# Research protocol — deterministic semantic work-zone digital-twin pilot **Protocol status:** frozen implementation specification; final publishable execution follows the audit note in Section 13 **Study type:** deterministic procedural sensor-fusion pilot **Evidence level:** synthetic method demonstration, not field validation ## 1. Purpose and research questions This pilot asks whether repeated viewpoints from a simple mobile patrol can turn a procedurally generated work-zone scene into (1) a metric semantic 3-D voxel representation, (2) a boundary estimated from detected temporary traffic-control (TTC) devices, and (3) a four-class operational bird's-eye-view (BEV) map. It is intentionally small, deterministic, and inspectable. It is designed to exercise an evidence chain, not to establish deployment readiness. The preregistered questions are: 1. Does patrol viewpoint coverage change 3-D reconstruction completeness? 2. Does viewpoint coverage change actionable operational-map quality? 3. Does the result vary across three illustrative work-zone boundary shapes? 4. Do unknown cells prevent unobserved ground-truth no-go space from being silently reported as traversable? 5. How accurately do fused semantics, TTC instances, and the inferred boundary recover their synthetic references without using truth in prediction? The directional expectations, fixed before execution, are that `loop_patrol` will have higher mean reconstruction completeness and actionable mIoU than `single_pose`, and that its mean false-traversable rate will not be higher. These are design expectations rather than safety hypotheses. All three directional metrics and all additional required metrics will be reported whether or not the expectations hold. ## 2. Frozen experimental design The complete design contains **45 runs**: - 3 procedural layouts; - 5 fixed seeds per layout; and - 3 patrol strategies per layout-seed pair. This gives 15 runs per patrol strategy and five matched runs in every layout-by-strategy cell. The layout, seed, and patrol identifiers constitute a run's unique key: ```text __seed___ ``` ### 2.1 Layouts The layout identifiers are frozen as: 1. `right_lane_closure` — a shoulder-origin taper progressively closes the right travel lane and leads into a longitudinal protected work area; 2. `shoulder_work_area` — channelizing devices separate a shoulder work area from an adjacent live lane; and 3. `lane_shift_chicane` — staggered channelizing devices form a curved, single-valued boundary around a protected work area. These are illustrative boundary shapes, not compliant traffic-control plans. Each layout uses the same rectangular region of interest (ROI), coordinate convention, class ontology, nominal road width, and object library. A layout definition specifies polygonal ground-truth regions and procedural objects, including road surface, traffic-control devices, barriers, and one stationary work vehicle. Layout polygons must be mutually exclusive after applying the precedence rule in Section 5.3. Each TTC boundary is single-valued in `y` over its longitudinal support so that it can be evaluated as `y = b(x)` without using the truth boundary during estimation. ### 2.2 Seeds The fixed seeds are: ```text 20260808, 20260809, 20260810, 20260811, 20260812 ``` Within prespecified bounded ranges, the seed controls small object-position jitter, surface-point sampling phase, Cartesian coordinate noise, point dropout, and semantic label corruption. It does not change the named layout, ROI, patrol poses, operational ontology, metric definitions, or analysis plan. The same layout-seed scene is reused across all three patrol strategies. Randomness must come from one documented pseudorandom-number generator. To make comparisons nested rather than dependent on call order, every pose has a stable identifier and its stochastic stream is derived from `(layout, seed, pose_id, generator_version)`. Observations from a shared pose must therefore be numerically identical in every strategy that contains that pose. ### 2.3 Patrol strategies The three frozen strategies are: - `single_pose`: the common start pose only; - `one_way_patrol`: the common start pose plus evenly spaced forward-moving poses along the protected inspection corridor (seven poses total); and - `loop_patrol`: every `one_way_patrol` pose plus a return sequence with the sensor facing the reverse direction and a fixed lateral offset that remains inside the synthetic protected corridor (14 poses total). The implementation must define the ordered pose list once in a versioned configuration file. `single_pose` is a strict subset of `one_way_patrol`, which is a strict subset of `loop_patrol`. No route is adapted to intermediate reconstruction results. The routes are geometric observation schedules only; they do not model robot dynamics, collision avoidance, or autonomous driving. ## 3. Coordinate frame and procedural reference scene The world frame is right-handed and metric: `x` follows the road, `y` crosses the road from the outer shoulder toward the adjacent live lane, and `z` points upward. The frozen planar ROI is `x ∈ [0.0, 72.0)` m and `y ∈ [-0.9, 7.2)` m. The ROI bounds, BEV resolution, voxel resolution, procedural geometry, and every sensor parameter must be serialized in the run manifest. The same half-open ROI convention, `[min, max)`, is used for ground truth, predictions, and evaluation so that boundary cells are not counted twice. The reference scene is generated directly from primitives such as planes, boxes, cylinders, and cones. Surface points are sampled at a fixed spatial spacing. The generator retains the continuous geometry and also exports the reference occupied-voxel set used for completeness evaluation. Object placement jitter is bounded so that it cannot move a protected object into the live-lane polygon or change the topology of the ground-truth operational map. Any run violating that invariant fails validation and is regenerated only by fixing code, never by substituting a new seed. This study does not use photographs, CARLA frames, SLAM logs, or physical LiDAR. Procedural labels are known by construction. The 3-D semantic ontology contains `road_surface`, `ttc_device`, `barrier`, and `work_vehicle`. Integer codes and the deterministic tie order are frozen in the manifest. Reference object IDs and labels exist for simulation audit and metric calculation. Prediction code receives only perturbed point coordinates, observed semantic labels, and patrol-pose identifiers; it does not receive reference object IDs, reference TTC centers, or ground-truth operational polygons. ## 4. Ordinary synthetic 3-D observation model The observation model is deliberately simple. It approximates a spinning 3-D range sensor without claiming the fidelity of any commercial LiDAR or simulator. For each frozen patrol pose, it performs the following deterministic steps: 1. transform reference surface samples into the sensor frame; 2. retain samples inside the frozen minimum/maximum range, horizontal field of view, and vertical field of view; 3. assign retained samples to fixed azimuth-elevation angular bins; 4. retain the nearest sample in each bin, providing a basic ray-wise occlusion approximation; 5. apply seeded range-dependent Bernoulli point dropout and independent zero-mean Gaussian noise to the three world-coordinate components using the pose-specific stream; and 6. attach a seeded synthetic semantic observation drawn from one frozen class-confusion table. The primary sensor configuration is frozen as follows: | Parameter | Value | | --- | ---: | | minimum / maximum range | 0.65 / 30.0 m | | horizontal field of view | 360° | | vertical field of view | -32° to +14° | | azimuth / elevation bin width | 1.15° / 1.25° | | dropout probability at range `r` | `0.025 + 0.075 × (r / 30.0)^2` | | coordinate-noise standard deviation | 0.012 m independently on `x`, `y`, `z` | | semantic-confusion probability | 0.018 per retained return | On semantic corruption, the replacement label is sampled from the frozen class-confusion map and must differ from the source label. The full confusion map and pseudorandom-number-generator identity are included in the manifest. No distribution, angular resolution, range limit, or probability may be tuned by inspecting evaluation results. The confusion process is an observation perturbation, not a trained segmentation model. Pose is supplied exactly by the procedural generator; localization error is outside this pilot. The prediction-safe observation record contains only: ```text run_id, pose_id, point_xyz_world, observed_semantic_class, range_m, azimuth_bin, elevation_bin ``` A separate audit record contains the corresponding source indices, reference object IDs, reference points and labels, and per-source view counts. Audit fields are used for evaluation and determinism checks only and are never passed to voxel fusion, TTC detection, boundary estimation, or BEV prediction. ## 5. Semantic voxel fusion, boundary estimation, and operational BEV ### 5.1 Voxel fusion All observed points are quantized into a fixed metric 3-D voxel grid using `floor((coordinate - roi_min) / voxel_size)`. For every voxel, fusion stores: - total observation count; - count by observed semantic class; - number of distinct contributing poses; and - the centroid of observed points. The fused semantic class is the class with the largest observation count. Ties are resolved by the frozen integer class order, never by container or thread iteration order. Voxels with no observation do not appear in the fused cloud. No interpolation, learned completion, map smoothing, or ground-truth filling is allowed in the primary analysis. The primary voxel, detection, and BEV constants are frozen as: | Parameter | Value | | --- | ---: | | voxel side length | 0.25 m | | TTC cluster radius / minimum voxels | 0.72 m / 2 | | TTC evaluation match radius | 1.00 m | | BEV cell size | 0.60 m | | maximum interpolated boundary gap | 11.00 m | | evidence height maximum | 0.42 m | | minimum column observations / poses | 1 / 1 | | symmetric boundary inspection half-width | 0.48 m | | detected-TTC inspection-buffer radius | 0.72 m | | observed-obstacle buffer | 0.48 m | ### 5.2 TTC instance detection and supported boundary estimation TTC instances are estimated from fused voxels whose **predicted** semantic class is `ttc_device`. Their horizontal centroids are clustered by deterministic radius-connected components using the frozen `ttc_cluster_radius_m`; components with fewer than `minimum_ttc_voxels` are discarded. A detected instance center is the component-wise median of its fused-voxel centroids. Components and centers are sorted lexicographically by `(x, y, z)` after clustering. Reference object IDs or centers may not participate in clustering. The estimated boundary uses detected instance centers only. Centers are ordered by `(x, y)`, and a piecewise-linear segment is fitted between adjacent centers only when their longitudinal separation is no larger than the frozen `maximum_boundary_gap_m`. No segment is extrapolated before the first center, after the last center, or across an excessive gap. The union of accepted segments is the **boundary-supported interval**. If multiple centers occupy the same longitudinal BEV bin, their median `y` is used before interpolation. Consequently, missed TTC devices can create an unsupported interval rather than being silently filled from the known procedural layout. The predicted-BEV function accepts only ROI bounds, the prediction-safe fused cloud, detected TTC centers, and frozen mapping parameters; its signature does not accept a scene or any reference geometry. Ground-truth TTC centers and the ground-truth boundary are loaded by a separate truth rasterizer only after prediction is complete, for the metrics in Sections 6.4 and 6.5. The saved run record must include separate prediction-input and evaluation-truth fields so this separation is auditable. ### 5.3 Four-class operational BEV The operational map uses exactly four predicted classes: 1. `traversable` — supported, observed road cells on the lower-`y` side of the estimated TTC boundary; 2. `inspection` — supported cells within the fixed metric inspection band of the estimated boundary or within the fixed buffer of a detected TTC center; 3. `no_go` — supported, observed road cells on the higher-`y` side of the estimated TTC boundary, plus directly observed `barrier` and `work_vehicle` cells; and 4. `unknown` — cells lacking sufficient fused evidence for one of the three actionable labels, including cells outside boundary-supported intervals. The 3-D voxels are lowered into the BEV grid by column. A road cell is eligible for classification only if its column meets the preregistered minimum total observation count and minimum number of distinct contributing poses and its `x` coordinate lies in a boundary-supported interval. At its cell-center `x`, the estimated boundary gives `y_hat`. A road cell is `inspection` in the symmetric closed band `|y - y_hat| <= 0.48 m`, `traversable` below that band, and `no_go` above that band. Directly observed obstacle columns may be labeled `no_go` without boundary support. A cell within 0.72 m of a detected TTC center may be labeled `inspection` without an interpolated segment. Every other cell remains `unknown`. The frozen precedence for competing evidence is `no_go > inspection > traversable > unknown`. The inspection band and buffer, height slice, evidence thresholds, cluster parameters, maximum boundary gap, and BEV cell size are manifest parameters shared by every run. In particular, the prediction procedure may not query the procedural protected-work-area or live-lane polygons. The higher-`y` no-go side is a frozen coordinate-frame rule, not a per-run truth lookup. Ground truth covers the complete labeled ROI and contains only `traversable`, `inspection`, and `no_go`; it never contains `unknown`. It is rasterized directly from procedural polygons and object footprints at the same BEV resolution. Ground-truth precedence is also `no_go > inspection > traversable`. Ground-truth polygons and boundary samples are evaluation artifacts only and may not be passed to voxel fusion, TTC detection, boundary estimation, or predicted-BEV lowering. Each layout must contain at least one cell of every actionable ground-truth class. ## 6. Preregistered metrics Metrics are computed on the entire labeled BEV ROI or the complete reference occupied-voxel set. No observed-only mask is permitted. ### 6.1 Reconstruction completeness Let `V_gt` be the set of reference occupied voxels in the 3-D ROI and `V_obs` the set of voxel coordinates containing at least one fused observation. Then: ```text reconstruction_completeness = |V_gt ∩ V_obs| / |V_gt| ``` Completeness ignores the fused semantic label; a separate label error is reflected downstream in BEV IoU. Extra observed voxels caused by noise do not increase the numerator. `V_gt` is guaranteed nonempty. ### 6.2 Median geometry error Let `C_obs` contain every fused-voxel centroid and let `S_gt` contain the dense reference surface samples in the 3-D ROI. For each `p` in `C_obs`, compute its Euclidean distance to the nearest point in `S_gt`. The metric, in metres, is: ```text median_geometry_error_m = median({ min(||p - q||_2) : q in S_gt } for p in C_obs) ``` All fused centroids are included, so a noise-created off-surface voxel is not silently discarded. `C_obs` and `S_gt` must both be nonempty; otherwise the run is invalid. This one-directional error measures the location accuracy of what was reconstructed, while completeness in Section 6.1 measures what was missed. ### 6.3 Fused semantic accuracy For each fused centroid `p`, let `q(p)` be its nearest reference surface sample in Euclidean 3-D distance, using reference-array order to break an exact distance tie. A fused centroid is semantically correct only when its fused label equals the reference label of `q(p)`: ```text semantic_correct = count(p in C_obs where fused_label(p) = reference_label(q(p))) semantic_accuracy = semantic_correct / |C_obs| ``` All fused centroids remain in the denominator and are matched, including noise-created off-surface centroids. The denominator must be nonzero. The nearest-reference distances are the same distances used for median geometry error, so both metrics are independently recomputable from the saved arrays. ### 6.4 TTC instance recall Detected instance centers are matched one-to-one to reference TTC centers in the horizontal plane after the frozen `ttc_match_radius_m` gate is applied. The matching objective is maximum cardinality. Because the registered recall metric uses only that cardinality, equal-cardinality assignments are not ranked by an additional distance objective. Natural reference and detection index order makes the augmenting-path computation deterministic. Detection itself is complete before reference centers are loaded. ```text ttc_true_positive = number of gated one-to-one matched pairs ttc_recall = ttc_true_positive / number_of_reference_ttc_instances ``` Every reference layout contains at least one TTC instance. Unmatched detections are recorded as false positives and the auxiliary precision `matched / detected` is exported (defined as `0` when there are no detections), but TTC recall is the preregistered required metric. ### 6.5 Boundary mean absolute error At every BEV cell-center `x_j` inside an estimated boundary-supported interval, evaluate both the estimated boundary `b_hat(x_j)` and continuous procedural reference boundary `b_gt(x_j)`. Let `J_supported` be the resulting index set: ```text boundary_mae_m = mean(|b_hat(x_j) - b_gt(x_j)| for j in J_supported) ``` No unsupported `x` is interpolated, assigned zero error, or filled from truth. If `J_supported` is empty, boundary MAE is stored as null and the run fails the primary boundary-estimation quality gate; it is never reported as zero. The number and fraction of supported longitudinal samples are saved beside the MAE so a short accurate fragment cannot masquerade as a complete boundary. ### 6.6 Known coverage Known coverage is evaluated over the complete BEV ROI: ```text known_cell_count = count(i where P_i != unknown) known_coverage = known_cell_count / total_roi_cell_count ``` This reports how much of the operational map is actionable. It does not assess whether the known labels are correct. ### 6.7 Actionable mIoU Let `G_i` be the ground-truth class and `P_i` the predicted class for ROI cell `i`. For each actionable class `c ∈ {traversable, inspection, no_go}`: ```text intersection_c = count(i where G_i = c and P_i = c) union_c = count(i where G_i = c or P_i = c) IoU_c = intersection_c / union_c actionable_mIoU = (IoU_traversable + IoU_inspection + IoU_no_go) / 3 ``` Every `unknown` prediction is retained in the evaluation array. If `G_i = c` and `P_i = unknown`, that cell is a false negative for `c`: it is in `union_c` but not `intersection_c`. Thus unknown predictions **count as misses** for actionable mIoU. Unknown is not a fourth term in the mean. Because every layout contains every actionable class, all three unions are nonzero; an empty union is treated as an invalid layout rather than assigned an arbitrary score. Per-class IoUs must be saved even though the headline quality metric is their unweighted mean. ### 6.8 False-traversable rate The failure metric is defined only with ground-truth no-go cells in its denominator: ```text false_traversable_count = count(i where G_i = no_go and P_i = traversable) ground_truth_no_go_count = count(i where G_i = no_go) false_traversable_rate = false_traversable_count / ground_truth_no_go_count ``` Predicted traversable cells elsewhere are not part of this denominator. Predicted `unknown`, `inspection`, or `no_go` within ground-truth no-go space are not false-traversable events, although an unknown no-go cell still lowers `IoU_no_go` and therefore actionable mIoU. The denominator must be positive in all valid layouts. This is a synthetic mapping-error rate, not an accident probability or safety-certification measure. ### 6.9 Required diagnostic counts Each run also records total ROI cells, ground-truth cells per actionable class, predicted cells per four-class label, unknown rate, the three IoU intersections and unions, observed/reference voxel counts, geometry-error sample count, semantic numerator and denominator, detected/reference/matched TTC counts, TTC false-positive count and auxiliary precision, supported/total boundary sample counts, known numerator and denominator, and false-traversable numerator and denominator. These counts make every reported rate independently recomputable. ## 7. Aggregation and comparisons For Figure 2, each patrol strategy is summarized over its 15 fixed layout-seed runs for reconstruction completeness, actionable mIoU, and false-traversable rate, as required by `chart_contract.md`. The complete aggregate table additionally covers median geometry error, semantic accuracy, TTC recall, boundary MAE, and known coverage. For every required metric, report the arithmetic mean, sample standard deviation, `n = 15`, and a two-sided descriptive 95% Student t-interval: ```text mean ± t_(0.975, 14) × sample_sd / sqrt(15) ``` Absolute chart axes begin at zero. Intervals are retained even when variation is nearly zero; exact direct labels are shown rather than inventing visual separation. These intervals describe dispersion across the fixed procedural runs. They are not population-level confidence, formal safety uncertainty, or evidence that the synthetic layouts represent roadway prevalence. For Figure 3, actionable mIoU is averaged across the five fixed seeds in each layout-by-strategy cell and displayed on one fixed 0–1 scale. Per-run values remain available. Strategy differences may also be exported as matched layout-seed differences, but no post-hoc significance tests, exclusions, or metric substitutions are part of the primary report. ## 8. Preregistered representative and failure-aware cases Before any result is generated, the representative case is fixed as: ```text layout: right_lane_closure seed: 20260808 patrol: loop_patrol ``` It supplies the reference-scene, fused-semantic-cloud, and four-class BEV panels in Figure 1. It is selected by protocol, not because it performs best. Figure 4 compares `single_pose` with `loop_patrol` for the same `right_lane_closure`, seed `20260808` layout-seed pair, with identical ROI, axes, ontology, and rasterization. Both maps must be shown even if they do not support the directional expectation. No alternative seed may replace this case after results are known. ## 9. Artifacts and schemas The executed pilot must save, at minimum: ### 9.1 Configuration and provenance - `results/manifest.json` — protocol version, source revision, dependency versions, generator version, layouts, fixed seeds, patrol pose lists, ROI, all sensor/noise/confusion parameters, voxel and BEV parameters, class and tie-break orders, and expected run count; - `results/run_index.csv` — one row for each of the 45 expected run keys, completion status, artifact paths, validation status, and checksums; and - `results/validation.json` — invariant checks, failed checks if any, and confirmation that no expected run is missing or duplicated. ### 9.2 Raw per-run evidence - `results/raw/observations/.npz` — prediction-safe point observations and pose IDs, with no source, instance, or truth fields; - `results/raw/audit/.npz` — evaluation-only source correspondence, reference points/labels/instances, and view counts; - `results/raw/fused_voxels/.npz` — voxel coordinates, centroids, semantic counts, contributing-pose counts, and fused labels; - `results/raw/ttc_boundary/.npz` — detected TTC centers, cluster sizes, accepted boundary segments, supported longitudinal samples, and predicted boundary ordinates, without embedded truth fields; - `results/raw/bev/.npz` — aligned ground-truth and predicted rasters; and - `results/raw/run_metrics.csv` — one row per run containing reconstruction completeness, median geometry error, semantic accuracy, TTC recall, boundary MAE, known coverage, actionable mIoU, false-traversable rate, and every diagnostic numerator, denominator, and count from Section 6.9. NPZ array names, dtypes, shapes, units, and class-code mappings must be stated in the manifest. Raw evidence is written before aggregate tables and figures. ### 9.3 Aggregate evidence - `results/aggregate/strategy_summary.csv` — metric, strategy, `n`, mean, sample standard deviation, t critical value, interval lower bound, and interval upper bound; - `results/aggregate/layout_strategy_miou.csv` — layout, strategy, five-seed mean actionable mIoU, and the five underlying run IDs; - `results/aggregate/matched_differences.csv` — optional but, if emitted, contains prespecified pairwise strategy differences for every matched layout-seed pair; and - rendered PNG and SVG outputs for all figures named in `chart_contract.md`. Every table uses full-precision stored values; rounding occurs only in display labels. Figures are rendered exclusively from saved raw/aggregate evidence, not from hidden in-memory results. ## 10. Determinism and quality gates An execution is publishable only if all of the following pass: - exactly 45 distinct run keys exist and match the frozen design matrix; - the three strategies for a layout-seed pair share an identical reference scene and identical observations for every shared pose; - no reference object ID, reference TTC center, ground-truth boundary, or ground-truth operational polygon is present in prediction inputs; - the saved predicted TTC centers and boundary reproduce the saved operational BEV without access to evaluation truth; - all reference and prediction arrays use the same ROI and grid convention; - all metric denominators are positive and all rates lie in `[0, 1]`; - recomputation from saved counts reproduces every metric within the declared floating-point tolerance; - aggregate rows can be reproduced from `raw/run_metrics.csv` alone; - a second run in the exact package environment pinned in `requirements.txt` reproduces all numeric arrays and tables within the declared tolerance (cross-version bit identity is not claimed); and - captions and figure footers use the phrase **“deterministic procedural sensor-fusion pilot.”** If a code or validation defect is found, all affected cells are rerun with the same fixed seeds after the correction is documented. Runs are never removed because of poor performance. Missing runs, invalid geometry, or failed determinism checks are reported as failures rather than silently excluded. Final PNGs must be inspected at their intended webpage width. Labels may not be clipped, legends must remain readable, and class/strategy distinctions may not depend on color alone. ## 11. Claim boundaries Permitted claims are limited to the behavior of this implemented procedural pilot under its frozen synthetic layouts, seeds, observation model, and metrics. A completed study may say that a strategy had a measured metric value or difference across these 45 runs and may describe the saved evidence chain. The study must **not** be described as: - CARLA data or a CARLA experiment; - real, recorded, or hardware LiDAR; - a validated LiDAR sensor model; - learned perception, SLAM, localization, or an autonomous robot controller; - evidence of field robustness, standards compliance, collision avoidance, or an approved traffic-control plan; - a safety guarantee, safety case, accident-risk estimate, or deployment validation; or - proof that synthetic confidence intervals generalize to roads, workers, vehicles, weather, or sensor populations. The operational labels are planning-oriented abstractions. In particular, `unknown` represents insufficient synthetic evidence, not a certified safe abstention mechanism. Any later connection to model-checked routing, CARLA, or hardware must be evaluated as a separate artifact and cannot retroactively expand the claims of this pilot. ## 12. Reporting rule The public extended abstract must state the 45-run design, the fixed seeds, all eight required metric definitions, and the synthetic evidence boundary. It must show all three strategies, every layout-strategy cell, the preregistered cases, and failure-aware metrics. Until the evidence artifacts and quality gates above are complete, quantitative fields must be labeled **results pending**; placeholder numbers or simulated advantages are prohibited. ## 13. Pre-publication implementation audit Before the publishable matrix was executed, implementation review corrected four evidence-chain defects: TTC recall now gates edges before computing a maximum-cardinality match; geometry and semantic reference samples now share the exact half-open 3-D ROI used by completeness; prediction-safe observations and TTC-boundary artifacts are physically separated from `raw/audit/` truth; and aggregate/metric validation now reads saved evidence and recomputes the registered quantities. The predicted-BEV API was also split from the truth rasterizer, and the numeric replay digest was expanded to every emitted numeric array. The frozen layouts, seeds, patrols, thresholds, representative cases, metric definitions, and directional expectations were not changed. The final 45 cells were rerun with the same fixed seeds after these corrections.