Preserve SLC validation behavior with explicit None narrowing, use existing Mock test doubles, and restore controlsd executable metadata without content changes. Keep exact torque gain expectations while matching the existing list representation.
Validated 1095 related tests, targeted ty and Ruff; prior baseline comparison and 4236 guard-equivalence cases preserve existing rejection semantics. Refresh the inventory receipt only for these validated changes.
Use one saved schedule with editable zero defaults. Preserve current schedules and round displayed offsets and edits to whole units without conversion drift.
Re-vendored at the v0.2.1 release (2b9dc6c), which adds StarPilot as a host.
Since the last copy: the matrix tests only re-key SAFETY_PARAM when the host's
stock base defines it (IQ.Pilot's iqdbc doesn't; StarPilot's does, so no change
here), and a FORKS.md note.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The previous commit let the camera's actuator through again as soon as one host frame was rejected. Mid-steer
that put the camera's inactive frame (its own counter) on the bus in place of the blocked one, and
the F-150's PSCM ramped out and reported lateral control faulty for several seconds, from a single
blocked frame. Without AOL, static blocking makes a rejected frame a missed one, which the PSCM rides
through.
Block the camera's copy while the host is sending, accepted or not; only a host that has stopped
sending for the AOL host timeout gives the actuator back to the camera.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
With AOL, the camera's actuator (0x3D3/0x3D6/0x3CA) is forwarded unless AOL owns steering, but the
host sends its own every frame, active or not. When AOL isn't steering, the PSCM hears both, with
unrelated counters. On a 2021 F-150 this flipped LatCtlSte_D_Stat between Unavailable and Available
every 50-100 ms for seconds at a time, worst when the two counters ran 1-2 apart: steerFaultTemporary
alerts, the panda's LKA-ready check denying lateral, and AOL dropping its latch on re-engagement.
BluePilot's angle-mode release during a manual turn made it easy to hit.
Block the camera's actuator while the host's last frame was accepted and is within the AOL host
timeout, as static blocking does without AOL. A rejected or stale host frame lets the camera's
copy through again. Permission and display ownership are unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
On the Steering page, for every Ford that can run BluePilot lateral (not the Transit), in Galaxy and the
native settings alike:
- BluePilot Lateral (off by default), Primary Control (curvature/angle) and Use Pinion Yaw Sensor (platforms
with a pinion geometry row) change while parked; the switch and the pinion sensor apply at the next vehicle
startup, and Safe Mode keeps BluePilot lateral off.
- the tuning rows of the current mode change any time, since the library reads them every frame; rows that
depend on Lane Positioning or the custom profile wait for it.
Ranges come from the library's manifest and defaults from params_keys.h, so the rows can't drift from what the
controller reads. A change is checked against the row it was made on, so a request from before its switch
changed is refused.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- params_keys.h: every setting in the library's manifest (python -m opendbc.bluepilot_lateral.params.manifest),
without BACKUP, which StarPilot's params don't have. disable_BP_lat_UI defaults to "1": BluePilot lateral
is off until the user turns it on.
- car init (VehicleStartupPreferences.prepare): init_ford_safety_param_starpilot ORs the library's startup
bits into the Ford param. They stay off without the openpilot toggle, in Safe Mode, or when a startup
setting can't be read.
- card (configure_controller): the Ford CarController gets a BluePilotInputs, which fills the library's
LateralInputs from modelV2, vehicleParameters and lateralDelay each frame and re-reads the per-frame
settings every 3 s.
- test_bluepilot_lateral.py: the init path's bits, the real CarController and libsafety with the same
param, for a CAN and a CAN FD Ford, off/on/on+pinion/pinion-only, curvature and angle mode: every
steering and LKA frame passes, and only angle mode with BluePilot on steers through the path angle.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- safety/modes/ford.h: includes the library's safety with StarPilot's lateral permission
(lateral_controls_allowed(), which includes AOL) as its lateral binding. ford_init hands the library
bits 9-14 of the Ford param (never on the Transit); with the bit set, LateralMotionControl/2 go through
the library's 4-signal checks instead of the stock ones, Lane_Assist_Data1 carries the angle-mode state,
and the pinion source replaces yaw and joins the selected RX list (stock, stock-switch or AOL).
- car/ford/carcontroller.py: one BluePilotLateral per Ford; while it's active it sends the steering and
LKA messages, otherwise the stock path runs unchanged. StarPilot's openpilot side attaches the per-frame
inputs and settings as bluepilot_inputs.
- safety tests: test.sh runs the library's safety tests by directory and gates the library headers'
coverage in a run of their own; test_ford_bluepilot_hooks.py covers where the bits ride, the Transit,
the pinion RX check on every list and the full-list guard. The qualification and mutation runners
include the library's safety tests.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The CAN FD display fixtures and the stock-switch class left alternative_experience at 32. Now that the
stock words are AOL words, a later Ford test could run with AOL configured; they reset it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
opendbc_repo/opendbc/bluepilot_lateral is BluePilotDev/bluepilot-lateral as released, made by the
library's tools/vendor.sh and checked by its tools/check_vendored.sh (VERSION names the release and
commit). Nothing inside the folder is edited here: changes go to the library, get released, and are
vendored again.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
StarPilot's angle-only bluepilot_lateral adaptation and the BluePilot-derived curvature strategies (Mach-E,
classic, Explorer, generic CAN FD, new-port curvature, manual-turn latch, curvature preview, pinion
measurement) are removed, with their extended safety profiles 16/32/64 and the interim angle word 128. Ford
lateral is upstream's stock curvature path until the BluePilot lateral library is mounted.
StarPilot's own Ford features stay, re-keyed from the extended words to the stock ones:
- AOL: classic 32 -> 0, Mach-E 18 and the CAN FD trucks 66 -> 2 (+1 with openpilot long); the CAN FD
retained-display rules apply to word 2. Edge/Mondeo/Transit and the manual bit (256) are unchanged.
- release CAN FD long: word 3 (was 19/67); 19 and 67 are now retired and denied.
- stock cruise switch, CAN FD camera-lead radar handling, hands-free cluster: keyed on the Ford family.
- classic stock ACC (0) keeps the no-ACCDATA TX list the extended classic profile had.
Bits 9-14 of the Ford param are reserved for the BluePilot lateral library's startup bits
(safety/modes/ford_param.h); AOL and pandad mask them out of the profile word.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Dom