AEP-4754 NATO generic vehicle architecture for land systems

What it is

AEP-4754 is the NATO Allied Engineering Publication (AEP) that sets out the NATO Generic Vehicle Architecture (NGVA): a common approach to the electrical power and data infrastructure that different sub-systems on a land vehicle plug into. It is the technical document under STANAG 4754, the agreement by which NATO nations commit to use it - "ratifying nations agree that the NGVA Standard is to be applied to all future land vehicle platforms and vehicle platform sub-systems." AEP-4754 is not one document but a set of volumes, and this record holds all eight of them: the architecture approach, power infrastructure, data infrastructure, crew terminal software architecture, the data model, safety, verification and validation, and, added later, the tactical effector.

Eight volumes, two editions

Volumes I, IV and VII were promulgated together in February 2018, at Edition A. Volumes II, III, V and VI followed at Edition B in February 2023. Volume VIII, covering the tactical effector, is the newest addition, promulgated in October 2024 - its own front matter updates the standard's description of itself from seven volumes to eight to account for it. A supplier working from the whole set is working across two editions, not one.

Who carries the work

The individual nation government delivery team defines the requirements a specific programme has to meet and "shall be responsible for ensuring the successful integration of all sub-systems onto the vehicle platform." Germany acts as custodian, maintaining configuration management and change management for the standard and its volumes. Below that sit the roles a supplier will recognise: a System Designer and Supplier, responsible for the electronic infrastructure - the power distribution and data exchange means between sub-systems; Sub-System Designers and Suppliers providing individual sub-systems, sometimes as subcontractors to the System Designer; a System Integrator delivering the complete system; and a Conformity Assessment Authority that verifies and validates it independently of the supplier.

Compulsory Requirements and Optional Enhancements

Every requirement in AEP-4754 is one of two kinds. A Compulsory Requirement "needs to be implemented in order to conform to Standard AEP-4754 and to gain certification." An Optional Enhancement does not need to be implemented to conform - but once a supplier chooses to implement it, it has to be built to the stated specification to count as compliant. That distinction runs through every volume: it is worth checking, requirement by requirement, which kind a given line is, because the two carry different consequences for a conformity claim.

Power and data infrastructure

Volume II covers how sub-systems connect to the vehicle's power infrastructure. Volume III covers the data side: an External Gateway "shall provide the access to any services inside the Vehicle Platform that are required or need to be accessible from outside the Vehicle Platform," and any non-NGVA network or bus - the document uses other vehicle data buses as its example - "shall require an NGVA Ready gateway." A system integrator has to be able to show that "failure of the NGVA Data Infrastructure or its components shall not degrade the performance of the Base Vehicle." Connector, pin and rating detail sits inside these volumes but is outside what this page covers - the point for a supplier is that the interface exists, what it is for, and that it has to be documented and gateway-managed where it sits outside NGVA.

The data model and its governance

A platform or sub-system implements only the data model domains its own requirements call for, built to the applicable use case, sequence and state-machine specifications for each domain. AEP-4754 provides a reference package for doing this, and "it must be used to realize an NGVA-compliant platform or NGVA-ready mission sub-system." The data model is maintained on an ongoing basis by a change control board under Germany's custodianship, which "will be convened at least annually" and will not approve a change that drops a module below its agreed minimum maturity. A supplier needs to know which release of the data model, and which maturity level, its own implementation is built against - the model moves, and a fixed-in-time implementation can fall behind it.

Safety: the modular safety case

Where safety is affected, conformity is demonstrated through a safety case - "a structured argument, supported by a body of evidence that provides a compelling, comprehensible and valid case that a system is safe for a given application in a given environment" - built module by module rather than once for the whole platform. That modularity is deliberate: replacing one module generally means only that module's safety case has to be re-verified against its interface, not the whole platform's. Volume VI requires an appropriate system safety standard to be applied to any NGVA (sub-)system development activity - it names DEF-STAN 00-56 and MIL-STD 882E as examples - and maps its own safety lifecycle phases against those standards' phase structures, including against IEC 61508. In-service reconfiguration is tightly bounded: it "shall only be performed within the scope of NGVA system configurations given by the safety statement of the NGVA system," with a safe mode, defined procedures, minimum staff training and restricted access all required beforehand.

Verification, validation and three compatibility levels

Volume VII sets out how conformity to the rest of the standard is demonstrated, and is explicit that it adds no new technical requirements of its own. A verification plan "tailored to the specific NGVA system shall be written to define the verification process," and how independent the people running it need to be scales with the system's Safety Integrity Level - "Classical IV&V is generally required for Safety Integrity Level (SIL) 4." Conformity itself runs through three sequential Compatibility Levels - Connectivity, Communication and Functional, each including everything below it - and "only products certified by accredited conformity assessment bodies will be able to claim conformity to a NGVA Compatibility Level." These levels are kept distinct from two further terms: "NGVA Ready" describes a sub-system, "NGVA Compliant" describes a whole vehicle platform.

Tactical Effector, the newest volume

Volume VIII, added well after the original seven, architects a vehicle's tactical effector systems - the weapon and sensor systems it carries - on top of the same data model and safety foundations as the rest of the standard: "all messages shall be implemented in accordance to the NGVA Data Model Volume V," and an effector's safety functions have to be identified against Volume VI's safety approach. It defines mandatory basic engagement-handling capability, system support operations such as registering an effector system with the vehicle's coordination system, and enhanced use cases including a smoke dispenser and an air defence effector.

What the document does not cover

AEP-4754 names no scheme by which an organisation becomes "AEP-4754 certified." Certification, in this document, means acceptance of a safety case by a certification authority, or assessment of a specific system against a Compatibility Level by an accredited conformity assessment body - both are judgements about a system or a platform, not about the company that built it. The standard also does not fix pin, connector or message-field detail on this page: those live in the volumes themselves and are a matter for the engineering team building to them.

Standards it references

• STANAG 4697Binds
• AAP-03Background
• IEC 61508Background
• AEP-79Background
• STANAG 4074Background
• STANAG 4628Background
• STANAG 4406Background
• ISO 10007Background
• AECTP-400Background