Well, obviously you have to clock it, meaning a transient
analysis. An input ramp is one method. A looped binary
search, running an input offset variable, is another and
potentially more efficient (especially if you can skip DC
solution, and keep total simulation time short).
With an input ramp, your accuracy depends on the ramp
being slow, like more than 2^bits times the worst case
prop delay if you want "bits" worth of accuracy (and, to
get accurate, you probably need to "back-date" the
input value by the prop delay to see what-it-was at
input switchpoint, not output switchpoint.
A third, and ATE-test-solution realistic method is to put
the comparator inside an integrator / divider loop, let it
find its 50% duty cycle point on noise-driven-chatter,
and read the pre-divider voltage as a gained-up proxy
for the likely-unmeasurable Vio. Of course an internal
comparator could not be accessed in this way absent a
test mux tree. But the approach is valid to simulation.
Its total run time would probably fall between the previous
two methods (ramp will run full duration regardless of
where the comparator switches, so anywhere from 1%
to 99% of the run time would be wasted; search will
need only (bits) number of much shorter runs; integrator
time constant / settling will determine the run time you
need for accuracy(a box between settling tail, and
having a ripple residue > LSB on the integrator output).