Dear Mr. Chairman:
On February 25, 1991, a Patriot missile defense system operating at Dhahran, Saudi Arabia, during Operation Desert Storm failed to track and intercept an incoming Scud. This Scud subsequently hit an Army barracks, killing 28 Americans. This report responds to your request that we review the facts associated with this incident and determine if a computer software problem was involved. If so, you asked that we provide information on what the specific software problem was, and what has been done to correct it. Appendix I details our objectives, scope, and methodology.
The Patriot battery at Dhahran failed to track and intercept the Scud missile because of a software problem in the system's weapons control computer. This problem led to an inaccurate tracking calculation that became worse the longer the system operated. At the time of the incident, the battery had been operating continuously for over 100 hours. By then, the inaccuracy was serious enough to cause the system to look in the wrong place for the incoming Scud.
The Patriot had never before been used to defend against Scud missiles nor was it expected to operate continuously for long periods of time. Two weeks before the incident, Army officials received Israeli data indicating some loss in accuracy after the system had been running for 8 consecutive hours. Consequently, Army officials modified the software to improve the system's accuracy. However, the modified software did not reach Dhahran until February 26, 1991--the day after the Scud incident.
The Patriot is an Army surface-to-air, mobile, air defense missile system. Since the mid-1960s, the system has evolved to defend against aircraft and cruise missiles, and more recently against short-range ballistic missiles.
The Patriot system was originally designed to operate in Europe against Soviet medium- to high-altitude aircraft and cruise missiles traveling at speeds up to about MACH 2 (1500 mph). To avoid detection it was designed to be mobile and operate for only a few hours at one location.
The Patriot operates as part of a battalion usually composed of six batteries. Each battery is made up of one ground-based radar unit for surveillance and target detection, tracking, and engagement; an Engagement Control Station for manual or automated command and control of the missile interceptors; eight missile launchers; and a Communications Relay Group for communications support. An Information Coordination Center controls the batteries and coordinates their operation with other battalions and higher level U.S. Command authorities.
The heart of the Patriot system is its weapons control computer. It performs the system's major functions for tracking and intercepting a target, as well as other battle management, command and control functions. The Patriot's weapons control computer used in Operation Desert Storm is based on a 1970s design with relatively limited capability to perform high precision calculations.
To carry out its mission, the Patriot's weapons control computer obtains target information from the system's radar. The Patriot's radar sends out electronic pulses that scan the air space above it. When the pulses hit a target they are reflected back to the radar system and shown as an object (or plot) on the Patriot's display screens.(1) Patriot operators use the software to instruct the system to intercept certain types of objects such as planes, cruise missiles, or tactical ballistic missiles (such as Scuds). During Desert Storm the Patriot was instructed to intercept tactical ballistic missiles. For the Patriot's computer to identify, track, and intercept these missiles, important information(2) describing them was kept by the system's range-gate algorithm.(3)
After the Patriot's radar detects an airborne object that has the characteristics of a Scud, the range gate--an electronic detection device within the radar system--calculates an area in the air space where the system should next look for it. The range gate filters out information about airborne objects outside its calculated area and only processes the information needed for tracking, targeting, and intercepting Scuds. Finding an object within the calculated range gate area confirms that it is a Scud missile. Figure 3 depicts a correctly calculated range gate area.
The range gate's prediction of where the Scud will next appear is a function of the Scud's know velocity and the time of the last radar detection. Velocity is a real number that can be expressed as a whole number and a decimal (e.g., 3750.2563...miles per hour). Time is kept continuously by the system's internal clock in tenths of seconds but is expressed as an integer or whole number (e.g., 32, 33, 34...). The longer the system has been running, the larger the number representing time. To predict where the Scud will next appear, both time and velocity must be expressed as real numbers. Because of the way the Patriot computer performs its calculations and the fact that its registers(4) are only 24 bits long, the conversion of time from an integer to a real number cannot be any more precise than 24
bits.(5) This conversion results in a loss of precision causing a less accurate time calculation. The effect of this inaccuracy on the range gate's calculation is directly proportional to the target's velocity and the length of time the system has been running. Consequently, performing the conversion after the Patriot has been running continuously for extended periods causes the range gate to shift away from the center of the target, making it less likely that the target, in this case a Scud, will be successfully intercepted.
Shortly after Operation Desert Shield began, Patriot battalions were deployed to Saudi Arabia and then to Israel. These battalions were generally placed in permanent positions to defend key assets, military personnel, and citizens against Iraqi Scud missiles.
Because this was the first time the Patriot had been used to defend against Scud missiles, which fly at approximately MACH 5 (3750 mph), the Army had much to learn about tracking and intercepting them. To obtain Scud data, the Army relied on operational experience conveyed by Patriot users as well as other intelligence sources. With the launch of each Scud, the Army became more and more knowledgeable about the Scud's flight characteristics. Recorded data is another more useful tool that could have provided detailed data on the Patriot's actual performance. However, obtaining recorded performance data from Patriot units was hindered for two reasons.
First, the Patriot was not equipped with an embedded (internal) data recorder to retain system performance information. Second, although portable, external data recorders were available, U.S. commanders decided not to use them because they believed the recorders could cause an unanticipated system shutdown. However, Israeli commanders used data recorders on the Patriot systems they controlled and provided this data to the U.S. Army. As information from all sources became available, software changes were made from August 1990 to February 1991 by the Patriot Project Office in Huntsville, Alabama, to adapt the system to the Desert Storm environment. During the conflict, the Patriot's software was modified six times. Patriots had to be shut down for at least 1 to 2 hours to install each software modification.
On February 11, 1991, the Patriot Project Office received Israeli data identifying a 20 percent shift in the Patriot system's radar range gate after the system had been running for 8 consecutive hours. (Figure 4 depicts the location of a Scud within the range gate after the Patriot has been in operation for over 8 hours.) This shift is significant because it meant that the target (in this case, the Scud) was no longer in the center of the range gate. The target needs to be in the center ofthe range gate to ensure the highest probability of tracking the target. As previously mentioned, the range gate is calculated by an algorithm that determines if the detected target is a Scud, and if the Scud is in the Patriot's firing range. If these conditions are met, the Patriot fires its missiles.
Patriot Project Office officials said that the Patriot system will not track a Scud when there is a range gate shift of 50 percent or more. Because the shift is directly proportional to time, extrapolating the Israeli data (which indicated a 20 percent shift after 8 hours) determined that the range gate would shift 50 percent after about 20 hours of continuous use. Specifically, after about 20 hours, the inaccurate time calculation becomes sufficiently large to cause the radar to look in the wrong place for the target. Consequently, the system fails to track and intercept the Scud. See Figure 5 for a representation of an incorrect range gate calculation. Appendix II shows the number of meters the range gate shifts from the center of the target after continuous operation.
Significant shifts of the range gate away from the desired center of the target could be eliminated by rebooting the system-turning the system off and on--every few hours. Rebooting, which takes about 60 to 90 seconds, reinitializes the computer's clock, setting the time back to zero.
Army officials said that they believed the Israeli experience was atypical--they assumed other Patriot users were not running their systems for 8 or more hours at a time. However, after analyzing the Israeli data and confirming some loss in targeting accuracy, the officials made a software change which compensated for the inaccurate time calculation. This change allowed for extended run times and was included in the modified software version that was released on February 16, 1991. However, Army officials did not use the Israeli data to determine how long the Patriot could operate before the inaccurate time calculation would render the system ineffective.
On February 21, 1991, the Patriot Project Office sent a message to Patriot users stating that very long run times could cause a shift in the range gate, resulting in the target being offset. The message also said a software change was being sent that would improve the system's targeting. However, the message did not specify what constitutes very long run times. According to Army officials, they presumed that the users would not continuously run the batteries for such extended periods of time that the Patriot would fail to track targets. Therefore, they did not think that more detailed guidance was required.
The air fields and seaports of Dhahran were protected by six Patriot batteries. Alpha Battery, the battery in question, was to protect the Dhahran Air Base. On February 25, Alpha Battery had been in operation for over 100 consecutive hours. Because the system had been on so long, the resulting inaccuracy in the time calculation caused the range gate to shift so much that the system could not track the incoming Scud. Consequently, Alpha Battery did not engage the Scud, which then struck an Army barracks and killed 28 American soldiers.
On February 26, the next day, the modified software, which compensated for the inaccurate time calculation, arrived in Dhahran. According to Army officials, the delay in distributing the software from the United States to all
Patriot locations was due to the time it took to arrange for air and ground transportation in a wartime environment.
In September 1991, officials from the Patriot Project Office stated that Patriot algorithms will continue to be re-examined as a result of experience gained during Desert Storm and will continue to be tested against aircraft, cruise, and tactical ballistic missiles. Further, an endurance test has been conducted to ensure that extended run times do not cause other system difficulties.
We conducted our review from June 1991 to January 1992, in accordance with generally accepted government auditing standards. As requested, we did not provide a draft of this report to the Department of Defense for its review and comment. Instead, we discussed the report's facts with officials involved and incorporated their views as appropriate. These officials generally agreed with the facts as presented. We plan no further distribution of this report until 30 days from the date of this letter. We will then send copies to the Secretary of Defense, the Secretary of the Army, and other interested parties. Copies will also be made available to others upon request. Should you have any questions concerning this report, please contact Samuel Bowlin, Director, Defense and Security Information Systems at (202) 336-6240. Major contributors to this report are listed in Appendix III.
Sincerely yours,
Michael G. for
Ralph V. Carlone
Assistant Comptroller General
- A radar plot indicates the object's position in terms of latitude, longitude, and azimuth (elevation angle in degrees from the radar). A radar track is a series of plots that, when processed, indicate an object's altitude, speed, direction, and position.
- Such information includes velocity (speed and direction), latitude, longitude, azimuth, and altitude.
- An algorithm is a precise description of a method for solving a particular problem.
- Registers are temporary storage areas for instructions or data. They are special storage locations whose advantage is speed. They can very rapidly accept and transfer instructions or data and are therefore used in performing arithmetic or comparison operations.
- The precision of a computer's calculations depends on the number of bits in its registers. Since the Patriot's registers are only 24 bits long, precision beyond 24 bits is not possible unless the software is specifically written to adjust for such hardware limitations. Computers built today have registers that contain as many as 64 bits, permitting calculations with far greater precision.
GAO: General Accounting Office
IMTEC: Information Management and Technology Division
The Chairman, Subcommittee on Investigations and Oversight, House Committee on Science, Space, and Technology, requested that we review the facts of the February 25, 1991, incident in which the Patriot defense system failed to engage an Iraqi Scud missile and determine if a computer software problem was involved. If so, our objectives were to provide information on what specific software problem prevented the Patriot from intercepting the Scud missile and what has been done to correct it.
To meet these objectives, we interviewed Patriot Project Office officials responsible for maintaining Patriot software and reviewed official Department of the Army analyses describing the cause of this incident. Subsequently, we independently verified the Army's findings by analyzing key documentation including (1) a description of the Patriot system computer architecture; (2) the assembly language programs responsible for surveillance, tracking, and target engagement; and (3) selected machine instructions that caused the tracking inaccuracy.
To determine what was done to locate and correct the software problem, we interviewed software maintenance officials at the Patriot Project Office and obtained documentation on the specific changes made to the software. Additionally, we checked the Army's correction to the software by performing the key calculations needed to account for longer run times.
To become more knowledgeable about how the Patriot system performed in an operational environment, we participated in a simulation at the Patriot Software Test Facility in Huntsville, Alabama, where we intercepted Scuds with Patriot missiles. Through the simulation, we gained a better understanding of the Patriot's hardware, software, and human interfaces. Further, we interviewed and obtained documentation from officials involved in Patriot software and operations at the Department of the Army Headquarters in Washington, D.C.
Our work was conducted from June 1991 through January 1992 at the Department of the Army, Washington D.C., and the Patriot Program Office, Huntsville, Alabama.
Hours Seconds Calculated Time Inaccuracy Approximate Shift In
(Seconds) (Seconds) Range Gate (Meters)
0 0 0 0 0
1 3600 3599.9966 .0034 7
8 28800 28799.9725 .0025 55
20(a) 72000 71999.9313 .0687 137
48 172800 172799.8352 .1648 330
72 259200 259199.7528 .2472 494
100(b) 360000 359999.6667 .3433 687
a. Continuous operation exceeding about 20 hours--target outside range gate
b. Alpha Battery ran continuously for about 100 hours
Michael Blair, Assistant Director
Sally Obenski, Evaluator-in-Charge
Paula Bridickas, Computer Scientist