Font Size: 

Software-defined vehicles change their driving functions several times a year, and regulation accepts simulation as safety evidence without saying how its acceptance threshold is derived or how a virtual result stays valid after a software update. This paper treats both as questions of metrology. A calibrated test setup and its digital twin form a Reference Pair: the twin is qualified for a scenario class by an equivalence test on the vehicle’s behaviour, with the measured trajectories of the reference actors replayed in the twin. The equivalence margin must lie between the measurement uncertainty of the reference and the safety tolerance of the function less that uncertainty; their ratio Q is one auditable number, and Q ≥ 2 is required. Three gates, proposed as a hypothesis, let a qualification carry to a new software version without a new physical campaign. The setup requirements and the observations that would refute each rule are stated; no campaign is reported.