{"id":2954,"date":"2026-10-31T23:08:19","date_gmt":"2026-10-31T23:08:19","guid":{"rendered":"https:\/\/raynovtechnology.com\/hil-vs-sil-vs-mil-ecu-test-levels\/"},"modified":"2026-11-01T10:29:45","modified_gmt":"2026-11-01T10:29:45","slug":"hil-vs-sil-vs-mil-ecu-test-levels","status":"publish","type":"post","link":"https:\/\/raynovtechnology.com\/fr\/hil-vs-sil-vs-mil-ecu-test-levels\/","title":{"rendered":"HIL, SIL ou MIL : choisir le bon niveau de test pour un projet calculateur"},"content":{"rendered":"<p>Three weeks before a sample delivery, the integration team plugs the first ECU into the HIL bench and the torque request oscillates at 8 Hz. The model-in-the-loop runs were clean. The software-in-the-loop runs were clean. The cause turns out to be a 2 ms difference between the sampling period the model assumed and the one the scheduler actually delivers on the target, plus a first-order filter on the sensor input that nobody had modelled. Nothing was &#8220;wrong&#8221; at any single level. The mistake was expecting one level to find a defect that only another level can see.<\/p>\n<p>That is the real question behind &#8220;HIL vs SIL vs MIL&#8221;. These are not competing options to pick from; they are filters with different meshes. The engineering decision is which defect you want to catch where, and at what cost per test.<\/p>\n<h2>1. The four levels, defined by what is real<\/h2>\n<p>The cleanest way to separate the levels is to ask, for each one, which parts of the system are real and which are simulated.<\/p>\n<ul>\n<li><strong>MIL (model-in-the-loop):<\/strong> the controller is a model, the plant is a model. Both run in the same simulation tool, usually on a desktop, often in non-real time. You are testing the <em>algorithm<\/em>.<\/li>\n<li><strong>SIL (software-in-the-loop):<\/strong> the controller is now the <em>generated or hand-written production code<\/em>, compiled for the PC, still connected to the plant model. You are testing the <em>code<\/em> against the algorithm: data types, fixed-point scaling, saturation, initialisation, state machines.<\/li>\n<li><strong>PIL (processor-in-the-loop):<\/strong> the same code is compiled with the target compiler and runs on the target processor (or an evaluation board), still exchanging data with the plant model through a debug or communication link. You are testing <em>compiler and processor effects<\/em>: execution time, stack use, numeric behaviour of the target.<\/li>\n<li><strong>HIL (hardware-in-the-loop):<\/strong> the real ECU, with its real hardware and near-production software, is connected through real electrical interfaces to a plant model running on a <strong>real-time target<\/strong>. You are testing the <em>ECU as a product<\/em>: inputs, outputs, drivers, diagnostics, timing, power behaviour, communication.<\/li>\n<\/ul>\n<p>PIL is often skipped in conversations, but it answers a question neither SIL nor HIL answer cheaply: does the code fit, in time and memory, on the chip that will ship?<\/p>\n<h3>1.1 Principle diagram (described)<\/h3>\n<p>Picture four boxes in a row, left to right, each one replacing a simulated block with a real one:<\/p>\n<ol>\n<li>MIL: [controller model] \u21c4 [plant model], both inside one simulation, connected by signals with no physical meaning.<\/li>\n<li>SIL: [compiled C code on PC] \u21c4 [plant model], connected through a software wrapper.<\/li>\n<li>PIL: [code on target CPU] \u21c4 serial\/debug link \u21c4 [plant model on PC].<\/li>\n<li>HIL: [real ECU] \u21c4 harness \u21c4 breakout and fault injection \u21c4 signal conditioning \u21c4 I\/O boards \u21c4 [plant model on real-time target], with a host PC for automation and logging.<\/li>\n<\/ol>\n<p>Each step to the right adds realism, cost per test and set-up time. Each step to the left adds speed, repeatability and coverage per hour.<\/p>\n<h2>2. What each level can and cannot find<\/h2>\n<table>\n<thead>\n<tr>\n<th>Defect type<\/th>\n<th>MIL<\/th>\n<th>SIL<\/th>\n<th>PIL<\/th>\n<th>HIL<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Wrong control law, wrong requirement interpretation<\/td>\n<td>Yes<\/td>\n<td>Yes<\/td>\n<td>Yes<\/td>\n<td>Yes, but expensive<\/td>\n<\/tr>\n<tr>\n<td>Fixed-point overflow, scaling, data-type errors<\/td>\n<td>No<\/td>\n<td>Yes<\/td>\n<td>Yes<\/td>\n<td>Yes<\/td>\n<\/tr>\n<tr>\n<td>Execution-time overrun, stack overflow<\/td>\n<td>No<\/td>\n<td>No<\/td>\n<td>Yes<\/td>\n<td>Yes<\/td>\n<\/tr>\n<tr>\n<td>Input threshold, filtering, ADC reference errors<\/td>\n<td>No<\/td>\n<td>No<\/td>\n<td>No<\/td>\n<td>Yes<\/td>\n<\/tr>\n<tr>\n<td>Driver diagnostics (open load, short to battery or ground)<\/td>\n<td>No<\/td>\n<td>No<\/td>\n<td>No<\/td>\n<td>Yes<\/td>\n<\/tr>\n<tr>\n<td>Start-up, reset, low-voltage behaviour<\/td>\n<td>No<\/td>\n<td>No<\/td>\n<td>No<\/td>\n<td>Yes<\/td>\n<\/tr>\n<tr>\n<td>Bus timing, network management, diagnostics over CAN<\/td>\n<td>Partly (simulated)<\/td>\n<td>Partly<\/td>\n<td>Partly<\/td>\n<td>Yes<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>The table makes the economic argument by itself. Every row that can be closed at MIL or SIL should be closed there, because a test there costs seconds of CPU time and can run overnight by the thousand. HIL time is the scarce resource: one bench, one ECU, real time. It should be spent on the rows only HIL can close.<\/p>\n<h2>3. Worked example 1: why a timing assumption breaks between levels<\/h2>\n<p><em>Example (illustrative values, not RAYNOV specifications).<\/em><\/p>\n<p>A PI speed controller is designed in MIL with a sampling period Ts = 10 ms. On the target, the task actually runs every 10 ms, but the sensor value it reads was acquired by the ADC at the end of the previous task, so the effective delay between measurement and actuation is closer to one full period: \u03c4 \u2248 10 ms (a zero-order hold adds roughly another half period; we keep 10 ms for simplicity).<\/p>\n<p>A pure delay \u03c4 adds a phase lag at frequency f of:<\/p>\n<p>\u03c6 = 360\u00b0 \u00d7 f \u00d7 \u03c4<\/p>\n<p>If the closed-loop crossover frequency is 8 Hz:<\/p>\n<p>\u03c6 = 360 \u00d7 8 \u00d7 0.010 = 28.8\u00b0<\/p>\n<p>If the MIL design had a phase margin of 40\u00b0, the real margin falls to about 11\u00b0. The loop does not go unstable, but it rings, exactly the behaviour seen in the opening story. The fix is cheap if found early: model the delay (a unit delay block) at MIL and the effect appears there. At HIL, it appears anyway, but now it costs a bench day and a software release.<\/p>\n<p><strong>Lesson:<\/strong> put the target&#8217;s real timing assumptions (task periods, sampling instants, communication delays) into the model as early as MIL. Then HIL confirms them instead of discovering them.<\/p>\n<h2>4. Worked example 2: the HIL real-time step<\/h2>\n<p><em>Example (illustrative values, not RAYNOV specifications).<\/em><\/p>\n<p>A HIL bench must run the plant model fast enough that the ECU cannot tell it is simulated. A common rule of thumb is a model step 10 to 20 times shorter than the fastest time constant (or 10 or more samples per period of the fastest signal) the ECU controls or observes; 5\u00d7 is a bare minimum.<\/p>\n<p>Suppose the ECU drives an injector or a valve with a PWM at 1 kHz and reads back an averaged current. The relevant dynamic is the coil&#8217;s electrical time constant, \u03c4 = L \/ R. With L = 10 mH and R = 5 \u03a9:<\/p>\n<p>\u03c4 = 0.010 \/ 5 = 2 ms<\/p>\n<p>A model step of 200 \u00b5s (\u03c4 \/ 10) represents that current rise properly. If the ECU instead measures the current <em>within<\/em> each PWM period, the model must resolve the 1 ms period itself, and a 200 \u00b5s step gives only 5 points per period: too coarse. You then need either a much faster step, or FPGA-based I\/O that generates and measures the PWM in hardware while the model runs slower.<\/p>\n<p><strong>Lesson:<\/strong> the HIL architecture (CPU model step vs FPGA I\/O) follows from the fastest signal the ECU really looks at, not from the size of the model. The <a href=\"https:\/\/raynovtechnology.com\/hil-test-bench-architecture\/\">HIL bench architecture guide<\/a> details the blocks and timing constraints, and the guide on <a href=\"https:\/\/raynovtechnology.com\/acquisition-timing-jitter-windows\/\">acquisition timing and jitter<\/a> covers why a desktop OS cannot close such a loop.<\/p>\n<h2>5. How to split the test plan between levels<\/h2>\n<p>A practical approach is to tag every requirement with the <em>lowest<\/em> level that can verify it, then only escalate when necessary.<\/p>\n<ol>\n<li><strong>Functional logic and control laws<\/strong> \u2192 MIL first, regressed in SIL on every code change.<\/li>\n<li><strong>Code quality and numeric behaviour<\/strong> \u2192 SIL (back-to-back tests: same stimuli to model and code, compare outputs within a tolerance).<\/li>\n<li><strong>Resource and timing budgets<\/strong> \u2192 PIL, or HIL with execution-time measurement if PIL is not set up.<\/li>\n<li><strong>Electrical interfaces, diagnostics, power modes, fault reactions<\/strong> \u2192 HIL only.<\/li>\n<li><strong>Integration with other ECUs and the network<\/strong> \u2192 HIL with restbus simulation, then the vehicle.<\/li>\n<\/ol>\n<p>Back-to-back testing deserves a word. Running the same stimulus vectors through MIL and SIL, and comparing outputs sample by sample, is one of the cheapest ways to prove that code generation, fixed-point conversion or hand-coding did not change behaviour. The tolerance must be stated explicitly (for example, a fixed number of LSBs on each output), otherwise every quantisation difference becomes a debate.<\/p>\n<h3>5.1 Reusing assets across levels<\/h3>\n<p>The biggest saving does not come from one level; it comes from reuse:<\/p>\n<ul>\n<li><strong>Same plant model<\/strong> from MIL to HIL, after checking that it runs in real time at the required step. Exchanging models as FMUs through the <a href=\"https:\/\/fmi-standard.org\/\">FMI standard<\/a> helps when several tools are involved.<\/li>\n<li><strong>Same test cases<\/strong>, written against signal names rather than tool-specific variables, so a MIL test can be re-run on HIL with only the mapping changed. The guide <a href=\"https:\/\/raynovtechnology.com\/test-automation-script-to-sequencer\/\">from scripts to a test sequencer<\/a> covers how to structure this.<\/li>\n<li><strong>Same pass\/fail criteria<\/strong>, with tolerances widened explicitly where the real hardware adds noise, not silently.<\/li>\n<\/ul>\n<h2>6. What only HIL brings, and how to prepare for it<\/h2>\n<p>When the ECU is on the bench, the value is in the electrical and system-level tests that no simulation can replace:<\/p>\n<ul>\n<li><strong>Fault injection<\/strong> on each pin: open circuit, short to ground, short to battery, pin-to-pin short, under sequencer control. See the guide on <a href=\"https:\/\/raynovtechnology.com\/fault-injection-harness-ecu\/\">fault injection on harnesses and ECUs<\/a>.<\/li>\n<li><strong>Measurement access<\/strong> to every signal without cutting the harness, through a <a href=\"https:\/\/raynovtechnology.com\/product-category\/breakout-boxes\/\">breakout box<\/a>. How to specify one is covered in the <a href=\"https:\/\/raynovtechnology.com\/breakout-box-specification-guide\/\">breakout box specification guide<\/a>.<\/li>\n<li><strong>Power behaviour<\/strong>: cranking profiles, slow voltage ramps, micro-cuts, reverse-polarity handling.<\/li>\n<li><strong>Input conditioning<\/strong>: the real thresholds and filters of the ECU&#8217;s digital and analog inputs. The guide on <a href=\"https:\/\/raynovtechnology.com\/digital-input-signal-conditioning\/\">digital input signal conditioning<\/a> shows why these matter.<\/li>\n<\/ul>\n<p>A compact, cost-effective bench such as the <a href=\"https:\/\/raynovtechnology.com\/products\/mini-hil-test-bench\/\">RAYNOV Mini HIL test bench<\/a> brings real-time simulation, fault injection and automated execution to the lab, R&amp;D or production floor, without the footprint of a full-size system.<\/p>\n<h2>7. Common mistakes<\/h2>\n<ul>\n<li><strong>Treating HIL as the main functional test level.<\/strong> It becomes the bottleneck, and the bench is busy re-finding logic bugs that SIL would have found in minutes.<\/li>\n<li><strong>Skipping timing in the model.<\/strong> No delays, no sampling, ideal sensors at MIL, then surprise at HIL.<\/li>\n<li><strong>Different test cases per level.<\/strong> Two teams, two test languages, no traceability between a MIL result and a HIL result.<\/li>\n<li><strong>Validating the ECU on an unvalidated bench.<\/strong> If the bench itself has not been checked (I\/O accuracy, timing, fault-injection paths), a failing test may be a bench defect. Bench qualification is covered in the <a href=\"https:\/\/raynovtechnology.com\/test-bench-qualification-fat-sat\/\">FAT and SAT guide<\/a>.<\/li>\n<li><strong>Ignoring the harness.<\/strong> A bench harness with different lengths, grounds or connectors from the vehicle can mask or create faults.<\/li>\n<li><strong>No exit criteria per level.<\/strong> Without them, a level never ends, or ends because the calendar says so.<\/li>\n<\/ul>\n<h2>8. Checklist: choosing and planning test levels<\/h2>\n<ul>\n<li>[ ] Each requirement tagged with the lowest level able to verify it.<\/li>\n<li>[ ] Task periods, sampling delays and bus latencies modelled at MIL.<\/li>\n<li>[ ] Back-to-back MIL\/SIL comparison with written tolerances.<\/li>\n<li>[ ] Execution time and stack measured on the target (PIL or HIL).<\/li>\n<li>[ ] Fastest signal observed by the ECU identified; HIL model step or FPGA I\/O chosen accordingly.<\/li>\n<li>[ ] Test cases written once, mapped to each level.<\/li>\n<li>[ ] Fault-injection list per pin defined before the HIL bench is ordered.<\/li>\n<li>[ ] Bench qualified before it is used to accept ECU software.<\/li>\n<li>[ ] Exit criteria and coverage target written for each level.<\/li>\n<li>[ ] Acceptance tests distinguished from qualification tests (see <a href=\"https:\/\/raynovtechnology.com\/atp-vs-qtp\/\">ATP vs QTP<\/a>).<\/li>\n<\/ul>\n<h2>9. Conclusion<\/h2>\n<p>MIL, SIL, PIL and HIL are not a ladder you climb once. They are parallel filters, each cheap for some defects and blind to others. A well-planned ECU project spends simulation hours generously and HIL hours carefully, reuses models and test cases across levels, and arrives at the bench with only the questions that need real hardware to answer.<\/p>\n<p>For background reading, the general article on <a href=\"https:\/\/en.wikipedia.org\/wiki\/Hardware-in-the-loop_simulation\">hardware-in-the-loop simulation<\/a> and the <a href=\"https:\/\/en.wikipedia.org\/wiki\/ISO_26262\">ISO 26262<\/a> functional safety standard, which describes verification at software and hardware integration levels, are useful starting points.<\/p>\n<p><strong>Planning a HIL bench or deciding which test level fits your ECU project?<\/strong> <a href=\"https:\/\/raynovtechnology.com\/quote-page\/\">Ask RAYNOV for a quote<\/a> and our engineers will review your test plan with you.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>MIL, SIL, PIL and HIL compared by an engineer: what each test level can and cannot find, how to split test cases, timing examples and a checklist.<\/p>","protected":false},"author":2,"featured_media":2953,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_uag_custom_page_level_css":"","site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"normal-width-container","site-content-style":"unboxed","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[21],"tags":[],"class_list":["post-2954","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-validation-methods"],"uagb_featured_image_src":{"full":["https:\/\/raynovtechnology.com\/wp-content\/uploads\/2026\/10\/hil-vs-sil-vs-mil-ecu-test-levels.png",1200,675,false],"thumbnail":["https:\/\/raynovtechnology.com\/wp-content\/uploads\/2026\/10\/hil-vs-sil-vs-mil-ecu-test-levels-150x150.png",150,150,true],"medium":["https:\/\/raynovtechnology.com\/wp-content\/uploads\/2026\/10\/hil-vs-sil-vs-mil-ecu-test-levels-300x169.png",300,169,true],"medium_large":["https:\/\/raynovtechnology.com\/wp-content\/uploads\/2026\/10\/hil-vs-sil-vs-mil-ecu-test-levels-768x432.png",768,432,true],"large":["https:\/\/raynovtechnology.com\/wp-content\/uploads\/2026\/10\/hil-vs-sil-vs-mil-ecu-test-levels-1024x576.png",1024,576,true],"1536x1536":["https:\/\/raynovtechnology.com\/wp-content\/uploads\/2026\/10\/hil-vs-sil-vs-mil-ecu-test-levels.png",1200,675,false],"2048x2048":["https:\/\/raynovtechnology.com\/wp-content\/uploads\/2026\/10\/hil-vs-sil-vs-mil-ecu-test-levels.png",1200,675,false],"trp-custom-language-flag":["https:\/\/raynovtechnology.com\/wp-content\/uploads\/2026\/10\/hil-vs-sil-vs-mil-ecu-test-levels-18x10.png",18,10,true]},"uagb_author_info":{"display_name":"Sphie-bot","author_link":"https:\/\/raynovtechnology.com\/fr\/author\/sphie-bot\/"},"uagb_comment_info":0,"uagb_excerpt":"MIL, SIL, PIL and HIL compared by an engineer: what each test level can and cannot find, how to split test cases, timing examples and a checklist.","_links":{"self":[{"href":"https:\/\/raynovtechnology.com\/fr\/wp-json\/wp\/v2\/posts\/2954","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/raynovtechnology.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/raynovtechnology.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/raynovtechnology.com\/fr\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/raynovtechnology.com\/fr\/wp-json\/wp\/v2\/comments?post=2954"}],"version-history":[{"count":1,"href":"https:\/\/raynovtechnology.com\/fr\/wp-json\/wp\/v2\/posts\/2954\/revisions"}],"predecessor-version":[{"id":2968,"href":"https:\/\/raynovtechnology.com\/fr\/wp-json\/wp\/v2\/posts\/2954\/revisions\/2968"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/raynovtechnology.com\/fr\/wp-json\/wp\/v2\/media\/2953"}],"wp:attachment":[{"href":"https:\/\/raynovtechnology.com\/fr\/wp-json\/wp\/v2\/media?parent=2954"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/raynovtechnology.com\/fr\/wp-json\/wp\/v2\/categories?post=2954"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/raynovtechnology.com\/fr\/wp-json\/wp\/v2\/tags?post=2954"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}