1. Course overview
A Virtual Safety Assessment Dossier (VSAD) is the consolidated, traceable body of evidence that demonstrates a product, system, or process meets its safety requirements when the assessment is performed through simulation, digital modeling, and virtual verification rather than — or in addition to — physical testing. The Audit Evidence Package (AEP) is the subset of that dossier, packaged and indexed for an independent reviewer, assessor, or certification body to examine. The two artifacts are related but not identical: the dossier is the working technical record owned by the engineering organization; the evidence package is the curated, defensible presentation of that record for external scrutiny.
This first chapter establishes why these artifacts exist, what they must contain, how they are structured, and how the course will build them incrementally. It is deliberately conceptual: before writing a single evidence record, you need a clear mental model of the deliverable and the audit logic that will judge it.
Why a Virtual Safety Assessment Dossier Exists
Safety-critical industries — automotive (ISO 26262, ISO 21448/SOTIF), aerospace (DO-178C, ARP4754A), rail (EN 50126/50128), medical devices (IEC 62304), and industrial automation (IEC 61508) — increasingly rely on simulation to demonstrate safety. Virtual assessment offers real advantages: it can exercise scenarios that are dangerous, expensive, or physically impossible to test; it scales across millions of parameter combinations; and it produces machine-readable logs. But it introduces a specific audit risk: a simulation result is only as trustworthy as the model, the scenario, the toolchain, and the analysis behind it.
The dossier exists to close that trust gap. It answers four questions an assessor will inevitably ask:
- What was assessed? — the item, its boundaries, its safety goals, and the operational design domain (ODD).
- How was it assessed? — the models, scenarios, tools, and methods, with their qualification status.
- What was the result? — the outputs, metrics, pass/fail criteria, and residual risk.
- Why should we believe it? — traceability, tool confidence, model validation, and independence of review.
Without a structured dossier, these answers are scattered across tickets, scripts, slide decks, and personal folders. The audit then becomes an archaeology exercise, and the assessment — however technically sound — fails on evidentiary grounds.
Scope: What Belongs in the Dossier
Scope is the most common source of audit findings, because it is easy to leave implicit. A well-scoped dossier defines three boundaries explicitly:
| Boundary | What it defines | Typical evidence |
|---|---|---|
| Item boundary | The system, subsystem, or function under assessment and its interfaces | Item definition, interface control document, context diagram |
| Operational boundary | The ODD, use cases, and environmental conditions covered | ODD specification, scenario catalog, operating conditions |
| Evidentiary boundary | Which claims are supported by virtual evidence and which by physical test or analysis | Verification matrix, method allocation rationale |
Anything outside these boundaries is explicitly excluded, and the exclusion is justified. An assessor who finds an unstated assumption — for example, that sensor degradation was "covered elsewhere" — will treat the entire package as unreliable. Stating exclusions is not weakness; it is evidence of rigor.
Structure: The Dossier Architecture
A practical VSAD is organized as a layered structure, where each layer answers a different audit question and links downward to supporting detail. The following diagram shows the architecture and the direction of traceability.
The key architectural principle is downward traceability: every claim in L1 must resolve, through L2 and L3, to a concrete artifact in L5. An assessor should be able to start at any safety goal and walk down to a log file, or start at any log file and walk up to the claim it supports. If either walk is broken, the dossier has a traceability gap.
The Audit Evidence Package as a Curated Subset
The AEP is not a copy of the dossier. It is a reviewer-oriented projection of it. Three principles govern its construction:
- Claim-indexed navigation. The package is organized around the claims being made, not around the folder structure of the engineering team. Each claim has an entry point that lists its supporting evidence, the method used, and the reviewer's path to verify it.
- Immutability and integrity. Evidence records are frozen at the point of submission, with checksums and timestamps. If a model or log is regenerated, it becomes a new revision with a documented change rationale — never an in-place edit.
- Explicit open items. Known limitations, deviations, and unresolved anomalies are listed, not hidden. An assessor who discovers an undisclosed deviation will discount the entire package; a disclosed one can be evaluated and accepted with justification.
How This Course Is Structured
The course builds the dossier and the evidence package in the order an actual assessment would produce them, but with deliberate revisits. Early chapters establish scope, claims, and the safety argument skeleton. Middle chapters address the method and toolchain layer: model validation, scenario generation, tool qualification, and coverage metrics. Later chapters cover execution records, analysis, review independence, and finally the packaging, indexing, and submission of the AEP. Each chapter produces a concrete artifact — a scope statement, a claim register, a tool qualification record, a coverage report, an evidence index — that accumulates into the final deliverable.
Two conventions apply throughout. First, all examples use a running illustrative case — an automated emergency braking (AEB) function assessed in a simulation environment — with clearly labeled example parameters; these are teaching values, not measured results. Second, every chapter distinguishes between what the standard requires and what good practice looks like, because the gap between the two is where most audit findings occur.
What You Should Be Able to Do After This Chapter
- Explain the difference between the VSAD and the AEP, and why both are needed.
- State the three scope boundaries and give an example of each for a virtual assessment.
- Describe the five-layer dossier architecture and the direction of traceability.
- Identify the three principles that make an evidence package audit-ready.
- Recognize the most common failure mode — unstated scope and undisclosed deviation — and how the structure prevents it.
The remainder of the course turns these concepts into working artifacts. The next step is to define the item and its claims precisely enough that every later layer has something unambiguous to support.