4 ms·

Thanks for the perspective. Do you happen to know what the hardware safety is like? Just curious.

enragedcacti 7y ago
Sure! so there are three stages of safety: OpenPilot generates all of the control messages to send to the vehicle based off of feedback from the cars sensors and it's own camera. it has rate limits for all control messages it generates so that it can't jerk the steering wheel or slam on the brakes (as of now it leaves Collision Avoidance up to the stock system) Steering limits: https://github.com/commaai/openpilot/blob/a2ae18d1dbd1e59c38ce22fa25ddffbd1d3084e3/selfdrive/controls/lib/latcontrol_indi.py#L99 https://github.com/commaai/openpilot/blob/a2ae18d1dbd1e59c38... Accel/Decel limits: https://github.com/commaai/openpilot/blob/a2ae18d1dbd1e59c38ce22fa25ddffbd1d3084e3/selfdrive/controls/lib/longcontrol.py#L76 https://github.com/commaai/openpilot/blob/a2ae18d1dbd1e59c38... These control messages are then passed to the Panda over USB. Panda is a microcontroller that converts the control messages into CAN messages that the vehicle can understand. The Panda has the same rate limits checks hardcoded into the firmware and it will reject any control messages that are outside the limits Panda Safety code: https://github.com/commaai/openpilot/blob/a2ae18d1dbd1e59c38ce22fa25ddffbd1d3084e3/panda/board/safety.h#L156 https://github.com/commaai/openpilot/blob/a2ae18d1dbd1e59c38... Finally, because Panda is sending the same CAN messages as the stock ADAS system, whatever safety mechanisms the OEM implemented apply to OpenPilot as well. Most cars have some form of torque caps and some form of rate limiting baked into the EPS firmware.
numpad0 7y ago
There’s the self driving code and native layers that runs on a bog standard Android phone, then an Arduino like microcontroller handles interfacing which is more or less realtime. Malformed, illegal or out of range commands would be trimmed out if occurs. They also has a narrower than commonly used limits and that is reportedly insufficient for tighter curves on some highways but are done so in good faith I guess.

Sure! so there are three stages of safety: OpenPilot generates all of the control messages to send to the vehicle based off of feedback from the cars sensors and it's own camera. it has rate limits for all control messages it generates so that it can't jerk the steering wheel or slam on the brakes (as of now it leaves Collision Avoidance up to the stock system) Steering limits: https://github.com/commaai/openpilot/blob/a2ae18d1dbd1e59c38ce22fa25ddffbd1d3084e3/selfdrive/controls/lib/latcontrol_indi.py#L99 https://github.com/commaai/openpilot/blob/a2ae18d1dbd1e59c38... Accel/Decel limits: https://github.com/commaai/openpilot/blob/a2ae18d1dbd1e59c38ce22fa25ddffbd1d3084e3/selfdrive/controls/lib/longcontrol.py#L76 https://github.com/commaai/openpilot/blob/a2ae18d1dbd1e59c38... These control messages are then passed to the Panda over USB. Panda is a microcontroller that converts the control messages into CAN messages that the vehicle can understand. The Panda has the same rate limits checks hardcoded into the firmware and it will reject any control messages that are outside the limits Panda Safety code: https://github.com/commaai/openpilot/blob/a2ae18d1dbd1e59c38ce22fa25ddffbd1d3084e3/panda/board/safety.h#L156 https://github.com/commaai/openpilot/blob/a2ae18d1dbd1e59c38... Finally, because Panda is sending the same CAN messages as the stock ADAS system, whatever safety mechanisms the OEM implemented apply to OpenPilot as well. Most cars have some form of torque caps and some form of rate limiting baked into the EPS firmware.

numpad0 7y ago

There’s the self driving code and native layers that runs on a bog standard Android phone, then an Arduino like microcontroller handles interfacing which is more or less realtime. Malformed, illegal or out of range commands would be trimmed out if occurs. They also has a narrower than commonly used limits and that is reportedly insufficient for tighter curves on some highways but are done so in good faith I guess.