Deadly Round-Off Error: Failure of the Patriot System in Dhahran 1991

On February 25, 1991, a Patriot missile defence system operating in Dhahran, Saudi Arabia, failed to engage an incoming Scud missile. The missile struck U.S. Army barracks, killing 28 soldiers and injuring 98. The reason for the failure of the Patriot was a fixed-point round-off error in the range-gate algorithm of the Patriot radar unit’s tracking system. This paper reconstructs the events and explains how the patriot system works. Then it illustrates in detail how the round-off error developed and how it amplified to a critical inaccuracy. Possible approaches for the prevention of these issues are discussed. These approaches, divided in solutions on the technical and on the organisational side of software engineering, will demonstrate that the incident at Dhahran could have been prevented.