Confidence-Based Sensor Fusion and Watchdog Fallback for an ASIL D Construction-Zone Overspeed Hazard: A Simulation-Based Study

Abstract

Construction zones ask an automated vehicle to drop from highway speed to a temporary limit, often marked by only a portable sign and a few cones. An earlier ISO 26262 case study rated this hazard ASIL D. In six runs, a camera-only design reached the zone boundary at about 99 km/h against a 40 km/h limit, while a three-path fusion design stayed near 40 km/h, but that study gave no decision rule. This paper defines one. Each sensing path (camera, LiDAR, HD map with GPS) reports a confidence score. One path above the threshold starts braking, and braking is released only when two healthy paths that can see the zone both read low. A watchdog forces emergency braking if a weak cue is not confirmed within 1.5 s. We tested the rule in a simulator we wrote in Python 3.12 using NumPy and SciPy. It is a 20 Hz kinematic and probabilistic model, so we did not use CARLA or CarMaker, and no sensor data is rendered. The simulator covers twelve operating conditions with 1,000 trials each and compares the rule with a camera-only baseline and three other voting rules on identical random draws. No measured or third-party dataset was used, and every input distribution is our own assumption. Under these assumptions, 97.0% of proposed-system trials cross the boundary at or below 42 km/h, against 57.8% for the baseline, and faults in all three paths remain the weak case at 75.3%. In 20,000 hazard-free approaches, the system issues a brief brake command in 1.25% and leaves a brake unreleased in 0.02%. Because the inputs are assumed, we report sensitivity sweeps and a 200-draw perturbation ensemble instead of significance tests. The results are simulation evidence for a proposed design and not a safety case.