The Matterhorn Protocol: 31 checkpoints and 136 failure conditions, explained for people who are not PDF engineers

If you have ever run a PDF through PAC and wondered where a code like "14-003" comes from, the answer is the Matterhorn Protocol. It is the document that turns the prose of ISO 14289-1 into a numbered list of ways a file can fail, and it is the shared vocabulary of PDF/UA testing. This guide explains its structure, its counts, and how to use it without being a PDF engineer.

What it is

The Matterhorn Protocol is published by the PDF Association's PDF/UA Technical Working Group. In the Association's words it is "an algorithm establishing failure criteria for accessible PDF documents" intended to promote adoption of PDF/UA among software developers, service bureaus, and end users. Version 1.1, released on April 22, 2021, "adds a new failure condition and provides several clarifications" and consists of 31 checkpoints comprised of 136 failure conditions. The protocol's own introduction adds the split that matters most in practice: "87 failure conditions can be determined by software alone, 47 failure conditions usually require human judgment. 2 failure conditions have no specific tests (23-001 and 27-001)." Some conditions apply to the document, some to a page, and most to individual objects such as tags, tables, or annotations.

How a failure condition is written

Each condition has an index (checkpoint number, then a sequence number), a one-sentence failure description, the clause of ISO 14289-1 it derives from, a type (Doc, Page, or Object), and a "How" column marked M for machine-decidable or H for human judgement. Four examples from the protocol show the range:

• 06-001 (Document, M): "Document does not contain an XMP metadata stream." A checker can decide this instantly.
• 06-004 (Document, H): "dc:title does not clearly identify the document." Software can see a title exists; only a person can judge whether it identifies the document.
• 13-004 (Object, M): "<Figure> tag alternative or replacement text missing." Machine-decidable, but its companion 13-001, whether graphics that should be figures are tagged as figures, is marked H.
• 14-003 (Document, M): "Numbered heading levels in descending sequence are skipped (Example: <H3> follows directly after <H1>)." A machine can find the skip; whether each heading is at the right level (14-001) is a human check.

The 31 checkpoints

Three things the protocol clears up

Bookmarks are not a page-count rule. Checkpoint 27 on navigation contains one entry, 27-001: "No tests specific to navigation are required; use appropriate semantics." The familiar rule that a document of 21 or more pages must have bookmarks is Adobe Acrobat's own checker rule, not a PDF/UA-1 failure condition. Bookmarks remain good practice and a WCAG technique (PDF2), but a PDF/UA report will not fail a long document for lacking them. The document settings guide covers the difference.

Security can fail a file outright. Checkpoint 26 has two machine-decidable conditions: 26-001, the file is encrypted but has no P (permissions) entry, and 26-002, the file is encrypted and the tenth bit of the P entry is false. That bit is the permission that lets assistive technology extract text, so a PDF locked without it is inaccessible no matter how well it is tagged.

Language is checked in five places. Checkpoint 11 lists failure conditions for page content, Alt and ActualText and E attributes, outline entries, annotation Contents, and form field TU entries. Setting the document language is only the first of them; the language tagging guide goes through the rest.

How to use a Matterhorn-based report

1. Fix the machine-decidable failures first. They are unambiguous, usually quick, and a checker will confirm the fix.
2. Then work through the human-judgement conditions the checker lists for review. These are where reading order (09-001), heading appropriateness (14-001), table header relationships (15-001 and 15-002), and alternative text quality live, and no tool can close them.
3. Do not treat an empty error list as conformance. The protocol itself says 47 of its conditions usually need a person, and the PDF/UA versus WCAG guide explains why WCAG outcomes go further still.
4. Remember the scope. The Matterhorn Protocol tests PDF/UA-1. For PDF 2.0 files under PDF/UA-2, use a validator with PDF/UA-2 profiles; see PDF/UA-2 explained.

Frequently asked questions

Sources

The statements above rest on the primary sources below. Where a source is a law or standard, the version and date named in the text are the ones checked on the review date. This guide is general information, not legal advice.

1. PDF Association: Matterhorn Protocol 1.1, PDF/UA Conformance Testing Model (PDF) . Checkpoint list, counts of machine and human conditions, and the failure conditions quoted.
2. PDF Association, April 22, 2021: Rules for Accessible PDF, Matterhorn Protocol 1.1 is now available
3. Adobe: Create and verify PDF accessibility (Acrobat Pro) . Acrobat's bookmarks rule for documents of 21 or more pages.
4. W3C WAI: PDF2, creating bookmarks in PDF documents