AOP-15 safety and suitability assessment for munitions

What it is

AOP-15 is the NATO Allied Publication that guides the assessment of the safety and suitability for service (S3) of non-nuclear munitions, across their entire life cycle "from concept exploration and design, through eventual use or disposal". It is written for the people who plan and run that assessment - project management, systems engineering and design engineers, and the safety analyst or engineer performing the hazard analyses - and it is a NATO/PFP guidance document rather than an agreement in its own right: NATO's Letter of Promulgation states that "the agreement of NATO nations to use this publication is recorded in STANAG 4297" and that "AOP-15 (Edition 3) contains only factual information". This is Edition 3, promulgated April 2009, superseding Edition 2.

Because AOP-15 is guidance rather than a binding agreement on its own, it reaches an organisation only through what a nation builds on it: a national armed-forces acquisition programme, or the safety evaluation organisation that programme relies on, requiring the S3 assessment this document describes before a munition's in-service date. AOP-15 itself names no contract mechanism and no single applicable tier; those come from whatever the specific programme requires.

A five-step System Safety process

AOP-15 structures the assessment as five steps: Program Definition, Hazard Identification and Tracking, Risk Assessment, Risk Reduction, and Risk Acceptance. Program Definition calls for a System Safety Program Plan (the developer's approach) or a System Safety Management Plan (the programme manager's approach), fixing the tasks, responsibilities and milestones for the whole effort; smaller programmes may combine the two. Hazard identification then runs continuously from early design onward, built around a hazard log that tracks each hazard, the action taken to close it, and any risk left over, drawing where possible on the hazard and mishap history of comparable systems.

The hazard analyses that build the evidence

A series of overlapping analyses accumulates evidence as a design matures. A Preliminary Hazard Analysis, done early in concept work, identifies hazardous components and safety-related interfaces. A Subsystem Hazards Analysis follows once detailed subsystem design exists. A System Hazards Analysis then examines the interfaces between subsystems, because, as AOP-15 puts it, "the assembly of individual hazard-free components does not necessarily ensure that the resulting system is also hazard-free". An Operating and Support Hazard Analysis covers the hazards of production, handling, maintenance and disposal procedures, and, where software performs a safety function, a Software Hazards Analysis is carried out under the companion Allied Publication AOP-52. Three further assessments sit alongside these where relevant: an Insensitive Munitions assessment against STANAG 4439, a disposal assessment against STANAG 4518, and a range sustainability or health-hazard assessment where a munition's use or constituents could affect an operational range or exposed personnel.

Reducing risk, and who accepts what is left

Where a hazard cannot be designed out, AOP-15 sets a fixed order of precedence: eliminate or reduce the risk through the design itself first, then a safety device, then a warning device, and only last a procedure or training regime - and for the most severe hazard categories, the document specifically discourages relying on a warning alone. Any hazard remaining after mitigation "must be accepted by the appropriate Decision Authority", and AOP-15 is explicit that this authority is not NATO: risk acceptance is a national function, and "the appropriate authority designated to accept the risk... will vary for each nation". A related point worth being precise about: a safety and suitability for service assessment is not a certification, and AOP-15 creates none. See "How you are evaluated" below.

Design safety principles, and the Munitions Safety Data Package

A separate annex, Annex B, lists the family of STANAGs carrying the design safety principles for specific classes of munition - fuzing systems, cannon ammunition, air-launched munitions, hand-emplaced munitions and others. AOP-15 expects those principles "shall be adhered to unless it can be clearly demonstrated that they are not applicable", with any departure documented and given a rationale. To avoid nations duplicating each other's testing, the nation developing a munition is expected to compile the resulting evidence into a Munitions Safety Data Package, structured to Annex C: a description of the munition and its explosive components, the defined service environment, the hazard analyses performed and what they found, a summary of any safety trials, the explosive qualification and hazard-classification work behind the design, an audit trail for later modifications, and the final safety approval together with any waivers granted against normal acceptance standards. On a valid request through national channels, a nation with primary development responsibility supplies that package to a nation participating in a collaborative development or procurement programme - the mechanism by which AOP-15 supports interoperability between allies fielding the same munition.

How you are evaluated

AOP-15 creates no certification, for a munition or for a supplier. Nothing in the document names an accredited certification body, and the word "certification" appears only twice: once for a developer's own sign-off on the accuracy of an environmental-profile questionnaire in Annex A, and once as a line item asking whether a munition intended for airborne use already holds an airworthiness certification issued elsewhere. Neither is a scheme AOP-15 itself administers, and passing an AOP-15 assessment does not make a supplier "AOP-15 certified".

What actually happens is that a national or service safety evaluation organization reviews the hazard analyses, trial results and the compiled Munitions Safety Data Package, and a designated national risk acceptance authority decides whether the residual risk has been reduced as low as reasonably practicable (ALARP); as the document says, that authority and its threshold "will vary for each nation". This is a government safety-review process directed at a specific munition, closer to government surveillance than to an accredited third party certifying an organisation's management system, and the evidence an assessor actually reviews is the safety data package itself.

Standards it references

• STANAG 4297 - the Standardization Agreement recording NATO nations' agreement to use AOP-15; the cover that gives it force. Binds.
• AOP-52 - the companion publication on software safety design and assessment for munition-related computing systems, which AOP-15's Software Hazards Analysis step defers to.
• STANAG 4170 - the methodology for qualifying explosive materials for military use, behind AOP-15's explosive-material identification step.
• STANAG 4439 - NATO's policy for the introduction and assessment of Insensitive Munitions, which AOP-15's IM Assessment step compares a munition against.
• STANAG 4518 - guidance on the safe disposal of munitions, behind AOP-15's Disposal Assessment step.
• STANAG 4187 - design safety criteria for fuzing systems and Safety and Arming devices, AOP-15's own example of a generic-class design safety STANAG.
• STANAG 4370, AECTP-100 and AECTP-300 - the environmental testing agreement and its environmental-factor series, used throughout AOP-15 to define the service environments an assessment must cover.
• STANAG 4147 and AEP-04 - nuclear hardening design and assessment references, cited where a munition's survivability in a nuclear environment is in scope.
• STANAG 4145 - referenced alongside AEP-04 for nuclear threat levels in the environment-profile questionnaire.
• STANAG 4240, STANAG 4241, STANAG 4382, STANAG 4396, STANAG 4496 and STANAG 4526 - test-procedure STANAGs for specific hazard types (fuel fire, bullet impact, slow heating, sympathetic reaction, fragment impact and shaped-charge attack) that AOP-15's hazard analysis points a developer toward.
• STANAG 2818, STANAG 3441, STANAG 4368, STANAG 4432, STANAG 4157, STANAG 4497, STANAG 4423, STANAG 4516, STANAG 4599, STANAG 4608 and STANAG 4238 - the family of generic-class design-safety and safety-and-suitability-evaluation STANAGs listed in AOP-15's own Annex B.

NATO's Standardization Document Database is the authoritative source for AOP-15. NATO's documents are free of charge; we credit NATO for the catalogue and neither sell nor host a copy ourselves.

Standards it references

• STANAG 4370Binds
• STANAG 4439Background
• STANAG 4518Background
• STANAG 4187Background
• AOP-52Background
• STANAG 4170Background
• AOP-07Background
• STANAG 4375Background
• STANAG 4240Background
• STANAG 4147Background
• AEP-04Background
• STANAG 4382Background
• STANAG 4241Background
• STANAG 4496Background
• STANAG 4526Background
• AECTP-300Background
• STANAG 4145Background
• STANAG 4396Background
• STANAG 2818Background
• STANAG 3441Background
• STANAG 4368Background
• STANAG 4432Background
• STANAG 4157Background
• STANAG 4497Background
• AECTP-100Background
• STANAG 4423Background
• STANAG 4516Background
• STANAG 4599Background
• STANAG 4608Background
• STANAG 4238Background