prEN 17833

SLOVENSKI STANDARD
01-marec-2026
Železniške naprave - Verodostojnost simulacije
Railway applications - Simulation Credibility
Bahnanwendungen - Vertrauenswürdigkeit von Simulationen
Applications ferroviaires - Fiabilité des simulations
Ta slovenski standard je istoveten z: prEN 17833
ICS:
45.020 Železniška tehnika na Railway engineering in
splošno general
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.

DRAFT
EUROPEAN STANDARD
NORME EUROPÉENNE
EUROPÄISCHE NORM
January 2026
ICS 45.020
English Version
Railway applications - Simulation Credibility
Applications ferroviaires - Fiabilité des simulations Bahnanwendungen - Vertrauenswürdigkeit von
Simulationen
This draft European Standard is submitted to CEN members for enquiry. It has been drawn up by the Technical Committee
CEN/TC 256.
If this draft becomes a European Standard, CEN members are bound to comply with the CEN/CENELEC Internal Regulations
which stipulate the conditions for giving this European Standard the status of a national standard without any alteration.

This draft European Standard was established by CEN in three official versions (English, French, German). A version in any other
language made by translation under the responsibility of a CEN member into its own language and notified to the CEN-CENELEC
Management Centre has the same status as the official versions.

CEN members are the national standards bodies of Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia,
Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Norway,
Poland, Portugal, Republic of North Macedonia, Romania, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Türkiye and
United Kingdom.
Recipients of this draft are invited to submit, with their comments, notification of any relevant patent rights of which they are
aware and to provide supporting documentation.

Warning : This document is not a European Standard. It is distributed for review and comments. It is subject to change without
notice and shall not be referred to as a European Standard.

EUROPEAN COMMITTEE FOR STANDARDIZATION
COMITÉ EUROPÉEN DE NORMALISATION

EUROPÄISCHES KOMITEE FÜR NORMUNG

CEN-CENELEC Management Centre: Rue de la Science 23, B-1040 Brussels
© 2026 CEN All rights of exploitation in any form and by any means reserved Ref. No. prEN 17833:2026 E
worldwide for CEN national Members.

Page
Contents
European foreword . 3
Introduction . 4
1 Scope . 5
2 Normative references . 5
3 Terms and definitions . 5
4 The simulation framework . 8
4.1 General . 8
4.1.1 Overview . 8
4.1.2 Use by standardization working groups . 9
4.1.3 Use by simulation engineers, organizations and their potential subcontractors . 9
4.2 Simulation purpose . 10
4.3 Target credibility . 11
4.3.1 General . 11
4.3.2 Rating of consequences . 11
4.3.3 Rating of design . 12
4.3.4 Target credibility level . 12
4.4 Simulation credibility . 13
4.4.1 General . 13
4.4.2 Simulation model and tool verification . 13
4.4.3 Simulation model and tool validation . 15
4.4.4 Input data . 17
4.4.5 Uncertainty . 18
4.4.6 Organization . 19
4.4.7 Processes . 20
4.5 Credibility assessment . 21
4.6 Documentation . 22
Annex A (informative) Guidance for standardization Working Groups (WG) . 23
Annex B (informative) Examples for managing uncertainties . 24
B.1 General . 24
B.2 Safety factor approach . 24
B.3 Stress-strength approach . 24
B.4 Uncertainty propagation approach . 25
Bibliography. 27

European foreword
This document (prEN 17833:2026) has been prepared by Technical Committee CEN/TC 256 "Railway
applications", the secretariat of which is held by DIN.
This document is currently submitted to the CEN Enquiry.
This document will supersede CEN/TR 17833:2022.
In comparison with the previous edition, the following technical modifications have been made:
— the previous Technical Report is entirely revised into an European Standard;
— the Scope is changed;
— the entire assessment concept has been fundamentally revised;
— all clauses titles, contents, and numbering have been reworked.
This document has been prepared under a mandate given to CEN by the European Commission and the
European Free Trade Association, and supports essential requirements of EU Directive(s).

Introduction
The rationale for producing this document is the return of experience that physical testing on the real
system for train, control-command system and infrastructure certification leads to:
— high costs;
— delays bringing products to market.
There are several ways in which simulations can help improve the system validation phase. They can be
used to better understand certain phenomena, enabling experts to study/explore a wider range of cases
than those practicably covered by physical tests on the real system (which are limited by environment
parameters such as weather, geographical range and configuration, boundary conditions or degraded
modes etc.) and hence complement them. Another possibility is to use simulation in order to reduce the
amount of physical testing on the real system and to reduce delays bringing products to market.
1 Scope
This document sets out a framework to replace and/or complement physical tests with virtual tests by
introducing simulation credibility for a given railway application. This covers simulation development,
use and management.
Users of this document can be:
— simulation engineers or organizations and their subcontractors,
— standardization working groups to introduce simulations in their standards or
— technical assessors and conformity assessment bodies.
This document provides guidance, particularly when simulations are not yet defined. Where applicable,
this document can be used in conjunction with existing standards pertaining to the use of simulations.
If simulation is already recognized in existing domain-specific standards, this document does not modify
the requirements of those standards. However, it may assist in future improvements and harmonization.
It does not provide domain-specific guidance on applying simulations.
For the use of technologies including, but not limited to, artificial intelligence, model-scale testing, and
distributed computing, relevant potential technology based risks can arise.
2 Normative references
There are no normative references in this document.
3 Terms and definitions
For the purposes of this document, the following terms and definitions apply.
ISO and IEC maintain terminological databases for use in standardization at the following addresses:
— IEC Electropedia: available at http://www.electropedia.org/
— ISO Online browsing platform: available at http://www.iso.org/obp
3.1
artefact
tangible or intangible product that is deliberately created or used during the application of this
document
Note 1 to entry: Artefacts may include documents, models, code, data sets, or physical objects, and serve as
evidence of progress, design decisions, or outcomes within this framework.
3.2
configuration management
means to ensure that simulation results are unique and can be reproduced in a controlled manner,
considering the simulation tools, the environment, requirements, design specifications, models, input
data, hardware, software (commercial and/or customized), test parameters, test procedures and any
other contributing system
Note 1 to entry: Time duration for storing configuration depends on the simulation purpose.
3.3
environment
external aspects influencing the behaviour of a system
3.4
error
mistake or inaccuracy which results in a deviation from the intended performance or behaviour
3.5
Hardware-in-the-loop (HiL)
testing methodology where real hardware components are integrated into a simulation environment by
a two-way coupling
3.6
parameter
parameters can be identified by analysis of the system under consideration
Note 1 to entry: A parameter has impact on the simulation results.
3.6.1
key parameter
parameter which has high relevance for an analysis
Note 1 to entry: The parameter has direct significant impact on the simulation results. It can be distinguished to a
parameter that is only slightly connected with the context it is used in. One way to identify key parameters is a
sensitivity analysis.
3.7
limit value
value used as limit for deciding whether the similarity of a simulation compared with the system under
consideration or reference system is sufficient to fulfill the simulation requirements
3.8
model
mathematical and/or physical representation of a system or a process
3.9
numerical model
numerical representation of a mathematical model
3.10
regression testing
testing required to determine that a change to a system (e.g. a model or a tool) has not adversely affected
functionality, reliability or performance and has not introduced additional defects
[SOURCE: ISO/IEC 27034-7:2018 [1], 3.15, modified]
3.11
reference system
system similar to the system under consideration and used for model validation
3.12
simulation
use of a similar or equivalent system to reproduce the behaviour of the system under consideration
3.13
simulation credibility
confidence users have in simulations that they reliably serve the simulation purpose, established
through evidence from simulation development, use, and management
3.14
simulation lifecycle
series of identifiable stages of the simulation, from initiation to completion, including documentation
and archival
3.15
simulation purpose
reflects the use of the simulation in connection with the system under consideration and defines what
the simulation results should show or support
3.16
simulation requirement
user-defined requirements which are targeted towards the application-specific simulation purpose
3.17
simulation tool
framework for developing or embedding models that enable the execution of simulation
3.18
Software-in-the-loop (SiL)
simulation using production software code interfaced by a two-way coupling with simulation
environment
3.19
system under consideration
real world railway system that is subject to simulation
3.20
system validation
process of proving conformity to system requirements, ensuring that the system under consideration is
fit for its intended use in its intended operational environment
3.21
test
technical operation that consists of applying a set of environmental and operating conditions under a
specified procedure to the system under consideration or to the simulation
Note 1 to entry: A test can be carried out to determine one or more characteristics of a given object, process or
service according to a specified procedure. It can be used for different purposes such as verifying requirements,
calibration, test cases and correct implementation of a model.
Note 2 to entry: A test can be conducted on the real system, entirely or partially using simulation.
3.21.1
physical test
experiment on the system under consideration to determine its response under specific conditions
3.21.2
virtual test
experiment on the system under consideration using simulation to determine its response under
specific conditions
3.22
traceability
record of each artefact of a simulation from initiation to completion, enabling organizations to ensure
assessment, compliance, and continuous improvement through comprehensive visibility
Note 1 to entry: Metrological traceability as defined by EN ISO/IEC 17025:2017 [2] is out of scope of this document.
3.23
uncertainty
quantifiable lack of knowledge about the true values and inherent variability of parameters (e.g. model
assumptions, input data, and numerical methods, output data)
3.24
validation
process of determining the degree to which a simulation is an accurate representation
of the system under consideration in its environment
[SOURCE: ASME V&V 10:2019 [3]]
3.25
verification
process of determining that simulation models or simulation tool components produce
expected results
4 The simulation framework
4.1 General
4.1.1 Overview
The framework for the development, use, and management of simulations is organized in five main
parts:
a) simulation purpose (4.2),
b) target credibility (4.3),
c) simulation credibility (4.4),
d) credibility assessment (4.5),
e) documentation (4.6).
The simulation purpose defines how the simulation is intended to be used.
The target credibility determination defines the level of credibility that the simulation should achieve to
be appropriate for its purpose. Target credibility considers the rating of consequences and design of the
system under consideration. Therefore, it is based on factors that are not influenced when developing a
simulation.
The simulation credibility section is used to determine the simulation’s level of credibility. It takes
factors into account that can be influenced when developing and using the simulation, such as
verification of the tool and model.
The credibility assessment consists of comparing the actual simulation credibility level with the target
credibility level.
This document can be used by:
— standardization working groups to introduce simulations in their standards, described in 4.1.2,
— simulation engineers or organizations and their potential subcontractors, described in 4.1.3.
Documentation is the recording of the steps undertaken as part of the simulation process and generation
of outputs at all stages.
4.1.2 Use by standardization working groups
Standardization working groups aim towards the creation or revision of a domain-specific standard.
The technical domain or field of the simulation application is known, but the exact simulation
application or realization of it remains open.
Therefore they shall consider domain-specific requirements when applying this document. First of all,
as shown in Figure 1 , a domain-specific simulation purpose shall be defined in accordance with 4.2.
Based on that, a domain-specific target credibility level shall be derived in accordance with 4.3. Based
on the domain-specific target credibility level, domain-specific simulation requirements shall be defined
in accordance with 4.4.
Finally, a domain-specific assessment report shall ensure that:
— the domain-specific simulation requirements are valid,
— they fulfill the identified domain-specific target credibility level,
— the domain-specific simulation purpose is achieved.

Figure 1 — Application when used by standardization working groups
It is important that only the capabilities required for the simulation tools are specified, rather than
specifying particular third-party software. Usually, the latter is not acceptable in standards, and it limits
the use of different and/or better tools that may be developed in the future.
Annex A gives additional guidance for standardization groups for the use of this document.
4.1.3 Use by simulation engineers, organizations and their potential subcontractors
Simulation engineers, organizations and their potential subcontractors aim towards the creation or
revision of a credible simulation implementation. The exact simulation application and the application-
specific requirements are known.
A simulation purpose, as shown in Figure 2 , is defined in accordance with 4.2. A target credibility level
is derived in accordance with 4.3. Based on the target credibility level, application-specific simulation
requirements are defined in accordance with 4.4.
Finally, a credibility statement presents an argument in accordance with 4.5 to ensure that the following
criteria are met:
— the application-specific simulation requirements are verified;
— the specified target credibility level is reached;
— the specified simulation purpose is met;
— the actual simulation implementation is validated against these artefacts (application-specific
requirements, target credibility level, simulation purpose).

Figure 2 — Application when used by simulation engineers, organizations and their potential
subcontractors
4.2 Simulation purpose
The user of this document shall formulate at least one simulation purpose for each application. The
simulation purpose shall:
— reflect the use of the simulation in connection with the system under consideration;
— define what the simulation results should show or support.
If the simulation purpose is related to or based on a domain-specific standard, this may result in
additional requirements for the simulation.
The definition of the simulation purpose, alongside the target credibility level defined in 4.3.4, allows
specific simulation requirements to be developed. The specific simulation requirements may target
simulation processes, methods, models, and tools. The specific simulation requirements reflect how it
is planned to fulfill the generic requirements of this document especially those set out in Table 4 to Table
9 for the given application or use case.
The specific simulation requirements shall:
— be derived from simulation purpose(s) or other simulation requirements,
— maintain traceability up to the defined simulation purpose(s),
— be verified.
The specific simulation requirements may be organized hierarchically.
4.3 Target credibility
4.3.1 General
The target credibility level represents a risk and consists of two factors: the simulation‘s consequences
and design level.
The simulation’s rating of consequences is set out in 4.3.2.
The simulation’s design level is set out in 4.3.3.
4.3.2 Rating of consequences
The simulation consequence level is defined based on the simulation purpose. The rationale for the
consequence rating shall be documented.
The consequences of applying the simulation results shall be rated, taking into account its potential
effects on the safety and other consequential aspects of the system under consideration.
The consequence levels for this document are set out in Table 1.
Highly rated applications would require any subsequent verification and validation measure to be
accountable to the highest level of scrutiny.
Table 1 — Consequence levels
Consequence Consequences to persons or environment Consequences on service/property
level
— possible minor injury
1 Minor system damage
— no possibility of fatality, severe or
2 Severe system(s) damage
minor injuries only and/or
— minor damage to the environment
— affecting a very small number of
3 Loss of a major system
people and resulting in at least one
fatality, and/or
— large damage to the environment
— affecting a large number of people and
4 Any of the above consequences in presence of
resulting in multiple fatalities, and/or
consequences to persons or environment
— extreme damage to the environment
The rating of safety consequences follows the rating of EN 50126-1:2017 [4], Table C.4 together with Table C.3.

Other consequential aspects that can be considered include:
— Reputational: the level to which the reputational aspects are affected. This can range from
insignificant to severe. At low consequence levels, the reputational effect can include low levels of
complaint, with minimal change in stakeholder confidence, and a short period of impact (e.g. less
than one month). At its worst, this can include international media coverage with a great drop in
stakeholder confidence and a long period of exposure (e.g more than 12 months).
— Financial: the level to which the simulation output could impact the organisation’s finances. At
low level this can include minor fines, and at worst this can include insolvency.
The other consequences shall be rated from Level 1 to 4 based on their effect on the organisations using
the simulation, environment, and/or any dependencies.
The overall rating of consequence levels is obtained by identifying the maximum level from the safety
and other consequence levels.
4.3.3 Rating of design
The rating of design covers the novelty and complexity of the system under consideration given the
defined simulation purpose. The criteria for system novelty and complexity are explained below and the
levels are provided in Table 2.
Criteria for system novelty are:
— Low: no or minor incremental change to existing design in well established application areas.
— Medium: moderate change to existing design or implementation of existing technology from other
industrial fields in similar context.
— High: novel technology or major change to existing design.
The degree of change is evaluated through engineering change management and traceability
methodologies.
Criteria for system complexity are:
— Low system complexity: Low number of elements with simple and non-variable interconnections.
— Medium system complexity: Low number of elements with complex or variable interconnections
or a high number of elements with simple and non-variable interconnections.
— High system complexity: High number of elements with complex or variable interconnections
NOTE 1   Elements of the system under consideration are only to be considered as such if their
individual behavior has a significant influence on the simulation result. For example, although a train has
more components than an individual wagon, a simulation of the running speed of an entire train may be
simpler than a multi-body simulation of the dynamic behavior of an individual wagon.
Simulation engineers or organizations shall consider the rating of design.
Standardization working groups may consider the rating of design if known.
NOTE 2   There might be cases when the standard to be established by the working group may be applied on
systems with different design levels. A design might not exist for every case.
NOTE 3   A design may not exist for all cases, e.g. in case of functional or process standards.
Table 2 — Design levels
System Complexity
Design Levels
Low Medium High
System Low 1 2 3
Novelty
Medium 2 2 3
High 3 3 4
4.3.4 Target credibility level
To determine the overall target level for the simulation credibility, consequence levels are cross-
referenced against the design level. The level assigned to the consequences (section 4.3.2) is on the
vertical axis, and the level assigned to the design (section 4.3.3) is on the horizontal axis. The number
obtained from Table 3 is the level required for simulation credibility.
Table 3 — Target credibility level
Design Level
Target Credibility Level
Level 1 Level 2 Level 3 Level 4
Level 1 1 1 2 3
Level 2 2 2 3 4
Consequence
Level
Level 3 3 3 4 4
Level 4 4 4 4 4
4.4 Simulation credibility
4.4.1 General
The simulation credibility section considers all aspects of the simulation framework. It aims at
generating evidence that the target credibility level is reached and the simulation purpose is fulfilled.
NOTE  IEEE 1730:2022 [5] and/or ASME V&V 10:2019 [3] can be useful reference documents when
developing a simulation framework.
This document covers six factors which address the following stages:
— Simulation development which is a consideration of the simulation design (4.4.2 and 4.4.3 ).
— Simulation operation which assesses the use of the simulation including inputs and outputs (4.4.4
and 4.4.5 ).
— Simulation management which are organizational activities, not specific to a single project,
supporting simulation development and operation (4.4.6 and 4.4.7 ).
If the requirements of this section and the application-specific simulation requirements are fulfilled, the
simulation purpose is fulfilled and the associated target credibility level (4.3.4) is reached.
If the simulation development is based on domain-specific standard(s), this may result in additional
requirements for the simulation.
4.4.2 Simulation model and tool verification
The overall verification process is separated into two steps:
a) verification of the tool used, and
b) verification of the implementation of the model.
Each component of the simulation tool shall be verified separately and in combination, in order to verify
their inte
...