybe unusual, operating conditions. The airplane was pitched up by the copilot to 28 deg, in order (I would surmise) to activate the automatic pitch protection mechanism, under conditions of engine failure. Under these conditions, under autopilot control, the airplane flew itself into an flight condition from which an experienced test pilot was unable to recover in time. I wonder why more attention is not paid to this feature of the accident?
The trim setting was singled out as a cause, but the report also says that the accelerated rotation caused by this was controlled by the copilot, so I don't see how it figures as a cause, unless it was seen as one-task-too-many.
For comparison and discussion in RISKS, I'd like to mention a possible point of view different from that provided by Airbus [Ziegler interviews, Der Speigel 15.8.94, and Flight International, 17-23 Aug 1994, p4]. Namely: if the airplane had not crashed, seven more people would be alive -but we also wouldn't have known that an A330 with full aft CofG is unable to fly itself out of an engine-out-during-go-around situation if the altitude-select on the AP is set at or near 2000ft and the pitch is slightly above its 25deg limit of protection.
Is this computer-related? I'm sure the A330 software will be changed. If only because the Commission of Inquiry recommended it."
Some comments on the A330 accident: Computer-Related Incidents with Commercial Aircrafts, Peter Ladkin (University of Bielefeld, 1994).