On 25 February 1991, during Operation Desert Storm, a Patriot missile battery at Dhahran, Saudi Arabia, failed to track an incoming Scud. The Scud hit a barracks and killed 28 Americans. The US General Accounting Office (GAO) traced it to a software problem.
To track a Scud, the Patriot uses a range gate: from the missile's speed and the time of the last radar detection, it predicts where the Scud will be next and looks only there. The system counted time in tenths of a second as a whole number. Converting it to a real number in 24-bit registers lost precision, and the error grew the longer the system ran. A Scud flies at about Mach 5, so a tiny time error became a big distance.
The Patriot was designed to move often and run only a few hours in one place. In the Gulf, batteries sat in permanent positions. On 11 February, Israeli data showed a 20 percent range-gate shift after 8 hours of running. Officials thought that atypical but fixed the software, released on 16 February. A 21 February message warned that "very long run times" could shift the range gate, without saying how long. A reboot (60 to 90 seconds) resets the clock to zero.
Alpha Battery had been running for over 100 hours. Its time was off by about a third of a second and the range gate had shifted about 687 metres, so it could not track the Scud. The fixed software reached Dhahran on 26 February, the day after.
- 28 American soldiers killed
- Over 100 hours of continuous running
- After 8 hours: a 55 m shift; after 100 hours: about 0.34 s of clock error, a 687 m shift
- About 20 hours: when the target fell outside the range gate
- The fix arrived 1 day too late, on 26 February
Why it matters: Errors that grow with uptime (drift, leaks, counters) turn a working system into a broken one by staying on. Know how long your system can safely run, write it down as a number, and test it.