The Patriot Missile Failure (2000)(www-users.cse.umn.edu)
www-users.cse.umn.edu
The Patriot Missile Failure (2000)
https://www-users.cse.umn.edu/~arnold/disasters/patriot.html
52 comments
I once worked with a person who had an advanced degree in nuclear physics. They were sharp as a tack, a skilled programmer in multiple languages and on several platforms, and grossly over-qualified for the job they had taken but Congress had just killed their position with the SSC in Texas so they needed to switch gears for a while.
Though they were super smart and a rapid typist they were also dyslexic. To make it worse, they would never take responsibility for any mistakes resulting from their failure to double-check the figures entered into the software they needed to run. As a result, we were constantly forced to rerun processes they had worked on because the person never reviewed the parameters they entered into the processing modules before running the jobs. Very simple mistakes like entering 1005 instead of 1500 would cost us a day or more rerunning jobs. It took me weeks to detect the pattern of failures and link them conclusively to this individual since other jobs by other people I supervised also failed but for different reasons.
Once I saw the problem and could easily document the issue I took a few moments to sit with them privately to show what I had found and made the recommendation that they should double-check everything they typed before submitting the jobs so that we could eliminate that class of failures. This person was adamant that I had to be wrong and that they were a perfect typist and somehow someone else was responsible.
Try as I might I could not get them to adopt a simple review-before-submit plan so, since they were a valuable team member who didn't need to lose their job during a period where good jobs were not easy to find, after consulting with my superiors it became my job to review everything they submitted, correct any input parameter fat-fingers or dyslexic inputs, and resubmit those jobs so that we could eliminate those failures.
It was easy enough to do so we made it work and they were never informed I was bird-dogging their work so closely. They remained a valued member of the team until one day they put in their notice.
They had been applying for any positions anywhere that would allow them to use their programming skills on problems that a physicist might find challenging. They had been offered and had accepted a position as a programmer with Raytheon working on missile guidance systems. After their exit, we joked that one day we would hear about a fat-finger mistake sending a missile to an unintended location.
This person was not connected at all to this event since their work with Raytheon was several years after this event occurred (SSC shuttered in 1993). I have no idea what they worked on while there but I hope that someone noticed the issue and insured that two sets of eyes hit everything they typed. Those were the days.
Though they were super smart and a rapid typist they were also dyslexic. To make it worse, they would never take responsibility for any mistakes resulting from their failure to double-check the figures entered into the software they needed to run. As a result, we were constantly forced to rerun processes they had worked on because the person never reviewed the parameters they entered into the processing modules before running the jobs. Very simple mistakes like entering 1005 instead of 1500 would cost us a day or more rerunning jobs. It took me weeks to detect the pattern of failures and link them conclusively to this individual since other jobs by other people I supervised also failed but for different reasons.
Once I saw the problem and could easily document the issue I took a few moments to sit with them privately to show what I had found and made the recommendation that they should double-check everything they typed before submitting the jobs so that we could eliminate that class of failures. This person was adamant that I had to be wrong and that they were a perfect typist and somehow someone else was responsible.
Try as I might I could not get them to adopt a simple review-before-submit plan so, since they were a valuable team member who didn't need to lose their job during a period where good jobs were not easy to find, after consulting with my superiors it became my job to review everything they submitted, correct any input parameter fat-fingers or dyslexic inputs, and resubmit those jobs so that we could eliminate those failures.
It was easy enough to do so we made it work and they were never informed I was bird-dogging their work so closely. They remained a valued member of the team until one day they put in their notice.
They had been applying for any positions anywhere that would allow them to use their programming skills on problems that a physicist might find challenging. They had been offered and had accepted a position as a programmer with Raytheon working on missile guidance systems. After their exit, we joked that one day we would hear about a fat-finger mistake sending a missile to an unintended location.
This person was not connected at all to this event since their work with Raytheon was several years after this event occurred (SSC shuttered in 1993). I have no idea what they worked on while there but I hope that someone noticed the issue and insured that two sets of eyes hit everything they typed. Those were the days.
Can you really be a skilled programmer if you refuse code reviews and constantly ship buggy code?
I might be an outlier here, but I absolutely think that makes a shit developer. No amount of code knowledge is worth hiring someone that won't work with others. I absolutely hate the trope of the brilliant genius coder who has to be left alone. The reality of that is exactly what you're describing.
I might be an outlier here, but I absolutely think that makes a shit developer. No amount of code knowledge is worth hiring someone that won't work with others. I absolutely hate the trope of the brilliant genius coder who has to be left alone. The reality of that is exactly what you're describing.
>Can you be a skilled programmer...
The answer is no. I agree with you and there is a chance that I could've been less generous in my description.
I think they were ashamed to be confronted since they had a more advanced education and experience level than most of the rest of the team. They worked well with everyone, would gladly help others improve skills, had a great personality and sense of humor but their main defect was the unwillingness to accept the fact of their own fallibility, causing production lags and extra work fixing problems that shouldn't have happened. We handled it and it all worked out in the end.
The answer is no. I agree with you and there is a chance that I could've been less generous in my description.
I think they were ashamed to be confronted since they had a more advanced education and experience level than most of the rest of the team. They worked well with everyone, would gladly help others improve skills, had a great personality and sense of humor but their main defect was the unwillingness to accept the fact of their own fallibility, causing production lags and extra work fixing problems that shouldn't have happened. We handled it and it all worked out in the end.
Can you be a good musician if you always make mistakes while performing?
Maybe you’re a better composer or producer then, but it’s on whoever leads the group of musicians to organize that.
Jerks who randomly push buggy code straight to master might be the reason you have a job. Most of them probably aren’t, but some of them are the reason a bunch of other people have a job running around fixing stuff and being mad about it.
It’s really hard to see yourself as a regulating component in some messy system, but nothing is better for velocity than pissed of engineers heroically fixing all the stuff they hate from some other engineer that’s pumping out mostly working high impact stuff left and right.
Maybe you’re a better composer or producer then, but it’s on whoever leads the group of musicians to organize that.
Jerks who randomly push buggy code straight to master might be the reason you have a job. Most of them probably aren’t, but some of them are the reason a bunch of other people have a job running around fixing stuff and being mad about it.
It’s really hard to see yourself as a regulating component in some messy system, but nothing is better for velocity than pissed of engineers heroically fixing all the stuff they hate from some other engineer that’s pumping out mostly working high impact stuff left and right.
This was a good read, thanks.
> but I hope that someone noticed the issue and insured that two sets of eyes hit everything they typed.
I think you mean ‘ensured’.
> but I hope that someone noticed the issue and insured that two sets of eyes hit everything they typed.
I think you mean ‘ensured’.
>I think you mean ‘ensured’.
Yes. That is the correct word.
It's funny to me to make this grammatical error in a wordy post about a dyslexic person who fat-fingered things. The character differences, "i" versus "e", between the two words are both typed by the middle fingers of opposite hands.
Your post shows the value of having a second set of eyes on your work. Thanks.
Yes. That is the correct word.
It's funny to me to make this grammatical error in a wordy post about a dyslexic person who fat-fingered things. The character differences, "i" versus "e", between the two words are both typed by the middle fingers of opposite hands.
Your post shows the value of having a second set of eyes on your work. Thanks.
As you say, it’s amazing what you find when you review your work. I’m currently trying to implement a checklist system for reviewing work to get output quality up.
I’m consistently disappointed to see what I have done. Having worked at places where the solution was to tell people off when they made errors, that doesn’t work.
People then just watched their manager make the same error and took pleasure from the situation.
I’m consistently disappointed to see what I have done. Having worked at places where the solution was to tell people off when they made errors, that doesn’t work.
People then just watched their manager make the same error and took pleasure from the situation.
In my own career doing QC work I found that so many people would never ask for assistance understanding why their work was rejected. They would simply blame me for noticing their errors. That was literally my job, I was the second set of (trained) eyes.
I worked with a couple of people who would regularly see more than 90% of their work rejected for processing errors that were easily recognized if they had bothered to look at their own work but they consistently missed these things and suffered because they knew that I was waiting to look at it and if there was a problem they would know about it soon enough. They did no QC at all even though this regularly set them and the project back sometimes by weeks.
I would make a point to highlight the problem, describe the source of the problem and detail how to prevent it in the future yet inevitably I would see the same issues all over again from the same people. There was no effort to use any of the QC processes or tools that I set up for them so that errors could be minimized.
One person's position was put in jeopardy when they fell so far behind that a big client had to be informed that deadlines would slip. Only then did that person catch me in the hall and ask me to show them exactly how I checked their data, what I looked for, and how they could fix their processes so that their data passed QC. I ended up teaching that person all the things that their job required anyway and they became one of the best performers in the group.
I was not hard to reach, difficult to work with, unwilling to teach or assist - people were just unwilling to ask for help since it could imply a weakness in their skill sets and put some of their other work under closer scrutiny.
It was a depressing job overall since I always felt like I was the bad guy whose only purpose was to point out all the defects in someone else's hard work.
With the final data products they were producing becoming the basis for a client's decision to spend multiple millions of dollars it was important to me to get things right.
Good luck with your checklist.
I worked with a couple of people who would regularly see more than 90% of their work rejected for processing errors that were easily recognized if they had bothered to look at their own work but they consistently missed these things and suffered because they knew that I was waiting to look at it and if there was a problem they would know about it soon enough. They did no QC at all even though this regularly set them and the project back sometimes by weeks.
I would make a point to highlight the problem, describe the source of the problem and detail how to prevent it in the future yet inevitably I would see the same issues all over again from the same people. There was no effort to use any of the QC processes or tools that I set up for them so that errors could be minimized.
One person's position was put in jeopardy when they fell so far behind that a big client had to be informed that deadlines would slip. Only then did that person catch me in the hall and ask me to show them exactly how I checked their data, what I looked for, and how they could fix their processes so that their data passed QC. I ended up teaching that person all the things that their job required anyway and they became one of the best performers in the group.
I was not hard to reach, difficult to work with, unwilling to teach or assist - people were just unwilling to ask for help since it could imply a weakness in their skill sets and put some of their other work under closer scrutiny.
It was a depressing job overall since I always felt like I was the bad guy whose only purpose was to point out all the defects in someone else's hard work.
With the final data products they were producing becoming the basis for a client's decision to spend multiple millions of dollars it was important to me to get things right.
Good luck with your checklist.
Thanks. If nothing else, it has vastly improved my work.
Seems almost criminally negligent.
It's interesting that Raytheon's name is nowhere to be found on this. It sounds like Raytheon's bad code killed 28 US soldiers.
The Iraqi SCUD killed 28 US soldiers. Raytheon failed to prevent it.
Yes, the Iraqi scud was the primary factor, but it almost seems like if your seat belt snaps in a car accident with a drunk driver and you go through the windshield and die. The drunk driver is culpable but the car company doesn't get a free pass.
Due to a code defect in their product*
Missile interceptors are incredibly complicated. Even with perfect code there is a probability range for successful intercept. The probability was much lower in this case as the software had a defect, and the battery was online for 100h.
That was being used outside of its original design specifications.
The Patriot missile in the first gulf war was mostly a failure when it came to its stated purpose of intercepting and rendering harmless incoming missiles. It was however a huge propaganda success. Each time it deflected a SCUD, people felt safer, even though often the explosive payload survived and still caused damage on the ground. Given the almost non-existent guidance system on the SCUD, their goal was simply to hit enemy territory and hope to get lucky. The Patriot didn't change that. But it did keep Israel from entering the war and kept the American public believing that the SCUDs were being derogated. Instead of being horrified at the helplessness against SCUDs, people were cheering for the Patriot missile.
IIRC from my military time, the first generations of the patriot missiles (PAC-1, PAC-2) were designed to explode when in vicinity of the target. The PAC-3 missile was the first to introduce kinetic damage before the payload would explode.
This is correct. The Patriot was an anti-aircraft missile that was retrofitted to kinda sorta be adequate for ballistic missile intercept. It was a proverbial dancing bear -- it was impressive that it worked at all, never mind that it wasn't very good.
Hah, I remember being shown a, well, propaganda TV event for schoolchildren, where cute kids would lisp questions like, "what if we run out of Patriot missiles, but Saddam still has his SCUDs?" and the hosts would assure that we had tons of them left.
UAE has recently shot at least $150M of interceptors in a single night. THAAD, and PAC III.
Raytheon people are all over the place there, to the point I bumped into them on every drone industry event I been (3 in total)
Raytheon people are all over the place there, to the point I bumped into them on every drone industry event I been (3 in total)
I remember the US gained air superiority and control of the skies pretty quickly in the first gulf war and that was pretty much game over for the SCUD or other threats. They were forced to keep them hidden and moving or else a squad of Apache helicopters would make short work of the batteries.
That was the propaganda published at the time. Postwar analysis showed that the air campaign was totally ineffective at hunting down scud launchers.
>Second, there is no technical evidence that a single TEL was actually destroyed during the war, despite the claims of some 100 “kills” by aircrews and special forces. [...] The exact impact of coalition operations against mobile systems is more problematic. Iraqi launch operations never stopped and only diminished somewhat over time, although during the last week of the war launch operations increased in tempo. At best, it can be said that counter-Scud efforts only maintained “pressure” on Iraqi missile operations and that Scud CAP operations apparently were successful at harassing but never halting Iraqi launch operations.
https://media.defense.gov/2019/Apr/11/2002115481/-1/-1/0/15C...
>Second, there is no technical evidence that a single TEL was actually destroyed during the war, despite the claims of some 100 “kills” by aircrews and special forces. [...] The exact impact of coalition operations against mobile systems is more problematic. Iraqi launch operations never stopped and only diminished somewhat over time, although during the last week of the war launch operations increased in tempo. At best, it can be said that counter-Scud efforts only maintained “pressure” on Iraqi missile operations and that Scud CAP operations apparently were successful at harassing but never halting Iraqi launch operations.
https://media.defense.gov/2019/Apr/11/2002115481/-1/-1/0/15C...
People are still cheering for the Patriot missile in unwarranted circumstances.
Everyone calling for war with Russia seems to ignore the fact that the Patriot batteries that are 'simply defending a NATO members territory' are switched to attack weapons with a simple software change, meaning that the difference between safety and catastrophe is, as always with the Patriot technology, just a matter of software ..
Everyone calling for war with Russia seems to ignore the fact that the Patriot batteries that are 'simply defending a NATO members territory' are switched to attack weapons with a simple software change, meaning that the difference between safety and catastrophe is, as always with the Patriot technology, just a matter of software ..
You might be confusing Patriot with Aegis ashore [1]. That's the one that is usually suspected of having offensive capabilities (by replacing interceptors with Tomahawk missiles that could hypothetically have nuclear payloads).
[1] https://en.wikipedia.org/wiki/Aegis_Ballistic_Missile_Defens...
[1] https://en.wikipedia.org/wiki/Aegis_Ballistic_Missile_Defens...
> Everyone calling for war with Russia
This list needs to include Russia themselves, who've been ramping up the hostile internal propaganda and moving their troops to the front.
This list needs to include Russia themselves, who've been ramping up the hostile internal propaganda and moving their troops to the front.
They don't have warheads designed for surface strike. Do you mind elaborating on what you mean by this?
As a complete noob when it comes to weaponry - why would it need a warehead specifically designed for a surface strike? A missile going 1000km/h+ doesn't even need to explode at the target to cause some incredible damage when it hits, does it?
A tomahawk can carry 450kg of conventional explosives or up to 150kt nuclear warhead.
Compare that to a patriot which has a different purpose and was optimized to carry almost nothing.
One can wipe out a large area, the other is like a large arrow... might not even penetrate a tanks armor?
Compare that to a patriot which has a different purpose and was optimized to carry almost nothing.
One can wipe out a large area, the other is like a large arrow... might not even penetrate a tanks armor?
aa-jv posts pro-Russian propaganda. Don't feed the trolls.
Not true at all. Anti-war != Pro-Russia.
You still anti-war? Or you still calling everyone NATO bootlickers as Russia bombs the people of Ukraine… The irony is you were the Russian tyrant bootlicker all along.
You said about Russian military on Ukraine border, there was: “Nothing at all wrong with that, one bit.”
I’m not sure where you fell off, but if you ever considered yourself anti-war, I’m here to tell your younger self that you’ve been led far far astray…
You said about Russian military on Ukraine border, there was: “Nothing at all wrong with that, one bit.”
I’m not sure where you fell off, but if you ever considered yourself anti-war, I’m here to tell your younger self that you’ve been led far far astray…
I'm very much still anti-war, and just as disappointed in things as anyone, but I fail to see how NATO bootlickers have done anything BUT promote this situation and create the conditions for our current circumstances.
Yes, I consider NATO an aggressor, and it has finally accomplished the breech in European peace that has been planned since 2008.
Here, I'll spell it out for you:
Russian military in their borders: okay.
Russian military in Kiev: not okay.
American military in Poland, Lithuania, Latvia, Turkey, Greece, Croatia, Hungary, Slovakia, Czech-Republic: not okay.
American military in Iraq, Syria, Afghanistan, Pakistan, Somalia, Yemen: not okay.
Get the picture? If so, please color in red crayon the states above that are currently on fire, emitting endless streams of war refugees, and press hard if those states have been that way since the Western coalition started WW3 in 2003 .. speaking of 'being led astray'.
Yes, I consider NATO an aggressor, and it has finally accomplished the breech in European peace that has been planned since 2008.
Here, I'll spell it out for you:
Russian military in their borders: okay.
Russian military in Kiev: not okay.
American military in Poland, Lithuania, Latvia, Turkey, Greece, Croatia, Hungary, Slovakia, Czech-Republic: not okay.
American military in Iraq, Syria, Afghanistan, Pakistan, Somalia, Yemen: not okay.
Get the picture? If so, please color in red crayon the states above that are currently on fire, emitting endless streams of war refugees, and press hard if those states have been that way since the Western coalition started WW3 in 2003 .. speaking of 'being led astray'.
[deleted]
There's an incredibly interesting video from inside a US command centre of an inbound scud being detected, announced, tracked, and eventually destroyed (presumably by patriot). I tried searching youtube for it, but couldn't spot it.
Side-note: search on youtube is a mess. 'For you' and 'Previously watched' collectively took up 16 of the 28 videos displayed on the first page of results, not including '+3 MORE' and '+6 MORE' messages.
Side-note: search on youtube is a mess. 'For you' and 'Previously watched' collectively took up 16 of the 28 videos displayed on the first page of results, not including '+3 MORE' and '+6 MORE' messages.
Anyway the Patriot hit the fuel tank after the warhead had separated, turning the tank from one big projectile into lots of smaller projectiles spreading out to hit lots of targets, and leaving the warhead untouched.
I always wonder how much damage a bug can do in a war. Maybe nothing tops an hypothetical catastrophic bug in the Minuteman III ICBM during a first strike/MAD scenario.
A bug in one's cryptography could be really bad, if there's someone like Alan Turing on the other side capable of noticing and exploiting it.
Also any automated threat detection system that looks at satellite photos / night vision camera feeds / radar / sonar and misinterprets enemy military equipment for something innocuous or vice versa could be really bad. Especially if weapons are used on the targets on the basis of the system's recommendation.
Also any automated threat detection system that looks at satellite photos / night vision camera feeds / radar / sonar and misinterprets enemy military equipment for something innocuous or vice versa could be really bad. Especially if weapons are used on the targets on the basis of the system's recommendation.
I mean, the world almost came to an end in 1983 when the Soviet early detection system detected with 100% confidence multiple missile launches from US heading towards Russia. The only reason we are still alive is because one man, officer in the Soviet Air Defence forces, took a personal decision to wait for radar confirmation before informing his superiors(who would have almost certainly ordered a counterstrike before the missiles could arrive).
The most terrifying point in all of this is that multiple systems were all coming up with confirmation that the attack is really happening, he had his entire department checking and checking and checking everything over, and it was coming back as 100% positive.
I don't think Soviets ever publicly said what the issue actually was, we can only guess.
https://en.wikipedia.org/wiki/1983_Soviet_nuclear_false_alar...
The most terrifying point in all of this is that multiple systems were all coming up with confirmation that the attack is really happening, he had his entire department checking and checking and checking everything over, and it was coming back as 100% positive.
I don't think Soviets ever publicly said what the issue actually was, we can only guess.
https://en.wikipedia.org/wiki/1983_Soviet_nuclear_false_alar...
oh a bug in the ICBM warning system would be far worse. if minuteman's are flying we've already lost
And that already happened! https://en.wikipedia.org/wiki/1983_Soviet_nuclear_false_alar...
The interesting twist here is that the programmed target is calculated to be the place where the most damage can be inflicted. A malfunction involving an actual nuclear explosion is likely to happen over somewhere like the polar ice cap.
[deleted]
> Velocity is a real number that can […]
Strange definition of velocity!
Strange definition of velocity!
[deleted]
Click-bait title, good article. Not surprised there was a computational error in 1991.
Glad there was a failure so more R&D could be done to improve.
Glad there was a failure so more R&D could be done to improve.
Edit: To be clear, this was not just bad code, as that issue was already measured and known, but not communicated well, for one. It was military leadership systems-level issue in addition to a Raytheon/coder/etc. issue.
Software was corrected on February 16.
> On February 21, 1991, the Patriot Project Office sent a message to Patriot users stating that very long run times could cause a shift in the range gate, resulting in the target being offset. The message also said a software change was being sent that would improve the system’s targeting. However, the message did not specify what constitutes very long run times.
So Israel was running their units for 8h, but the US unit kept theirs running more than 10x longer with no idea what was appropriate. Phew.
Then, on Scud-day, February 25, there were _six_ batteries operating around the vicinity, and it so happens that the 100h-uptime Patriot battery was tasked to this missile. (How many scuds flew that day? I'd like to know)
And finally on February 26, the next day, "the modified software, which compensated for the inaccurate time calculation, arrived in Dhahran."
Ouch. :-(
The PDF report is a really nice effort. Things like the table on page 17/print page 15 made it easier to understand the range error situation compared to Patriot battery run time.