The Patriot Missile Failure

GAO
United States
General Accounting Office
Washington, D.C. 20548

Information Management and Technology Division

B-247094

February 4, 1992

The Honorable Howard Wolpe

Chairman, Subcommittee on Investigations and Oversight
Committee on Science, Space, and Technology
House of Representatives

Dear Mr. Chairman:

On February 25, 1991, a Patriot missile defense system operating at Dhahran, Saudi Arabia,
during Operation Desert Storm failed to track and intercept an incoming Scud. This Scud
subsequently hit an Army barracks, killing 28 Americans. This report responds to your
request that we review the facts associated with this incident and determine if a computer
software problem was involved. If so, you asked that we provide information on what the
specific software problem was, and what has been done to correct it. Appendix I details our
objectives, scope, and methodology.

Results in Brief

The Patriot battery at Dhahran failed to track and intercept the Scud missile because of a
software problem in the system's weapons control computer. This problem led to an
inaccurate tracking calculation that became worse the longer the system operated. At the time
of the incident, the battery had been operating continuously for over 100 hours. By then, the
inaccuracy was serious enough to cause the system to look in the wrong place for the
incoming Scud.

The Patriot had never before been used to defend against Scud missiles nor was it expected to
operate continuously for long periods of time. Two weeks before the incident, Army officials
received Israeli data indicating some loss in accuracy after the system had been running for 8
consecutive hours. Consequently, Army officials modified the software to improve the
system's accuracy. However, the modified software did not reach Dhahran until February 26,
1991--the day after the Scud incident.

Background

The Patriot is an Army surface-to-air, mobile, air defense missile system. Since the mid-
1960s, the system has evolved to defend against aircraft and cruise missiles, and more
recently against short-range ballistic missiles.

Page 1 -- GAO/IMTEC-92-26 Patriot Missile Software Problem

The Patriot system was originally designed to operate in Europe against Soviet medium- to
high-altitude aircraft and cruise missiles traveling at speeds up to about MACH 2 (1500
mph). To avoid detection it was designed to be mobile and operate for only a few hours at
one location.

Page 2 -- GAO/IMTEC-92-26 Patriot Missile Software Problem

Patriot System Description

The Patriot operates as part of a battalion usually composed of six batteries. Each battery is
made up of one ground-based radar unit for surveillance and target detection, tracking, and
engagement; an Engagement Control Station for manual or automated command and control
of the missile interceptors; eight missile launchers; and a Communications Relay Group for
communications support. An Information Coordination Center controls the batteries and
coordinates their operation with other battalions and higher level U.S. Command authorities.

Page 3 -- GAO/IMTEC-92-26 Patriot Missile Software Problem

The heart of the Patriot system is its weapons control computer. It performs the system's
major functions for tracking and intercepting a target, as well as other battle management,
command and control functions. The Patriot's weapons control computer used in Operation
Desert Storm is based on a 1970s design with relatively limited capability to perform high
precision calculations.

To carry out its mission, the Patriot's weapons control computer obtains target information
from the system's radar. The Patriot's radar sends out electronic pulses that scan the air space
above it. When the pulses hit a target they are reflected back to the radar system and shown
as an object (or plot) on the Patriot's display screens.(1) Patriot operators use the software to
instruct the system to intercept certain types of objects such as planes, cruise missiles, or
tactical ballistic missiles (such as Scuds). During Desert Storm the Patriot was instructed to
intercept tactical ballistic missiles. For the Patriot's computer to identify, track, and intercept
these missiles, important information(2) describing them was kept by the system's range-gate
algorithm.(3)

After the Patriot's radar detects an airborne object that has the characteristics of a Scud, the
range gate--an electronic detection device within the radar system--calculates an area in the
air space where the system should next look for it. The range gate filters out information
about airborne objects outside its calculated area and only processes the information needed
for tracking, targeting, and intercepting Scuds. Finding an object within the calculated range
gate area confirms that it is a Scud missile. Figure 3 depicts a correctly calculated range gate
area.

Page 4 -- GAO/IMTEC-92-26 Patriot Missile Software Problem

The range gate's prediction of where the Scud will next appear is a function of the Scud's
know velocity and the time of the last radar detection. Velocity is a real number that can be
expressed as a whole number and a decimal (e.g., 3750.2563...miles per hour). Time is kept
continuously by the system's internal clock in tenths of seconds but is expressed as an integer
or whole number (e.g., 32, 33, 34...). The longer the system has been running, the larger the
number representing time. To predict where the Scud will next appear, both time and velocity
must be expressed as real numbers. Because of the way the Patriot computer performs its
calculations and the fact that its registers(4) are only 24 bits long, the conversion of time from
an integer to a real number cannot be any more precise than 24

Page 5 -- GAO/IMTEC-92-26 Patriot Missile Software Problem

bits.(5) This conversion results in a loss of precision causing a less accurate time calculation.
The effect of this inaccuracy on the range gate's calculation is directly proportional to the
target's velocity and the length of time the system has been running. Consequently,
performing the conversion after the Patriot has been running continuously for extended
periods causes the range gate to shift away from the center of the target, making it less likely
that the target, in this case a Scud, will be successfully intercepted.

Key Events Leading to Patriot's Failure to Intercept Scud Missile

Shortly after Operation Desert Shield began, Patriot battalions were deployed to Saudi Arabia
and then to Israel. These battalions were generally placed in permanent positions to defend
key assets, military personnel, and citizens against Iraqi Scud missiles.
Because this was the first time the Patriot had been used to defend against Scud missiles,
which fly at approximately MACH 5 (3750 mph), the Army had much to learn about tracking
and intercepting them. To obtain Scud data, the Army relied on operational experience
conveyed by Patriot users as well as other intelligence sources. With the launch of each Scud,
the Army became more and more knowledgeable about the Scud's flight characteristics.
Recorded data is another more useful tool that could have provided detailed data on the
Patriot's actual performance. However, obtaining recorded performance data from Patriot
units was hindered for two reasons.

First, the Patriot was not equipped with an embedded (internal) data recorder to retain system
performance information. Second, although portable, external data recorders were available,
U.S. commanders decided not to use them because they believed the recorders could cause an
unanticipated system shutdown. However, Israeli commanders used data recorders on the
Patriot systems they controlled and provided this data to the U.S. Army. As information from
all sources became available, software changes were made from August 1990 to February
1991 by the Patriot Project Office in Huntsville, Alabama, to adapt the system to the Desert
Storm environment. During the conflict, the Patriot's software was modified six times.
Patriots had to be shut down for at least 1 to 2 hours to install each software modification.

Page 6 -- GAO/IMTEC-92-26 Patriot Missile Software Problem

Anomaly Observed in Patriot Range Gate

On February 11, 1991, the Patriot Project Office received Israeli data identifying a 20 percent
shift in the Patriot system's radar range gate after the system had been running for 8
consecutive hours. (Figure 4 depicts the location of a Scud within the range gate after the
Patriot has been in operation for over 8 hours.) This shift is significant because it meant that
the target (in this case, the Scud) was no longer in the center of the range gate. The target
needs to be in the center ofthe range gate to ensure the highest probability of tracking the
target. As previously mentioned, the range gate is calculated by an algorithm that determines
if the detected target is a Scud, and if the Scud is in the Patriot's firing range. If these
conditions are met, the Patriot fires its missiles.
 Page 7 -- GAO/IMTEC-92-26 Patriot Missile Software Problem

Patriot Project Office officials said that the Patriot system will not track a Scud when there is
a range gate shift of 50 percent or more. Because the shift is directly proportional to time,
extrapolating the Israeli data (which indicated a 20 percent shift after 8 hours) determined
that the range gate would shift 50 percent after about 20 hours of continuous use.
Specifically, after about 20 hours, the inaccurate time calculation becomes sufficiently large
to cause the radar to look in the wrong place for the target. Consequently, the system fails to
track and intercept the Scud. See Figure 5 for a representation of an incorrect range gate
calculation. Appendix II shows the number of meters the range gate shifts from the center of
the target after continuous operation.

Page 8 -- GAO/IMTEC-92-26 Patriot Missile Software Problem

Significant shifts of the range gate away from the desired center of the target could be
eliminated by rebooting the system-turning the system off and on--every few hours.
Rebooting, which takes about 60 to 90 seconds, reinitializes the computer's clock, setting the
time back to zero.

Patriot Project Office Response to Anomaly

Army officials said that they believed the Israeli experience was atypical--they assumed other
Patriot users were not running their systems for 8 or more hours at a time. However, after
analyzing the Israeli data and confirming some loss in targeting accuracy, the officials made a
software change which compensated for the inaccurate time calculation. This change allowed
for extended run times and was included in the modified software version that was released
on February 16, 1991. However, Army officials did not use the Israeli data to determine how
long the Patriot could operate before the inaccurate time calculation would render the system
ineffective.

On February 21, 1991, the Patriot Project Office sent a message to Patriot users stating that
very long run times could cause a shift in the range gate, resulting in the target being offset.
The message also said a software change was being sent that would improve the system's
targeting. However, the message did not specify what constitutes very long run times.
According to Army officials, they presumed that the users would not continuously run the
batteries for such extended periods of time that the Patriot would fail to track targets.
Therefore, they did not think that more detailed guidance was required.

Iraqi Scud Attack and Aftermath

The air fields and seaports of Dhahran were protected by six Patriot batteries. Alpha Battery,
the battery in question, was to protect the Dhahran Air Base. On February 25, Alpha Battery
had been in operation for over 100 consecutive hours. Because the system had been on so
long, the resulting inaccuracy in the time calculation caused the range gate to shift so much
that the system could not track the incoming Scud. Consequently, Alpha Battery did not
engage the Scud, which then struck an Army barracks and killed 28 American soldiers.

On February 26, the next day, the modified software, which compensated for the inaccurate
time calculation, arrived in Dhahran. According to Army officials, the delay in distributing
the software from the United States to all

Page 9 -- GAO/IMTEC-92-26 Patriot Missile Software Problem

Patriot locations was due to the time it took to arrange for air and ground transportation in a
wartime environment.

In September 1991, officials from the Patriot Project Office stated that Patriot algorithms will
continue to be re-examined as a result of experience gained during Desert Storm and will
continue to be tested against aircraft, cruise, and tactical ballistic missiles. Further, an
endurance test has been conducted to ensure that extended run times do not cause other
system difficulties.

We conducted our review from June 1991 to January 1992, in accordance with generally
accepted government auditing standards. As requested, we did not provide a draft of this
report to the Department of Defense for its review and comment. Instead, we discussed the
report's facts with officials involved and incorporated their views as appropriate. These
officials generally agreed with the facts as presented. We plan no further distribution of this
report until 30 days from the date of this letter. We will then send copies to the Secretary of
Defense, the Secretary of the Army, and other interested parties. Copies will also be made
available to others upon request. Should you have any questions concerning this report,
please contact Samuel Bowlin, Director, Defense and Security Information Systems at (202)
336-6240. Major contributors to this report are listed in Appendix III.

Sincerely yours,
Michael G. for
Ralph V. Carlone
Assistant Comptroller General
 Page 10 -- GAO/IMTEC-92-26 Patriot Missile Software Problem

Footnotes

1. A radar plot indicates the object's position in terms of latitude, longitude, and azimuth
(elevation angle in degrees from the radar). A radar track is a series of plots that, when
processed, indicate an object's altitude, speed, direction, and position.
2. Such information includes velocity (speed and direction), latitude, longitude, azimuth, and
altitude.
3. An algorithm is a precise description of a method for solving a particular problem.
4. Registers are temporary storage areas for instructions or data. They are special storage
locations whose advantage is speed. They can very rapidly accept and transfer instructions
or data and are therefore used in performing arithmetic or comparison operations.
5. The precision of a computer's calculations depends on the number of bits in its registers.
Since the Patriot's registers are only 24 bits long, precision beyond 24 bits is not possible
unless the software is specifically written to adjust for such hardware limitations. Computers
built today have registers that contain as many as 64 bits, permitting calculations with far
greater precision.

Contents
Letter..........................................................1
Appendix I:
Objectives, Scope, and Methodology.............................14
Appendix II:
Effect of Extended Run Time on Patriot Operation...............15
Appendix III:
Major Contributors to This Report..............................16

Figures:
Figure 1: Patriot Fired for Missile Interception................2
Figure 2: Patriot Missile Launcher in Saudi Arabia..............3
Figure 3: Correctly Calculated Range Gate.......................5
Figure 4: Calculated Range Gate After Approximately 8 Hours.....7
Figure 5: Incorrectly Calculated Range Gate.....................8

Abbreviations

GAO: General Accounting Office

IMTEC: Information Management and Technology Division

Page 12 -- GAO/IMTEC-92-26 Patriot Missile Software Problem

Appendix I

Objectives, Scope, and Methodology

The Chairman, Subcommittee on Investigations and Oversight, House Committee on

Science, Space, and Technology, requested that we review the facts of the February 25, 1991,
incident in which the Patriot defense system failed to engage an Iraqi Scud missile and
determine if a computer software problem was involved. If so, our objectives were to provide
information on what specific software problem prevented the Patriot from intercepting the
Scud missile and what has been done to correct it.

To meet these objectives, we interviewed Patriot Project Office officials responsible for
maintaining Patriot software and reviewed official Department of the Army analyses
describing the cause of this incident. Subsequently, we independently verified the Army's
findings by analyzing key documentation including (1) a description of the Patriot system
computer architecture; (2) the assembly language programs responsible for surveillance,
tracking, and target engagement; and (3) selected machine instructions that caused the
tracking inaccuracy.

To determine what was done to locate and correct the software problem, we interviewed
software maintenance officials at the Patriot Project Office and obtained documentation on
the specific changes made to the software. Additionally, we checked the Army's correction to
the software by performing the key calculations needed to account for longer run times.

To become more knowledgeable about how the Patriot system performed in an operational
environment, we participated in a simulation at the Patriot Software Test Facility in
Huntsville, Alabama, where we intercepted Scuds with Patriot missiles. Through the
simulation, we gained a better understanding of the Patriot's hardware, software, and human
interfaces. Further, we interviewed and obtained documentation from officials involved in
Patriot software and operations at the Department of the Army Headquarters in Washington,
D.C.

Our work was conducted from June 1991 through January 1992 at the Department of the
Army, Washington D.C., and the Patriot Program Office, Huntsville, Alabama.

Page 14 -- GAO/IMTEC-92-26 Patriot Missile Software Problem

Appendix II

Effect of Extended Run Time on Patriot Operation

Hours Seconds Calculated Time Inaccuracy Approximate Shift In
(Seconds) (Seconds) Range Gate (Meters)
0 0 0 0 0
1 3600 3599.9966 .0034 7
8 28800 28799.9725 .0025 55
20(a) 72000 71999.9313 .0687 137
48 172800 172799.8352 .1648 330
72 259200 259199.7528 .2472 494
100(b) 360000 359999.6667 .3433 687

a. Continuous operation exceeding about 20 hours--target outside range gate

b. Alpha Battery ran continuously for about 100 hours
 Page 15 -- GAO/IMTEC-92-26 Patriot Missile Software Problem

Appendix III

Major Contributors to This Report

Information Management and Technology Division, Washington, D.C.

Michael Blair, Assistant Director

Sally Obenski, Evaluator-in-Charge
Paula Bridickas, Computer Scientist

(510680)
Page 16 -- GAO/IMTEC-92-26 Patriot Missile Software Problem