Auditable Simulation Evidence for Reliability and Safety Assessment: Provenance of Multi-Level Simulation Runs

Multi-level simulation (MLS) executes one scenario on models of different abstraction levels and switches between them at runtime. Switches are triggered by policies and admitted or rejected by validation gates, and each carries the behavioral state across simulator boundaries. Whether a result segment can serve as evidence in a reliability or safety assessment therefore also depends on a decision and validation history that conventional outputs do not record. A rejected or aborted switch leaves no trace in the result files, and a commit on a level whose validity check failed leaves at most a flag. We map a compact, simulator-independent run-time model of MLS switching, including declared gate failure semantics, onto the W3C PROV data model and implement a deterministic PROV-JSON exporter with four audit queries that supply the switching-related part of the records required by the simulation-credibility standard NASA-STD-7009B, among them "why did segment $X$ run at level $L$?" and "which results depend on degraded segments?". On 51 runs of a deterministic MLS harness, the answers computed from the exported documents alone agree with the harness's event log for all 8,537 switched segments and all 64 rejected, aborted, or degraded switches. ... mehrEvery document parses and re-serializes with standard PROV tooling. Graphs grow linearly with the number of switches, and answering each query once takes under a millisecond for typical runs.