Title: Simulation Credibility | ISO 26262 Academy URL: https://iso26262.academy/features/concepts/simulation-credibility Description: A simulation result is a number; safety evidence is a number plus an argument. --- Concept guide · ISO 26262 + ISO 21448 + ISO 34501 · 13 chapters # Simulation Credibility Turn simulation results into safety evidence: the platforms, the questions they can answer, the verification and validation chain behind a claim, and the argument an assessor actually buys. 13 Chapters 6 XiL platforms 8 Credibility factors 7 Pitfall patterns Included in [Expert](https://iso26262.academy/pricing#plan-advanced) [Preview free](https://iso26262.academy/register?plan=free&from=%2Fconcepts%2Fsimulation-credibility&utm_source=website&utm_medium=cta&utm_campaign=features_concepts) See the chapters Inside the course 1. 01 **The Evidence Question** 2. 02 **The XiL Ladder** 3. 03 **Intended Use & Credibility Goals** 4. 04 **Verifying & Validating the Model** 5. 05 **Calibration Without Circular Evidence** The short version ## Quick answers What is the difference between a simulation result and safety evidence? A result is a number a computer produced: the braking distance was a certain value, the fault was detected in a certain time, a whole campaign passed. Evidence is that result plus a credibility argument, a documented reason to believe the number says something true about the real vehicle, for this question, in this domain. Results are cheap, because a cluster produces them by the million overnight; the argument is the expensive part and the only part an assessor buys. Break any link in the chain, and the claim drops from evidence back to anecdote while the dashboard stays exactly as green as before. Is hardware-in-the-loop testing automatically stronger than software-in-the-loop? No, and reading the platform matrix row-wise shows why. Hardware in the loop has the real ECU behind its real connector, but its plant model is usually simpler than an offline one because it must complete every step inside a real-time frame. Software in the loop has no timing truth but can run enormous scenario campaigns faster than real time. Processor in the loop buys real instruction timing and almost nothing else. So the honest question is never which rung is higher; it is whether the claim leans on the elements a given platform makes real, which is a sentence that belongs in the verification strategy. Keep going, free - [Demo exam · no account Test yourself with 7 exam-style questions](https://iso26262.academy/demo-exam) Why this course · ISO 26262 ## Why it pays for itself ### The argument nobody hands you, built link by link Recognised test environments are not a credibility case. Intended use, verification, validation, calibration discipline, uncertainty, correlation, coverage, fault fidelity, tool confidence and reproducibility are assembled into one chain whose weakest link sets the claim. ### Platform choice tied to the claim, not to a fidelity ranking A matrix of what is real, emulated, modelled or absent per loop element, so a test strategy is written from which elements the claim leans on rather than from the assumption that one platform is stronger than another. ### Coverage and weight stated honestly The strongest claim each campaign type actually supports, the three gaps between a modelled parameter space and reality, and the discounts a result takes for credibility shortfall and for extrapolation beyond its validated domain. After the course ## What you’ll be able to do ### Match the Platform to the Claim Choose between model, software, processor, hardware, driver and vehicle in the loop on the basis of which loop elements the claim leans on, and say so explicitly in the verification strategy. ### Write the Question Before the Campaign Fix the question of interest, the context of use, the validity domain and the acceptance thresholds in advance, so a campaign cannot quietly define them after the results exist. ### Keep Calibration and Validation Apart Partition data before fitting, track parameter provenance, and recognise when a retune has just expired every validation result obtained with the previous parameters. ### Report Distributions, Not Point Values Quantify and propagate input uncertainty, rank the contributors, and refuse a pass verdict for a distribution that straddles the limit however comfortable its mean looks. ### State Coverage Claims Honestly Name the denominator behind any coverage number, attach the sampling scheme and exposure assumptions to it, and keep the scenario catalog under the governance an evidence artifact needs. ### Assemble a Defensible Argument Bind correlation, calibration provenance, convergence, campaign logs, uncertainty reports, tool confidence and the configuration manifest into one structured argument whose gaps are visible as gaps. The curriculum · 13 chapters ## Chapter by chapter 1. 01 **The Evidence Question** Why simulation became load-bearing, and the distinction the rest of the guide turns on: a result is a number a computer produced, while evidence is that number plus a documented reason to believe it says something true about the real vehicle. - The statistical wall, computed live - The credibility chain behind one claim - Where published standards leave the argument to you 2. 02 **The XiL Ladder** Six platforms that each make different things real, laid out as a matrix rather than a fidelity ranking. Read it row-wise and the surprise appears: the plant stays modelled all the way through hardware-in-the-loop, and is often simpler there. - What is real, emulated, modelled or absent - The real-time contract and frame overruns - Injection points, and what a digital twin is not 3. 03 **Intended Use & Credibility Goals** A model is credible for a question, not in general. Write the question of interest and the context of use first, scale rigor to how much of the decision rests on the model, and name the validity domain before anyone asks a question outside it. - Risk-scaled rigor tiers - Validity domain and the extrapolation temptation - A factor vocabulary for stating credibility goals 4. 04 **Verifying & Validating the Model** Two distinct ways to be wrong: solving the equations badly, and solving the wrong equations well. Code verification, solution verification through convergence studies, solver choice as a modelling decision, and why validating an unverified model invites compensation. - Three artifacts, three checks - Step size, stability and silent distortion - Stiffness, event detection and their blind spots 5. 05 **Calibration Without Circular Evidence** Tuning a model on the very tests later claimed as validation proves that the optimizer converged. The chapter draws the circular flow honestly, prices the partitioned alternative, and adds the trap that survives perfect data discipline. - Calibration error against held-out error - The partition has a shelf life - Identifiability, and why parameters travel 6. 06 **Uncertainty & Sensitivity** A result offered as evidence is a distribution plus a statement of what that distribution includes. Two kinds of not knowing, propagation through the model, sensitivity ranking that names where measurement money should go, and comparing distributions rather than points. - Aleatory, epistemic, parameter, model form - Tornado screening and its blind spot - Margin is not margin until uncertainty is subtracted 7. 07 **Correlation to Physical Tests** Physical measurements anchor the whole virtual edifice, but matching peaks is not correlation. Decomposed agreement ratings, the two models that hit the same peak by opposite mechanisms, and how to spend a scarce test budget. - Corridor, phase, magnitude and slope - Right answer for the wrong reason - Correlation evidence ages, so script the rerun 8. 08 **Scenario & Parameter Coverage** Coverage of what, sampled how, and what could still be hiding between the samples? The functional, logical and concrete ladder, four sampling strategies against a hidden failure region, and the strongest honest claim each campaign type supports. - Claims made at the top, tests run at the bottom - Grid, random, stratified and adaptive search - The scenario catalog as an evidence artifact 9. 09 **Fault Injection Fidelity** A plant model calibrated on healthy data has no validation evidence about its behaviour with a jammed valve. The chapter asks, per fault class, on which platform the physics is actually present, and measures the timing chain where the real scheduling lives. - Fault class against platform, cell by cell - Detection interval plus reaction against the budget - What a sampled frame simply cannot see 10. 10 **Qualifying the Toolchain** Every box in the virtual test stack is a software tool in the Part 8 sense, including the script that decides pass or fail. Tool confidence addresses malfunction; a qualified solver running an invalid model produces results that are precise, repeatable and false. - Walking the stack, tool by tool - Tool correctness against model validity - The post-processing blind spot 11. 11 **Configuration & Reproducibility** Every claim quietly assumes a fixed object. A manifest that resolves model, parameters, scenarios, solver settings, seeds, tools, environment and scoring script to exact versions is what answers the assessor question about rerunning tonight. - Which claims survive your pinning discipline - Non-determinism you did not order - A change-impact table with the reruns it triggers 12. 12 **Weighing the Evidence** From a pile of artifacts to an argument: a goal structure where every solution node is an artifact the earlier chapters produced, the division of labor between virtual breadth and physical anchoring, and the discounts that decide what a result may weigh. - Each leg carries an assessor question - Credibility shortfall and extrapolation discounts - The claims-limits list, stated before the assessor does 13. 13 **A Worked Credibility Argument** One driver assistance function, one campaign, every chapter in its place: the question and domain written first, a correlation gate that no campaign may pass without, the evidence built in order, and a claim that states its residuals. - Sixteen weeks, three worlds, one gate - Weakest-link credibility scoring - Seven pitfalls and the question that catches each Read all 13 chapters with Expert. Start with a free account: the complete Functional Safety Concept guide and 5 practice exams a month, then upgrade when you need this guide. [Expert](https://iso26262.academy/pricing#plan-advanced) [Preview free](https://iso26262.academy/register?plan=free&from=%2Fconcepts%2Fsimulation-credibility&utm_source=website&utm_medium=cta&utm_campaign=features_concepts) [Try the 7-question demo exam](https://iso26262.academy/demo-exam) Built for ## Who this guide is for - Verification and validation leads deciding how much of a safety argument simulation may carry - Simulation and model engineers whose results are cited in a safety case - HIL and test bench owners defending timing and fault injection evidence - Automated driving teams running large scenario campaigns and reporting coverage - Functional safety managers and assessors probing the seam between tool confidence and model validity ## Frequently Asked Questions Common questions about Simulation Credibility It is validating a model on the same data used to tune it. Calibration adjusts parameters until outputs match reference data, which is part of building the model; validation measures how well the finished model matches data it has never seen, which is part of judging it. The two acts use identical machinery, which is exactly why they get merged. A calibrated match to the calibration data carries almost no information about predictive power, because the optimizer would have produced a match whether or not the physics was right, and flexible models make it worse by absorbing more noise and structural error into the fit. No, and the seam between the two is where assessors probe. Tool qualification addresses tool malfunction: the solver computing something other than its own specification, the automation skipping cases, the script summing the wrong column. It says nothing about whether the model being solved is a valid stand-in for reality. A fully qualified solver faithfully executing its numerics on a plant model whose behaviour is wrong outside the calibrated range produces results that are precise, repeatable, qualified and false. Both territories are required and neither substitutes for the other. Only what its sampling scheme supports, against a denominator it has to name. A campaign covers a modelled parameter space under a chosen sampling scheme; it does not cover reality. Three gaps separate the two: the logical scenario may omit parameters that matter, the exposure distribution used for drawing may misweight the world, and whole scenario classes may be missing from the catalog, which is the residual that performance-limitation analysis exists to chase. The guide states the strongest honest claim per campaign type and computes the zero-failure bound, so run counts stop being reported without their fine print. It runs 13 chapters: why simulation became load-bearing and what separates a result from evidence, the platform ladder and the real-time contract, intended use and risk-scaled rigor with the validity domain, verification before validation with step size and event detection, calibration discipline and identifiability, uncertainty propagation and sensitivity, correlation to physical tests with decomposed agreement ratings, scenario coverage and the claims each campaign supports, fault injection fidelity per platform, tool confidence applied to the whole virtual stack including the scoring script, configuration manifests and reproducibility, the argument that weighs the evidence, and a worked campaign for one driver assistance function with a pitfalls checklist. Every number in the figures is either from a named public source or labelled illustrative. ## Start the course today A free account unlocks one full concept guide, 3 work product templates, 1 guided process, the Markov simulator, and 5 practice exams per month. The Pro and Expert plans unlock more of the 93-guide library. No credit card required. [Preview free](https://iso26262.academy/register?plan=free&from=%2Fconcepts%2Fsimulation-credibility&utm_source=website&utm_medium=cta&utm_campaign=features_concepts) [View Pricing Plans](https://iso26262.academy/pricing) Continue with ## Where this topic leads next. [Browse all 93 guides](https://iso26262.academy/features/concepts#library) - Verification and assessment [Verification & Validation](https://iso26262.academy/features/concepts/verification-validation) Learn multi-level verification from unit testing through system and vehicle validation with ASIL-dependent coverage criteria. Covers reviews, HIL/SIL testing, fault injection, MC/DC coverage, and evidence management. [Expert](https://iso26262.academy/pricing#plan-advanced) 14 chapters - Safety analyses [Safety Analyses](https://iso26262.academy/features/concepts/safety-analyses) Learn how HARA, FMEA, FTA, STPA, DFA, and HAZOP complement each other across the ISO 26262 lifecycle. Covers method selection criteria, analysis sequencing, and a guide to choosing the right technique for each risk. [Expert](https://iso26262.academy/pricing#plan-advanced) 14 chapters - Safety analyses [FMEA Mastery for Functional Safety](https://iso26262.academy/features/concepts/fmea) Learn bottom-up failure mode analysis to identify single-point, residual, and latent faults in your system. Covers scoping, severity/occurrence rating, diagnostic coverage linkage, and integration with SPFM/LFM calculations. [Expert](https://iso26262.academy/pricing#plan-advanced) 12 chapters