FprEN 17833

• Abstract:

  This document sets out a framework to assure simulation credibility for railway applications when complementing or replacing physical tests with virtual tests. This covers simulation model and tool verification and validation, input data and uncertainties, organization and processes of these simulations.; This document can be used particularly when simulations are not yet defined. Where applicable, this document can be used in conjunction with existing standards pertaining to the use of simulations.; If domain-specific standards mandate requirements for simulations, that are intended to replace or complement physical tests, this document is not meant to be applied and does not modify the requirements of those standards. However, this document could assist in future improvements and harmonization of domain-specific standards.; It does not provide domain-specific guidance on applying simulations.; For the use of technologies including, but not limited to, artificial intelligence, model-scale testing, and distributed computing, relevant potential technology-based risks can arise.

• Status: Not Published
• Publication Date: 03-Feb-2027
• ICS: 45.020 - Railway engineering in general
• Technical Committee: CEN/TC 256 - Railway applications
• Drafting Committee: CEN/TC 256/SC 3/WG 55 - Guidance for simulation requirements into railway standards
• Current Stage: 4599 - Dispatch of FV draft to CMC - Finalization for Vote
• Start Date: 31-Jul-2026
• Due Date: 07-Apr-2027
• Completion Date: 31-Jul-2026
• Mandate: M/483 - Mandate for programming and standardisation addressed to the European standardisation bodies under directive 2008/57/EC in the field of the interoperability of the rail system within the European Union
• Mandate: M/591 - Standardisation request to the European Committee for Standardisation and the European Committee for Electrotechnical Standardisation as regards railway products in support of Directive (EU) 2016/797
• Ref Project: oSIST prEN 17833:2026 - Railway applications - Simulation Credibility

• Revises: CEN/TR 17833:2022 - Railway applications - Guidance for the use of simulations - Guidance for the use of simulations to demonstrate compliance with technical and regulatory requirements and on the introduction and development of simulation requirements into standards
• Effective Date: 17-Sep-2025

FprEN 17833 is a CEN draft European Standard for railway applications that sets out how to judge the credibility of simulations used for virtual testing. It specifies a framework for defining the simulation purpose, setting a target credibility level, and checking verification, validation, input data, uncertainty, organization, and process controls for railway simulation work.

What does FprEN 17833 specify?

FprEN 17833 specifies a framework for assuring simulation credibility when virtual tests complement or replace physical tests in railway applications. It is aimed at simulation development, use, and management, especially when simulations are not yet defined in other rules or standards.

The document says it does not provide domain-specific guidance for applying simulations. Where a domain-specific standard already sets simulation requirements, FprEN 17833 is not meant to change them.

The document is organized around Clause 4, which covers the simulation framework, followed by two informative annexes.

Annex	What it covers
Annex A	Guidance for standardization Working Groups on introducing simulation into standards
Annex B	Examples for managing uncertainties, including three approaches

What are the key requirements of FprEN 17833?

FprEN 17833 builds simulation credibility from the intended use of the simulation, then checks whether the resulting work reaches the required level. In practice, the user has to define the purpose, rate the risk, verify and validate the model and tool, control data and uncertainties, and document the whole chain.

Simulation purpose and target credibility

Clause 4.2 requires at least one simulation purpose for each application. FprEN 17833 says the purpose must state how the simulation is used with the system under consideration and what the results should show or support. This matters because every later requirement is derived from that purpose.

Clause 4.3 sets the target credibility level by combining two ratings: consequences and design. Consequences cover safety and other effects such as reputational or financial impact, while design reflects novelty and complexity. In practice, this means a simple, low-risk case does not need the same level of evidence as a novel, high-risk one.

Verification of the model and tool

Clause 4.4.2 requires separate verification of the simulation tool and of the model implementation, including their interfaces and overall function. The document points to checks such as robustness, numerical convergence, accuracy and precision, range of validity, and boundary conditions. For a user, this means the code, software environment, and chosen simulation settings have to work as intended before results are trusted.

FprEN 17833 also links verification depth to the credibility level. Higher levels require more systematic error analysis, stronger methods for identifying key parameters, and stronger review or audit activities. The document allows methods such as static checks, benchmarking, reference cases, regression testing, and convergence checking.

Validation against the system under consideration

Clause 4.4.3 requires validation of the full model and tool against a reference system and representative conditions. The comparison has to address the simulation purpose, the similarity of the reference system, the environment, the boundaries, the outputs, and the limit values used for acceptance. In practice, the simulation only counts as credible if it matches the real-world behaviour that matters for the intended use.

The validation requirements become stricter at higher credibility levels. The document expects better quality measurement data, broader coverage of the operating domain, and tighter limit values as the level rises. It also says the compared physical and simulated data must be directly comparable, for example in sampling frequency, sensor location, units, and post-processing method.

Input data and uncertainty

Clause 4.4.4 ranks input data by traceability. FprEN 17833 focuses on whether the origin and transformations of the data are recorded, not on data quality by itself. For users, this means data lineage must be kept clear from source to final input so results can be checked and reproduced.

Clause 4.4.5 requires significant uncertainties to be identified, and at higher levels quantified and analysed. The document mentions uncertainty from the system itself, measurement, modelling choices, and operating conditions. This matters because a simulation can be technically correct and still give misleading results if uncertainty is not understood.

Organization and process control

Clause 4.4.6 requires defined roles and responsibilities, competence management, and appropriate independence between design, verification, and validation work. Higher levels also require evidence of that independence and an organizationally independent assessor. In practice, the person checking the model should not be the same person who built it.

Clause 4.4.7 requires a defined process covering the full simulation lifecycle, with quality assurance, configuration management, and review. Higher levels require independent review, formal acceptance criteria, and continuous improvement. This gives organizations a repeatable way to manage simulation work instead of treating each study as a one-off exercise.

Credibility assessment and documentation

Clause 4.5 requires a credibility assessment that collects evidence that all applicable requirements are fulfilled and that the artefacts are traceable. If gaps remain, FprEN 17833 allows either improving the simulation or reducing the simulation purpose so that a lower target credibility level applies. Clause 4.6 then requires documentation of the purpose, target credibility level, credibility levels achieved, and the credibility assessment, with configuration management applied to all artefacts.

What terms does FprEN 17833 define?

• Simulation credibility - the confidence users have that a simulation reliably serves its purpose, based on evidence from development, use, and management.
• Simulation purpose - the intended use of the simulation in relation to the system under consideration, and what the results should show or support.
• Target credibility level - the required level of credibility set by combining consequence and design ratings.
• Reference system - a system similar to the system under consideration and used for model validation.
• Validation - the process of determining how closely the simulation represents the system under consideration in its environment.
• Verification - the process of checking that the simulation model or tool components produce the expected results.
• Configuration management - the means of keeping simulation results reproducible by controlling tools, models, data, hardware, software, and procedures.

Who uses FprEN 17833?

FprEN 17833 is written for simulation engineers, organizations, and their subcontractors who create or run railway simulations. It is also intended for standardization Working Groups that want to introduce simulation into a railway standard.

The document also names technical assessors and conformity assessment bodies as users. In practice, these roles use the standard when virtual tests are part of certification, assessment, or approval work in railway applications.

What changed in FprEN 17833 from the previous edition?

FprEN 17833 will supersede CEN/TR 17833:2022. The foreword states that the previous Technical Report has been revised into a European Standard, the scope has changed, the assessment concept has been fundamentally revised, and all clause titles, contents, and numbering have been reworked.

What does the FprEN 17833 document contain?

FprEN 17833 contains the framework clauses for scope, references, terms, the simulation framework, target credibility, simulation credibility, credibility assessment, and documentation. It includes tables for consequence levels, design levels, target credibility levels, and level rankings for verification, validation, input data, uncertainty, organization, and processes.

The document also includes figures showing how the framework is applied by Working Groups and by simulation engineers, plus a validation testing domain and a credibility assessment process. Annex A gives guidance for Working Groups, and Annex B gives example uncertainty methods such as a safety factor approach, a stress-strength approach, and an uncertainty propagation approach.

SLOVENSKI STANDARD
01-marec-2026
Železniške naprave - Verodostojnost simulacije
Railway applications - Simulation Credibility
Bahnanwendungen - Vertrauenswürdigkeit von Simulationen
Applications ferroviaires - Fiabilité des simulations
Ta slovenski standard je istoveten z: prEN 17833
ICS:
45.020 Železniška tehnika na Railway engineering in
splošno general
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

DRAFT
EUROPEAN STANDARD
prEN 17833
NORME EUROPÉENNE
EUROPÄISCHE NORM
January 2026
ICS 45.020
English Version
Railway applications - Simulation Credibility
Applications ferroviaires - Fiabilité des simulations Bahnanwendungen - Vertrauenswürdigkeit von
Simulationen
This draft European Standard is submitted to CEN members for enquiry. It has been drawn up by the Technical Committee
CEN/TC 256.
If this draft becomes a European Standard, CEN members are bound to comply with the CEN/CENELEC Internal Regulations
which stipulate the conditions for giving this European Standard the status of a national standard without any alteration.

This draft European Standard was established by CEN in three official versions (English, French, German). A version in any other
language made by translation under the responsibility of a CEN member into its own language and notified to the CEN-CENELEC
Management Centre has the same status as the official versions.

CEN members are the national standards bodies of Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia,
Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway,
Poland, Portugal, Republic of North Macedonia, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Türkiye and
United Kingdom.
Recipients of this draft are invited to submit, with their comments, notification of any relevant patent rights of which they are
aware and to provide supporting documentation.

Warning : This document is not a European Standard. It is distributed for review and comments. It is subject to change without
notice and shall not be referred to as a European Standard.

EUROPEAN COMMITTEE FOR STANDARDIZATION
COMITÉ EUROPÉEN DE NORMALISATION

EUROPÄISCHES KOMITEE FÜR NORMUNG

CEN-CENELEC Management Centre: Rue de la Science 23, B-1040 Brussels
© 2026 CEN All rights of exploitation in any form and by any means reserved Ref. No. prEN 17833:2026 E
worldwide for CEN national Members.

prEN 17833 (E)
Page
Contents
European foreword . 3
Introduction . 4
1 Scope . 5
2 Normative references . 5
3 Terms and definitions . 5
4 The simulation framework . 8
4.1 General . 8
4.1.1 Overview . 8
4.1.2 Use by standardization working groups . 9
4.1.3 Use by simulation engineers, organizations and their potential subcontractors . 9
4.2 Simulation purpose . 10
4.3 Target credibility . 11
4.3.1 General . 11
4.3.2 Rating of consequences . 11
4.3.3 Rating of design . 12
4.3.4 Target credibility level . 12
4.4 Simulation credibility . 13
4.4.1 General . 13
4.4.2 Simulation model and tool verification . 13
4.4.3 Simulation model and tool validation . 15
4.4.4 Input data . 17
4.4.5 Uncertainty . 18
4.4.6 Organization . 19
4.4.7 Processes . 20
4.5 Credibility assessment . 21
4.6 Documentation . 22
Annex A (informative) Guidance for standardization Working Groups (WG) . 23
Annex B (informative) Examples for managing uncertainties . 24
B.1 General . 24
B.2 Safety factor approach . 24
B.3 Stress-strength approach . 24
B.4 Uncertainty propagation approach . 25
Bibliography. 27

prEN 17833 (E)
European foreword
This document (prEN 17833:2026) has been prepared by Technical Committee CEN/TC 256 "Railway
applications", the secretariat of which is held by DIN.
This document is currently submitted to the CEN Enquiry.
This document will supersede CEN/TR 17833:2022.
In comparison with the previous edition, the following technical modifications have been made:
— the previous Technical Report is entirely revised into an European Standard;
— the Scope is changed;
— the entire assessment concept has been fundamentally revised;
— all clauses titles, contents, and numbering have been reworked.
This document has been prepared under a mandate given to CEN by the European Commission and the
European Free Trade Association, and supports essential requirements of EU Directive(s).

prEN 17833 (E)
Introduction
The rationale for producing this document is the return of experience that physical testing on the real
system for train, control-command system and infrastructure certification leads to:
— high costs;
— delays bringing products to market.
There are several ways in which simulations can help improve the system validation phase. They can be
used to better understand certain phenomena, enabling experts to study/explore a wider range of cases
than those practicably covered by physical tests on the real system (which are limited by environment
parameters such as weather, geographical range and configuration, boundary conditions or degraded
modes etc.) and hence complement them. Another possibility is to use simulation in order to reduce the
amount of physical testing on the real system and to reduce delays bringing products to market.
prEN 17833 (E)
1 Scope
This document sets out a framework to replace and/or complement physical tests with virtual tests by
introducing simulation credibility for a given railway application. This covers simulation development,
use and management.
Users of this document can be:
— simulation engineers or organizations and their subcontractors,
— standardization working groups to introduce simulations in their standards or
— technical assessors and conformity assessment bodies.
This document provides guidance, particularly when simulations are not yet defined. Where applicable,
this document can be used in conjunction with existing standards pertaining to the use of simulations.
If simulation is already recognized in existing domain-specific standards, this document does not modify
the requirements of those standards. However, it may assist in future improvements and harmonization.
It does not provide domain-specific guidance on applying simulations.
For the use of technologies including, but not limited to, artificial intelligence, model-scale testing, and
distributed computing, relevant potential technology based risks can arise.
2 Normative references
There are no normative references in this document.
3 Terms and definitions
For the purposes of this document, the following terms and definitions apply.
ISO and IEC maintain terminological databases for use in standardization at the following addresses:
— IEC Electropedia: available at http://www.electropedia.org/
— ISO Online browsing platform: available at http://www.iso.org/obp
3.1
artefact
tangible or intangible product that is deliberately created or used during the application of this
document
Note 1 to entry: Artefacts may include documents, models, code, data sets, or physical objects, and serve as
evidence of progress, design decisions, or outcomes within this framework.
3.2
configuration management
means to ensure that simulation results are unique and can be reproduced in a controlled manner,
considering the simulation tools, the environment, requirements, design specifications, models, input
data, hardware, software (commercial and/or customized), test parameters, test procedures and any
other contributing system
Note 1 to entry: Time duration for storing configuration depends on the simulation purpose.
3.3
environment
external aspects influencing the behaviour of a system
prEN 17833 (E)
3.4
error
mistake or inaccuracy which results in a deviation from the intended performance or behaviour
3.5
Hardware-in-the-loop (HiL)
testing methodology where real hardware components are integrated into a simulation environment by
a two-way coupling
3.6
parameter
parameters can be identified by analysis of the system under consideration
Note 1 to entry: A parameter has impact on the simulation results.
3.6.1
key parameter
parameter which has high relevance for an analysis
Note 1 to entry: The parameter has direct significant impact on the simulation results. It can be distinguished to a
parameter that is only slightly connected with the context it is used in. One way to identify key parameters is a
sensitivity analysis.
3.7
limit value
value used as limit for deciding whether the similarity of a simulation compared with the system under
consideration or reference system is sufficient to fulfill the simulation requirements
3.8
model
mathematical and/or physical representation of a system or a process
3.9
numerical model
numerical representation of a mathematical model
3.10
regression testing
testing required to determine that a change to a system (e.g. a model or a tool) has not adversely affected
functionality, reliability or performance and has not introduced additional defects
[SOURCE: ISO/IEC 27034-7:2018 [1], 3.15, modified]
3.11
reference system
system similar to the system under consideration and used for model validation
3.12
simulation
use of a similar or equivalent system to reproduce the behaviour of the system under consideration
3.13
simulation credibility
confidence users have in simulations that they reliably serve the simulation purpose, established
through evidence from simulation development, use, and management
prEN 17833 (E)
3.14
simulation lifecycle
series of identifiable stages of the simulation, from initiation to completion, including documentation
and archival
3.15
simulation purpose
reflects the use of the simulation in connection with the system under consideration and defines what
the simulation results should show or support
3.16
simulation requirement
user-defined requirements which are targeted towards the application-specific simulation purpose
3.17
simulation tool
framework for developing or embedding models that enable the execution of simulation
3.18
Software-in-the-loop (SiL)
simulation using production software code interfaced by a two-way coupling with simulation
environment
3.19
system under consideration
real world railway system that is subject to simulation
3.20
system validation
process of proving conformity to system requirements, ensuring that the system under consideration is
fit for its intended use in its intended operational environment
3.21
test
technical operation that consists of applying a set of environmental and operating conditions under a
specified procedure to the system under consideration or to the simulation
Note 1 to entry: A test can be carried out to determine one or more characteristics of a given object, process or
service according to a specified procedure. It can be used for different purposes such as verifying requirements,
calibration, test cases and correct implementation of a model.
Note 2 to entry: A test can be conducted on the real system, entirely or partially using simulation.
3.21.1
physical test
experiment on the system under consideration to determine its response under specific conditions
3.21.2
virtual test
experiment on the system under consideration using simulation to determine its response under
specific conditions
3.22
traceability
record of each artefact of a simulation from initiation to completion, enabling organizations to ensure
assessment, compliance, and continuous improvement through comprehensive visibility
Note 1 to entry: Metrological traceability as defined by EN ISO/IEC 17025:2017 [2] is out of scope of this document.
prEN 17833 (E)
3.23
uncertainty
quantifiable lack of knowledge about the true values and inherent variability of parameters (e.g. model
assumptions, input data, and numerical methods, output data)
3.24
validation
process of determining the degree to which a simulation is an accurate representation
of the system under consideration in its environment
[SOURCE: ASME V&V 10:2019 [3]]
3.25
verification
process of determining that simulation models or simulation tool components produce
expected results
4 The simulation framework
4.1 General
4.1.1 Overview
The framework for the development, use, and management of simulations is organized in five main
parts:
a) simulation purpose (4.2),
b) target credibility (4.3),
c) simulation credibility (4.4),
d) credibility assessment (4.5),
e) documentation (4.6).
The simulation purpose defines how the simulation is intended to be used.
The target credibility determination defines the level of credibility that the simulation should achieve to
be appropriate for its purpose. Target credibility considers the rating of consequences and design of the
system under consideration. Therefore, it is based on factors that are not influenced when developing a
simulation.
The simulation credibility section is used to determine the simulation’s level of credibility. It takes
factors into account that can be influenced when developing and using the simulation, such as
verification of the tool and model.
The credibility assessment consists of comparing the actual simulation credibility level with the target
credibility level.
This document can be used by:
— standardization working groups to introduce simulations in their standards, described in 4.1.2,
— simulation engineers or organizations and their potential subcontractors, described in 4.1.3.
Documentation is the recording of the steps undertaken as part of the simulation process and generation
of outputs at all stages.
prEN 17833 (E)
4.1.2 Use by standardization working groups
Standardization working groups aim towards the creation or revision of a domain-specific standard.
The technical domain or field of the simulation application is known, but the exact simulation
application or realization of it remains open.
Therefore they shall consider domain-specific requirements when applying this document. First of all,
as shown in Figure 1 , a domain-specific simulation purpose shall be defined in accordance with 4.2.
Based on that, a domain-specific target credibility level shall be derived in accordance with 4.3. Based
on the domain-specific target credibility level, domain-specific simulation requirements shall be defined
in accordance with 4.4.
Finally, a domain-specific assessment report shall ensure that:
— the domain-specific simulation requirements are valid,
— they fulfill the identified domain-specific target credibility level,
— the domain-specific simulation purpose is achieved.

Figure 1 — Application when used by standardization working groups
It is important that only the capabilities required for the simulation tools are specified, rather than
specifying particular third-party software. Usually, the latter is not acceptable in standards, and it limits
the use of different and/or better tools that may be developed in the future.
Annex A gives additional guidance for standardization groups for the use of this document.
4.1.3 Use by simulation engineers, organizations and their potential subcontractors
Simulation engineers, organizations and their potential subcontractors aim towards the creation or
revision of a credible simulation implementation. The exact simulation application and the application-
specific requirements are known.
A simulation purpose, as shown in Figure 2 , is defined in accordance with 4.2. A target credibility level
is derived in accordance with 4.3. Based on the target credibility level, application-specific simulation
requirements are defined in accordance with 4.4.
prEN 17833 (E)
Finally, a credibility statement presents an argument in accordance with 4.5 to ensure that the following
criteria are met:
— the application-specific simulation requirements are verified;
— the specified target credibility level is reached;
— the specified simulation purpose is met;
— the actual simulation implementation is validated against these artefacts (application-specific
requirements, target credibility level, simulation purpose).

Figure 2 — Application when used by simulation engineers, organizations and their potential
subcontractors
4.2 Simulation purpose
The user of this document shall formulate at least one simulation purpose for each application. The
simulation purpose shall:
— reflect the use of the simulation in connection with the system under consideration;
— define what the simulation results should show or support.
If the simulation purpose is related to or based on a domain-specific standard, this may result in
additional requirements for the simulation.
The definition of the simulation purpose, alongside the target credibility level defined in 4.3.4, allows
specific simulation requirements to be developed. The specific simulation requirements may target
simulation processes, methods, models, and tools. The specific simulation requirements reflect how it
is planned to fulfill the generic requirements of this document especially those set out in Table 4 to Table
9 for the given application or use case.
The specific simulation requirements shall:
— be derived from simulation purpose(s) or other simulation requirements,
— maintain traceability up to the defined simulation purpose(s),
— be verified.
The specific simulation requirements may be organized hierarchically.
prEN 17833 (E)
4.3 Target credibility
4.3.1 General
The target credibility level represents a risk and consists of two factors: the simulation‘s consequences
and design level.
The simulation’s rating of consequences is set out in 4.3.2.
The simulation’s design level is set out in 4.3.3.
4.3.2 Rating of consequences
The simulation consequence level is defined based on the simulation purpose. The rationale for the
consequence rating shall be documented.
The consequences of applying the simulation results shall be rated, taking into account its potential
effects on the safety and other consequential aspects of the system under consideration.
The consequence levels for this document are set out in Table 1.
Highly rated applications would require any subsequent verification and validation measure to be
accountable to the highest level of scrutiny.
Table 1 — Consequence levels
Consequence Consequences to persons or environment Consequences on service/property
level
— possible minor injury
1 Minor system damage
— no possibility of fatality, severe or
2 Severe system(s) damage
minor injuries only and/or
— minor damage to the environment
— affecting a very small number of
3 Loss of a major system
people and resulting in at least one
fatality, and/or
— large damage to the environment
— affecting a large number of people and
4 Any of the above consequences in presence of
resulting in multiple fatalities, and/or
consequences to persons or environment
— extreme damage to the environment
The rating of safety consequences follows the rating of EN 50126-1:2017 [4], Table C.4 together with Table C.3.

Other consequential aspects that can be considered include:
— Reputational: the level to which the reputational aspects are affected. This can range from
insignificant to severe. At low consequence levels, the reputational effect can include low levels of
complaint, with minimal change in stakeholder confidence, and a short period of impact (e.g. less
than one month). At its worst, this can include international media coverage with a great drop in
stakeholder confidence and a long period of exposure (e.g more than 12 months).
— Financial: the level to which the simulation output could impact the organisation’s finances. At
low level this can include minor fines, and at worst this can include insolvency.
prEN 17833 (E)
The other consequences shall be rated from Level 1 to 4 based on their effect on the organisations using
the simulation, environment, and/or any dependencies.
The overall rating of consequence levels is obtained by identifying the maximum level from the safety
and other consequence levels.
4.3.3 Rating of design
The rating of design covers the novelty and complexity of the system under consideration given the
defined simulation purpose. The criteria for system novelty and complexity are explained below and the
levels are provided in Table 2.
Criteria for system novelty are:
— Low: no or minor incremental change to existing design in well established application areas.
— Medium: moderate change to existing design or implementation of existing technology from other
industrial fields in similar context.
— High: novel technology or major change to existing design.
The degree of change is evaluated through engineering change management and traceability
methodologies.
Criteria for system complexity are:
— Low system complexity: Low number of elements with simple and non-variable interconnections.
— Medium system complexity: Low number of elements with complex or variable interconnections
or a high number of elements with simple and non-variable interconnections.
— High system complexity: High number of elements with complex or variable interconnections
NOTE 1   Elements of the system under consideration are only to be considered as such if their
individual behavior has a significant influence on the simulation result. For example, although a train has
more components than an individual wagon, a simulation of the running speed of an entire train may be
simpler than a multi-body simulation of the dynamic behavior of an individual wagon.
Simulation engineers or organizations shall consider the rating of design.
Standardization working groups may consider the rating of design if known.
NOTE 2   There might be cases when the standard to be established by the working group may be applied on
systems with different design levels. A design might not exist for every case.
NOTE 3   A design may not exist for all cases, e.g. in case of functional or process standards.
Table 2 — Design levels
System Complexity
Design Levels
Low Medium High
System Low 1 2 3
Novelty
Medium 2 2 3
High 3 3 4
4.3.4 Target credibility level
To determine the overall target level for the simulation credibility, consequence levels are cross-
referenced against the design level. The level assigned to the consequences (section 4.3.2) is on the
prEN 17833 (E)
vertical axis, and the level assigned to the design (section 4.3.3) is on the horizontal axis. The number
obtained from Table 3 is the level required for simulation credibility.
Table 3 — Target credibility level
Design Level
Target Credibility Level
Level 1 Level 2 Level 3 Level 4
Level 1 1 1 2 3
Level 2 2 2 3 4
Consequence
Level
Level 3 3 3 4 4
Level 4 4 4 4 4
4.4 Simulation credibility
4.4.1 General
The simulation credibility section considers all aspects of the simulation framework. It aims at
generating evidence that the target credibility level is reached and the simulation purpose is fulfilled.
NOTE  IEEE 1730:2022 [5] and/or ASME V&V 10:2019 [3] can be useful reference documents when
developing a simulation framework.
This document covers six factors which address the following stages:
— Simulation development which is a consideration of the simulation design (4.4.2 and 4.4.3 ).
— Simulation operation which assesses the use of the simulation including inputs and outputs (4.4.4
and 4.4.5 ).
— Simulation management which are organizational activities, not specific to a single project,
supporting simulation development and operation (4.4.6 and 4.4.7 ).
If the requirements of this section and the application-specific simulation requirements are fulfilled, the
simulation purpose is fulfilled and the associated target credibility level (4.3.4) is reached.
If the simulation development is based on domain-specific standard(s), this may result in additional
requirements for the simulation.
4.4.2 Simulation model and tool verification
The overall verification process is separated into two steps:
a) verification of the tool used, and
b) verification of the implementation of the model.
Each component of the simulation tool shall be verified separately and in combination, in order to verify
their inte
...