Understanding the openpilot Safety Model

Understanding the openpilot Safety Model

Contents

H2: What’s a Rich Text element?

The rich text element allows you to create and format headings, paragraphs, blockquotes, images, and video all in one place instead of having to add and format them individually. Just double-click and easily create content.

H3: Static and dynamic content editing

A rich text element can be used with static or dynamic content. For static content, just drop it into any page and begin editing. For dynamic content, add a rich text field to any collection and then connect a rich text element to that field in the settings panel. Voila!

text

H1: This is a Heading 1

This is some paragraph. lorem epsum.

This is a fig caption. This is how it will look like under a video frame as a description.

H4: How to customize formatting for each rich text

Headings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.

H5: Sample text is being used as a placeholder. Sample text helps you understand how real text may look. Sample text is being used as a placeholder for real text that is normally present.

Headings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.

H6: How to customize formatting for each rich text

Headings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.

Block Quote: Headings, paragraphs, blockquotes, figures, images, and figure captions can all be styled after a class is added to the rich text element using the "When inside of" nested selector system.

This is a heading 3.

  1. Sample text is being used as a placeholder.
  2. Sample text is being used as a placeholder.
  3. Sample text is being used as a placeholder.

This is a heading 2.

  • Sample text is being used as a placeholder.
  • Sample text is being used as a placeholder.
  • Sample text is being used as a placeholder.
# clone openpilot into your home directory
cd ~
git clone --recurse-submodules https://github.com/commaai/openpilot.git

# setup ubuntu environment
openpilot/tools/ubuntu_setup.sh

# build openpilot
cd openpilot && scons -j$(nproc)

We’ve been seeing questions about if modifications to openpilot violate our safety model or not. The safety model has three main principles.

  1. The driver must always be paying attention.
  2. The driver must always be capable of immediately retaking manual control of the vehicle.
  3. The vehicle must not alter its trajectory too quickly for the driver to safely react.

Complying with 1 obviously depends on the driver, but we’ve followed industry standard practices and built both a camera based driver monitoring system like GM Super Cruise and a “hands on wheel” detector like Tesla Autopilot to help the driver stay focused. This code lives in driver_monitor.py, and as long as you don’t disable it or nerf it by lowering the strictness, you are in compliance with 1. While stock openpilot uses both, we consider one or the other acceptable as long as Tesla does. Just not neither.

2 is enforced by the safety code in the panda, our real time STMF4 bridge to the car. The panda has a state variable “controls_allowed” which determines if control messages are allowed to be sent on the CAN bus. You enter controls allowed state by turning on cruise control, and you exit by cancelling cruise control. The brake pedal must always immediately cancel the controls allowed state. In stock openpilot, the gas pedal will always cancel too, though there is an unsafe flag to the panda to allow gas while engaged, since both Super Cruise and Autopilot allow this.

3 is the most subtle. Cars can overpower humans, and we need to make sure the human is always the one in control. By using the CAN messages as designed for ADAS, we get a lot of protection here from the car’s built in safety model. Do not use messages not designed for ADAS or outside of the stock ADAS spec. In addition, after doing injection testing, we’ve written an extra layer of safety in the panda limiting how these messages can be used.

Remember that in a level 2 system, doing nothing is always a safe option. You must never rely on your car to take or maintain an action, you can only rely on it to not do things like jerk the wheel or keep acting after you’ve stepped on the brake.

The beauty of this safety model is that none of openpilot’s functional safety depends on the neural network, or even anything running on the EON. So feel free to mess with models, UI, tuning, controls, device hardware, or sensors. Leave the panda code and the driver monitoring alone, and while safety overall is a holistic thing, the functional safety will remain intact with many different modifications.