Simulation earns its place, and the reason is arithmetic. Work published by RAND in 2016 calculated what it would take to demonstrate autonomous safety by driving alone: 275 million failure-free miles to show a failure rate no worse than human, 8.8 billion to estimate the rate within twenty per cent, and 11 billion to show a twenty per cent improvement with statistical confidence. Their conclusion was that developers and third-party testers “cannot drive their way to safety.”
They are right, and their recommended answer is simulation. This essay accepts the statistical argument entirely and disputes a different one.
The argument is about a specific limit, and about what the industry has quietly started to assume in spite of it.
A simulator renders what was specified
Every scenario in a simulator exists because a person wrote it, or because a generative model produced a variation on something a person wrote. The environment, the actors, the physics and the behavioural models all encode somebody’s understanding of how the world works. The field’s own survey literature concedes the shape of the problem: an infinite number of scenarios can theoretically occur in real traffic, and scenario-based testing works by reducing that infinity to a finite, human-authored set.
The international safety standard for this has a name for the residual. Its framework sorts scenarios by whether they are known and whether they are hazardous, and reserves a quadrant for the unknown and hazardous — the situations nobody has thought of. The entire process is defined as shrinking that box. A simulator can only exercise the boxes that have already been filled.
This means a simulator can test coverage against known unknowns with enormous efficiency. It cannot produce an unknown unknown, because producing one would require it to contain information nobody put into it.
You cannot be surprised by a world you built. The most you can be is surprised by an implication of a rule you wrote.
That second thing is real and valuable — emergent behaviour from simple rules genuinely does reveal problems. But it is a different category from the road throwing something at you that no one in the industry had considered, which is where the serious incidents come from.
The specific failures
Four things simulation systematically under-represents, in rough order of how much they matter.
- Human irrationality. Behavioural models in simulators are built around plausible agents. Real road users reverse down slip roads, cross against traffic while looking at a phone, stop dead in live lanes, and wave through a vehicle that has right of way. The tail of human behaviour is far stranger than any model of human behaviour.
- Compound conditions. Simulators test factors and combinations of factors that somebody enumerated. Reality combines low sun, a wet surface, a temporary road layout, a poorly-sited sign and a distracted driver simultaneously and without warning. Compound events are rarer than single factors and reliably more severe.
- The physical world’s untidiness. Faded markings, a bollard that has been hit and never replaced, contradictory temporary signage, a pothole full of water that reads as solid. Simulated environments are built; real ones have decayed for thirty years under budget pressure.
- The unknown outcome. In simulation you know what happened because you defined it. In the world, the value of an event is often that somebody survived it in a way that tells you something — and you only know that because you have the outcome.
The circularity risk
There is a compounding version of this problem that concerns us more than any single limit.
Train a perception model on real data. Use that model to inform the behavioural models in a simulator. Generate training data in the simulator. Train the next perception model partly on that. Repeat.
Each step is defensible. The system as a whole drifts steadily toward internal consistency and away from the world, and nothing in the loop is measuring the gap. It becomes excellent at the world as the pipeline understands it and no better at the world as it is — and the error is invisible from inside, because every validation is also run inside.
The only correction is a periodic collision with reality: held-out real events, with real outcomes, that the pipeline did not generate.
What the pairing looks like
The useful conclusion is not “simulate less.” It is that simulation and measured reality do different jobs and the second is currently under-supplied.
- Simulation for coverage. Exhaustive testing of the situations you know about, at a volume road testing cannot approach.
- Measured reality for discovery. Finding out what is out there that nobody put in the scenario library — and then feeding it back so simulation can cover it too.
- Measured reality for validation. Held-out real events with known outcomes, as the check on whether the whole apparatus still corresponds to anything.
Reality is the source of new scenarios; simulation is the multiplier on them. Run the multiplier without the source and the result converges on a world of your own design.
The correction this essay needs
“Simulation never discovers” is too strong and a knowledgeable reader will catch it. Formal scenario generation has produced test cases that transferred to a real track and exposed genuine defects nobody had catalogued — a published result, and a good one. That looks like discovery, and in a narrow sense it is.
The defensible version is sharper. Simulation finds unknown points inside a specified space. Only reality supplies unknown dimensions. A search can find a parameter combination nobody tried; it cannot invent an axis nobody encoded. Jaywalking was a missing dimension. A body beneath a chassis was a missing dimension. A towed vehicle at the wrong orientation was a missing dimension. None of those is a point a sampler would have reached, however cleverly it searched.
The same paper that demonstrates the transfer also demonstrates the gap: a test case that was safe in simulation produced a near miss on the track, minimum separation 1.94 metres against 5.85 in simulation, with the authors noting that small rendering details could change perception behaviour.
Where the industry agrees with us
The leading autonomy programme published this in late 2025:
There is simply no substitute for this volume of real-world fully autonomous experience — no amount of simulation, manually driven data collection, or operations with a test driver can replicate the spectrum of situations and reactions the Driver encounters when it’s fully in charge.
Its own safety methodology paper is more precise still: any simulation requires validation, so the company relies on road driving to validate its simulator. The novelty budget is imported from reality. That is not our claim about a competitor. It is their claim about themselves.
The question we would put to a programme
Not “how many miles have you simulated.” That number is a function of budget, and the publicly quoted ratio has run at a thousand simulated miles to one real mile for years.
The question is: when did a scenario last enter your library because the world produced it and nobody on your team had thought of it? If the answer is a while ago, the library has stopped growing in the only direction that matters.
What would change our mind
A documented case of a simulator surfacing a genuinely novel dimension — a failure mode whose axis was absent from the scenario schema, discovered in simulation and subsequently confirmed on the road. Points, we accept. Dimensions would falsify the essay.
What we are least sure about
Where the boundary between point and dimension actually sits. It is doing a great deal of work in this argument and it is not crisply defined. A sufficiently expressive scenario language blurs it — if the schema can express “pedestrian at arbitrary position with arbitrary goal,” then jaywalking was a point after all, and the failure was that nobody sampled it. We think the distinction survives, because the schema in that case genuinely lacked the goal. But we would not want to defend the line in every case.