Select the feedback controller on any Ford CAN FD vehicle when its Sunnylink toggle is enabled. Cover startup priority, toggle restarts, and downstream CAN publication across all six current CAN FD platforms; update the settings description and drive-test documentation.
Validation: 612 tests passed, 178 skipped, and 9146 subtests passed. Ruff and git diff checks passed. Offline validation only.
An accumulated correction can outweigh a new C1 request while measured
curvature still points the other way. Release that correction only with fresh
feedback and agreement from both target and slewed C0. Keep steady-target
correction, the existing integral strength, output limits and arbitration.
Record releases in the v2 diagnostic identity. The change adds one release
condition and a diagnostic counter; the command law still has three states.
Validation: 567 tests and 9,146 subtests pass, with 178 inherited or unsupported
skips. Randomized and b8/b9 replay checks cover 669,343 Float32/CAN round trips.
Activation and C0 match the previous controller exactly. Replay verifies
command behavior only; no physical response or stability claim is made.
Add a distance-integrated steering-curvature correction to the restored v1
heading request. Hold the correction at zero error, allow unwind at limits,
and clear it for driver override or inactive PSCM control. Preserve C0,
C2=C3=0, final output limits, the 100 Hz sender and the existing opt-in toggle.
Validate build/hold/unwind, measurement cadence, anti-windup and the actual
controlsd-to-CAN path. The combined suite passes 511 tests and 9,146 subtests;
178 inherited or unsupported safety variants skip. Stress and frozen b8
replay pass 578,569 Float32/CAN round trips. These checks do not establish
physical tracking or stability. Record reproduction steps and source hashes.
Restore the exact tracked tree from 5fc16abc7, identified in the
9b and 9e strong-tracking routes, including opendbc c21a9013 and
the original 100 Hz CAN FD cadence. C0 samples model y at 7 m;
C1 is max(7 m, speed times 1 s) times selected desired curvature.
This removes the later model-orientation, forecast, damping and
cadence experiments. Model selection/bundles and Panda safety are
unchanged. Restoring the prior behavior does not establish the
physical cause of the reported wobble.
Validation: exact original tree and submodule match; 494 tests and
9146 subtests passed, 178 inapplicable safety skips; canonical
Sunnylink schema; 100 real-sender messages in 100 control cycles,
with counters/checksums, C2/C3 zero and unchanged Panda TX checks.
Assisted-by: OpenAI Codex
Revert the C1 early-release experiment in 7ca2df481 after reported
centering degradation. Restore the exact tracked tree from 4bd841ecc;
model selection and model bundles are unchanged. A different driving
model remains a possible confound, so this does not assign a physical
root cause to either model or controller.
Validation: exact baseline tree match, 267 tests and 3 subtests passed,
and Sunnylink generated schema matches its source.
Assisted-by: OpenAI Codex
Bound the model heading request toward zero using terminal spatial
curvature at the existing preview point. Preserve C0, command limits,
slew, 20 Hz cadence, and the existing Sunnylink selection.
This changes requests before some turn peaks as well as during unwind.
Document that authority tradeoff and distinguish command-level evidence
from unverified physical PSCM release.
Validation: Ford controller/sender/safety tests, Sunnylink schema tests,
independent geometry and replay tests, 28,138 stress CAN round trips,
and 35,775 recorded cycles with 71,550 baseline/candidate CAN checks.
Assisted-by: OpenAI Codex
Compare v7 and recorded v6 unwind instructions on a5 using both common request levels and own-peak thresholds. Preserve the later C0 release and earlier C1 release in the report without claiming a physical improvement.
Exercise saturated release through the actual sender for both signs and every send phase. Require original model clocks for current replay extracts and reject current candidates in the historical unchanged-C1 damping replay. Record the complete 585-test suite and refreshed stress evidence.
Assisted-by: OpenAI Codex
Use the model-predicted one-second station with the existing seven-metre minimum and endpoint hold for both C0 and C1. Remove the extra yaw forecast and scalar-curvature heading reconstruction; retain C2/C3 zero, independent limits and slew, the existing toggle, and 20Hz sends. Reject scalar-only maneuver references explicitly.
Validate model clocks, geometry, CAN delivery, Panda TX acceptance, and randomized boundaries offline. Recorded-input replay does not establish improved physical tracking.
Assisted-by: OpenAI Codex
Snapshot the existing Sunnylink toggle into CarParamsSP so controlsd and the CAN sender agree. Preserve the v6 C0/C1 calculation at 100Hz and Panda safety unchanged. Add actual sender timing, packing, selection, and safety checks; record the a5 frozen-input replay. Physical tracking improvement remains unverified.
Assisted-by: OpenAI Codex
Check both motion publication and embedded filter-state ages before using
calibrated yaw. Rebuild the pose when calibration changes between motion
samples. Four regression cases demonstrate stale, future, missing-state
fallback and calibration-only pose refresh.
Keep the Sunnylink YAML source synchronized with its generated schema and
update the drive guide and source-bound validation record for v6.
Validation: 427 tests and 26 subtests pass; type, lint and settings compiler
checks pass. All 340,757 recorded cycles still match the reviewed candidate,
with 681,514 CAN round trips. Physical steering improvement remains unverified.
Assisted-by: OpenAI Codex
Use fresh calibrated turn rate for the existing 150 ms C0 pose forecast.
Retain selected-curvature prediction when motion or calibration is unavailable,
and report the active pose source in controller diagnostics. C1, coefficient
limits, slew rates, C2/C3 zero, and the existing Sunnylink toggle are unchanged.
Validated 340,757 recorded cycles against the reviewed offline candidate,
681,514 CAN round trips, and the Ford/controller/Sunnylink test suite.
This is an experimental drive candidate, not a proven road-tracking fix.
Assisted-by: OpenAI Codex
Remove excess-yaw C0 attenuation while retaining full path prediction,
command limits, slew and input-health gates. Valid measured yaw no longer
changes path demand. Update diagnostics and Sunnylink help for v5.
Validate with 356 tests and 26 subtests, 100% controller coverage,
280,636 recorded route cycles and 779,410 Float32/CAN round trips.
These are command checks; physical tracking improvement is not established.
Assisted-by: OpenAI Codex
Remove the hand-chosen 0.15 m / 25% cap on the prediction adjustment.
Retain the available-horizon bound, nonfinite fallback, total field limits,
yaw damping, slew, input gates, two states and zero C2/C3.
Cover full predictions and geometric countersteering in regression tests.
Validate 374 tests plus 26 subtests, four-route replay and 817,346
Float32/CAN round trips. Document command changes without inferring
physical tracking performance from PSCM limits or fixed-input replay.
Assisted-by: OpenAI Codex
Predict nearby C0 from the current model path and selected curvature over
150 ms, bounded to 0.15 m and 25% of the original offset. Retain excess-yaw
damping, two slew states, C1 behavior, input gates, and zero C2/C3 under the
existing default-off Sunnylink toggle.
Validate 372 tests plus 26 subtests, four-route replay, and 817,346
Float32/CAN round trips. Record earlier command-level crossings and the
right-exit damping tradeoff without claiming improved vehicle tracking.
Assisted-by: OpenAI Codex
Select the new controller only on the CAN FD Lightning through a default-off startup toggle. Retire v8 and its setting; disabling restores the original controller or selected observer. Preserve packing, input gates and zero C2/C3.
Fix the existing Params filtered-key buffer lifetime exposed by Sunnylink backup tests. Record 284 tests, 26 subtests and 485238 offline packing round trips; physical calibration remains unapproved.
Assisted-by: OpenAI Codex
Add a two-state C0/C1 core and a separate freshness/timing adapter compatible
with the existing controlsd call. Preserve reviewed endpoint holding, reject
malformed inputs, and keep production selection and safety unchanged.
Validate actual selection/limiting/publication/CAN integration, exact core
replay across 133,550 route cycles, 200,000 randomized and mirrored cycles,
field boundaries, resets and release uncertainty. Record the completed
264-test Ford suite, mutation probes and dependency/source provenance.
Physical tracking remains unvalidated; calibration_approved=false.
Assisted-by: OpenAI Codex
Sync upstream 6135084c9 while preserving the Ford v8 controller and custom path transport. Merge OpenDBC upstream into the Ford branch. Retain the drive summary with upstream USB/loading icons and text alignment APIs.
Validation: 191 main-repository tests and 150 subtests; 203 Ford OpenDBC tests and 9143 subtests (178 skips); focused UI logic smoke; Ruff, generated Sunnylink settings, and diff checks.
Prevent same-direction C0/C1 growth when measured turning exceeds current and delayed requests during release, retaining request history across driver feedback resets. Permit bounded C1 correction after opposing bias reaches zero when both requests remain undertracked and measured curvature is no longer catching up.
Keep model allocation, gain, field and slew limits, platform selection, and zero C2/C3 unchanged. Add anonymous recorded-input regressions and diagnostics. Validation: 139 Ford tests plus 150 subtests, 46 Sunnylink tests, Ruff, generated settings check, and recorded-command replays. Physical response and stability remain unverified.
Allow release recovery only when fresh measured yaw undertracks both aligned current and delayed requests and PSCM limit is below 2. Unwind the opposing bias toward zero using current yaw error and existing antiwindup; preserve C0, base geometry, gains, rates, and safety guards.
Add mirrored unit checks and a sanitized recorded turn-exit regression. Validate with 142 tests and 97 subtests, full-route frozen-input replay, large-turn retention, CAN packing, diagnostics, and generated Sunnylink schema checks. Physical improvement remains unvalidated.
Reuse the existing model-pose allocator for aligned large maneuvers while encoding remaining selected curvature as C0/C1 and keeping C2/C3 zero. Permit measured heading backoff during release or PSCM limits without turning model-base changes into stored bias.
Validate with 127 tests and 67 subtests, including recorded large-turn retention, release and reversal, repeated-measurement backoff, CAN packing, logging, and Sunnylink schema checks. Replay checks command behavior; enabled vehicle tracking remains unvalidated.
Retain the absolute desired-curvature base and unchanged C0, while adding
measured yaw-error correction to C1 under fresh PSCM status. Preserve command
limits, reset on override or unusable status, and release stored correction
with the base request. Admit reachable partial increments at host slew limits.
Publish PSCM enums with original CAN receipt timestamps through carStateSP.
Add telemetry, status/driver guards, CAN roundtrip tests and recorded fixtures.
Validation: focused suite 116 tests and 38 subtests; Ruff, settings compilation
and diff checks pass. Production replay covers 52,273 route80 cycles; no-status
fallback preserves v4 over 246,961 cycles / 43 segments. Physical stability and
the reported 85-degree plateau remain unvalidated; EPS limits can inhibit the
new correction.
Derive full absolute C1 heading from the same selected curvature as C0, retaining existing bounds and independent slew. Keep the former filtered model heading as a diagnostic comparison and preserve input validity gates.
Add real route80 command regressions and release/reversal checks. All 97 focused tests pass; 43-segment replay preserves C0 and gates exactly and matches the independent C1 candidate. Physical tracking and stability remain unvalidated for this revision.
Encode the selected bounded curvature as C0 with an 8 m minimum preview while retaining full model-heading C1. Limit each channel independently so C1 transitions cannot delay C0 release, and validate the selected action source timestamp.
Add action, release, source-freshness, CAN and route regressions. Document the slow-turn reference disagreement and the limits of frozen-motion replay; physical centering remains unvalidated.
Replace the weak nominal acceleration conversion with C2-free spatial path requests. Align retained model geometry using measured CAN yaw before filtering model innovations, and preserve large-turn demand and straight-path centering.
Validate with seven recorded maneuver episodes, full-route command replay, real CAN packing and focused controller/settings tests. Physical closed-loop behavior remains unvalidated.
Track the bounded planner reference through C0 and delay-aware PI/rate feedback through C1. Remove the failed Shared Path toggle and add a default-off, Lightning RL38-specific Virtual Angle setting. Reject stale inputs and disable outgoing lateral requests when the path is invalid.
Validation: 85 focused tests plus 22 subtests, native Params, real CAN packing, settings generation and Ruff passed. Frozen route78 replay attenuates the observed command forcing; physical stability and turn authority remain unvalidated.
Preserve geometric C0/C1 before nominal plateaus during same-direction buildup. Keep reversal guards, command limits, C2 policy, and the existing default-off Shared Path Controller selection. Require nonzero demand for joint buildup.
Known limitation: nominal short-turn cancellation settles later with queued commands. Retain that regression as an explicit expected failure; this experiment does not establish physical response or resolve unwind. Add entry and zero-demand coverage.
Assisted-by: OpenAI Codex
Continue the same allocator through a short turn and cancellation so release checks retain command lead as well as nominal coefficient state. Reject earlier geometry buildup that keeps charging after cancellation. No production controller changes.
Assisted-by: OpenAI Codex
Update opendbc to 72a775d3 for C0/C1/C3 wire-range saturation and nonfinite input rejection. No fallback controller or tuning changes are included.
Assisted-by: OpenAI Codex
Retain larger model-derived fast fields when nominal allocation is equivalent, with per-field plateau qualification and inward-demand release priority. Keep corrected and geometric fast fields independently selectable without changing the existing contribution map, C2 policy, cadence, or command limits.
Validated with 68 controller/fallback/logging tests, 5 adversarial release tests, and 38300 fixed-input replay updates. Physical turn authority and release remain unverified; the existing experiment stays default off.
Assisted-by: OpenAI Codex
Cache per-field packet conversion and state projections within each allocation instead of recomputing them for every candidate combination. Preserve candidate ordering, scores, limits, and selected commands. Add a deterministic limiter-work regression budget.
Local recorded-input mean controller CPU time falls 56%; 1292 recorded updates and 4000 randomized allocations match the previous outputs exactly. Device timing remains unverified.
Assisted-by: Codex
Use SwagLogger.event for controller selection and periodic diagnostics. Logger.info forwards arbitrary keywords to Logger._log and crashed all Ford startups, regardless of the experiment toggle. Exercise both actual call sites with INFO enabled and the real logger/formatter.
Assisted-by: Codex
Separate holding demand, bounded pose feedback, and nominal coefficient allocation. Add a default-off Sunnylink selector with startup diagnostics and preserve the existing controller when disabled.
Assisted-by: Codex
* ui: remove raygui usage (#38708)
* ui: remove raygui usage
* match previous gui_text_box line spacing
* Revert "match previous gui_text_box line spacing"
This reverts commit ffd2fe31725c6d50bffaebc621c1e170d0926c66.
* Reapply "match previous gui_text_box line spacing"
This reverts commit d41404f09607e225f43868f7747f22dc0bb2cf16.
* log chestnut supply fault (#38711)
* log chestnut INA supply fault
* ci
* bump raylib (#38712)
* cabana: replace custom non-view Qt signals w/ plain observer (#38713)
* cabana: move RoutesDialog out of streams/ (#38716)
* cabana: string helpers in utils return std::string (#38720)
* cabana: use std::string in RoutesDialog API results (#38717)
* cabana: move stream open widgets into streamselector (#38715)
* cabana: remove Qt from livestream (#38722)
* cabana: split SettingsDialog out of settings (#38719)
cabana: split SettingsDialog out of settings.{h,cc}
* cabana: split comma API route fetching out of RoutesDialog (#38721)
* cabana: de-QT streams (#38718)
* ui: fix install update button overflow (#38696)
* cabana: split utils/util into Qt-free util and qtutil (#38723)
* ui: guard branch switcher before internet connected (#38692)
* ui: check for update on target branch switch (#38693)
* ui: sync gpu loading to offroad (#38727)
ui: sync gpu loading state
* add chestnut offroad alerts (#38706)
* system: add chestnut offroad alerts
* system: refine chestnut offroad alerts
* system: refine chestnut power alerts
* system: confirm chestnut power recovery from PCIe
* system: detect missing chestnut power from INA voltage
* common: fix OpenpilotPrefix cleanup on macOS (#38728)
The destructor built its cleanup commands as "rm %s -rf", with the flags
after the operand. GNU rm permutes arguments so this works on device and
in CI, but BSD rm on macOS stops option parsing at the first operand and
treats "-rf" as a second filename:
$ mkdir -p /tmp/rmtest/sub && rm /tmp/rmtest -rf
rm: /tmp/rmtest: is a directory
rm: -rf: No such file or directory
exit=1
So nothing is removed, and each of the four calls prints two errors plus
"system command failed (256)" from check_system. Every run of a tool that
owns an OpenpilotPrefix (replay, cabana) leaks its params dir, its
comma_home and its /tmp/msgq_ dir; 33 of each had accumulated on my
machine.
Pass the flags first.
* replay: capture downloader's stderr so download progress is reported again (#38734)
* bump panda (new health packet) (#38736)
pandad: support compact health packet
* BMRLNAP (#38681)
* ui: clarify branch switcher error message (#38732)
* ui(mici): name updater signal constants (#38731)
* mici: name updater signal constants
* drop SIGNAL_ prefix
* self contained
---------
Co-authored-by: Shane Smiskol <shane@smiskol.com>
* modem.py: accept hex chars in ICCID (#38735)
E.118 specifies decimal digits, but many real SIMs carry hex characters
in EF_ICCID (e.g. China Mobile's 898600B5... range, some MVNO/IoT SIMs).
AT+QCCID returns them verbatim, and the strict isdigit() check blanked
the ICCID, leaving the modem daemon stuck in INITIALIZING forever and
cellular dead. ModemManager parses ICCID as hex for the same reason.
Verified on a comma four with a China Mobile SIM (EG916Q-GL): previously
stuck retrying 'identity read incomplete', now dials and passes traffic.
* TGC (#38739)
* 23e6a04e-e6e5-462b-a0bb-e4088275ee43/12864 tgc
* here
* monitor chestnut USB in hardwared (#38741)
hardwared: monitor chestnut USB independently
* modeld: wait for stable chestnut (#38742)
modeld: wait for stable chestnut
* Revert "monitor chestnut USB in hardwared (#38741)" (#38744)
This reverts commit 7d5596d5c3.
* amd warp (#38684)
* modeld: fuse warp and policy TinyJit
* bump tg
* fix?
* this simple trick...
* debug 1
* bump tg
* pack all
* wips
* fix
* BIG_INTO_SMALL remove
* slower
* ui: show usb connection (#38745)
* ui: show USB status
* ui: resize USB icon
* ui: classify USB device once
* ui: debounce USB disconnect
* cereal: log big model in drivingModelData (#38747)
* ui: show one GPU status (#38748)
ui: show one GPU status icon
* AGNOS 19.7 (#38750)
---------
Co-authored-by: Trey Moen <50057480+greatgitsby@users.noreply.github.com>
Co-authored-by: Daniel Koepping <elkoled@gmail.com>
Co-authored-by: Robbe Derks <robbe.derks@gmail.com>
Co-authored-by: Harald Schäfer <harald.the.engineer@gmail.com>
Co-authored-by: Shane Smiskol <shane@smiskol.com>
Co-authored-by: XiaoXX <xiaoxx97@outlook.com>
Co-authored-by: YassineYousfi <yyousfi1@binghamton.edu>
Remove model-pose residuals and tracking trim from the gentle regime. Blend the model pose into C0/C1 only as maneuver demand rises, while retaining opposing-path C2 unload and the coordinated 100 Hz handoff.
Assisted-by: Codex
Use constrained desired curvature for ordinary C2 while keeping model geometry authoritative in the coordinated C0/C1 residual. This restores normal centering strength without changing large-maneuver or bounded-feedback behavior.
Assisted-by: Codex
Isaac Barham