honda bosch longitudinal safety

board/drivers/llcan.h

@@ -14,6 +14,7 @@
 #define GET_BYTE(msg, b) (((int)(b) > 3) ? (((msg)->RDHR >> (8U * ((unsigned int)(b) % 4U))) & 0xFFU) : (((msg)->RDLR >> (8U * (unsigned int)(b))) & 0xFFU))
 #define GET_BYTES_04(msg) ((msg)->RDLR)
 #define GET_BYTES_48(msg) ((msg)->RDHR)
+#define GET_FLAG(value, mask) (((__typeof__(mask))param & mask) == mask)
 
 #define CAN_INIT_TIMEOUT_MS 500U
 #define CAN_NAME_FROM_CANIF(CAN_DEV) (((CAN_DEV)==CAN1) ? "CAN1" : (((CAN_DEV) == CAN2) ? "CAN2" : "CAN3"))

board/safety/safety_honda.h

@@ -9,6 +9,8 @@
 const CanMsg HONDA_N_TX_MSGS[] = {{0xE4, 0, 5}, {0x194, 0, 4}, {0x1FA, 0, 8}, {0x200, 0, 6}, {0x30C, 0, 8}, {0x33D, 0, 5}};
 const CanMsg HONDA_BG_TX_MSGS[] = {{0xE4, 2, 5}, {0xE5, 2, 8}, {0x296, 0, 4}, {0x33D, 2, 5}};  // Bosch Giraffe
 const CanMsg HONDA_BH_TX_MSGS[] = {{0xE4, 0, 5}, {0xE5, 0, 8}, {0x296, 1, 4}, {0x33D, 0, 5}};  // Bosch Harness
+const CanMsg HONDA_BG_LONG_TX_MSGS[] = {{0xE4, 0, 5}, {0x1DF, 0, 8}, {0x1EF, 0, 8}, {0x1FA, 0, 8}, {0x30C, 0, 8}, {0x33D, 0, 5}, {0x39F, 0, 8}, {0x18DAB0F1, 0, 8}};  // Bosch Giraffe w/ gas and brakes
+const CanMsg HONDA_BH_LONG_TX_MSGS[] = {{0xE4, 1, 5}, {0x1DF, 1, 8}, {0x1EF, 1, 8}, {0x1FA, 1, 8}, {0x30C, 1, 8}, {0x33D, 1, 5}, {0x39F, 1, 8}, {0x18DAB0F1, 1, 8}};  // Bosch Harness w/ gas and brakes
 
 // Roughly calculated using the offsets in openpilot +5%:
 // In openpilot: ((gas1_norm + gas2_norm)/2) > 15
@@ -18,12 +20,16 @@ const CanMsg HONDA_BH_TX_MSGS[] = {{0xE4, 0, 5}, {0xE5, 0, 8}, {0x296, 1, 4}, {0
 // In this safety: ((gas1 + (gas2/2))/2) > THRESHOLD
 const int HONDA_GAS_INTERCEPTOR_THRESHOLD = 344;
 #define HONDA_GET_INTERCEPTOR(msg) (((GET_BYTE((msg), 0) << 8) + GET_BYTE((msg), 1) + ((GET_BYTE((msg), 2) << 8) + GET_BYTE((msg), 3)) / 2 ) / 2) // avg between 2 tracks
+const int HONDA_BOSCH_NO_GAS_VALUE = -30000; // value sent when not requesting gas
+const int HONDA_BOSCH_GAS_MAX = 2000;
+const int HONDA_BOSCH_ACCEL_MIN = -350; // max braking == -3.5m/s2
 
 // Nidec and Bosch giraffe have pt on bus 0
 AddrCheckStruct honda_rx_checks[] = {
   {.msg = {{0x1A6, 0, 8},  {0x296, 0, 4}}, .check_checksum = true, .max_counter = 3U, .expected_timestep = 40000U},
   {.msg = {{0x158, 0, 8}}, .check_checksum = true, .max_counter = 3U, .expected_timestep = 10000U},
   {.msg = {{0x17C, 0, 8}}, .check_checksum = true, .max_counter = 3U, .expected_timestep = 10000U},
+  {.msg = {{0x1BE, 0, 3}}, .check_checksum = true, .max_counter = 3U, .expected_timestep = 10000U},
 };
 const int HONDA_RX_CHECKS_LEN = sizeof(honda_rx_checks) / sizeof(honda_rx_checks[0]);
 
@@ -32,12 +38,17 @@ AddrCheckStruct honda_bh_rx_checks[] = {
   {.msg = {{0x296, 1, 4}}, .check_checksum = true, .max_counter = 3U, .expected_timestep = 40000U},
   {.msg = {{0x158, 1, 8}}, .check_checksum = true, .max_counter = 3U, .expected_timestep = 10000U},
   {.msg = {{0x17C, 1, 8}}, .check_checksum = true, .max_counter = 3U, .expected_timestep = 10000U},
+  {.msg = {{0x1BE, 1, 3}}, .check_checksum = true, .max_counter = 3U, .expected_timestep = 10000U},
 };
 const int HONDA_BH_RX_CHECKS_LEN = sizeof(honda_bh_rx_checks) / sizeof(honda_bh_rx_checks[0]);
 
+const uint16_t HONDA_PARAM_ALT_BRAKE = 1;
+const uint16_t HONDA_PARAM_BOSCH_LONG = 2;
+
 int honda_brake = 0;
 bool honda_alt_brake_msg = false;
 bool honda_fwd_brake = false;
+bool honda_bosch_long = false;
 enum {HONDA_N_HW, HONDA_BG_HW, HONDA_BH_HW} honda_hw = HONDA_N_HW;
 
 
@@ -191,10 +202,14 @@ static int honda_tx_hook(CAN_FIFOMailBox_TypeDef *to_send) {
   int addr = GET_ADDR(to_send);
   int bus = GET_BUS(to_send);
 
-  if (honda_hw == HONDA_BG_HW) {
+  if ((honda_hw == HONDA_BG_HW) && !honda_bosch_long) {
     tx = msg_allowed(to_send, HONDA_BG_TX_MSGS, sizeof(HONDA_BG_TX_MSGS)/sizeof(HONDA_BG_TX_MSGS[0]));
-  } else if (honda_hw == HONDA_BH_HW) {
+  } else if ((honda_hw == HONDA_BG_HW) && honda_bosch_long) {
+    tx = msg_allowed(to_send, HONDA_BG_LONG_TX_MSGS, sizeof(HONDA_BG_LONG_TX_MSGS)/sizeof(HONDA_BG_LONG_TX_MSGS[0]));
+  } else if ((honda_hw == HONDA_BH_HW) && !honda_bosch_long) {
     tx = msg_allowed(to_send, HONDA_BH_TX_MSGS, sizeof(HONDA_BH_TX_MSGS)/sizeof(HONDA_BH_TX_MSGS[0]));
+  } else if ((honda_hw == HONDA_BH_HW) && honda_bosch_long) {
+    tx = msg_allowed(to_send, HONDA_BH_LONG_TX_MSGS, sizeof(HONDA_BH_LONG_TX_MSGS)/sizeof(HONDA_BH_LONG_TX_MSGS[0]));
   } else {
     tx = msg_allowed(to_send, HONDA_N_TX_MSGS, sizeof(HONDA_N_TX_MSGS)/sizeof(HONDA_N_TX_MSGS[0]));
   }
@@ -211,9 +226,10 @@ static int honda_tx_hook(CAN_FIFOMailBox_TypeDef *to_send) {
     pedal_pressed = pedal_pressed || gas_pressed_prev || (gas_interceptor_prev > HONDA_GAS_INTERCEPTOR_THRESHOLD);
   }
   bool current_controls_allowed = controls_allowed && !(pedal_pressed);
+  int bus_pt = (honda_hw == HONDA_BH_HW)? 1 : 0;
 
-  // BRAKE: safety check
-  if ((addr == 0x1FA) && (bus == 0)) {
+  // BRAKE: safety check (nidec)
+  if ((addr == 0x1FA) && (bus == bus_pt)) {
     honda_brake = (GET_BYTE(to_send, 0) << 2) + ((GET_BYTE(to_send, 1) >> 6) & 0x3);
     if (!current_controls_allowed) {
       if (honda_brake != 0) {
@@ -228,6 +244,31 @@ static int honda_tx_hook(CAN_FIFOMailBox_TypeDef *to_send) {
     }
   }
 
+  // BRAKE/GAS: safety check (bosch)
+  if ((addr == 0x1DF) && (bus == bus_pt)) {
+    int accel = (GET_BYTE(to_send, 3) << 3) | ((GET_BYTE(to_send, 4) >> 5) & 0x7);
+    accel = to_signed(accel, 11);
+    if (!current_controls_allowed) {
+      if (accel != 0) {
+        tx = 0;
+      }
+    }
+    if (accel < HONDA_BOSCH_ACCEL_MIN) {
+      tx = 0;
+    }
+
+    int gas = (GET_BYTE(to_send, 0) << 8) | GET_BYTE(to_send, 1);
+    gas = to_signed(gas, 16);
+    if (!current_controls_allowed) {
+      if (gas != HONDA_BOSCH_NO_GAS_VALUE) {
+        tx = 0;
+      }
+    }
+    if (gas > HONDA_BOSCH_GAS_MAX) {
+      tx = 0;
+    }
+  }
+
   // STEER: safety check
   if ((addr == 0xE4) || (addr == 0x194)) {
     if (!current_controls_allowed) {
@@ -245,7 +286,7 @@ static int honda_tx_hook(CAN_FIFOMailBox_TypeDef *to_send) {
     }
   }
 
-  // GAS: safety check
+  // GAS: safety check (interceptor)
   if (addr == 0x200) {
     if (!current_controls_allowed) {
       if (GET_BYTE(to_send, 0) || GET_BYTE(to_send, 1)) {
@@ -257,7 +298,6 @@ static int honda_tx_hook(CAN_FIFOMailBox_TypeDef *to_send) {
   // FORCE CANCEL: safety check only relevant when spamming the cancel button in Bosch HW
   // ensuring that only the cancel button press is sent (VAL 2) when controls are off.
   // This avoids unintended engagements while still allowing resume spam
-  int bus_pt = (honda_hw == HONDA_BH_HW)? 1 : 0;
   if ((addr == 0x296) && !current_controls_allowed && (bus == bus_pt)) {
     if (((GET_BYTE(to_send, 0) >> 5) & 0x7) != 2) {
       tx = 0;
@@ -275,22 +315,27 @@ static void honda_nidec_init(int16_t param) {
   gas_interceptor_detected = 0;
   honda_hw = HONDA_N_HW;
   honda_alt_brake_msg = false;
+  honda_bosch_long = false;
 }
 
 static void honda_bosch_giraffe_init(int16_t param) {
   controls_allowed = false;
   relay_malfunction_reset();
   honda_hw = HONDA_BG_HW;
   // Checking for alternate brake override from safety parameter
-  honda_alt_brake_msg = (param == 1) ? true : false;
+  honda_alt_brake_msg = GET_FLAG(param, HONDA_PARAM_ALT_BRAKE);
+  // radar disabled so allow gas/brakes
+  honda_bosch_long = GET_FLAG(param, HONDA_PARAM_BOSCH_LONG);
 }
 
 static void honda_bosch_harness_init(int16_t param) {
   controls_allowed = false;
   relay_malfunction_reset();
   honda_hw = HONDA_BH_HW;
   // Checking for alternate brake override from safety parameter
-  honda_alt_brake_msg = (param == 1) ? true : false;
+  honda_alt_brake_msg = GET_FLAG(param, HONDA_PARAM_ALT_BRAKE);
+  // radar disabled so allow gas/brakes
+  honda_bosch_long = GET_FLAG(param, HONDA_PARAM_BOSCH_LONG);
 }
 
 static int honda_nidec_fwd_hook(int bus_num, CAN_FIFOMailBox_TypeDef *to_fwd) {

tests/safety/libpandasafety_py.py

@@ -66,6 +66,7 @@
 void init_tests_honda(void);
 void set_honda_fwd_brake(bool);
 void set_honda_alt_brake_msg(bool);
+void set_honda_bosch_long(bool c);
 int get_honda_hw(void);
 
 void init_tests_chrysler(void);

tests/safety/test.c

@@ -71,6 +71,7 @@ void fault_recovered(uint32_t fault) {
 #define GET_BYTE(msg, b) (((int)(b) > 3) ? (((msg)->RDHR >> (8U * ((unsigned int)(b) % 4U))) & 0XFFU) : (((msg)->RDLR >> (8U * (unsigned int)(b))) & 0xFFU))
 #define GET_BYTES_04(msg) ((msg)->RDLR)
 #define GET_BYTES_48(msg) ((msg)->RDHR)
+#define GET_FLAG(value, mask) (((__typeof__(mask))param & mask) == mask)
 
 #define UNUSED(x) (void)(x)
 
@@ -183,6 +184,10 @@ void set_honda_alt_brake_msg(bool c){
   honda_alt_brake_msg = c;
 }
 
+void set_honda_bosch_long(bool c){
+  honda_bosch_long = c;
+}
+
 int get_honda_hw(void) {
   return honda_hw;
 }