Academia.eduAcademia.edu

Verification validation and accreditation of simulation models

1997, Proceedings of the 29th conference on Winter simulation - WSC '97

This paper discusses verification, validation, and accreditation of simulation models. The different approaches to deciding model validity are presented; how model verification and validation relate to the model development process are discussed; various validation techniques are defined; conceptual model validity, model verification, operational validity, and data validity are described; ways to document results are given; a recommended procedure is presented; and accreditation is briefly discussed.

Proceedings of the 2000 Winter Simulation Conference J. A. Joines, R. R. Barton, K. Kang, and P. A. Fishwick, eds. VERIFICATION, VALIDATION, AND ACCREDITATION OF SIMULATION MODELS Robert G. Sargent Simulation Research Group Department of Electrical Engineering and Computer Science College of Engineering and Computer Science Syracuse University Syracuse, NY 13244, U.S.A. ABSTRACT that purpose. If the purpose of a model is to answer a variety of questions, the validity of the model needs to be determined with respect to each question. Numerous sets of experimental conditions are usually required to define the domain of a model’s intended applicability. A model may be valid for one set of experimental conditions and invalid in another. A model is considered valid for a set of experimental conditions if its accuracy is within its acceptable range, which is the amount of accuracy required for the model’s intended purpose. This usually requires that the model’s output variables of interest (i.e., the model variables used in answering the questions that the model is being developed to answer) be identified and that their required amount of accuracy be specified. The amount of accuracy required should be specified prior to starting the development of the model or very early in the model development process. If the variables of interest are random variables, then properties and functions of the random variables such as means and variances are usually what is of primary interest and are what is used in determining model validity. Several versions of a model are usually developed prior to obtaining a satisfactory valid model. The determination of whether a model is valid or not, i.e., model verification and validation, is usually a process and is part of the total model development process. It is often too costly and time consuming to determine that a model is absolutely valid over the complete domain of its intended applicability. Instead, tests and evaluations are conducted until sufficient confidence is obtained that a model can be considered valid for its intended application (Sargent 1982, 1984 and Shannon 1975). Figure 1 contains the relationships of cost (a similar relationship holds for the amount of time) of performing model validation and the value of a model to the user as a function of model confidence. The cost of model validation is usually quite significant, especially when extremely high model confidence is required. The remainder of this paper is organized as follows: Section 2 discusses the basic approaches used in decid- This paper discusses verification, validation, and accreditation of simulation models. The different approaches to deciding model validity are presented; how model verification and validation relate to the model development process are discussed; various validation techniques are defined; conceptual model validity, model verification, operational validity, and data validity are described; ways to document results are given; a recommended procedure is presented; and accreditation is briefly discussed. 1 INTRODUCTION Simulation models are increasingly being used in problem solving and in decision making. The developers and users of these models, the decision makers using information derived from the results of the models, and people affected by decisions based on such models are all rightly concerned with whether a model and its results are “correct.” This concern is addressed through model verification and validation. Model verification is often defined as “ensuring that the computer program of the computerized model and its implementation are correct,” and is the definition adopted here. Model validation is usually defined to mean “substantiation that a computerized model within its domain of applicability possesses a satisfactory range of accuracy consistent with the intended application of the model” (Schlesinger et al. 1979) and is the definition used here. A model sometimes becomes accredited through model accreditation. Model accreditation determines if a model satisfies a specified model accreditation criteria according to a specified process. A related topic is model credibility. Model credibility is concerned with developing in (potential) users the confidence they require to use a model and the information derived from that model. A model should be developed for a specific purpose (or application) and its validity determined with respect to 50 Sargent Value Cost Cost evaluation is extremely costly and time consuming for what is obtained. This author’s view is that if a third party is to be used, it should be during the model development process. If a model has already been developed, this author believes that a third party should usually only evaluate the verification and validation that has already been performed. The last approach for determining whether a model is valid is to use a scoring model (see, e.g., Balci (1989), Gass (1993), and Gass and Joel (1987)). Scores (or weights) are determined subjectively when conducting various aspects of the validation process and then combined to determine category scores and an overall score for the simulation model. A simulation model is considered valid if its overall and category scores are greater than some passing score(s). This approach is infrequently used in practice. This author does not believe in the use of a scoring model for determining validity because (1) the subjectiveness of this approach tends to be hidden and thus appears to be objective, (2) the passing scores must be decided in some (usually subjective) way, (3) a model may receive a passing score and yet have a defect that needs correction, and (4) the score(s) may cause overconfidence in a model or be used to argue that one model is better than another. We now discuss how model verification and validation relate to the model development process. There are two common ways to view this relationship. One way uses some type of detailed model development process, and the other uses some type of simple model development process. Banks, Gerstein, and Searles (1988) reviewed work using both of these ways and concluded that the simple way more clearly illuminates model validation and verification. This author recommends the use of a simple way (see, e.g., Sargent (1981) and Sargent (1982)), which is presented next. Consider the simplified version of the modeling process in Figure 2. The problem entity is the system (real or proposed), idea, situation, policy, or phenomena to be modeled; the conceptual model is the mathematical/logical/verbal representation (mimic) of the problem entity developed for a particular study; and the computerized model is the conceptual model implemented on a computer. The conceptual model is developed through an analysis and modeling phase, the computerized model is developed through a computer programming and implementation phase, and inferences about the problem entity are obtained by conducting computer experiments on the computerized model in the experimentation phase. We now relate model validation and verification to this simplified version of the modeling process (see Figure 2). Conceptual model validity is defined as determining that the theories and assumptions underlying the conceptual model are correct and that the model representation of the problem entity is “reasonable” for the intended purpose of the model. Computerized model verification is defined as ensuring that Value of Model to User Model Confidence 100% Figure 1: Model Confidence 0% ing model validity; Section 3 defines validation techniques; Sections 4, 5, 6, and 7 contain descriptions of data validity, conceptual model validity, model verification, and operational validity, respectively; Section 8 describes ways of documenting results; Section 9 gives a recommended validation procedure; Section 10 contains a brief description of accreditation; and Section 11 has the summary. 2 VALIDATION PROCESS Three basic approaches are used in deciding whether a simulation model is valid or invalid. Each of the approaches requires the model development team to conduct verification and validation as part of the model development process, which is discussed below. The most common approach is for the development team to make the decision as to whether the model is valid. This is a subjective decision based on the results of the various tests and evaluations conducted as part of the model development process. Another approach, often called “independent verification and validation” (IV&V), uses a third party to decide whether the model is valid. The third party is independent of both the model development team and the model sponsor/user(s). (A third party is also usually used for model accreditation.) There are two common ways that IV&V is conducted. One way is to conduct IV&V concurrently with model development. The other way is to conduct IV&V after the model has been completely developed by the model development team. IV&V is often used when a large cost is associated with the problem the simulation model is being used for and/or to help in model credibility. In the concurrent way of conducting IV&V, the model development team receives input regarding verification and validation from the IV&V team as the model is being developed. Thus, the development of a model should not progress beyond each stage of development if the model is not satisfying the verification and validation requirements. If the IV&V is conducted after the model has been completely developed, the evaluation performed can range from simply evaluating the verification and validation conducted by the model development team to a complete verification and validation effort. Wood (1986) describes experiences over this range of evaluation by a third party on energy models. One conclusion that Wood makes is that a complete IV&V 51 Sargent Comparison to Other Models: Various results (e.g., outputs) of the simulation model being validated are compared to results of other (valid) models. For example, (1) simple cases of a simulation model may be compared to known results of analytic models, and (2) the simulation model may be compared to other simulation models that have been validated. Degenerate Tests: The degeneracy of the model’s behavior is tested by appropriate selection of values of the input and internal parameters. For example, does the average number in the queue of a single server continue to increase with respect to time when the arrival rate is larger than the service rate? Event Validity: The “events” of occurrences of the simulation model are compared to those of the real system to determine if they are similar. An example of events is deaths in a fire department simulation. Extreme Condition Tests: The model structure and output should be plausible for any extreme and unlikely combination of levels of factors in the system; e.g., if inprocess inventories are zero, production output should be zero. Face Validity: “Face validity” is asking people knowledgeable about the system whether the model and/or its behavior are reasonable. This technique can be used in determining if the logic in the conceptual model is correct and if a model’s input-output relationships are reasonable. Fixed Values: Fixed values (e.g., constants) are used for various model input and internal variables and parameters. This should allow the checking of model results against (easily) calculated values. Historical Data Validation: If historical data exist (or if data are collected on a system for building or testing the model), part of the data is used to build the model and the remaining data are used to determine (test) whether the model behaves as the system does. (This testing is conducted by driving the simulation model with either samples from distributions or traces (Balci and Sargent 1982a, 1982b, 1984b).) Historical Methods: The three historical methods of validation are rationalism, empiricism, and positive economics. Rationalism assumes that everyone knows whether the underlying assumptions of a model are true. Logic deductions are used from these assumptions to develop the correct (valid) model. Empiricism requires every assumption and outcome to be empirically validated. Positive economics requires only that the model be able to predict the future and is not concerned with a model’s assumptions or structure (causal relationships or mechanism). Internal Validity: Several replications (runs) of a stochastic model are made to determine the amount of (internal) stochastic variability in the model. A high amount of variability (lack of consistency) may cause the model’s results to be questionable and, if typical of the problem Problem Entity Conceptual Model Validity Analysis and Modeling Operational Validity Experimentation Data Validity Computerized Model Computer Programming and Implementation Conceptual Model Computerized Model Verification Figure 2: Simplified Version of the Modeling Process the computer programming and implementation of the conceptual model is correct. Operational validity is defined as determining that the model’s output behavior has sufficient accuracy for the model’s intended purpose over the domain of the model’s intended applicability. Data validity is defined as ensuring that the data necessary for model building, model evaluation and testing, and conducting the model experiments to solve the problem are adequate and correct. Several versions of a model are usually developed in the modeling process prior to obtaining a satisfactory valid model. During each model iteration, model validation and verification are performed (Sargent 1984). A variety of (validation) techniques are used, which are described below. No algorithm or procedure exists to select which techniques to use. Some attributes that affect which techniques to use are discussed in Sargent (1984). 3 VALIDATION TECHNIQUES This section describes various validation techniques (and tests) used in model verification and validation. Most of the techniques described here are found in the literature, although some may be described slightly differently. They can be used either subjectively or objectively. By “objectively,” we mean using some type of statistical test or mathematical procedure, e.g., hypothesis tests and confidence intervals. A combination of techniques is generally used. These techniques are used for validating and verifying the submodels and overall model. Animation: The model’s operational behavior is displayed graphically as the model moves through time. For example, the movements of parts through a factory during a simulation are shown graphically. 52 Sargent To build a conceptual model we must have sufficient data on the problem entity to develop theories that can be used to build the model, to develop the mathematical and logical relationships in the model that will allow it to adequately represent the problem entity for its intended purpose, and to test the model’s underlying assumptions. In addition, behavioral data are needed on the problem entity to be used in the operational validity step of comparing the problem entity’s behavior with the model’s behavior. (Usually, this data are system input/output data.) If behavior data are not available, high model confidence usually cannot be obtained, because sufficient operational validity cannot be achieved. The concern with data is that appropriate, accurate, and sufficient data are available, and if any data transformations are made, such as disaggregation, they are correctly performed. Unfortunately, there is not much that can be done to ensure that the data are correct. The best that can be done is to develop good procedures for collecting and maintaining data, test the collected data using techniques such as internal consistency checks, and screen for outliers and determine if they are correct. If the amount of data is large, a data base should be developed and maintained. entity, may question the appropriateness of the policy or system being investigated. Multistage Validation: Naylor and Finger (1967) proposed combining the three historical methods of rationalism, empiricism, and positive economics into a multistage process of validation. This validation method consists of (1) developing the model’s assumptions on theory, observations, general knowledge, and function, (2) validating the model’s assumptions where possible by empirically testing them, and (3) comparing (testing) the input-output relationships of the model to the real system. Operational Graphics: Values of various performance measures, e.g., number in queue and percentage of servers busy, are shown graphically as the model moves through time; i.e., the dynamic behaviors of performance indicators are visually displayed as the simulation model moves through time. Parameter Variability–Sensitivity Analysis: This technique consists of changing the values of the input and internal parameters of a model to determine the effect upon the model’s behavior and its output. The same relationships should occur in the model as in the real system. Those parameters that are sensitive, i.e., cause significant changes in the model’s behavior or output, should be made sufficiently accurate prior to using the model. (This may require iterations in model development.) Predictive Validation: The model is used to predict (forecast) the system behavior, and then comparisons are made between the system’s behavior and the model’s forecast to determine if they are the same. The system data may come from an operational system or from experiments performed on the system. e.g., field tests. Traces: The behaviors of different types of specific entities in the model are traced (followed) through the model to determine if the model’s logic is correct and if the necessary accuracy is obtained. Turing Tests: People who are knowledgeable about the operations of a system are asked if they can discriminate between system and model outputs. (Schruben (1980) contains statistical tests for use with Turing tests.) 4 5 CONCEPTUAL MODEL VALIDATION Conceptual model validity is determining that (1) the theories and assumptions underlying the conceptual model are correct, and (2) the model representation of the problem entity and the model’s structure, logic, and mathematical and causal relationships are “reasonable” for the intended purpose of the model. The theories and assumptions underlying the model should be tested using mathematical analysis and statistical methods on problem entity data. Examples of theories and assumptions are linearity, independence, stationary, and Poisson arrivals. Examples of applicable statistical methods are fitting distributions to data, estimating parameter values from the data, and plotting the data to determine if they are stationary. In addition, all theories used should be reviewed to ensure they were applied correctly; for example, if a Markov chain is used, does the system have the Markov property, and are the states and transition probabilities correct? Next, each submodel and the overall model must be evaluated to determine if they are reasonable and correct for the intended purpose of the model. This should include determining if the appropriate detail and aggregate relationships have been used for the model’s intended purpose, and if the appropriate structure, logic, and mathematical and causal relationships have been used. The primary validation techniques used for these evaluations are face validation and traces. Face validation has experts on the problem entity evaluate the conceptual model to determine if it is correct and reasonable for its purpose. This usually requires examining DATA VALIDITY Even though data validity is often not considered to be part of model validation, we discuss it because it is usually difficult, time consuming, and costly to obtain sufficient, accurate, and appropriate data, and is frequently the reason that attempts to validate a model fail. Data are needed for three purposes: for building the conceptual model, for validating the model, and for performing experiments with the validated model. In model validation we are concerned only with the first two types of data. 53 Sargent the flowchart or graphical model, or the set of model equations. The use of traces is the tracking of entities through each submodel and the overall model to determine if the logic is correct and if the necessary accuracy is maintained. If errors are found in the conceptual model, it must be revised and conceptual model validation performed again. 6 results are obtained. If there are a large number of variables, one might aggregate some of the variables to reduce the number of tests needed or use certain types of design of experiments (Kleijnen 1987). It is necessary to be aware while checking the correctness of the computer program and its implementation that errors may be caused by the data, the conceptual model, the computer program, or the computer implementation. For a detailed discussion on model verification, see Whitner and Balci (1989). MODEL VERIFICATION Computerized model verification ensures that the computer programming and implementation of the conceptual model are correct. The major factor affecting verification is whether a simulation language or a higher level programming language such as FORTRAN, C, or C++ is used. The use of a special-purpose simulation language generally will result in having fewer errors than if a general-purpose simulation language is used, and using a general purpose simulation language will generally result in having fewer errors than if a general purpose higher level language is used. (The use of a simulation language also usually reduces the programming time required and the flexibility.) When a simulation language is used, verification is primarily concerned with ensuring that an error free simulation language has been used, that the simulation language has been properly implemented on the computer, that a tested (for correctness) pseudo random number generator has been properly implemented, and that the model has been programmed correctly in the simulation language. The primary techniques used to determine that the model has been programmed correctly are structured walk-throughs and traces. If a higher level language has been used, then the computer program should have been designed, developed, and implemented using techniques found in software engineering. (These include such techniques as object-oriented design, structured programming, and program modularity.) In this case verification is primarily concerned with determining that the simulation functions (such as the time-flow mechanism, pseudo random number generator, and random variate generators) and the computer model have been programmed and implemented correctly. There are two basic approaches for testing simulation software: static testing and dynamic testing (Fairley 1976). In static testing the computer program is analyzed to determine if it is correct by using such techniques as structured walk-throughs, correctness proofs, and examining the structure properties of the program. In dynamic testing the computer program is executed under different conditions and the values obtained (including those generated during the execution) are used to determine if the computer program and its implementations are correct. The techniques commonly used in dynamic testing are traces, investigations of input-output relations using different validation techniques, internal consistency checks, and reprogramming critical components to determine if the same 7 OPERATIONAL VALIDITY Operational validity is concerned with determining that the model’s output behavior has the accuracy required for the model’s intended purpose over the domain of its intended applicability. This is where most of the validation testing and evaluation takes place. The computerized model is used in operational validity, and thus any deficiencies found may be due to an inadequate conceptual model, an improperly programmed or implemented conceptual model (e.g., due to programming errors or insufficient numerical accuracy), or due to invalid data. All of the validation techniques discussed in Section 3 are applicable to operational validity. Which techniques and whether to use them objectively or subjectively must be decided by the model development team and other interested parties. The major attribute affecting operational validity is whether the problem entity (or system) is observable, where observable means it is possible to collect data on the operational behavior of the program entity. Table 1 gives a classification of the validation approaches for operational validity. “Comparison” means comparing/testing the model and system input-out behaviors, and “explore model behavior” means to examine the output behavior of the model using appropriate validation techniques and usually includes parameter variability-sensitivity analysis. Various sets of experimental conditions from the domain of the model’s intended applicability should be used for both comparison and exploring model behavior. Table 1: Operational Validity Classification OBSERVABLE SYSTEM SUBJECTIVE APPROACH • COMPARISON USING GRAPHICAL DISPLAYS • EXPLORE MODEL BEHAVIOR OBJECTIVE APPROACH • COMPARISON USING STATISTICAL TESTS AND PROCEDURES NON-OBSERVABLE SYSTEM • EXPLORE MODEL BEHAVIOR • COMPARISON TO OTHER MODELS • COMPARISON TO OTHER MODELS USING STATISTICAL TESTS AND PROCEDURES To obtain a high degree of confidence in a model and its results, comparisons of the model’s and system’s input- 54 Sargent output behaviors for several different sets of experimental conditions are usually required. There are three basic comparison approaches used: (1) graphs of the model and system behavior data, (2) confidence intervals, and (3) hypothesis tests. Graphs are the most commonly used approach, and confidence intervals are next. 7.1 Graphical Comparison of Data The behavior data of the model and the system are graphed for various sets of experimental conditions to determine if the model’s output behavior has sufficient accuracy for its intended purpose. Three types of graphs are used: histograms, box (and whisker) plots, and behavior graphs using scatter plots. (See Sargent (1996a) for a thorough discussion on the use of these for model validation.) An example of a box plot is given in Figure 3, and examples of behavior graphs are shown in Figures 4 and 5. A variety of graphs using different types of (1) measures such as the mean, variance, maximum, distribution, and time series of a variable, and (2) relationships between (a) two measures of a single variable (see Figure 4) and (b) measures of two variables (see Figure 5) are required. It is important that appropriate measures and relationships be used in validating a model and that they be determined with respect to the model’s intended purpose. See Anderson and Sargent (1974) for an example of a set of graphs used in the validation of a simulation model. 120 System Figure 4: Reaction Time Model 100 80 60 40 Figure 3: Box Plot These graphs can be used in model validation in different ways. First, the model development team can use the graphs in the model development process to make a subjective judgment on whether a model possesses sufficient accuracy for its intended purpose. Second, they can be used in the face validity technique where experts are asked to make subjective judgments on whether a model possesses sufficient accuracy for its intended purpose. Third, the graphs can be used is in Turing tests. Another way they can be used is in IV&V. We note that independence of data is not required (as is required for most formal statistical approaches) in the use of these graphs. See Sargent (1996a) for details. Figure 5: Disk Access 7.2 Confidence Intervals Confidence intervals (c.i.), simultaneous confidence intervals (s.c.i.), and joint confidence regions (j.c.r.) can be obtained for the differences between the means, variances, 55 Sargent H1 : and distributions of different model and system output variables for each set of experimental conditions. These c.i., s.c.i., and j.c.r. can be used as the model range of accuracy for model validation. To construct the model range of accuracy, a statistical procedure containing a statistical technique and a method of data collection must be developed for each set of experimental conditions and for each variable of interest. The statistical techniques used can be divided into two groups: (1) univariate statistical techniques and (2) multivariate statistical techniques. The univariate techniques can be used to develop c.i., and with the use of the Bonferroni inequality (Law and Kelton 1991), s.c.i. The multivariate techniques can be used to develop s.c.i. and j.c.r. Both parametric and nonparametric techniques can be used. The method of data collection must satisfy the underlying assumptions of the statistical technique being used. The standard statistical techniques and data collection methods used in simulation output analysis (Banks, Carson, and Nelson 1996, Law and Kelton 1991) can be used for developing the model range of accuracy, e.g., the methods of replication and (nonoverlapping) batch means. It is usually desirable to construct the model range of accuracy with the lengths of the c.i. and s.c.i. and the sizes of the j.c.r. as small as possible. The shorter the lengths or the smaller the sizes, the more useful and meaningful the model range of accuracy will usually be. The lengths and the sizes (1) are affected by the values of confidence levels, variances of the model and system output variables, and sample sizes, and (2) can be made smaller by decreasing the confidence levels or increasing the sample sizes. A tradeoff needs to be made among the sample sizes, confidence levels, and estimates of the length or sizes of the model range of accuracy, i.e., c.i., s.c.i., or j.c.r. Tradeoff curves can be constructed to aid in the tradeoff analysis. Details on the use of c.i., s.c.i., and j.c.r. for operational validity, including a general methodology, are contained in Balci and Sargent (1984b). A brief discussion on the use of c.i. for model validation is also contained in Law and Kelton (1991). Model is invalid for the acceptable range of accuracy under the set of experimental conditions. Two types of errors are possible in testing hypotheses. The first, or type I error, is rejecting the validity of a valid model and the second, or type II error, is accepting the validity of an invalid model. The probability of a type error I, α, is called model builder’s risk, and the probability of the type II error, β, is called model user’s risk (Balci and Sargent 1981). In model validation, the model user’s risk is extremely important and must be kept small. Thus both type I and type II errors must be carefully considered when using hypothesis testing for model validation. The amount of agreement between a model and a system can be measured by a validity measure, λ, which is chosen such that the model accuracy or the amount of agreement between the model and the system decreases as the value of the validity measure increases. The acceptable range of accuracy can be used to determine an acceptable validity range, 0 ≤ λ ≤ λ∗ . The probability of acceptance of a model being valid, Pa , can be examined as a function of the validity measure by using an Operating Characteristic Curve (Johnson 1994). Figure 6 contains three different operating characteristic curves to illustrate how the sample size of observations affect Pa as a function of λ. As can be seen, an inaccurate model has a high probability of being accepted if a small sample size of observations is used, and an accurate model has a low probability of being accepted if a large sample size of observations is used. 7.3 Hypothesis Tests Figure 6: Operating Characteristic Curves Hypothesis tests can be used in the comparison of means, variances, distributions, and time series of the output variables of a model and a system for each set of experimental conditions to determine if the model’s output behavior has an acceptable range of accuracy. An acceptable range of accuracy is the amount of accuracy that is required of a model to be valid for its intended purpose. The first step in hypothesis testing is to state the hypotheses to be tested: H0 : The location and shape of the operating characteristic curves are a function of the statistical technique being used, the value of α chosen for λ = 0, i.e., α ∗ , and the sample size of observations. Once the operating characteristic curves are constructed, the intervals for the model user’s risk β(λ) and the model builders risk α can be determined for a given λ∗ as follows: α ∗ ≤ model builder’s risk α ≤ (1 − β ∗ ) 0 ≤ model user’s risk β(λ) ≤ β ∗ . Model is valid for the acceptable range of accuracy under the set of experimental conditions. 56 Sargent Thus there is a direct relationship among the builder’s risk, model user’s risk, acceptable validity range, and the sample size of observations. A tradeoff among these must be made in using hypothesis tests in model validation. Details of the methodology for using hypothesis tests in comparing the model’s and system’s output data for model validations are given in Balci and Sargent (1981). Examples of the application of this methodology in the testing of output means for model validation are given in Balci and Sargent (1982a, 1982b, 1983). Also, see Banks et al. (1996). 8 6. 7. 8. In at least the last model iteration, make comparisons, if possible, between the model and system behavior (output) data for several sets of experimental conditions. Develop validation documentation for inclusion in the simulation model documentation. If the model is to be used over a period of time, develop a schedule for periodic review of the model’s validity. Models occasionally are developed to be used more than once. A procedure for reviewing the validity of these models over their life cycles needs to be developed, as specified by step 8. No general procedure can be given, as each situation is different. For example, if no data were available on the system when a model was initially developed and validated, then revalidation of the model should take place prior to each usage of the model if new data or system understanding has occurred since its last validation. DOCUMENTATION Documentation on model verification and validation is usually critical in convincing users of the “correctness” of a model and its results, and should be included in the simulation model documentation. (For a general discussion on documentation of computer-based models, see Gass (1984).) Both detailed and summary documentation are desired. The detailed documentation should include specifics on the tests, evaluations made, data, results, etc. The summary documentation should contain a separate evaluation table for data validity, conceptual model validity, computer model verification, operational validity, and an overall summary. See Table 2 for an example of an evaluation table of conceptual model validity. (See Sargent (1994, 1996b) for examples of two of the other evaluation tables.) The columns of the table are self-explanatory except for the last column, which refers to the confidence the evaluators have in the results or conclusions, and this is often expressed as low, medium, or high. The DoD has moved to accrediting simulation models. They define accreditation in DoDD 5000.59 as “the official certification that a model or simulation is acceptable for use for a specific application.” The evaluation for accreditation is usually conducted by a third (independent) party, is subjective, and often includes not only verification and validation but items such as documentation and how user friendly the simulation is. The acronym VV&A is used for Verification, Validation, and Accreditation. 9 11 SUMMARY 10 ACCREDITATION RECOMMENDED PROCEDURE Model verification and validation are critical in the development of a simulation model. Unfortunately, there is no set of specific tests that can easily be applied to determine the “correctness” of the model. Furthermore, no algorithm exists to determine what techniques or procedures to use. Every new simulation project presents a new and unique challenge. There is considerable literature on verification and validation. Articles given in the limited bibliography can be used as a starting point for furthering your knowledge on model verification and validation. For a fairly recent bibliography, see the following UHL on the web: <http://manta.cs.vt.edu/biblio/>. This author recommends that, as a minimum, the following steps be performed in model validation: 1. 2. 3. 4. 5. Have an agreement made prior to developing the model between (a) the model development team and (b) the model sponsors and (if possible) the users, specifying the basic validation approach and a minimum set of specific validation techniques to be used in the validation process. Specify the amount of accuracy required of the model’s output variables of interest for the model’s intended application prior to starting the development of the model or very early in the model development process. Test, wherever possible, the assumptions and theories underlying the model. In each model iteration, perform at least face validity on the conceptual model. In each model iteration, at least explore the model’s behavior using the computerized model. REFERENCES Anderson, H. A. and R. G. Sargent. 1974. An investigation into scheduling for an interactive computer system, IBM Journal of Research and Development, 18 (2):125–137. 57 Sargent Table 2: Evaluation Table for Conceptual Model Validity Category/Item • Theories • Assumptions • Model representation Technique(s) Used • Face validity • Historical • Accepted approach • Derived from empirical data • Theoretical derivation Justification for Technique Used Reference to Supporting Report Result/ Conclusion Confidence In Result Strengths Weaknesses Overall evaluation for Computer Model Verification Overall Conclusion Justification for Conclusion Confidence In Conclusion Fairley, R. E. 1976. Dynamic testing of simulation software, Proc. of the 1976 Summer Computer Simulation Conf., Washington, D.C., 40–46. Gass, S. I. 1983. Decision-aiding models: Validation, assessment, and related issues for policy analysis, Operations Research, 31(4):601–663. Gass, S. I. 1984. Documenting a computer-based model, Interfaces, 14(3):84–93. Gass, S. I. 1993. Model accreditation: A rationale and process for determining a numerical rating, European Journal of Operational Research, 66(2):250–258. Gass, S. I. and L. Joel. 1987. Concepts of model confidence, Computers and Operations Research, 8, 4, pp. 341–346. Gass, S. I. and B. W. Thompson. 1980. Guidelines for model evaluation: An abridged version of the U.S. general accounting office exposure draft, Operations Research, 28(2):431–479. Johnson, R. A. 1994. Miller and Freund’s probability and statistics for engineers, 5th edition, Prentice-Hall, Englewood Cliffs, N.J. Kleijnen, J. P. C. 1987. Statistical tools for simulation practitioners, Marcel Dekker, New York. Kleijnen, J. P. C. 1999. Validation of models: Statistical techniques and data availability, Proc. of 1999 Winter Simulation Conf., 647–654. Kleindorfer, G. B. and R. Ganeshan. 1993. The philosophy of science and validation in simulation, Proc. of 1993 Winter Simulation Conf., 50–57. Knepell, P. L. and D. C. Arangno. 1993. Simulation validation: A confidence assessment methodology, IEEE Computer Society Press. Law, A. M. and W. D. Kelton. 1991. Simulation modeling and analysis, 2nd Ed., McGraw-Hill. Naylor, T. H. and J. M. Finger. 1967. Verification of computer simulation models, Management Science, 14(2):B92–B101. Balci, O. 1989. How to assess the acceptability and credibility of simulation results, Proc. of the 1989 Winter Simulation Conf., 62–71. Balci, O. 1998. Validation, verification, and accreditation, Proc. of the 1998 Winter Simulation Conf., 41–48. Balci, O. and R. G. Sargent. 1981. A methodology for costrisk analysis in the statistical validation of simulation models, Comm. of the ACM, 24(4):190–197. Balci, O. and R. G. Sargent. 1982a. Validation of multivariate response simulation models by using hotelling’s two-sample T 2 test, Simulation, 39(6):185–192. Balci, O. and R. G. Sargent. 1982b. Some examples of simulation model validation using hypothesis testing, Proc. of the 1982 Winter Simulation Conf.,620–629. Balci, O. and R. G. Sargent. 1983. Validation of multivariate response trace-driven simulation models, Performance 83, ed. Agrawada and Tripathi, North Holland, 309– 323. Balci, O. and R. G. Sargent. 1984a. A bibliography on the credibility assessment and validation of simulation and mathematical models, Simuletter, 15(3):15–27. Balci, O. and R. G. Sargent. 1984b. Validation of simulation models via simultaneous confidence intervals, American Journal of Mathematical and Management Science, 4(3):375–406. Banks, J., J. S. Carson II, and B. L. Nelson. 1996. Discreteevent system simulation, 2nd Ed., Prentice-Hall, Englewood Cliffs, N.J. Banks, J., D. Gerstein, and S. P. Searles. 1988. Modeling processes, validation, and verification of complex simulations: A survey, Methodology and Validation, Simulation Series, Vol. 19, No. 1, The Society for Computer Simulation, 13–18. DOD simulations: Improved assessment procedures would increase the credibility of results. 1987. U. S. General Accounting Office, PEMD-88-3. 58 Sargent Oren, T. 1981. Concepts and criteria to assess acceptability of simulation studies: A frame of reference, Comm. of the ACM, 24(4):180–189. Rao, M. J. and R. G. Sargent. 1988. An advisory system for operational validity, Artificial Intelligence and Simulation: The Diversity of Applications, ed. T. Hensen, Society for Computer Simulation, San Diego, CA, 245– 2250. Sargent, R. G. 1979. Validation of simulation models, Proc. of the 1979 Winter Simulation Conf., San Diego, CA,497–503. Sargent, R. G. 1981. An assessment procedure and a set of criteria for use in the evaluation of computerized models and computer-based modeling tools, Final Technical Report RADC-TR-80-409. Sargent, R. G. 1982. Verification and validation of simulation models, Chapter IX in Progress in Modelling and Simulation, ed. F. E. Cellier, Academic Press, London,159–169. Sargent, R. G. 1984. Simulation model validation, Simulation and Model-Based Methodologies: An Integrative View, ed. Oren, et al., Springer-Verlag. Sargent, R. G. 1985. An expository on verification and validation of simulation models, Proc. of the 1985 Winter Simulation Conf., 15-22. Sargent, R. G. 1986. The use of graphic models in model validation, Proc. of the 1986 Winter Simulation Conf., Washington, D.C., 237–241. Sargent, R. G. 1988. A tutorial on validation and verification of simulation models, Proc. of 1988 Winter Simulation Conf., 33–39. Sargent, R. G. 1990. Validation of mathematical models, Proc. of Geoval-90: Symposium on Validation of Geosphere Flow and Transport Models, Stockholm, Sweden, pp. 571–579. Sargent, R. G. 1991. Simulation Model Verification and Validation, Proc. of 1991 Winter Simulation Conf., Phoenix, AZ, 37–47. Sargent, R. G. 1994. Verification and validation of simulation models, Proc. of 1994 Winter Simulation Conf., Lake Buena Vista, FL, 77–87. Sargent, R. G. 1996a. Some subjective validation methods using graphical displays of data, Proc. of 1996 Winter Simulation Conf., 345–351. Sargent, R. G. 1996b. Verifying and validating simulation models, Proc. of 1996 Winter Simulation Conf., 55–64. Sargent, R. G. 1999. Validation and verification of simulation models, Proc. of 1999 Winter Simulation Conf., 39–48. Schlesinger, et al. 1979. Terminology for model credibility, Simulation, 32(3):103–104. Schruben, L. W. 1980. Establishing the credibility of simulations, Simulation, 34(3):101–105. Shannon, R. E. 1975. Systems simulation: The art and the science, Prentice-Hall. Whitner, R. B. and O. Balci. 1989. Guidelines for selecting and using simulation model verification techniques, Proc. of 1989 Winter Simulation Conf., Washington, D.C., 559–568. Wood, D. O. 1986. MIT model analysis program: What we have learned about policy model review, Proc. of the 1986 Winter Simulation Conf., Washington, D.C., 248–252. Zeigler, B. P. 1976. Theory of Modelling and Simulation, John Wiley and Sons, Inc., New York. AUTHOR BIOGRAPHY ROBERT G. SARGENT is a Research Professor and Professor Emeritus at Syracuse University. He received his education at The University of Michigan. Dr. Sargent has served his profession in numerous ways and has been awarded the TIMS (now INFORMS) College on Simulation Distinguished Service Award for longstanding exceptional service to the simulation community. His current research interests include the methodology areas of both modeling and discrete event simulation, model validation, and performance evaluation. Professor Sargent has published extensively and is listed in Who’s Who in America. His email and web addresses are <[email protected]> and <www.cis.syr.edu/srg/ rsargent/>. 59