7.2
the original article from a scientic periodical - on software errors in military systems
Title:
Fatal error: how Patriot overlooked a Scud.
author(s): Eliot
Marshall.
Source:
Science 255.n5050 (March 13, 1992): pp 1347(1). Science Magazine Full Text: COPYRIGHT
1992 American Association for the Advancement of Science.
Even a
minute mathematical error can lead to tragedy in the computer age, as confirmed
by a report on the Patriot missile issued by the General Accounting Office
(GAO) last week. The report describes how a minor bug in Patriot's software
allowed an Iraqi Scud missile to slip through Patriot defenses a year ago and
hit U.S. Army barracks in Dhahran, Saudi Arabia, killing 28 servicemen.
GAO
undertook the study on orders from Representative Howard Wolpe (D-MI),who says
he has questions about whether the military's " logistical apparatus is
adequate to support...software-driven weapons." He was not reassured.
"The episode," Wolpe wrote in a letter to Defense Secretary Richard
Cheney, "makes clear the problems American troops may face as we continue
to take advantage of the benefits of the computer revolution in developing
weapons." According to the GAO report, the Patriot's electronic brain -
now 20 years old - would have performed well in the task it was designed to do,
which was to track and shoot down relatively slow-moving aircraft. But it ran
into trouble when it was pressed into service in the Persian Gulf to defend against high-speed
ballistic missiles. The main flaw was in the way the Patriot battery's
missile-tracking computers processed timing information, which affected its
ability to pinpoint the location of fast-moving targets. The computer's
tracking calculations depended on signals from its internal clock, which it
translated into a "floating point" mathematical value. Because the
computer could handle only relatively small chunks of data (by today's
standards), it was forced to truncate this time value slightly, creating a
slight error. By itself, the flaw would not have been fatal, but the Patriot
software was written in away that caused the error to increase steadily as time
passed on the computer's clock. That's what happened on the night of 25
February 1991.
A Scud missile launched from Iraq popped over the horizon in Saudi Arabia and was picked up by a Patriot's
radar, which was then performing a wide search of the sky. The Patriot locked
onto this target and calculated a "track" that was an approximation
of the path it would follow to the ground. To confirm that this was truly an
enemy Scud, the computer was programmed to get a second radar sighting to
determine whether the object was following the path expected of a ballistic
missile. If it was not, the signal would be rejected as a false alarm. And to
spend up the process, the software told the computer to analyze only data from
a small portion of the radar beam - the portion within a mathematically limited
zone (the " range gate ") centered on the path that a ballistic
missile would be expected to follow. If the computer found a target within this
range gate, it would know that the attack was real and would launch a Patriot
missile. Sadly, in this case the computer miscalculated the position of the
range gate, failed to see the Scud, and ruled that the original signal was
false alarm. The mistake occurred because this particular Patriot battery had
been running continuously for about 100 hours. According to GAO, its logic had
built up a timing lag of 0.3433 second. That may sound trivial, but when
tracking targets traveling at ballistic speeds the error was fatal, for it
caused the computer to shift the range gate 687 meters, letting the Scud pass
unnoticed. Ironically, about a week before the Dhahran tragedy, U.S. military officials had been warned
that something like this could happen, according to GAO. The warning came first
from the Israeli military, which had been analyzing data records from Patriot
batteries in Israel. The Israelis discovered that after
about 8 hours of continuous use, the Patriot system built up a timing error of
0.0275 second, enough to create a range-finding error of about 55 meters. They
passed the word to the U.S. Patriot project office on 11
February 1991.
Within a few days, the Patriot project office made a software fix correcting
the timing error, and sent it out to the troops on 16 February1991. On 21
February, the office sent out a warning that "very long run times"
could affect the targeting accuracy and alerted officers to the fact new
software was on the way. The troops were not told, however, how many
hours " very long " was, or that it would help to switch the computer
off and on again after 8 hours. The U.S. forces finally solved the
timing problem when they received and installed the new software at Dhahran on
26February - a day too late.