Delegate the isolated Ioniq5PE, Toyota shell and GM pitch mock default lookups to real Params metadata. Preserve existing assertions, no-setting-write checks and runtime behavior.
Delegate mock default lookup to Params metadata and supply the existing healthy UI fixtures with their post-start receive frame and onroad state. Preserve all runtime code, assertions and negative authority coverage.
Feed exact emitted steering payloads and their accepted/rejected host-bus receipts on the next parser cycle. Preserve all assertions and runtime behavior.
Keep existing assertions and runtime behavior unchanged. Model healthy transport by returning only actually emitted steering commands; retain missing, stale, wrong-bus and rejected receipt coverage.
Preserve SLC validation behavior with explicit None narrowing, use existing Mock test doubles, and restore controlsd executable metadata without content changes. Keep exact torque gain expectations while matching the existing list representation.
Validated 1095 related tests, targeted ty and Ruff; prior baseline comparison and 4236 guard-equivalence cases preserve existing rejection semantics. Refresh the inventory receipt only for these validated changes.
Use one saved schedule with editable zero defaults. Preserve current schedules and round displayed offsets and edits to whole units without conversion drift.
Re-vendored at the v0.2.1 release (2b9dc6c), which adds StarPilot as a host.
Since the last copy: the matrix tests only re-key SAFETY_PARAM when the host's
stock base defines it (IQ.Pilot's iqdbc doesn't; StarPilot's does, so no change
here), and a FORKS.md note.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The previous commit let the camera's actuator through again as soon as one host frame was rejected. Mid-steer
that put the camera's inactive frame (its own counter) on the bus in place of the blocked one, and
the F-150's PSCM ramped out and reported lateral control faulty for several seconds, from a single
blocked frame. Without AOL, static blocking makes a rejected frame a missed one, which the PSCM rides
through.
Block the camera's copy while the host is sending, accepted or not; only a host that has stopped
sending for the AOL host timeout gives the actuator back to the camera.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
With AOL, the camera's actuator (0x3D3/0x3D6/0x3CA) is forwarded unless AOL owns steering, but the
host sends its own every frame, active or not. When AOL isn't steering, the PSCM hears both, with
unrelated counters. On a 2021 F-150 this flipped LatCtlSte_D_Stat between Unavailable and Available
every 50-100 ms for seconds at a time, worst when the two counters ran 1-2 apart: steerFaultTemporary
alerts, the panda's LKA-ready check denying lateral, and AOL dropping its latch on re-engagement.
BluePilot's angle-mode release during a manual turn made it easy to hit.
Block the camera's actuator while the host's last frame was accepted and is within the AOL host
timeout, as static blocking does without AOL. A rejected or stale host frame lets the camera's
copy through again. Permission and display ownership are unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
On the Steering page, for every Ford that can run BluePilot lateral (not the Transit), in Galaxy and the
native settings alike:
- BluePilot Lateral (off by default), Primary Control (curvature/angle) and Use Pinion Yaw Sensor (platforms
with a pinion geometry row) change while parked; the switch and the pinion sensor apply at the next vehicle
startup, and Safe Mode keeps BluePilot lateral off.
- the tuning rows of the current mode change any time, since the library reads them every frame; rows that
depend on Lane Positioning or the custom profile wait for it.
Ranges come from the library's manifest and defaults from params_keys.h, so the rows can't drift from what the
controller reads. A change is checked against the row it was made on, so a request from before its switch
changed is refused.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- params_keys.h: every setting in the library's manifest (python -m opendbc.bluepilot_lateral.params.manifest),
without BACKUP, which StarPilot's params don't have. disable_BP_lat_UI defaults to "1": BluePilot lateral
is off until the user turns it on.
- car init (VehicleStartupPreferences.prepare): init_ford_safety_param_starpilot ORs the library's startup
bits into the Ford param. They stay off without the openpilot toggle, in Safe Mode, or when a startup
setting can't be read.
- card (configure_controller): the Ford CarController gets a BluePilotInputs, which fills the library's
LateralInputs from modelV2, vehicleParameters and lateralDelay each frame and re-reads the per-frame
settings every 3 s.
- test_bluepilot_lateral.py: the init path's bits, the real CarController and libsafety with the same
param, for a CAN and a CAN FD Ford, off/on/on+pinion/pinion-only, curvature and angle mode: every
steering and LKA frame passes, and only angle mode with BluePilot on steers through the path angle.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- safety/modes/ford.h: includes the library's safety with StarPilot's lateral permission
(lateral_controls_allowed(), which includes AOL) as its lateral binding. ford_init hands the library
bits 9-14 of the Ford param (never on the Transit); with the bit set, LateralMotionControl/2 go through
the library's 4-signal checks instead of the stock ones, Lane_Assist_Data1 carries the angle-mode state,
and the pinion source replaces yaw and joins the selected RX list (stock, stock-switch or AOL).
- car/ford/carcontroller.py: one BluePilotLateral per Ford; while it's active it sends the steering and
LKA messages, otherwise the stock path runs unchanged. StarPilot's openpilot side attaches the per-frame
inputs and settings as bluepilot_inputs.
- safety tests: test.sh runs the library's safety tests by directory and gates the library headers'
coverage in a run of their own; test_ford_bluepilot_hooks.py covers where the bits ride, the Transit,
the pinion RX check on every list and the full-list guard. The qualification and mutation runners
include the library's safety tests.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The CAN FD display fixtures and the stock-switch class left alternative_experience at 32. Now that the
stock words are AOL words, a later Ford test could run with AOL configured; they reset it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
firestar5683