Platform
Modules
By sector
By sector
By standard
Blog
News
Events
AOP-20
National Safety Approving Authorities, and the SAF System and packaging agencies that build and document safety, arming and functioning system test programmes for them
AOP-20 is NATO's common manual of test methods for producing the safety evidence on a munition's safety, arming and functioning system, reviewed by national and service safety authorities rather than certified.
AOP-20 is a NATO Allied Ordnance Publication: the common manual of test methods used to generate the safety evidence for a munition's Safety, Arming and Functioning (SAF) System. The Letter of Promulgation records that it "has been approved by the nations in the CNAD AMMUNITION SAFETY GROUP (CASG - AC/326)," and that "the agreement of nations to use this publication is recorded in STANAG 4157" - the same agreement that covers its companion requirements document, AOP-4157. The relationship between the two is direct: AOP-4157 decides which of AOP-20's tests apply to a given SAF System and how they are tailored, and AOP-20 supplies the test methods themselves. The edition in front of a reader today is Edition B, Version 1, promulgated 27 February 2017.
AOP-20 does not decide, on its own, whether a SAF System is safe. It is the shared toolbox of test methods that AOP-4157 draws from when it sets a system's own test programme, and the evidence that programme produces feeds the wider safety and suitability for service judgement a National Safety Approving Authority makes. Test selection itself is tied to the system's expected life-cycle environments, and applicability is set by AOP-4157, not by this manual. The manual also distinguishes requirements by when a design started: revised test requirements apply to SAF Systems developed after the relevant change notice, and an older system's testing can be tailored to whichever legacy standards applied when it was designed, subject to the NSAA's approval.
Conduct of a given test can fall to either of two parties, and the manual is explicit about which one decides if they disagree: "the test may be performed by the packaging agency or the SAF System agency; however, since the SAF System is the controlling item, the SAF System agency has the final decision of suitability." Oversight runs through several further, named authorities rather than sitting with the tester alone. A National Safety Approving Authority concurs in the overall test plan before testing starts. A design authority, acting with the NSAA's concurrence, sets a substitute pass criterion where a standard interface test cannot be met. For tests whose detailed requirements vary by system, a Safety System Authority concurs in the test plan, approves any configuration deviation, and separately receives evidence of any fault or anomaly for its own assessment. And "the chosen test strategy and results shall be presented and justified to the appropriate service safety authority" before that strategy is relied on.
What the manual fixes, across every test, is the paper trail rather than a single procedure. A test plan has to be built and agreed with the NSAA before testing starts, specifying the test number and title, quantity, sequence, inspection and data methods, any modifications or waivers, alternate or optional tests, and the post-test verification procedure. All test equipment has to meet the conditions the test requires, with its calibration verified, within its validity period, by a registered organisation, to the satisfaction of the procuring activity. Where the test item contains explosive material or components, safety procedures and equipment matched to the hazard level are required, to protect personnel and equipment in the event of an explosion.
During and after testing, a complete record has to cover the test plan, the test item's condition before, during and after each test, the equipment used, the conditions applied, and the results and their analysis, kept so the technical effort can be properly analysed afterwards; any deviation or waiver has to be documented along with the technical reason for it. A visual examination is required at the start or end of any test, or whenever exposure is considered to have affected the item, with any damage recorded in the test item record. Where a SAF System's safety condition after a test is in doubt, "inspection by radiography is recommended prior to disassembly and inspection."
Each test itself is written up in a common chapter format - purpose, description, pass/fail criteria, equipment, procedure, and alternate, optional or related-information subsections - and a separate annex covers the statistical methods used to determine the initiation probability of one-shot devices. This page does not walk through which tests apply, what they examine, or at what levels: selecting and tailoring them is AOP-4157's job and the design or procuring agency's, not this page's.
Nobody is certified against AOP-20. The document names no accredited certification body, no notified body, and no NATO scheme that certifies a SAF System or the company that tested it. What it describes instead is government and service oversight of the evidence a supplier generates. For most tests, the pass/fail criteria are not fixed by the manual itself; they are set in the development test plan or the production specification by the design or procuring agency. Nearly every individual test still reaches its decision the same way: breakdown, inspection, other appropriate tests, and engineering judgment together form the basis for whether the item passed, and the result is stated against one of three standardised conditions for the SAF System - safe and operable, safe but not required to be operable, or safe for disposal only.
A national or service safety authority is where that evidence goes. The NSAA concurs in the test plan and, for interface tests that cannot meet a standard criterion, in the substitute a design authority sets. A Safety System Authority separately concurs in a test plan whose requirements vary by system, approves any configuration change, and reviews any fault or anomaly on its own account. And the chosen test strategy and its results are presented and justified to the appropriate service safety authority before they are relied on. Documentation is itself part of how the programme is checked: raw test data and analysed results have to be reported so that an independent party, not just the tester, can review the work.
AOP-20 is covered by STANAG 4157, the agreement recording nations' commitment to use it; the same agreement covers its companion requirements document, AOP-4157, which sets which of AOP-20's tests apply to a given SAF System. That framework sits under the wider safety and suitability for service assessment that AOP-15 and STANAG 4297 describe, and beside STANAG 4629, the broader agreement for safety and suitability for service assessment testing of non-nuclear munitions generally.
A group of design-safety STANAGs sit behind particular SAF System types this manual's tests address: STANAG 4187 for fuzing systems, STANAG 4497 for hand-emplaced munitions, STANAG 4368 for rocket and guided-missile motor ignition systems, and STANAG 4238 for electrical and electromagnetic design environments. A separate group of test-procedure STANAGs sit alongside AOP-20's own chapters for particular hazard responses: STANAG 4240, STANAG 4241, STANAG 4382 and STANAG 4375 - the last of these named in Annex A as an alternative procedure that may optionally be used in place of the drop test the manual itself describes there. STANAG 4370 is the overall environmental-testing agreement behind AOP-20's climatic test chapters, and STANAG 4439 is NATO's policy for introducing and assessing Insensitive Munitions, which this testing supports the evidence for. STANAG 4170 governs qualification of the explosive material itself, a separate and earlier step to the SAF System testing this manual covers.
Initiation-system and electro-explosive-device testing forms its own family, cited alongside rather than inside this manual: STANAG 4363 and AOP-21 for detonating explosive components, and STANAG 4560 and AOP-43 for electro-explosive devices. Individual test chapters also point to the Allied Environmental Conditions and Test Publications series - AECTP-300, AECTP-400 and AECTP-500 - for particular test conditions, alternative procedures, or, at several points in the manual, wording that ties a test's conduct directly to a named leaflet in that series.
NATO's Standardization Document Database is the authoritative source for AOP-20. NATO's documents are free of charge; we credit NATO for the catalogue and neither sell nor host a copy ourselves.
AOP-20 is an operational and technical standard, not a management-system standard: the work it describes happens in a test facility, on the SAF System itself, under the authorities the manual names, and no software changes that. ComplyTrain's part is the paper trail those authorities ask for: the test plan as agreed with the NSAA, the record of every test item's condition before, during and after each test, the equipment and calibration records behind it, the results and their analysis, and the documented reason behind any deviation or waiver. ComplyTrain gives a programme team a controlled place to keep that evidence trail current - version-controlled test plans and their approvals, a live record of what has been tested against what, the calibration records an assessor will ask for, and the training records for the people running the programme - which is the same document-control and audit-trail discipline ComplyTrain supports for any technical standard's evidence, not a mapping to AOP-20's specific test chapters.
What ComplyTrain does not do: it does not perform or witness a test, decide whether a SAF System has passed, set a substitute pass criterion, or act as or substitute for a National Safety Approving Authority or a Safety System Authority. Those judgements stay with the test agencies and safety authorities AOP-20 names.
Which of this manual's tests apply to a given SAF System, and which authority concurs in them, is set by AOP-4157 and by the contract and the customer's quality clause, not by us. See what else sits alongside AOP-20 in the standards explorer, and talk to us about the documentation trail behind a SAF System test programme.
Tell us how you need to work with AOP-20 and what you need from it. We will come back to you about what ComplyTrain can do.
Thank you. Your list is on its way to your inbox, and we will come back to you on what working with these standards in ComplyTrain involves, usually within one business day.
AOP-20 does not bind on its own account: nations record their agreement to use it through STANAG 4157, a nation-to-nation ratification. It reaches a supplier once AOP-4157, a national qualification programme, or a contract requires a SAF System to be tested against it, which is a question for that programme, not for AOP-20 in isolation.
No. AOP-20 names no accredited body, notified body or NATO certification scheme. A National Safety Approving Authority, and, for particular tests, a service safety authority or a Safety System Authority, review and concur in the test evidence a supplier generates; there is no third-party certificate to hold and no scheme that awards one.
AOP-4157 sets the testing requirements: which tests from this manual apply to a given SAF System, and how they are tailored. AOP-20 is the manual those requirements point to - the common test methods themselves, written up one per chapter in a fixed format.
For most tests the pass/fail criteria are set outside the manual, in the development test plan or production specification, by the design or procuring agency. The decision itself is reached from breakdown, inspection, other appropriate tests, and engineering judgment together, and stated against one of three standardised outcomes: safe and operable, safe but not required to be operable, or safe for disposal only. Several tests also require a named authority's separate concurrence or approval before the result is relied on.
From NATO's Standardization Document Database, which lists the catalogue and serves the unclassified documents free of charge. We do not sell it or host a copy ourselves.
One system for the whole compliance programme. Start with the module you need most.
Collect information the same way every time, and decide in advance what happens next.
Know whether your controls are operating, not just whether a policy says they exist.
Turn the compliance work you already know about into a plan with owners, dependencies and dates.
Know what you can offer, and hold the evidence behind every configuration you offer it in.
Eight built-in reports across every module, scheduled, delivered, and filed where the evidence lives.
The sector news that matters to your organisation - read and rated by AI, and delivered as a scheduled digest in your own language.
AI reads the tender pack and pulls out the requirements, deadlines and rules - then helps you draft the response from your own approved content, with you reviewing every step.
One current register of the suppliers and partners you depend on - each risk-assessed, re-assessing itself on schedule, and wired straight into your risk register.
See every requirement you face - across every standard, plus your own contracts and policies - traced to the documents, evidence and processes that satisfy it.
Identify, score, treat and review your risks in one place - with AI to help anyone run a proper assessment, and a defensible trail behind every decision.
Assign training, prove it was understood, and hold the competence records an auditor asks for.
Draft compliance documents with AI, keep every version under control, and export them beautifully branded - all in one place.
Audits, corrective actions, processes and approvals in one quality system, organised around ISO 9001.
Medical device manufacturers operate under more regulatory pressure than almost any other sector outside pharmaceuticals. The rules govern how you design a device, how you make it, how you track it after it ships, and how you respond when something goes wrong.
Learn how EU dual-use export controls apply to encryption, sensors, and software, how classification works under Annex I, and why sending source code by email can count as an export.
A practical way to turn in-your-head risk management into a register that survives staff turnover and answers the risk questions now showing up in tenders.