Merge remote-tracking branch 'upstream/master' into brake-preenable

board/safety/safety_gm.h

@@ -9,21 +9,6 @@ const SteeringLimits GM_STEERING_LIMITS = {
   .type = TorqueDriverLimited,
 };
 
-const int GM_MAX_STEER = 300;
-const int GM_MAX_RT_DELTA = 128;          // max delta torque allowed for real time checks
-const uint32_t GM_RT_INTERVAL = 250000;    // 250ms between real time checks
-const int GM_MAX_RATE_UP = 7;
-const int GM_MAX_RATE_DOWN = 17;
-const int GM_DRIVER_TORQUE_ALLOWANCE = 50;
-const int GM_DRIVER_TORQUE_FACTOR = 4;
-
-//typedef struct {
-//  const int max_gas;
-//  const int max_regen;
-//  const int inactive_regen;
-//  const int max_brake;
-//} GmLongLimits;
-
 const LongitudinalLimits GM_ASCM_LONG_LIMITS = {
   .max_gas = 3072,
   .min_gas = 1404,
@@ -200,22 +185,13 @@ static int gm_tx_hook(CANPacket_t *to_send, bool longitudinal_allowed, bool gas_
   if (addr == 715) {
     bool apply = GET_BIT(to_send, 0U) != 0U;
     int gas_regen = ((GET_BYTE(to_send, 2) & 0x7FU) << 5) + ((GET_BYTE(to_send, 3) & 0xF8U) >> 3);
-    // Disabled message is !engaged with gas
-    // value that corresponds to inactive regen.
-    if (!gas_allowed) {
-      if (gas_regen != gm_long_limits->inactive_regen) {
-        tx = 0;
-      }
-    }
-    // Need to allow apply bit in pre-enabled and overriding states
-    if (!controls_allowed) {
-      bool apply = GET_BIT(to_send, 0U) != 0U;
-      if (apply) {
-        tx = 0;
-      }
-    }
-    // Enforce gas/regen actuation limits (max_regen <= gas_regen <= max_gas)
-    if ((gas_regen < gm_long_limits->max_regen) || (gas_regen > gm_long_limits->max_gas)) {
+
+    bool violation = false;
+    // Allow apply bit in pre-enabled and overriding states
+    violation |= !controls_allowed && apply;
+    violation |= longitudinal_gas_checks(gas_regen, *gm_long_limits, longitudinal_allowed);
+
+    if (violation) {
       tx = 0;
     }
   }

board/safety/safety_honda.h

@@ -300,24 +300,16 @@ static int honda_tx_hook(CANPacket_t *to_send, bool longitudinal_allowed, bool g
 
   // BRAKE/GAS: safety check (bosch)
   if ((addr == 0x1DF) && (bus == bus_pt)) {
-    int accel = (GET_BYTE(to_send, 3) << 3) | ((GET_BYTE(to_send, 4) >> 5) & 0x7U);  // used for brakes
-    if (!longitudinal_allowed) {
-      if (accel != 0) {
-        tx = 0;
-      }
-    }
-    if (accel < HONDA_BOSCH_ACCEL_MIN) {
-      tx = 0;
-    }
+    int accel = (GET_BYTE(to_send, 3) << 3) | ((GET_BYTE(to_send, 4) >> 5) & 0x7U);
+    accel = to_signed(accel, 11);
 
     int gas = (GET_BYTE(to_send, 0) << 8) | GET_BYTE(to_send, 1);
     gas = to_signed(gas, 16);
-    if (!gas_allowed) {
-      if (gas != HONDA_BOSCH_NO_GAS_VALUE) {
-        tx = 0;
-      }
-    }
-    if (gas > HONDA_BOSCH_GAS_MAX) {
+
+    bool violation = false;
+    violation |= longitudinal_accel_checks(accel, HONDA_BOSCH_LONG_LIMITS, longitudinal_allowed);
+    violation |= longitudinal_gas_checks(gas, HONDA_BOSCH_LONG_LIMITS, longitudinal_allowed);
+    if (violation) {
       tx = 0;
     }
   }

board/safety/safety_hyundai.h

@@ -259,22 +259,7 @@ static int hyundai_tx_hook(CANPacket_t *to_send, bool longitudinal_allowed, bool
     int aeb_decel_cmd = GET_BYTE(to_send, 2);
     int aeb_req = GET_BIT(to_send, 54U);
 
-    bool violation = 0;
-
-    if (!longitudinal_allowed) {
-      if ((desired_accel_raw != 0) || (desired_accel_val != 0)) {
-        violation = 1;
-      }
-    }
-
-    if (!gas_allowed) {
-      if ((desired_accel_raw <= 0) || (desired_accel_val <= 0)) {
-        violation = 1;
-      }
-    }
-
-    violation |= max_limit_check(desired_accel_raw, HYUNDAI_MAX_ACCEL, HYUNDAI_MIN_ACCEL);
-    violation |= max_limit_check(desired_accel_val, HYUNDAI_MAX_ACCEL, HYUNDAI_MIN_ACCEL);
+    bool violation = false;
 
     violation |= longitudinal_accel_checks(desired_accel_raw, HYUNDAI_LONG_LIMITS, longitudinal_allowed);
     violation |= longitudinal_accel_checks(desired_accel_val, HYUNDAI_LONG_LIMITS, longitudinal_allowed);

board/safety/safety_toyota.h

@@ -16,14 +16,11 @@ const SteeringLimits TOYOTA_STEERING_LIMITS = {
 };
 
 // longitudinal limits
-const int TOYOTA_MAX_ACCEL = 2000;        // 2.0 m/s2
-const int TOYOTA_MIN_ACCEL = -3500;       // -3.5 m/s2
 const LongitudinalLimits TOYOTA_LONG_LIMITS = {
   .max_accel = 2000,   // 2.0 m/s2
-  .min_accel = -2000,  // -3.5 m/s2
+  .min_accel = -3500,  // -3.5 m/s2
 };
 
-
 // panda interceptor threshold needs to be equivalent to openpilot threshold to avoid controls mismatches
 // If thresholds are mismatched then it is possible for panda to see the gas fall and rise while openpilot is in the pre-enabled state
 // Threshold calculated from DBC gains: round((((15 + 75.555) / 0.159375) + ((15 + 151.111) / 0.159375)) / 2) = 805
@@ -161,25 +158,10 @@ static int toyota_tx_hook(CANPacket_t *to_send, bool longitudinal_allowed, bool
     if (addr == 0x343) {
       int desired_accel = (GET_BYTE(to_send, 0) << 8) | GET_BYTE(to_send, 1);
       desired_accel = to_signed(desired_accel, 16);
-      bool violation = false;
-
-      if (!longitudinal_allowed) {
-        if (desired_accel != 0) {
-          violation = true;
-        }
-      }
 
-      if (!gas_allowed) {
-        if (desired_accel > 0) {
-          violation = true;
-        }
-      }
-
-      if (!longitudinal_allowed || toyota_stock_longitudinal) {
-        if (desired_accel != 0) {
-          tx = 0;
-        }
-      }
+      bool violation = false;
+      violation |= longitudinal_accel_checks(desired_accel, TOYOTA_LONG_LIMITS, longitudinal_allowed);
+      violation |= longitudinal_accel_checks(desired_accel, TOYOTA_LONG_LIMITS, !toyota_stock_longitudinal);
 
       // only ACC messages that cancel are allowed when openpilot is not controlling longitudinal
       if (toyota_stock_longitudinal) {

board/safety/safety_volkswagen_mqb.h

@@ -202,10 +202,7 @@ static int volkswagen_mqb_rx_hook(CANPacket_t *to_push) {
   return valid;
 }
 
-static int volkswagen_mqb_tx_hook(CANPacket_t *to_send, bool longitudinal_allowed, bool gas_allowed) {
-  UNUSED(longitudinal_allowed);
-  UNUSED(gas_allowed);
-
+static int volkswagen_mqb_tx_hook(CANPacket_t *to_send, bool longitudinal_allowed) {
   int addr = GET_ADDR(to_send);
   int tx = 1;
 

board/safety_declarations.h

@@ -58,11 +58,13 @@ typedef struct {
   // acceleration cmd limits
   const int max_accel;
   const int min_accel;
+  const int inactive_accel;
 
-  // gas/regen & brake cmd limits
+  // gas & brake cmd limits
+  // inactive and min gas are 0 on most safety modes
   const int max_gas;
-  const int max_regen;
-  const int inactive_regen;
+  const int min_gas;
+  const int inactive_gas;
   const int max_brake;
 } LongitudinalLimits;