Original URL: http://www.theregister.co.uk/2004/05/20/patriot_missile/
Patriot missile: friend or foe?
RAF Tornado downed, questions unanswered
Our recent story on the 2003 friendly-fire incident which saw a US Patriot missile down a RAF Tornado with the loss of both crew members, prompted several reader comments on the weapon's chequered history.
Long before Gulf War II, there was considerable concern and doubt surrounding the Patriot's reliability and performance. The missile (overview here), which is manufactured by Raytheon and Lockheed Martin, began life some 40 years ago as an anti-aircraft weapon. According to the Raytheon blurb:
Patriot is a long-range, high-altitude, all-weather system designed to defeat advanced threats, including aircraft, tactical ballistic missiles, and cruise missiles. Combat proven during Operation Desert Storm, Patriot can simultaneously engage multiple targets under the most severe electronic countermeasure conditions. Since Operation Desert Storm, the United States Department of Defense has invested over $3.0 billion to further improve and extend Patriot ground equipment performance.
Multifunction phased array radar, track-via-missile guidance, and automated operations - including man-in-the-loop (human) override - are the key features of the Patriot system. In addition to the phased array radar, a Patriot Fire Unit is deployed with an engagement control station, an electronic power plant vehicle, an antenna mast group for communications, and up to sixteen remote launching stations. Each launcher contains four ready-to-fire Patriot missiles.
The list of threats is significant here. In fact, the Patriot was hurriedly modified for anti-ballistic missile service in Desert Storm. It was heralded as a great success at the time for its performance against Scuds - particularly in Israel - but later analysis told a different story.
The tally of Scuds claimed was, in fact, fictitious. An initial kill rate of 40-50 per cent soon became a mere 5-10 per cent. Worse still, Patriot suffered from a serious software problem which quickly manifested itself with disastrous results:
On February 25, 1991, a Patriot missile defense system operating at Dhahran, Saudi Arabia, during Operation Desert Storm failed to track and intercept an incoming Scud. This Scud subsequently hit an Army barracks, killing 28 Americans. This report responds to your request that we review the facts associated with this incident and determine if a computer software problem was involved. If so, you asked that we provide information on what the specific software problem was, and what has been done to correct it.
That's the first paragraph of a 1992 report by the Information Management and Technology Division of the General Accounting Office in response to a request by Howard Wolpe, Chairman, Subcommittee on Investigations and Oversight Committee on Science, Space, and Technology, House of Representatives.
The report's summary conclusion (there are more detailed extracts at the end of this article) states:
The Patriot battery at Dhahran failed to track and intercept the Scud missile because of a software problem in the system's weapons control computer. This problem led to an inaccurate tracking calculation that became worse the longer the system operated. At the time of the incident, the battery had been operating continuously for over 100 hours. By then, the inaccuracy was serious enough to cause the system to look in the wrong place for the incoming Scud.
The Patriot had never before been used to defend against Scud missiles nor was it expected to operate continuously for long periods of time. Two weeks before the incident, Army officials received Israeli data indicating some loss in accuracy after the system had been running for 8 consecutive hours. Consequently, Army officials modified the software to improve the system's accuracy. However, the modified software did not reach Dhahran until February 26, 1991--the day after the Scud incident.
No surprise then that "since Operation Desert Storm, the United States Department of Defense has invested over $3.0 billion to further improve and extend Patriot ground equipment performance", as Raytheon puts it.
Perhaps, then, it might be reasonable to expect a considerable improvement in Patriot performance during Gulf War II. An abc news report dated 23 March 2003 tells of Patriot batteries bogged down in sand en route to Nasiriya:
Patriot missile systems are made up of a system of delicate electronics susceptible to frequent failures. While stationary in Kuwait, each battery in this unit had almost daily problems that caused the system to shut down. Commanders worried that the combined stress of a long trip and sand in the electronics could render the radar and computers useless by the time they arrived on site.
In less than an hour, the Patriot missiles were set up, and it was the moment of truth for the computers and the radar. Everything worked and everyone was relieved. Maybe Patriot systems were made for this, after all.
Not so. On the same day a Patriot battery downed an RAF Tornado returning from a mission over Iraq, killing Flt Lt Kevin Main and Flt Lt David Williams.
Two days later, a US Air Force pilot in an F-16 fighter was alerted to the fact that he had been targeted by radar. Assuming it to be enemy in origin, he counter-attacked and fired a missile at a Patriot battery, an event witnessed by embedded reporter Robert Riggs from the Dallas station KTVT: "Suddenly, my whole field of vision is just-becomes white light. We all thought we were under Iraqi mortar attack. We had no idea this is the good guys shooting at us."
The CBS report which contains Riggs' experiences with the Patriot battery makes sobering reading:
This was like a bad science fiction movie in which the computer starts creating false targets. And you have the operators of the system wondering is this a figment of a computer's imagination or is this real.
They were seeing what were called spurious targets that were identified as incoming tactical ballistic missiles. Sometimes, they didn't exist at all in time and space. Other times, they were identifying friendly U.S. aircraft as incoming TBMs.
Sometimes, as CBS notes, the system realised its error, and sometimes it didn't. Riggs continues:
We were in one of the command posts. And I walked in and all the operators and officers are focused intently on their screens. And so you know something's going on here. And suddenly the door flies open, and a Raytheon tech representative runs in and says, ‘Don't shoot! Don't shoot!’ Well, that got our attention real quick.
On 2 April, 2003 two Patriots downed the F-A-18C of US Navy Pilot Lt. Nathan White while he was returning to the USS Kitty Hawk. He was killed instantly.
Last week's report by UK defence minister Ivor Caplin on the Tornado incident fingered a "system error" as the cause, linked to failure of the aircraft's "identification friend or foe" (IFF) system against a backdrop of of "inexperienced US troops, heavily reliant on technology to make decisions, but lacking crucial equipment which could have helped them identify the Tornado as a friendly aircraft".
More specifically, the Ministry of Defence Military Aircraft Accident Summary (PDF) notes that:
1. Royal Air Force Tornado GR4A ZG710 was returning to Ali Al Salem Air Base in Kuwait at 2348 hrs on 22 Mar 03 (0248 hrs on 23 Mar 03 local time) when it was destroyed by a US Army Patriot Surface-to-Air-Missile after being wrongly identified as an Iraqi Anti-Radiation Missile. The aircraft was the second of a pair of Tornados, flying as part of a package of Coalition aircraft, operating during the early part of the war in Iraq. Both members of the crew were killed instantly when the missile hit their aircraft.
4. The Patriot Battery crew were monitoring for Iraqi Tactical Ballistic Missiles when ZG710 was tracked by their system. The symbol which appeared on their radar indicated that an Anti-Radiation Missile was coming directly towards them. The track was interrogated for IFF but there was no response. Having met all classification criteria, the Patriot crew launched the missile, and the Tornado, mistaken for an "Anti-Radiation Missile", was engaged in self-defence. The Patriot crew had complied with extant self-defence Rules of Engagement for dealing with Anti-Radiation Missiles.
How, then, could the Patriot mistake a Tornado for an anti-radiation missile?
Patriot System Anti-Radiation Missile Classification.
9. The Patriot system identifies hostile missiles through their flight profile and other characteristics, including the lack of an IFF response. The criteria programmed into the Patriot computer were based on the many different Anti-Radiation Missiles available worldwide, and were therefore very broad.
ZG710's flight profile met these criteria as it commenced its descent into Ali Al Salem. The Board considered that the criteria should have been much tauter, based on the known threat from Iraq, and concluded that the generic Anti-Radiation Missile classification criteria programmed into the Patriot computer were a contributory factor in the accident.
Regarding the Patriot's operators' role in the disaster, the report notes:
Patriot Anti-Radiation Missile Rules Of Engagement.
10. The Board concluded that the Patriot Anti-Radiation Missile Rules Of Engagement were not robust enough to prevent a friendly aircraft being classified as an Anti-Radiation Missile and then engaged in self-defence, and were thus contributory factors in the accident.
Patriot Firing Doctrine and Training.
11. Patriot crews are trained to react quickly, engage early and to trust the Patriot system. If the crew had delayed firing, ZG710 would probably have been reclassified as its flight path changed. The crew had about one minute to decide whether to engage. The crew were fully trained, but their training had focused on recognising generic threats rather than on those that were specific to Iraq or on identifying false alarms. The Board concluded that both Patriot firing doctrine and training were contributory factors in the accident.
To add a final twist to this tale, there is the matter of the Tornado's IFF system:
15. The Board considered IFF serviceability, potential IFF failures, and aircrew actions relating to the IFF. The Board was able to discount external damage to the IFF.
a. Serviceability. The ground engineering check on ZG710's encrypted Mode 4 IFF was completed satisfactorily pre-engine start, and an RAF Regiment Rapier Missile unit that regularly checked the IFF of departing aircraft did not report the aircraft or log a fault. In line with extant procedures, only Mode 4 was checked on the ground. However, there is no firm evidence that ZG710 responded to any IFF interrogations throughout the entire mission, although there is evidence that the navigator checked the IFF switches at the appropriate times. The Board concluded that ZG710's IFF had a fault and, as an IFF Mode 4 response would have prevented the Patriot Anti-Radiation Missile classification and engagement, concluded that the lack of IFF at the time of the accident was a contributory factor.
b. Failure Modes. Following initial investigation, it became apparent that certain power failures associated with the IFF may not be displayed to the crew. The most likely explanation for the absence of an IFF response was that there had been a power supply failure. The Board recommended that further work be conducted to research the failure modes, reliability and serviceability of the Tornado IFF system.
We spoke to Theodore Postol, professor of science, technology, and national security policy at MIT, and a vociferous analyst of the Patriot's performance. His 1992 statement to the Committee on Government Operations, US House of Representatives, dissects the missile's failure against Scuds.
His analysis of the RAF report is as follows:
The facts provided in the RAF Report issued on May 14 raise more doubts, rather than less, about the accuracy of US Army information provided to the UK - and about the technical and operational reliability of the Patriots in Operation Iraqi Freedom.
A careful reading of the RAF Report indicates that the Patriot Fire Unit did not have its imbedded data recorder operating during the shoot-down of the Tornado, which basically means that there is no reliable information about what the Patriot operators saw and how they responded. It is not even clear to me that the IFF Mode 4 on the Tornado failed, as we do not have recorded data from the Patriot unit and can therefore not be certain that the Tornado was properly interrogated as claimed by the Patriot operators.
In addition, the RAF Reported that the Tornado was mis-classified as an anti-radiation homing missile, which raises very serious and basic additional questions that remain unanswered.
The only such missile in-theater was the HARM (High-Speed Ant-Radiation Homing Missile) which travels at Mach 2 (roughly 2,000+ feet/sec). The RAF reported that the Patriot crew fired on the Tornado immediately, rather than using an available one minute to further evaluate the nature of the potentially hostile target reported to them by the Patriot computer software - which was known to be unreliable. Since the Patriot unit had one minute to decide whether or not to fire on a target classified as a HARM, this would mean that the HARM was roughly 120,000 to 140,000 feet downrange, or roughly 25 to 30 miles distance when Patriot's were launched. However, we know that the Tornado had to be traveling no faster than roughly Mach 0.8 (800+ feet/sec). Since the Patriot unit fired when they had one minute to assess the approaching target, this suggests that the Tornado must have been at a range of roughly 50,000 to 70,000 feet ( 10 to 15 miles) when the Patriot interceptors were actually launched.
If the Tornado was in fact at 10 to 15 miles range (as well as at 17,000 feet - according to the RAF report), then this indicates that a subsonic air-supported vehicle was mis-classified as a supersonic homing missile. If this was the case, the Army needs to explain how a subsonic aircraft following pre-established flight-approach rules could possibly have been mis-classified as an anti-radiation missile by the Patriot's artificial intelligence software. The Army also needs to explain why the Patriot Unit was allowed to operate autonomously when it could not directly communicate with its Battalion headquarters, and why the unit was allowed to engage any target under these inherently unsafe conditions of operations.
We're obliged to Professor Postol for addressing what are some fundamental - and to date unanswered - questions about the Patriot's effectiveness as a weapon.
The Patriot has been sold to the armed forces of Germany, Greece, Israel, Japan , Kuwait, Netherlands, Saudi Arabia and Taiwan. In 1999, Egypt received a $3.2bn grant for a military modernisation programme, including the purchase of 3 Patriot missile system fire units. This Autumn, the US will augment its Patriot capability in South Korea with the deployment of two further batteries.
But is Patriot the defence panacea its champions claim - or a neurotic and expensive flying turkey? ®
More from the1992 report by the Information Management and Technology Division of the General Accounting Office in response to a request by Howard Wolpe, Chairman, Subcommittee on Investigations and Oversight Committee on Science, Space, and Technology, House of Representatives:
The heart of the Patriot system is its weapons control computer. It performs the system's major functions for tracking and intercepting a target, as well as other battle management, command and control functions. The Patriot's weapons control computer used in Operation Desert Storm is based on a 1970s design with relatively limited capability to perform high precision calculations.
To carry out its mission, the Patriot's weapons control computer obtains target information from the system's radar. The Patriot's radar sends out electronic pulses that scan the air space above it. When the pulses hit a target they are reflected back to the radar system and shown as an object (or plot) on the Patriot's display screens.(1) Patriot operators use the software to instruct the system to intercept certain types of objects such as planes, cruise missiles, or tactical ballistic missiles (such as Scuds). During Desert Storm the Patriot was instructed to intercept tactical ballistic missiles. For the Patriot's computer to identify, track, and intercept these missiles, important information(2) describing them was kept by the system's range-gate algorithm.(3)
After the Patriot's radar detects an airborne object that has the characteristics of a Scud, the range gate--an electronic detection device within the radar system--calculates an area in the air space where the system should next look for it. The range gate filters out information about airborne objects outside its calculated area and only processes the information needed for tracking, targeting, and intercepting Scuds. Finding an object within the calculated range gate area confirms that it is a Scud missile.
The range gate's prediction of where the Scud will next appear is a function of the Scud's know velocity and the time of the last radar detection. Velocity is a real number that can be expressed as a whole number and a decimal (e.g., 3750.2563...miles per hour). Time is kept continuously by the system's internal clock in tenths of seconds but is expressed as an integer or whole number (e.g., 32, 33, 34...). The longer the system has been running, the larger the number representing time. To predict where the Scud will next appear, both time and velocity must be expressed as real numbers. Because of the way the Patriot computer performs its calculations and the fact that its registers(4) are only 24 bits long, the conversion of time from an integer to a real number cannot be any more precise than 24 bits.(5) This conversion results in a loss of precision causing a less accurate time calculation. The effect of this inaccuracy on the range gate's calculation is directly proportional to the target's velocity and the length of time the system has been running. Consequently, performing the conversion after the Patriot has been running continuously for extended periods causes the range gate to shift away from the center of the target, making it less likely that the target, in this case a Scud, will be successfully intercepted.