3 ms·

Yes, they intercept whichever CAN bus in the target vehicle is used to send Adaptive Cruise Control and Automatic Lane Keeping messages, and send their own inst

by bri3d 6y ago

Yes, they intercept whichever CAN bus in the target vehicle is used to send Adaptive Cruise Control and Automatic Lane Keeping messages, and send their own instead. On many target cars, they actually simply use the stock Adaptive Cruise Control and openpilot provides only the steering (ALK).

kevin_thibedeau 6y ago
Seems like it could have disastrous results if the OEM components start talking on the bus, sharing a completely different state.
- bri3d 6y ago
  This is generally handled in one of three ways: * Filtering the OEM messages to prevent them from reaching their destinations, which can be accomplished if Comma hardware is installed in the correct place in the bus to function as a two-ended "gateway" / "relay." Of course, then if the hardware or forwarding software fails, something else breaks... * Relying on the end-user disabling the OEM feature which could conflict with Comma, and signaling an error state if they do. * Relying on factory sequential integrity checking to overwrite factory messages by beating them in a timing race, causing the Comma messages to be "valid" and the factory messages "invalid" (no joke!). * Just "spamming" the message so it's received more often than the OEM ones. As you can tell, this is not a trustworthy safety product by any stretch of anyone's imagination.
- throwaway0a5e 6y ago
  Canbus is designed to be an unreliable electronic shouting match. The modules on it expect it and can handle it.
  - bri3d 6y ago
    CANbus relies on message identifiers to prioritize communication. Spamming messages of equal arbitration ID at the same time, as is possible in an override system without careful design consideration, produces undefined behavior, as both messages can win the arbitration process. Furthermore, corrupting command streams by "racing" valid messages which are sequence-checked is expecting a fault state to produce valid "normal" behavior. That's a lot of trust in OEM control modules - good thing they're usually written with safety in mind!

by bri3d 6y ago

kevin_thibedeau 6y ago

Seems like it could have disastrous results if the OEM components start talking on the bus, sharing a completely different state.

bri3d 6y ago
This is generally handled in one of three ways: * Filtering the OEM messages to prevent them from reaching their destinations, which can be accomplished if Comma hardware is installed in the correct place in the bus to function as a two-ended "gateway" / "relay." Of course, then if the hardware or forwarding software fails, something else breaks... * Relying on the end-user disabling the OEM feature which could conflict with Comma, and signaling an error state if they do. * Relying on factory sequential integrity checking to overwrite factory messages by beating them in a timing race, causing the Comma messages to be "valid" and the factory messages "invalid" (no joke!). * Just "spamming" the message so it's received more often than the OEM ones. As you can tell, this is not a trustworthy safety product by any stretch of anyone's imagination.
throwaway0a5e 6y ago
Canbus is designed to be an unreliable electronic shouting match. The modules on it expect it and can handle it.
- bri3d 6y ago
  CANbus relies on message identifiers to prioritize communication. Spamming messages of equal arbitration ID at the same time, as is possible in an override system without careful design consideration, produces undefined behavior, as both messages can win the arbitration process. Furthermore, corrupting command streams by "racing" valid messages which are sequence-checked is expecting a fault state to produce valid "normal" behavior. That's a lot of trust in OEM control modules - good thing they're usually written with safety in mind!