Verification vs. Validation
Verification and validation address different questions, require different activities, and produce different evidence. In regulated industries they also have different mandatory documentation requirements under ISO 26262, DO-178C, and IEC 61508. Development teams that treat them as synonyms typically discover the distinction at the worst possible moment: during an audit.
The Core Distinction
The simplest way to keep them apart:
Verification
Did we build the software correctly?
Validation
Did we build the right software?
Verification checks that the software correctly implements its specifications. Validation checks that the specification correctly captures what the end user or system needs.
Verification in Practice
Verification activities focus on the internal correctness of the software. They include:
- Static code analysis: examining source code for defects and standard violations without executing it
- Unit testing: testing individual components in isolation against their specifications
- Code coverage measurement: confirming that tests exercise the code adequately
- Requirements-based testing: linking every test case back to a specific requirement
- Peer reviews and inspections: structured examination of code and documentation
The output of verification is documented evidence: test results, coverage reports, and traceability matrices that show which requirements have been verified and how.
Validation in Practice
Validation activities confirm that the system does what it was actually needed to do, not just what the specification said. They typically occur later in the development lifecycle and include:
- System testing against end-user requirements or operational scenarios
- Hardware-in-the-loop (HIL) testing for embedded systems
- Acceptance testing with customer or regulatory involvement
Validation confirms that a correctly built system is also the right system.
Why Both Are Required in Regulated Industries
Standards including ISO 26262, DO-178C, IEC 61508, and IEC 62304 explicitly require both verification and validation activities, with documented evidence for each. Verification evidence typically includes unit test reports, static analysis results, and coverage data. Validation evidence includes system-level test results and acceptance records.
VectorCAST and PC-lint Plus are designed to support the verification side of this equation, generating the auditable evidence these standards require.