7.2

the original article from a scientic periodical - on software errors in military systems

Title: Fatal error: how Patriot overlooked a Scud.

author(s): Eliot Marshall.
Source: Science 255.n5050 (March 13, 1992): pp 1347(1). Science Magazine Full Text: COPYRIGHT 1992 American Association for the Advancement of Science.

Even a minute mathematical error can lead to tragedy in the computer age, as confirmed by a report on the Patriot missile issued by the General Accounting Office (GAO) last week. The report describes how a minor bug in Patriot's software allowed an Iraqi Scud missile to slip through Patriot defenses a year ago and hit U.S. Army barracks in Dhahran, Saudi Arabia, killing 28 servicemen

GAO undertook the study on orders from Representative Howard Wolpe (D-MI),who says he has questions about whether the military's " logistical apparatus is adequate to support...software-driven weapons." He was not reassured. "The episode," Wolpe wrote in a letter to Defense Secretary Richard Cheney, "makes clear the problems American troops may face as we continue to take advantage of the benefits of the computer revolution in developing weapons." According to the GAO report, the Patriot's electronic brain - now 20 years old - would have performed well in the task it was designed to do, which was to track and shoot down relatively slow-moving aircraft. But it ran into trouble when it was pressed into service in the Persian Gulf to defend against high-speed ballistic missiles. The main flaw was in the way the Patriot battery's missile-tracking computers processed timing information, which affected its ability to pinpoint the location of fast-moving targets. The computer's tracking calculations depended on signals from its internal clock, which it translated into a "floating point" mathematical value. Because the computer could handle only relatively small chunks of data (by today's standards), it was forced to truncate this time value slightly, creating a slight error. By itself, the flaw would not have been fatal, but the Patriot software was written in away that caused the error to increase steadily as time passed on the computer's clock. That's what happened on the night of 25 February 1991. A Scud missile launched from Iraq popped over the horizon in Saudi Arabia and was picked up by a Patriot's radar, which was then performing a wide search of the sky. The Patriot locked onto this target and calculated a "track" that was an approximation of the path it would follow to the ground. To confirm that this was truly an enemy Scud, the computer was programmed to get a second radar sighting to determine whether the object was following the path expected of a ballistic missile. If it was not, the signal would be rejected as a false alarm. And to spend up the process, the software told the computer to analyze only data from a small portion of the radar beam - the portion within a mathematically limited zone (the " range gate ") centered on the path that a ballistic missile would be expected to follow. If the computer found a target within this range gate, it would know that the attack was real and would launch a Patriot missile. Sadly, in this case the computer miscalculated the position of the range gate, failed to see the Scud, and ruled that the original signal was false alarm. The mistake occurred because this particular Patriot battery had been running continuously for about 100 hours. According to GAO, its logic had built up a timing lag of 0.3433 second. That may sound trivial, but when tracking targets traveling at ballistic speeds the error was fatal, for it caused the computer to shift the range gate 687 meters, letting the Scud pass unnoticed. Ironically, about a week before the Dhahran tragedy, U.S. military officials had been warned that something like this could happen, according to GAO. The warning came first from the Israeli military, which had been analyzing data records from Patriot batteries in Israel. The Israelis discovered that after about 8 hours of continuous use, the Patriot system built up a timing error of 0.0275 second, enough to create a range-finding error of about 55 meters. They passed the word to the U.S. Patriot project office on 11 February 1991. Within a few days, the Patriot project office made a software fix correcting the timing error, and sent it out to the troops on 16 February1991. On 21 February, the office sent out a warning that "very long run times" could affect the targeting accuracy and alerted officers to the fact new software was on the way. The troops were not told, however, how many hours " very long " was, or that it would help to switch the computer off and on again after 8 hours. The U.S. forces finally solved the timing problem when they received and installed the new software at Dhahran on 26February - a day too late.