STANAG 4676: NATO intelligence tracking, translated both ways
STANAG 4676, published as AEDP-12, defines the NATO Intelligence, Surveillance and Reconnaissance Tracking Standard. SynapseCommand publishes a bidirectional adapter implemented class by class and attribute by attribute against Edition B Version 2.
What STANAG 4676 is
Where GMTI carries detections, STANAG 4676 carries tracks: an object model of tracks, track points, segments, sources, sensors, classifications and the confidence attached to each.
A conformant instantiation contains exactly one root object, and the standard states that the method of transmission is outside its scope. The adapter therefore takes one document, as XML or as the already parsed dictionary twin, and holds no state between documents.
The object model is substantial. The adapter covers 48 classes and 273 attributes, held in machine readable form alongside the written row set, with a test asserting that the two agree in both directions.
Why this matters to a commander
Tracks are how an intelligence picture is shared between organisations that do not share a sensor. A common tracking standard is what allows one nation's product to be reasoned about by another nation's staff.
For coalition work, the standard's explicit treatment of source, sensor and confidence is as important as the track geometry, because it is what lets a receiving staff judge how much weight a track deserves.
For a decision layer, carrying confidence and provenance through translation unchanged is the difference between an auditable recommendation and an opinion.
The exact behaviour, not a capability claim
The normative XML schema is distributed through NATO national representatives and could not be obtained or hashed for the public repository. The adapter therefore binds model attribute names to XML element names provisionally, through a single published table, and states that it does so.
That is a real limitation and it is declared rather than hidden. Any divergence the schema turns out to carry is a change to one table rather than a change to the translation code, and the parsed dictionary path is unaffected: a caller holding a document keyed by model attribute name gets identical canonical output either way.
Track identity is taken at the track data level rather than the segment level, because the standard defines a segment as a grouping a producer may choose at its discretion. A thing that may or may not be broken into pieces is not the thing that carries the identity. Segments are parked against the sample ranges they cover.
Points out of time order across segments are refused, quoting both instants, because sorting them would hide a defect the caller needs to see. Overlapping segments are refused as well, because that structure is a multi-hypothesis producer, and either interleaving the hypotheses or selecting the most confident one would be a judgement a translator may not make.
The collection information field that states whether data came from a real sensor never sets the deployment level synthetic flag. A contradiction between the two is a logged refusal in either direction rather than a silent change.
Exercise identities are resolved to the identity their definitions state, with the exercise role parked separately. Values whose definition has no canonical equivalent set nothing, and the loss is recorded as a declared gap.
- 01EditionAEDP-12 Edition B Version 2.
- 02Coverage48 classes and 273 attributes, cross-checked between the written row set and the machine readable model by a test.
- 03Direction inOne root document, as XML or as the parsed dictionary twin, to canonical Tracks and related objects.
- 04Direction outCanonical objects back to a document.
- 05Element namesProvisional, through one published table, because the normative schema is distributed through national representatives.
Which way the data actually moves
Into the canonical model
- NITS documentOne root object, XML or parsed twin.
- Canonical Track and related objectsOne track per track data object; segments parked against sample ranges.
Out of the canonical model
- Canonical objectsObjects for re-emission.
- NITS documentElement names bound through the provisional table.
Where this data is used
Coalition track exchange
Tracks produced by a partner enter the canonical model with source, sensor and confidence intact, so a receiving staff can weigh them rather than simply accept them.
Track quality in reasoning
The ISR Fusion Agent and the Targeting agent reason over the confidence the producer stated, not over a normalised substitute invented during translation.
Defect surfacing
Out of order points and overlapping hypothesis segments are refused with both instants quoted, which turns a producer side defect into a visible event rather than a quietly repaired input.
Every claim above has a file behind it
These paths are in the public repository, published under Apache 2.0. The adapter module for this page is stanag4676.
Source and fixtures
- Adapter sourcepackages/cdm/synapse_cdm/adapters/stanag4676.py
48 classes, 273 attributes, the provisional element name table and the refusal rules.
- Fixturespackages/cdm/synapse_cdm/fixtures/nits/
Documents, parsed twins and golden canonical output.
- Field by field coverageFORMAT_COVERAGE.md
The row set, including every declared gap and the provisional marking on element names.
Test evidence
- Harness testtests/test_cdm_stanag4676_adapter.py
Replayed by the validation harness shipped in the same package, which runs six checks per fixture including a never-drop lossless check.
- Coverage document testtests/test_cdm_format_coverage.py
Asserts the written class and attribute set agrees with the models.
Manifest-backed assurance
Maturity is declared in each generated adapter manifest and checked against suite eligibility. VERIFIED is a separate claim-status axis. Neither means external certification or integration with a named system.
stanag4676Maturity L4Claim VERIFIED
What these maturity levels mean
L3 means required provenance survives translation. L4 adds applicable roundtrip evidence. L5 would require every applicable public conformance gate to pass. L6 requires an independent real implementation or system and cannot be awarded from this repository's synthetic fixtures.
What is claimed, and what is not
The published adapter implements both translation directions: the format into the canonical data model, and the canonical data model back out to the format. Both directions are replayed by the validation harness against shipped fixtures.
Last reviewed against the published implementation on 2026-09-06.
Limitations
- XML element names are provisional pending access to the normative schema through national channels. This is stated in the adapter itself and is the single largest caveat on this page.
- One document at a time. Transmission is outside the standard and outside this layer.
- Multi-hypothesis track data is refused rather than resolved.
- Values whose definition has no canonical equivalent are recorded as declared gaps rather than approximated.
Security boundary
- XML parsing is guarded. A document carrying a document type definition is refused before the parser sees it, because a tracking document has no legitimate use for one and an internal entity expansion is a denial of service vector on a payload that arrives over a network.
- No classification labels, key material or transport credentials appear in the published layer.
Public sources
Statements about what SynapseCommand® implements are drawn from the published repository rather than from these external sources.
Frequently asked
- What does provisional mean for the XML element names?
- The normative XML schema is distributed through NATO national representatives and was not available to include or hash in a public repository. The adapter binds attribute names to element names through one published table and says so. A programme with schema access can correct the table without touching translation code.
- Does the adapter handle multi-hypothesis tracks?
- No. Track data whose segments overlap in time is refused. Interleaving the hypotheses would produce a physically absurd track and selecting the most confident one would be silent best hypothesis selection, and neither is a translator's decision.
- Is the coverage complete?
- 48 classes and 273 attributes are covered, and a test asserts that the written row set and the machine readable model agree. Where a value has no canonical equivalent, the loss is recorded as a declared gap rather than approximated.
Where to go next
Related standards
Related use cases
Related C2 environments
Command environments in the compatibility catalogue whose published characteristics reference this standard. Each page states the current SynapseCommand integration status for that system.